Agile Web Development with Rails: A Pragmatic Guide

715 Pages·2006·6.558 MB·English

by  Dave Thomas, David Hansson, Leon Breedt, Mike Clark, James Duncan Davidson, Justin Gehtland, Andreas Schwarz

Important Information
About Rails Versions
Railsis anevolvingframework.The core Railsdevelopers arecontinually
makingchanges,addingnew features,fixing bugs,and soon. Periodically
they packageup the latest versionof Railsintoa release.These releasesare
thenavailabletoapplicationdevelopersas RubyGems.
This book is writtenfor Rails 1.2.
As the book is going topressthe coreteamhave createdthe codebase for
Rails1.2.However, they have not yet packagedit intoa gem.This gives us a
bit ofa problem.Wewant the book toreflectall the latest andgreatestRails
features,but we alsoknowthat it is hardfor folks tojump throughthe hoops
requiredtoget the so-calledEdge versionof Railsinstalledontheir systems.
And untila gemis available,the 1.2 featuresareonly availableinEdge Rails.
Now,it may wellbe that by the time you get yourhands onthis book, the
Rails1.2 gemis out.It’s easyto find out.After you’ve installedRails(as
describedinChapter 3, InstallingRails,onpage 31),bringup a command
prompt andenter rails-v. Ifit reports“Rails1.2” or later,you’refine.
Ifinstead yousee something like“Rails1.1.6,” you’llneed to updateto get
the code inthis book torun.We’ve prepareda snapshot of the Railsframe-
workcode that weused whenwritingthisbook. You caninstallit inyour
ownRailsapplicationsas a temporarymeasureuntil1.2 is released.
• Create yourapplicationnormally.You’llfind that it willcontaina direc-
tory calledvendor
• Download http://media.pragprog.com/titles/rails2/code/rails.zip intoyour
application’svendor directoryand unzipit.It should createa new direc-
tory calledrails
• In yourapplication’stop-leveldirectory,issuethe command
rakerails:update
Once Rails1.2 is released,youcaninstallit and remove the directorytree
vendor/rails fromyourapplications.
The versionof Railsfromour website is not anofficial release,and should
not be used inproductionapplications.
Dave Thomas
Agile Web Development with Rails
Second Edition
Dave Thomas
David Heinemeier Hansson
withLeonBreedt
Mike Clark
James DuncanDavidson
JustinGehtland
AndreasSchwarz
The Pragmatic Bookshelf
Raleigh,NorthCarolina Dallas,Texas
Many of the designations used by manufacturers and sellers to distinguish their products are
claimedastrademarks.Wherethosedesignationsappearinthisbook,andThePragmaticProgram-
mers, LLC was aware of a trademark claim, the designations have been printed ininitial capital
lettersorinallcapitals.ThePragmaticStarterKit,ThePragmaticProgrammer,PragmaticProgram-
ming,PragmaticBookshelfandthelinkinggdevicearetrademarksofThePragmaticProgrammers,
LLC.
Every precaution was takeninthe preparation of thisbook.However, thepublisher assumes no
responsibilityforerrorsoromissions,orfordamagesthatmayresultfromtheuseofinformation
(includingprogramlistings)containedherein.
OurPragmaticcourses,workshops,andotherproductscanhelpyouandyourteamcreatebetter
software and have more fun. For more information, as well as the latest Pragmatictitles, please
visitusat
http://www.pragmaticprogrammer.com
Copyright©2007ThePragmaticProgrammersLLC.
Allrightsreserved.
Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmitted,inany
form,orbyanymeans,electronic,mechanical,photocopying,recording,orotherwise,withoutthe
priorconsentofthepublisher.
PrintedintheUnitedStatesofAmerica.
ISBN-10:0-9776166-3-0
ISBN-13:978-0-9776166-3-3
Printedonacid-freepaperwith85%recycled,30%post-consumercontent.
