tina4ruby 3.10.92 → 3.10.93

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 872c1e0d5dbae634259ad2772d69630f7160784967c03cb0d5ec68da3b122673
-  data.tar.gz: c08ab7a877b583e3141dc523125bc236e6e548f2acc5b757114074b3547b27c2
+  metadata.gz: 5820ce91766359bcb5365ef8ea729e09641d2477b0b68179ca7c617fc3ce4630
+  data.tar.gz: 05c9793be438311072c37ce8570aea4c6322d7b498a2b079007996450ca8006b
 SHA512:
-  metadata.gz: 2657a571cda5d98dcd0e46a0db670b6bcb027d23376d8b198413ad3b9c2f8bc56bec600fff1f77d71a0cf33ca51e632c3f4923f3caf67a8b40fd80125432f3b3
-  data.tar.gz: ecca10a04db72af6d1e7f42d60c1509c9d98ccb516d2635ecfa78bc48d2def7ac63dbb14092fa27e9c668fea1f2c57982c280210e56f755a6d9ccc122f326747
+  metadata.gz: ba80ea5428f0354e0c005a0e647f1a1c8982bf2bbc9a69059a86b20d49b9523448f1fec0e28a7e9c459b441987b811e91b50ae77cc2fdafd6100f64fdc34789a
+  data.tar.gz: 4eb11c4f9a289f88a49330a763b32a595c7c46715788af3c8ada2d8742e7bd5d35f8d219416e4e49a3e794c4cf2fc23d23032f7b99e1b3ed8536345d3ec4800e

data/lib/tina4/frond.rb

@@ -655,6 +655,7 @@ module Tina4
     def find_outside_quotes(expr, needle)
       in_q = nil
       depth = 0
+      bracket_depth = 0
       i = 0
       nlen = needle.length
       while i <= expr.length - nlen
@@ -676,8 +677,12 @@ module Tina4
           depth += 1
         elsif ch == ")"
           depth -= 1
+        elsif ch == "["
+          bracket_depth += 1
+        elsif ch == "]"
+          bracket_depth -= 1
         end
-        if depth == 0 && expr[i, nlen] == needle
+        if depth == 0 && bracket_depth == 0 && expr[i, nlen] == needle
           return i
         end
         i += 1
@@ -1172,8 +1177,30 @@ module Tina4
         part = part.strip.gsub(RESOLVE_STRIP_RE, "") # strip quotes from bracket access
         if value.is_a?(Hash) || value.is_a?(LoopContext)
           value = value[part] || value[part.to_sym]
-        elsif value.is_a?(Array) && part =~ DIGIT_RE
-          value = value[part.to_i]
+        elsif value.is_a?(Array)
+          # Slice syntax: value[1:5], value[:10], value[start:end]
+          if part.include?(":") && !(part.start_with?('"') || part.start_with?("'"))
+            slice_parts = part.split(":", 2)
+            s_start = slice_parts[0].strip.empty? ? nil : eval_expr(slice_parts[0].strip, context).to_i
+            s_end = slice_parts[1].strip.empty? ? nil : eval_expr(slice_parts[1].strip, context).to_i
+            if s_start && s_end
+              value = value[s_start...s_end]
+            elsif s_start
+              value = value[s_start..]
+            elsif s_end
+              value = value[0...s_end]
+            else
+              value = value.dup
+            end
+            next
+          end
+          idx = if part =~ DIGIT_RE
+                  part.to_i
+                else
+                  eval_expr(part, context)
+                end
+          idx = idx.to_i if idx.is_a?(Numeric)
+          value = idx.is_a?(Integer) ? value[idx] : nil
         elsif value.respond_to?(part.to_sym)
           value = value.send(part.to_sym)
         else

data/lib/tina4/localization.rb

@@ -10,6 +10,12 @@ module Tina4
         @translations ||= {}
       end
 
+      # Flat alias map: { locale => { leaf_key => value } }
+      # First-wins on conflict — later duplicates are ignored.
+      def flat_aliases
+        @flat_aliases ||= {}
+      end
+
       def current_locale
         @current_locale || ENV["TINA4_LOCALE"] || "en"
       end
@@ -19,8 +25,11 @@ module Tina4
       end
 
