tina4ruby 3.10.21 → 3.10.23

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29aa756b32ea3d0051d1b5d26cb8b1312bb77c871fec39fea3e4ce2a8d5c5afd
-  data.tar.gz: 326553173c9e4753b6b0bf0471729c065d169d62f609c663b0c3400847e889e8
+  metadata.gz: 3ae8ae6d644a0cb19a5b5fc2f68b02066ecfc41c4f6b6e6bae2415fdbe078fcc
+  data.tar.gz: eb1dd0310b3ed508ea582ec186e64f050be8c4fc8925abd5f038689b20a6f551
 SHA512:
-  metadata.gz: 2f23cc2b84be7fdc7d7f6b9e21ce400a124a95d51b78e5d5b458313516d4aba930e166fc32120df8c1c6f317df78e3d4937b9722d3459bcfbb00cd2cd7c731c0
-  data.tar.gz: db8f5ac24ff747c59cb6b93b4877b99ac5790b3234b1f7e360d811fb002bb00618215d32fb2fa1a707108b68257de31dfd937f4c312e41f7b63f8caf65b359e7
+  metadata.gz: cdcb3bf5c7d76949b51ec90fea3eed309fb0e9ec312f5ed5a02451da2a6953c3eb46524d191c0dee3d0efb587dc50581021dabd65b4432b42b469ccaa53342bf
+  data.tar.gz: ac974932d01d89edff858d9873ac39709f88161958956763757d952d8a3d17e97fccf96cd0cc1ce2678bca88488a357f9a28b7f2243d4bcd158be26f4e7fb541

data/lib/tina4/frond.rb

@@ -13,6 +13,7 @@ require "cgi"
 require "uri"
 require "date"
 require "time"
+require "securerandom"
 
 module Tina4
   # Marker class for strings that should not be auto-escaped in Frond.
@@ -1839,6 +1840,8 @@ module Tina4
 
     def register_builtin_globals
       @globals["form_token"] = ->(descriptor = "") { Frond.generate_form_token(descriptor.to_s) }
+      @globals["formTokenValue"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
+      @globals["form_token_value"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
     end
 
     # Generate a JWT form token and return a hidden input element.
@@ -1857,11 +1860,19 @@ module Tina4
       attr_accessor :form_token_session_id
     end
 
-    def self.generate_form_token(descriptor = "")
+    # Generate a raw JWT form token string.
+    #
+    # @param descriptor [String] Optional string to enrich the token payload.
+    #   - Empty: payload is {"type" => "form"}
+    #   - "admin_panel": payload is {"type" => "form", "context" => "admin_panel"}
+    #   - "checkout|order_123": payload is {"type" => "form", "context" => "checkout", "ref" => "order_123"}
+    #
+    # @return [String] The raw JWT token string.
+    def self.generate_form_jwt(descriptor = "")
       require_relative "log"
       require_relative "auth"
 
-      payload = { "type" => "form" }
+      payload = { "type" => "form", "nonce" => SecureRandom.hex(8) }
       if descriptor && !descriptor.empty?
         if descriptor.include?("|")
           parts = descriptor.split("|", 2)
@@ -1878,8 +1889,18 @@ module Tina4
 
       ttl_minutes = (ENV["TINA4_TOKEN_LIMIT"] || "60").to_i
       expires_in = ttl_minutes * 60
-      token = Tina4::Auth.create_token(payload, expires_in: expires_in)
+      Tina4::Auth.create_token(payload, expires_in: expires_in)
+    end
+
+    def self.generate_form_token(descriptor = "")
+      token = generate_form_jwt(descriptor)
       Tina4::SafeString.new(%(<input type="hidden" name="formToken" value="#{CGI.escapeHTML(token)}">))
     end
+
+    # Return just the raw JWT form token string (no <input> wrapper).
+    # Registered as both formTokenValue and form_token_value template globals.
+    def self.generate_form_token_value(descriptor = "")
+      Tina4::SafeString.new(generate_form_jwt(descriptor))
+    end
   end
 end

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.10.21"
+  VERSION = "3.10.23"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.10.21
+  version: 3.10.23
 platform: ruby
 authors:
 - Tina4 Team