P2.00printing,January15,2007
Version:2007-1-8
Contents
Preface to the Second Edition 12
1 Introduction 14
1.1 RailsIs Agile . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
1.2 Finding YourWayAround . . . . . . . . . . . . . . . . . . . . . 17
1.3 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Part I—Getting Started 21
2 The Architecture of Rails Applications 22
2.1 Models,Views,and Controllers . . . . . . . . . . . . . . . . . . 22
2.2 ActiveRecord:RailsModel Support . . . . . . . . . . . . . . . . 25
2.3 ActionPack:The View and Controller . . . . . . . . . . . . . . 29
3 Installing Rails 31
3.1 Your ShoppingList . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.2 Installingon Windows. . . . . . . . . . . . . . . . . . . . . . . . 32
3.3 Installingon MacOS X . . . . . . . . . . . . . . . . . . . . . . . 34
3.4 Installingon Linux. . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.5 Development Environments . . . . . . . . . . . . . . . . . . . . 36
3.6 Railsand Databases. . . . . . . . . . . . . . . . . . . . . . . . . 39
3.7 KeepingUp-to-Date . . . . . . . . . . . . . . . . . . . . . . . . . 42
3.8 Railsand ISPs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4 Instant Gratification 43
4.1 Creatinga New Application. . . . . . . . . . . . . . . . . . . . . 43
4.2 Hello,Rails! . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
4.3 LinkingPages Together . . . . . . . . . . . . . . . . . . . . . . . 56
4.4 What WeJust Did . . . . . . . . . . . . . . . . . . . . . . . . . . 59
CONTENTS 6
Part II—Building an Application 61
5 The Depot Application 62
5.1 IncrementalDevelopment . . . . . . . . . . . . . . . . . . . . . 62
5.2 What Depot Does . . . . . . . . . . . . . . . . . . . . . . . . . . 63
5.3 Let’s Code . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
6 Task A: Product Maintenance 68
6.1 IterationA1:Get SomethingRunning . . . . . . . . . . . . . . 68
6.2 IterationA2:Add a MissingColumn . . . . . . . . . . . . . . . 79
6.3 IterationA3:Validate! . . . . . . . . . . . . . . . . . . . . . . . . 81
6.4 IterationA4:PrettierListings . . . . . . . . . . . . . . . . . . . 85
7 Task B: Catalog Display 94
7.1 IterationB1: Create the CatalogListing . . . . . . . . . . . . . 94
7.2 IterationB2: Add a PageLayout . . . . . . . . . . . . . . . . . . 98
7.3 IterationB3: Use a Helperto Format the Price . . . . . . . . . 100
7.4 IterationB4: Linkingto the Cart . . . . . . . . . . . . . . . . . 100
8 Task C: Cart Creation 104
8.1 Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
8.2 IterationC1: Creatinga Cart . . . . . . . . . . . . . . . . . . . . 107
8.3 IterationC2: A SmarterCart . . . . . . . . . . . . . . . . . . . . 110
8.4 IterationC3: HandlingErrors . . . . . . . . . . . . . . . . . . . 113
8.5 IterationC4: Finishingthe Cart . . . . . . . . . . . . . . . . . . 118
9 Task D: Add a Dash of AJAX 122
9.1 IterationD1: Movingthe Cart . . . . . . . . . . . . . . . . . . . 123
9.2 IterationD2: AnAJAX-BasedCart . . . . . . . . . . . . . . . . 128
9.3 IterationD3: HighlightingChanges . . . . . . . . . . . . . . . . 131
9.4 IterationD4: Hide anEmptyCart . . . . . . . . . . . . . . . . . 133
9.5 IterationD5: DegradingIf JavascriptIs Disabled . . . . . . . . 137
9.6 What WeJust Did . . . . . . . . . . . . . . . . . . . . . . . . . . 138
10 Task E: Check Out! 140
10.1 IterationE1:CapturinganOrder . . . . . . . . . . . . . . . . . 140
11 Task F: Administration 155
11.1 IterationF1: AddingUsers . . . . . . . . . . . . . . . . . . . . . 155
11.2 IterationF2: LoggingIn . . . . . . . . . . . . . . . . . . . . . . . 163
11.3 IterationF3: LimitingAccess . . . . . . . . . . . . . . . . . . . . 166
11.4 IterationF4: A Sidebar,MoreAdministration . . . . . . . . . . 168
CONTENTS 7
12 Task G: One Last Wafer-Thin Change 175
12.1 Generatingthe XMLFeed. . . . . . . . . . . . . . . . . . . . . . 175
12.2 FinishingUp . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
13 Task T: Testing 185
13.1 Tests Baked RightIn . . . . . . . . . . . . . . . . . . . . . . . . 185
13.2 UnitTesting ofModels . . . . . . . . . . . . . . . . . . . . . . . 186
13.3 Functional Testingof Controllers . . . . . . . . . . . . . . . . . 198
13.4 IntegrationTestingof Applications . . . . . . . . . . . . . . . . 213
13.5 Performance Testing. . . . . . . . . . . . . . . . . . . . . . . . . 221
13.6 UsingMock Objects . . . . . . . . . . . . . . . . . . . . . . . . . 225
Part III—The Rails Framework 228
14 Rails in Depth 229
