tina4ruby 3.10.21 → 3.10.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29aa756b32ea3d0051d1b5d26cb8b1312bb77c871fec39fea3e4ce2a8d5c5afd
-  data.tar.gz: 326553173c9e4753b6b0bf0471729c065d169d62f609c663b0c3400847e889e8
+  metadata.gz: 6bbf81019e88de5f456938818de88c5f8219dcb691d647c26d504f6aacdf229a
+  data.tar.gz: a0b70c415d26e8727cfec8337fc957a58cb4d4895565bc0c1922ef9ebd2383c8
 SHA512:
-  metadata.gz: 2f23cc2b84be7fdc7d7f6b9e21ce400a124a95d51b78e5d5b458313516d4aba930e166fc32120df8c1c6f317df78e3d4937b9722d3459bcfbb00cd2cd7c731c0
-  data.tar.gz: db8f5ac24ff747c59cb6b93b4877b99ac5790b3234b1f7e360d811fb002bb00618215d32fb2fa1a707108b68257de31dfd937f4c312e41f7b63f8caf65b359e7
+  metadata.gz: a10cdebeca708e63aebaa1f75e8d18e1b77429560f42a0bedcec9247792c9ce7451d93a233f4b6c1bdd8865e7ce4bae3440ae33cded8974e8dbcf4cfac060e93
+  data.tar.gz: f613505809da1d5d5868e52a368f09a82e7f24905f5f51011b6747d4b45877e4151d5830f45a943764ba84f42d5b76aa40a47284038dafb8d40406164d748570

data/lib/tina4/frond.rb

@@ -13,6 +13,7 @@ require "cgi"
 require "uri"
 require "date"
 require "time"
+require "securerandom"
 
 module Tina4
   # Marker class for strings that should not be auto-escaped in Frond.
@@ -196,20 +197,14 @@ module Tina4
       raise "Template not found: #{path}" unless File.exist?(path)
 
       debug_mode = ENV.fetch("TINA4_DEBUG", "").downcase == "true"
-      cached = @compiled[template]
 
-      if cached
-        if debug_mode
-          # Dev mode: check if file changed
-          mtime = File.mtime(path)
-          if cached[1] == mtime
-            return execute_cached(cached[0], context)
-          end
-        else
-          # Production: skip mtime check, cache is permanent
-          return execute_cached(cached[0], context)
-        end
+      unless debug_mode
+        # Production: use permanent cache (no filesystem checks)
+        cached = @compiled[template]
+        return execute_cached(cached[0], context) if cached
       end
+      # Dev mode: skip cache entirely — always re-read and re-tokenize
+      # so edits to partials and extended base templates are detected
 
       # Cache miss — load, tokenize, cache
       source = File.read(path, encoding: "utf-8")
@@ -1839,6 +1834,8 @@ module Tina4
 
     def register_builtin_globals
       @globals["form_token"] = ->(descriptor = "") { Frond.generate_form_token(descriptor.to_s) }
+      @globals["formTokenValue"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
+      @globals["form_token_value"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
     end
 
     # Generate a JWT form token and return a hidden input element.
@@ -1857,11 +1854,19 @@ module Tina4
       attr_accessor :form_token_session_id
     end
 
-    def self.generate_form_token(descriptor = "")
+    # Generate a raw JWT form token string.
+    #
+    # @param descriptor [String] Optional string to enrich the token payload.
+    #   - Empty: payload is {"type" => "form"}
+    #   - "admin_panel": payload is {"type" => "form", "context" => "admin_panel"}
+    #   - "checkout|order_123": payload is {"type" => "form", "context" => "checkout", "ref" => "order_123"}
+    #
+    # @return [String] The raw JWT token string.
+    def self.generate_form_jwt(descriptor = "")
       require_relative "log"
       require_relative "auth"
 
-      payload = { "type" => "form" }
+      payload = { "type" => "form", "nonce" => SecureRandom.hex(8) }
       if descriptor && !descriptor.empty?
         if descriptor.include?("|")
           parts = descriptor.split("|", 2)
@@ -1878,8 +1883,18 @@ module Tina4
 
       ttl_minutes = (ENV["TINA4_TOKEN_LIMIT"] || "60").to_i
       expires_in = ttl_minutes * 60
-      token = Tina4::Auth.create_token(payload, expires_in: expires_in)
+      Tina4::Auth.create_token(payload, expires_in: expires_in)
+    end
+
+    def self.generate_form_token(descriptor = "")
+      token = generate_form_jwt(descriptor)
       Tina4::SafeString.new(%(<input type="hidden" name="formToken" value="#{CGI.escapeHTML(token)}">))
     end
+
+    # Return just the raw JWT form token string (no <input> wrapper).
+    # Registered as both formTokenValue and form_token_value template globals.
+    def self.generate_form_token_value(descriptor = "")
+      Tina4::SafeString.new(generate_form_jwt(descriptor))
+    end
   end
 end

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.10.21"
+  VERSION = "3.10.24"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.10.21
+  version: 3.10.24
 platform: ruby
 authors:
 - Tina4 Team