action_pack.cr

A Crystal port of Rails ActionPack 8.1.4 — controllers, routing, strong parameters, cookies/session/flash, CSRF protection, HTTP caching and streaming. Namespaces ActionController / ActionDispatch mirror the original 1:1. Behavioral parity is verified against the real gem via oracle specs (Ruby cases recorded with actionpack 8.1.4, replayed in Crystal without edits).

⚠️ EXPERIMENTAL FRAMEWORK, DO NOT USE IN PRODUCTION YET.

Installation

dependencies:
  action_pack_cr:
    github: OrelSokolov/action_pack.cr

shards install

Requires Crystal >= 1.21.0. Works with active_support.cr, action_view.cr and railties.cr (boot/middleware ladder).

Usage

class ApplicationController < ActionController::Base
end

class PostsController < ApplicationController
  before_action :authenticate, only: [:index]

  def index
    @posts = Post.all
  end

  def create
    post = Post.new(params.require(:post).permit(:title, :body))
    if post.save
      redirect_to posts_path, notice: "Created"
    else
      render :new, status: :unprocessable_entity
    end
  end
end

# config/routes.cr
CRails.application.routes.draw do
  resources :posts
  root "welcome#index"
end

Run the suite with make spec (or CRAILS_VIEWS=spec/fixtures/app/views crystal spec).

Feature comparison vs actionpack 8.1.4

Controllers & callbacks

Routing

Strong parameters

Cookies / session / flash

CSRF protection

HTTP caching & streaming

Beyond parity (not in actionpack)

Deviations & Crystal-specific notes

• Set-Cookie headers are written directly to response.headers (no deferred commit); HTTPS detection uses X-Forwarded-Proto (Crystal's HTTP::Server is unaware of TLS termination); SameSite is not injected by default (railties territory); the cookie verifier supports only SHA1/SHA256 digests.
• In Live: IOError maps to IO::Error; ActionView completion is not written when an exception fires after commit (matches observed gem behavior); abort wakes a blocked producer immediately; id: 0 is valid (the Ruby falsy quirk is not reproducible); SSE non-String payloads use stdlib to_json.
• permit/expect nested filters use a Hash argument (see table).
• HTTP layer is Crystal HTTP::Server with an HTTP::Handler chain exposing the same stack operations (use/insert_before/insert_after/ swap/delete); concurrency is fiber-per-connection.
• Benchmarks (bench/results/): SSE fanout ~482–622k events/s vs Rails+Puma 31–41k (~15×); chunked ~710–887k chunks/s (~6–7×); typed params ~30× vs dry-schema.

Testing

make spec   # or: CRAILS_VIEWS=spec/fixtures/app/views crystal spec

Oracle specs: Ruby cases in oracle/*_cases.rb are recorded with the real actionpack 8.1.4 into oracle/*_expected.yml, then replayed byte-for-byte by the Crystal mirror in spec/. Transport-level specs (Live/SSE, CSRF, data streaming, typed params E2E) live in railties.cr/spec/ against a real HTTP::Server.