14.1 So, Where’sRails? . . . . . . . . . . . . . . . . . . . . . . . . . . 229
14.2 DirectoryStructure . . . . . . . . . . . . . . . . . . . . . . . . . 229
14.3 RailsConfiguration . . . . . . . . . . . . . . . . . . . . . . . . . 238
14.4 Naming Conventions . . . . . . . . . . . . . . . . . . . . . . . . 241
14.5 LogginginRails . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
14.6 DebuggingHints . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
14.7 What’s Next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
15 Active Support 248
15.1 GenerallyAvailableExtensions . . . . . . . . . . . . . . . . . . 248
15.2 Enumerationsand Arrays . . . . . . . . . . . . . . . . . . . . . 249
15.3 StringExtensions . . . . . . . . . . . . . . . . . . . . . . . . . . 250
15.4 Extensions toNumbers . . . . . . . . . . . . . . . . . . . . . . . 252
15.5 Time and Date Extensions . . . . . . . . . . . . . . . . . . . . . 253
15.6 AnExtensiontoRubySymbols . . . . . . . . . . . . . . . . . . 255
15.7 with_options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256
15.8 UnicodeSupport . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
16 Migrations 263
16.1 Creatingand RunningMigrations . . . . . . . . . . . . . . . . . 264
16.2 Anatomyof a Migration . . . . . . . . . . . . . . . . . . . . . . . 266
16.3 ManagingTables . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
16.4 Data Migrations . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
16.5 AdvancedMigrations . . . . . . . . . . . . . . . . . . . . . . . . 278
16.6 WhenMigrationsGo Bad . . . . . . . . . . . . . . . . . . . . . . 280
16.7 Schema ManipulationOutside Migrations . . . . . . . . . . . . 281
16.8 ManagingMigrations . . . . . . . . . . . . . . . . . . . . . . . . 282
CONTENTS 8
17 Active Record: The Basics 284
17.1 Tables and Classes . . . . . . . . . . . . . . . . . . . . . . . . . 285
17.2 Columns and Attributes . . . . . . . . . . . . . . . . . . . . . . 285
17.3 PrimaryKeysand IDs . . . . . . . . . . . . . . . . . . . . . . . . 289
17.4 Connecting tothe Database . . . . . . . . . . . . . . . . . . . . 291
17.5 CRUD—Create,Read,Update,Delete. . . . . . . . . . . . . . . 296
17.6 Aggregationand StructuredData . . . . . . . . . . . . . . . . . 314
17.7 Miscellany. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321
18 Active Record: Relationships between Tables 324
18.1 CreatingForeignKeys . . . . . . . . . . . . . . . . . . . . . . . . 325
18.2 SpecifyingRelationshipsinModels . . . . . . . . . . . . . . . . 327
18.3 belongs_toand has_xxx Declarations. . . . . . . . . . . . . . . 329
18.4 Joining toMultipleTables . . . . . . . . . . . . . . . . . . . . . 344
18.5 Self-referentialJoins . . . . . . . . . . . . . . . . . . . . . . . . 354
18.6 ActsAs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 355
18.7 WhenThingsGet Saved. . . . . . . . . . . . . . . . . . . . . . . 359
18.8 PreloadingChild Rows . . . . . . . . . . . . . . . . . . . . . . . 361
18.9 Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362
19 Active Record: Object Life Cycle 364
19.1 Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
19.2 Callbacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 374
19.3 AdvancedAttributes . . . . . . . . . . . . . . . . . . . . . . . . . 381
19.4 Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384
20 Action Controller: Routing and URLs 393
20.1 The Basics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393
20.2 RoutingRequests . . . . . . . . . . . . . . . . . . . . . . . . . . 394
21 Action Controller and Rails 425
21.1 ActionMethods. . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
21.2 Cookies and Sessions . . . . . . . . . . . . . . . . . . . . . . . . 436
21.3 Flash—CommunicatingbetweenActions . . . . . . . . . . . . 446
21.4 Filters and Verification . . . . . . . . . . . . . . . . . . . . . . . 448
21.5 Caching,PartOne . . . . . . . . . . . . . . . . . . . . . . . . . . 456
21.6 The ProblemwithGET Requests . . . . . . . . . . . . . . . . . 463
CONTENTS 9
22 Action View 466
22.1 Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 466
22.2 UsingHelpers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 472
22.3 Helpers for Formatting,Linking,and Pagination . . . . . . . . 474
22.4 How Forms Work. . . . . . . . . . . . . . . . . . . . . . . . . . . 481
22.5 Forms That WrapModel Objects . . . . . . . . . . . . . . . . . 483
22.6 CustomForm Builders . . . . . . . . . . . . . . . . . . . . . . . 495
