Strong ETag validators

* Introduce `Response#strong_etag=` and `#weak_etag=` and analogous options
  for `fresh_when` and `stale?`. `Response#etag=` sets a weak ETag.

  Strong ETags are desirable when you're serving byte-for-byte identical
  responses that support Range requests, like PDFs or videos (typically
  done by reproxying the response from a backend storage service).
  Also desirable when fronted by some CDNs that support strong ETags
  only, like Akamai.

* No longer strips quotes (`"`) from ETag values before comparing them.
  Quotes are significant, part of the ETag. A quoted ETag and an unquoted
  one are not the same entity.

* Support `If-None-Match: *`. Rarely useful for GET requests; meant
  to provide some optimistic concurrency control for PUT requests.

2 files changed, 50 insertions, 20 deletions

diff --git a/actionpack/test/dispatch/request_test.rb b/actionpack/test/dispatch/request_test.rb
index 0edad72fd9..a4cb8ce449 100644
--- a/actionpack/test/dispatch/request_test.rb
+++ b/actionpack/test/dispatch/request_test.rb
@@ -1152,36 +1152,41 @@ class RequestParameterFilter < BaseRequestTest
 end
 
 class RequestEtag < BaseRequestTest
-  test "if_none_match_etags none" do
+  test "always matches *" do
+    request = stub_request('HTTP_IF_NONE_MATCH' => '*')
+
+    assert_equal '*', request.if_none_match
+    assert_equal ['*'], request.if_none_match_etags
+
+    assert request.etag_matches?('"strong"')
+    assert request.etag_matches?('W/"weak"')
+    assert_not request.etag_matches?(nil)
+  end
+
+  test "doesn't match absent If-None-Match" do
     request = stub_request
 
     assert_equal nil, request.if_none_match
     assert_equal [], request.if_none_match_etags
-    assert !request.etag_matches?("foo")
-    assert !request.etag_matches?(nil)
-  end
 
-  test "if_none_match_etags single" do
-    header = 'the-etag'
-    request = stub_request('HTTP_IF_NONE_MATCH' => header)
-
-    assert_equal header, request.if_none_match
-    assert_equal [header], request.if_none_match_etags
-    assert request.etag_matches?("the-etag")
+    assert_not request.etag_matches?("foo")
+    assert_not request.etag_matches?(nil)
   end
 
-  test "if_none_match_etags quoted single" do
+  test "matches opaque ETag validators without unquoting" do
     header = '"the-etag"'
     request = stub_request('HTTP_IF_NONE_MATCH' => header)
 
     assert_equal header, request.if_none_match
-    assert_equal ['the-etag'], request.if_none_match_etags
-    assert request.etag_matches?("the-etag")
+    assert_equal ['"the-etag"'], request.if_none_match_etags
+
+    assert request.etag_matches?('"the-etag"')
+    assert_not request.etag_matches?("the-etag")
   end
 
   test "if_none_match_etags multiple" do
     header = 'etag1, etag2, "third etag", "etag4"'
-    expected = ['etag1', 'etag2', 'third etag', 'etag4']
+    expected = ['etag1', 'etag2', '"third etag"', '"etag4"']
     request = stub_request('HTTP_IF_NONE_MATCH' => header)
 
     assert_equal header, request.if_none_match
diff --git a/actionpack/test/dispatch/response_test.rb b/actionpack/test/dispatch/response_test.rb
index cd385982d9..658e0d004b 100644
--- a/actionpack/test/dispatch/response_test.rb
+++ b/actionpack/test/dispatch/response_test.rb
@@ -189,7 +189,7 @@ class ResponseTest < ActiveSupport::TestCase
     assert_equal({"user_name" => "david", "login" => nil}, @response.cookies)
   end
 
-  test "read cache control" do
+  test "read ETag and Cache-Control" do
     resp = ActionDispatch::Response.new.tap { |response|
       response.cache_control[:public] = true
       response.etag = '123'
@@ -197,6 +197,9 @@ class ResponseTest < ActiveSupport::TestCase
     }
     resp.to_a
 
+    assert resp.etag?
+    assert resp.weak_etag?
+    assert_not resp.strong_etag?
     assert_equal('W/"202cb962ac59075b964b07152d234b70"', resp.etag)
     assert_equal({:public => true}, resp.cache_control)
 
@@ -204,6 +207,20 @@ class ResponseTest < ActiveSupport::TestCase
     assert_equal('W/"202cb962ac59075b964b07152d234b70"', resp.headers['ETag'])
   end
 
+  test "read strong ETag" do
+    resp = ActionDispatch::Response.new.tap { |response|
+      response.cache_control[:public] = true
+      response.strong_etag = '123'
+      response.body = 'Hello'
+    }
+    resp.to_a
+
+    assert resp.etag?
+    assert_not resp.weak_etag?
+    assert resp.strong_etag?
+    assert_equal('"202cb962ac59075b964b07152d234b70"', resp.etag)
+  end
+
   test "read charset and content type" do
     resp = ActionDispatch::Response.new.tap { |response|
       response.charset = 'utf-16'
@@ -446,11 +463,19 @@ class ResponseIntegrationTest < ActionDispatch::IntegrationTest
     assert_equal('application/xml; charset=utf-16', @response.headers['Content-Type'])
   end
 
-  test "we can set strong ETag by directly adding it as header" do
-    @response = ActionDispatch::Response.create
-    @response.add_header "ETag", '"202cb962ac59075b964b07152d234b70"'
+  test "strong ETag validator" do
+    @app = lambda { |env|
+      ActionDispatch::Response.new.tap { |resp|
+        resp.strong_etag = '123'
+        resp.body = 'Hello'
+        resp.request = ActionDispatch::Request.empty
+      }.to_a
+    }
+
+    get '/'
+    assert_response :ok
 
-    assert_equal('"202cb962ac59075b964b07152d234b70"', @response.etag)
     assert_equal('"202cb962ac59075b964b07152d234b70"', @response.headers['ETag'])
+    assert_equal('"202cb962ac59075b964b07152d234b70"', @response.etag)
   end
 end