Fix accept_params/reject_params missing a standalone Contract's unknown: strictness

[VSN2015]

The false positive

ParamsBehaviourMatcher#run (accept_params/reject_params's engine) replays the rule against a brand-new, generic throwaway host — Class.new { include Permittable; attr_accessor :params } — instead of one that behaves like @subject itself.

That matters for a standalone Permittable::Contract. Contract#initialize builds its own internal host with a deliberate override:

def permittable_check_unknown(fields, hash, path:, unknown:, top_level:, violations:)
  super(fields, hash, path: path, unknown: unknown, top_level: false, violations: violations)
end

— "standalone input has no router and no request... gets no exemption from unknown: checking." The matcher's generic host has no such override, so it falls through to the module default, which exempts routing/form keys (controller, action, format, ...) whenever top_level is true — true for any rootless rule, the common case for a Contract.

contract = Permittable::Contract.define(unknown: :error) { required :a, :integer }

contract.call(a: "1", controller: "x").invalid?              # => true  (real behaviour: rejects)
expect(contract).to accept_params(a: "1", controller: "x")   # => passed (matcher: WRONGLY accepted)

So accept_params/reject_params could disagree with contract.call on exactly the routing-shaped keys a standalone Contract is documented to not exempt — a false "accept" (or false negative on reject_params) in the one place a spec exists to catch it.

The fix

ParamsBehaviourMatcher#run still builds the same minimal generic host for the general case — it is not safe to subclass @subject's own class, since @subject may be a real controller, and instantiating one outside the framework's own dispatch (no request, no response, whatever its before_actions assume) isn't something the matcher can do reliably. @subject.class also isn't usable for a Contract, since Permittable::Contract doesn't itself include Permittable — it wraps a private internal host that does.

So the one override Contract makes is replicated directly on the throwaway host, only when @subject is a Permittable::Contract:

mirror_contract_unknown_check(host) if @subject.is_a?(Permittable::Contract)

The controller path is untouched — it still gets the plain generic host, exactly as before.

Verification

• New spec in spec/matchers_spec.rb reproduces the false positive against a rootless unknown: :error Contract with a controller key; confirmed it fails on master before the fix
• 849 examples, 0 failures (bundle exec rspec)
• RuboCop clean on the touched files

🤖 Generated with Claude Code