22.7 WorkingwithNonmodel Fields. . . . . . . . . . . . . . . . . . . 499
22.8 UploadingFiles to RailsApplications . . . . . . . . . . . . . . . 502
22.9 Layouts andComponents . . . . . . . . . . . . . . . . . . . . . 506
22.10 Caching,PartTwo . . . . . . . . . . . . . . . . . . . . . . . . . . 514
22.11 AddingNew TemplatingSystems . . . . . . . . . . . . . . . . . 519
23 The Web, V2.0 522
23.1 Prototype . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522
23.2 Script.aculo.us . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543
23.3 RJSTemplates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
23.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
24 Action Mailer 568
24.1 SendingE-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568
24.2 ReceivingE-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . 579
24.3 TestingE-mail . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580
25 Web Services on Rails 584
25.1 What AWSIs (and WhatIt Isn’t) . . . . . . . . . . . . . . . . . . 584
25.2 The API Definition . . . . . . . . . . . . . . . . . . . . . . . . . . 585
25.3 DispatchingModes . . . . . . . . . . . . . . . . . . . . . . . . . 590
25.4 UsingAlternateDispatching . . . . . . . . . . . . . . . . . . . . 591
25.5 Method InvocationInterception . . . . . . . . . . . . . . . . . . 593
25.6 TestingWeb Services . . . . . . . . . . . . . . . . . . . . . . . . 595
25.7 ProtocolClients . . . . . . . . . . . . . . . . . . . . . . . . . . . 598
Part IV—Secure and Deploy Your Application 599
26 Securing Your Rails Application 600
26.1 SQLInjection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 600
26.2 CreatingRecordsDirectlyfromForm Parameters . . . . . . . 602
26.3 Don’t TrustIDParameters . . . . . . . . . . . . . . . . . . . . . 604
26.4 Don’t Expose ControllerMethods . . . . . . . . . . . . . . . . . 605
26.5 Cross-SiteScripting(CSS/XSS) . . . . . . . . . . . . . . . . . . 606
26.6 AvoidSessionFixationAttacks . . . . . . . . . . . . . . . . . . 608
26.7 File Uploads . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609
CONTENTS 10
26.8 Don’t StoreSensitive Information inthe Clear . . . . . . . . . 610
26.9 Use SSLto TransmitSensitive Information . . . . . . . . . . . 611
26.10 Don’t Cache AuthenticatedPages . . . . . . . . . . . . . . . . . 612
26.11 KnowingThat It Works . . . . . . . . . . . . . . . . . . . . . . . 612
27 Deployment and Production 614
27.1 StartingEarly. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 615
27.2 How a ProductionServer Works . . . . . . . . . . . . . . . . . . 616
27.3 ComparingFront-End WebServers . . . . . . . . . . . . . . . . 618
27.4 RepeatableDeployments withCapistrano . . . . . . . . . . . . 619
27.5 SettingUp a Deployment Environment. . . . . . . . . . . . . . 620
27.6 Checking Upon a DeployedApplication . . . . . . . . . . . . . 626
27.7 ProductionApplicationChores . . . . . . . . . . . . . . . . . . 627
27.8 MovingOn toLaunchand Beyond . . . . . . . . . . . . . . . . 628
Part V—Appendices 630
A Introduction to Ruby 631
A.1 RubyIs anObject-OrientedLanguage . . . . . . . . . . . . . . 631
A.2 RubyNames . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632
A.3 Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 633
A.4 Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635
A.5 Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 637
A.6 Arraysand Hashes . . . . . . . . . . . . . . . . . . . . . . . . . 638
A.7 Control Structures. . . . . . . . . . . . . . . . . . . . . . . . . . 639
A.8 RegularExpressions. . . . . . . . . . . . . . . . . . . . . . . . . 640
A.9 Blocks and Iterators . . . . . . . . . . . . . . . . . . . . . . . . . 640
A.10 Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641
A.11 MarshalingObjects . . . . . . . . . . . . . . . . . . . . . . . . . 642
A.12 InteractiveRuby . . . . . . . . . . . . . . . . . . . . . . . . . . . 642
A.13 RubyIdioms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 642
A.14 RDoc Documentation . . . . . . . . . . . . . . . . . . . . . . . . 644
B Configuration Parameters 645
B.1 Top-Level Configuration . . . . . . . . . . . . . . . . . . . . . . 645
B.2 ActiveRecord Configuration . . . . . . . . . . . . . . . . . . . . 647
B.3 ActionControllerConfiguration . . . . . . . . . . . . . . . . . . 649
B.4 ActionView Configuration . . . . . . . . . . . . . . . . . . . . . 650
B.5 ActionMailerConfiguration . . . . . . . . . . . . . . . . . . . . 651
B.6 Test Case Configuration . . . . . . . . . . . . . . . . . . . . . . 652