Hanami 3.0

Apply the Ruby 4.0 baseline first. These rules cover Hanami 3.0 with its 3.0-series action, view, database, and optional mailer integrations; they were checked against Hanami 3.0.2. Hanami requires Ruby 3.3 or newer.

Routes, action lifecycle, and shared components

• Limit resources and resource routes with only: to the required operations. Authenticate and authorize every protected action and separately protect route blocks, callable endpoints, and mounted Rack apps; these do not acquire action callbacks merely by sharing a route scope or slice.
• Put authentication and authorization before protected work, and use halt or response.redirect_to to stop a denied request. Setting response.status or returning from a callback does not halt the action. Keep essential cleanup in ensure or enclosing middleware because halting skips subsequent callbacks, including after callbacks.
• For browser cross-origin API actions, position CORS Rack middleware outermost for the affected paths, before authentication, caches, static serving, and other short-circuiting middleware. Use config.middleware.use or route use only where the resulting stack covers OPTIONS preflights and 401/403/error responses. Allowlist exact origins, methods, request headers, and resources; never reflect an arbitrary or null origin. Keep credential sharing off unless required; then enable credentials: true only for specifically allowed origins and resources, never a wildcard. Send Vary: Origin for dynamic origin selection, and enforce authentication and CSRF separately.
• Rate-limit