Prepared exclusively for Mathieu Beautru Agile Web Development with Rails A Pragmatic Guide Dave Thomas David Heinemeier Hansson with Leon Breedt Mike Clark Thomas Fuchs Andreas Schwarz The Pragmatic Bookshelf Raleigh, North Carolina Dallas, Texas Prepared exclusively for Mathieu Beautru Pragmatic Bookshelf Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and The Pragmatic Programmers, LLC was aware of a trademark claim, the designations have been printed in initial capital letters or in all capitals. The Pragmatic Starter Kit, The Pragmatic Programmer, Pragmatic Programming, Pragmatic Bookshelf and the linking g device are trademarks of The Pragmatic Programmers, LLC. Every precaution was taken in the preparation of this book. However, the publisher assumes no responsibility for errors or omissions, or for damages that may result from the use of information (including program listings) contained herein. Our Pragmatic courses, workshops, and other products can help you and your team create better software and have more fun. For more information, as well as the latest Pragmatic titles, please visit us at http://www.pragmaticprogrammer.com Copyright © 2005 The Pragmatic Programmers LLC. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form, or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior consent of the publisher. Printed in the United States of America. ISBN 0-9766940-0-X Printed on acid-free paper with 85% recycled, 30% post-consumer content. Fourth printing, December 2005 Version: 2005-12-24 Prepared exclusively for Mathieu Beautru Contents 1Introduction 1 1.1 Rails Is Agile ........................... 3 1.2 Finding Your Way Around ................... 4 1.3 Acknowledgments ........................ 6 Part I—Getting Started 8 2 The Architecture of Rails Applications 9 2.1 Models, Views, and Controllers ................ 9 2.2 Active Record: Rails Model Support ............. 13 2.3 Action Pack: The View and Controller ............ 17 3 Installing Rails 19 3.1 Installing on Windows ..................... 19 3.2 Installing on Mac OS X ..................... 20 3.3 Installing on Unix/Linux .................... 20 3.4 Rails and Databases ...................... 21 3.5 Keeping Up-to-Date ....................... 24 3.6 Rails and ISPs .......................... 24 4 Instant Gratification 25 4.1 Creating a New Application .................. 25 4.2 Hello, Rails! ........................... 27 4.3 Linking Pages Together ..................... 37 4.4 What We Just Did ........................ 41 Prepared exclusively for Mathieu Beautru CONTENTS v Part II—Building an Application 42 5 The Depot Application 43 5.1 Incremental Development ................... 43 5.2 What Depot Does ........................ 44 5.3 Let’s Code ............................ 48 6 Task A: Product Maintenance 49 6.1 Iteration A1: Get Something Running ............ 49 6.2 Iteration A2: Add a Missing Column ............. 57 6.3 Iteration A3: Validate! ..................... 60 6.4 Iteration A4: Prettier Listings ................. 63 7 Task B: Catalog Display 67 7.1 Iteration B1: Create the Catalog Listing ........... 67 7.2 Iteration B2: Add Page Decorations ............. 70 8 Task C: Cart Creation 74 8.1 Sessions ............................. 74 8.2 More Tables, More Models ................... 76 8.3 Iteration C1: Creating a Cart ................. 78 8.4 Iteration C2: Handling Errors ................. 86 8.5 Iteration C3: Finishing the Cart ................ 90 9 Task D: Checkout! 95 9.1 Iteration D1: Capturing an Order ............... 96 9.2 Iteration D2: Show Cart Contents on Checkout ...... 104 10 Task E: Shipping 109 10.1 Iteration E1: Basic Shipping ................. 109 11 Task F: Administrivia 118 11.1 Iteration F1: Adding Users ................... 118 11.2 Iteration F2: Logging In .................... 123 11.3 Iteration F3: Limiting Access ................. 125 11.4 Finishing Up ........................... 129 11.5 More Icing on the Cake ..................... 130 Report erratum Prepared exclusively for Mathieu Beautru CONTENTS vi 12 Task T: Testing 132 12.1 Tests Baked Right In ...................... 132 12.2 Testing Models ......................... 133 12.3 Testing Controllers ....................... 148 12.4 Using Mock Objects ....................... 161 12.5 Test-Driven Development ................... 162 12.6 Running Tests with Rake ................... 165 12.7 Performance Testing ...................... 168 Part III—The Rails Framework 172 13 Rails in Depth 173 13.1 So Where’s Rails? ........................ 173 13.2 Directory Structure ....................... 173 13.3 Rails Configuration ....................... 177 13.4 Naming Conventions ...................... 