       def load(root_dir = Dir.pwd)
-        LOCALE_DIRS.each do |dir|
-          locale_dir = File.join(root_dir, dir)
+        locale_dir_override = ENV["TINA4_LOCALE_DIR"]
+        search_dirs = locale_dir_override && !locale_dir_override.empty? ? [locale_dir_override] : LOCALE_DIRS
+
+        search_dirs.each do |dir|
+          locale_dir = File.expand_path(dir, root_dir)
           next unless Dir.exist?(locale_dir)
 
           Dir.glob(File.join(locale_dir, "*.json")).each do |file|
@@ -28,6 +37,8 @@ module Tina4
             data = JSON.parse(File.read(file))
             translations[locale] ||= {}
             translations[locale].merge!(data)
+            # Build leaf-key aliases from the loaded data
+            build_leaf_aliases(locale, data)
             Tina4::Log.debug("Loaded locale: #{locale} from #{file}")
           end
 
@@ -37,8 +48,11 @@ module Tina4
               require "yaml"
               locale = File.basename(file, File.extname(file))
               data = YAML.safe_load(File.read(file))
-              translations[locale] ||= {}
-              translations[locale].merge!(data) if data.is_a?(Hash)
+              if data.is_a?(Hash)
+                translations[locale] ||= {}
+                translations[locale].merge!(data)
+                build_leaf_aliases(locale, data)
+              end
             rescue LoadError
               Tina4::Log.warning("YAML support requires the 'yaml' gem")
             end
@@ -94,6 +108,13 @@ module Tina4
           hash = hash[k]
         end
         hash[keys.last] = value
+
+        # Register leaf-key alias (first-wins)
+        leaf = keys.last
+        if value.is_a?(String)
+          flat_aliases[locale.to_s] ||= {}
+          flat_aliases[locale.to_s][leaf] ||= value
+        end
       end
 
       def available_locales
@@ -102,19 +123,45 @@ module Tina4
 
       private
 
+      # Recursively walk a nested hash and register leaf-key aliases.
+      # First-wins: if a leaf key already exists, it is NOT overwritten.
+      def build_leaf_aliases(locale, hash, prefix = nil)
+        flat_aliases[locale.to_s] ||= {}
+        hash.each do |key, value|
+          full_key = prefix ? "#{prefix}.#{key}" : key.to_s
+          if value.is_a?(Hash)
+            build_leaf_aliases(locale, value, full_key)
+          else
+            # Store the leaf key as an alias (first-wins)
+            flat_aliases[locale.to_s][key.to_s] ||= value
+          end
+        end
+      end
+
       def lookup(locale, key)
         keys = key.to_s.split(".")
         result = translations[locale]
         return nil unless result
 
+        # Try dot-path traversal first
+        dot_result = result
         keys.each do |k|
-          if result.is_a?(Hash)
-            result = result[k] || result[k.to_sym]
+          if dot_result.is_a?(Hash)
+            dot_result = dot_result[k] || dot_result[k.to_sym]
           else
-            return nil
+            dot_result = nil
+            break
           end
         end
-        result.is_a?(String) ? result : nil
+        return dot_result if dot_result.is_a?(String)
+
+        # Fall back to leaf-key alias (only for simple keys without dots)
+        if flat_aliases[locale]
+          alias_val = flat_aliases[locale][key.to_s]
+          return alias_val if alias_val.is_a?(String)
+        end
+
+        nil
       end
     end
   end

data/lib/tina4/orm.rb

@@ -4,7 +4,7 @@ require "json"
 module Tina4
   # Convert a snake_case name to camelCase.
   def self.snake_to_camel(name)
-    parts = name.to_s.split("_")
+    parts = name.to_s.downcase.split("_")
     parts[0] + parts[1..].map(&:capitalize).join
   end
 

data/lib/tina4/rack_app.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 require "json"
 require "securerandom"
+require "uri"
 
 module Tina4
   # Middleware wrapper that tags requests arriving on the AI dev port.
@@ -168,8 +169,35 @@ module Tina4
 