180 13.5 Active Support .......................... 184 13.6 Logging in Rails ......................... 186 13.7 Debugging Hints ........................ 186 13.8 What’s Next ........................... 188 14 Active Record Basics 190 14.1 Tables and Classes ....................... 191 14.2 Columns and Attributes .................... 192 14.3 Primary Keys and IDs ..................... 197 14.4 Connecting to the Database .................. 199 14.5 CRUD—Create, Read, Update, Delete ............ 201 14.6 Relationships between Tables ................. 216 14.7 Transactions ........................... 237 15 More Active Record 243 15.1 Acts As .............................. 243 15.2 Aggregation ........................... 247 15.3 Single Table Inheritance .................... 253 15.4 Validation ............................ 256 15.5 Callbacks ............................. 264 15.6 Advanced Attributes ...................... 272 15.7 Miscellany ............................ 275 Report erratum Prepared exclusively for Mathieu Beautru CONTENTS vii 16 Action Controller and Rails 278 16.1 Context and Dependencies .................. 278 16.2 The Basics ............................ 279 16.3 Routing Requests ........................ 280 16.4 Action Methods ......................... 291 16.5 Cookies and Sessions ...................... 301 16.6 Flash—Communicating between Actions .......... 311 16.7 Filters and Verification ..................... 313 16.8 Caching, Part One ....................... 318 16.9 The Problem with GET Requests ............... 324 17 Action View 327 17.1 Templates ............................ 327 17.2 Builder templates ........................ 329 17.3 RHTML Templates ....................... 330 17.4 Helpers .............................. 332 17.5 Formatting Helpers ....................... 335 17.6 Linking to Other Pages and Resources ............ 337 17.7 Pagination ............................ 340 17.8 Form Helpers .......................... 341 17.9 Layouts and Components ................... 356 17.10 Caching, Part Two ........................ 366 17.11 Adding New Templating Systems ............... 370 18 The Web, V2.0 373 18.1 Introducing AJAX ........................ 373 18.2 The Rails Way .......................... 376 18.3 The User Interface, Revisited ................. 384 18.4 Advanced Techniques ..................... 389 19 Action Mailer 399 19.1 Sending E-mail ......................... 399 19.2 Receiving E-mail ........................ 406 19.3 Testing E-mail .......................... 408 20 Web Services on Rails 411 20.1 What AWS Is (and What It Isn’t) ................ 411 20.2 The API Definition ........................ 412 20.3 Dispatching Modes ....................... 417 20.4 Using Alternate Dispatching .................. 420 20.5 Method Invocation Interception ................ 421 20.6 Testing Web Services ...................... 423 20.7 Protocol Clients ......................... 425 Report erratum Prepared exclusively for Mathieu Beautru CONTENTS viii 21 Securing Your Rails Application 427 21.1 SQL Injection .......................... 427 21.2 Cross-Site Scripting (CSS/XSS) ................ 430 21.3 Avoid Session Fixation Attacks ................ 433 21.4 Creating Records Directly from Form Parameters ..... 434 21.5 Don’t Trust ID Parameters ................... 435 21.6 Don’t Expose Controller Methods ............... 436 21.7 File Uploads ........................... 438 21.8 Don’t Cache Authenticated Pages ............... 438 21.9 Knowing That It Works ..................... 439 22 Deployment and Scaling 440 22.1 Picking a Production Platform ................. 440 22.2 A Trinity of Environments ................... 448 22.3 Iterating in the Wild ...................... 450 22.4 Maintenance ........................... 454 22.5 Scaling: The Share-Nothing Architecture .......... 456 22.6 Finding and Dealing with Bottlenecks ............ 459 22.7 Case Studies: Rails Running Daily .............. 463 Part IV—Appendices 466 AIntroductiontoRuby 467 A.1 Ruby Is an Object-Oriented Language ............ 467 A.2 Ruby Names ........................... 468 A.3 Methods ............................. 469 A.4 Classes .............................. 471 A.5 Modules ............................. 473 A.6 Arrays and Hashes ....................... 474 A.7 Control Structures ....................... 475 A.8 Regular Expressions ...................... 476 A.9 Blocks and Iterators ...................... 476 A.10 Exceptions ............................ 477 A.11 Marshaling Objects ....................... 478 A.12 Interactive Ruby ......................... 478 A.13 Ruby Idioms ..........................