       # Secure-by-default: enforce bearer-token auth on write routes
       if route.auth_required
+        token = nil
+        token_source = nil  # :header, :body, :session
+
+        # Priority 1: Authorization Bearer header
         auth_header = env["HTTP_AUTHORIZATION"] || ""
-        token = auth_header =~ /\ABearer\s+(.+)\z/i ? Regexp.last_match(1) : nil
+        if auth_header =~ /\ABearer\s+(.+)\z/i
+          token = Regexp.last_match(1)
+          token_source = :header
+        end
+
+        # Priority 2: formToken from request body (for frond.js saveForm with {{ form_token() }})
+        if token.nil?
+          body_str = _read_rack_body(env)
+          form_token = _extract_form_token(body_str, env)
+          if form_token && !form_token.empty?
+            token = form_token
+            token_source = :body
+          end
+        end
+
+        # Priority 3: Session token (for secured GET routes after login)
+        if token.nil?
+          session = Tina4::Session.new(env)
+          session_token = session.get("token")
+          if session_token && !session_token.empty?
+            token = session_token
+            token_source = :session
+          end
+        end
 
         # API_KEY bypass — matches tina4_python behavior
         api_key = ENV["TINA4_API_KEY"] || ENV["API_KEY"]
@@ -180,6 +208,11 @@ module Tina4
             return [401, { "content-type" => "application/json" }, [JSON.generate({ error: "Unauthorized" })]]
           end
           env["tina4.auth_payload"] = Tina4::Auth.get_payload(token)
+
+          # When body formToken validates, store a refreshed token for the FreshToken response header
+          if token_source == :body
+            env["tina4.fresh_token"] = Tina4::Auth.refresh_token(token)
+          end
         else
           return [401, { "content-type" => "application/json" }, [JSON.generate({ error: "Unauthorized" })]]
         end
@@ -231,6 +264,11 @@ module Tina4
       # Run global after middleware (block-based + class-based after_* methods)
       Tina4::Middleware.run_after(Tina4::Middleware.global_middleware, request, final_response)
 
+      # Inject FreshToken header when body formToken was used for auth
+      if env["tina4.fresh_token"]
+        final_response.add_header("FreshToken", env["tina4.fresh_token"])
+      end
+
       final_response.to_rack
     end
 
@@ -740,5 +778,40 @@ module Tina4
     end
 
 
+    # Read and rewind the Rack input body. Returns the raw body string.
+    def _read_rack_body(env)
+      input = env["rack.input"]
+      return "" unless input
+      input.rewind if input.respond_to?(:rewind)
+      body = input.read || ""
+      input.rewind if input.respond_to?(:rewind)
+      body
+    end
+
+    # Extract a formToken from the request body.
+    # Supports JSON body ({ "formToken": "..." }) and URL-encoded form data (formToken=...).
+    def _extract_form_token(body_str, env)
+      return nil if body_str.nil? || body_str.empty?
+
+      content_type = env["CONTENT_TYPE"] || env["HTTP_CONTENT_TYPE"] || ""
+
+      if content_type.include?("application/json")
+        begin
+          parsed = JSON.parse(body_str)
+          return parsed["formToken"] if parsed.is_a?(Hash) && parsed["formToken"]
+        rescue JSON::ParserError
+          # Not valid JSON — fall through
+        end
+      end
+
+      # URL-encoded form data (or fallback for any content type)
+      if body_str.include?("formToken=")
+        match = body_str.match(/(?:^|&)formToken=([^&]+)/)
+        return URI.decode_www_form_component(match[1]) if match
+      end
+
+      nil
+    end
+
   end
 end

data/lib/tina4/seeder.rb

@@ -524,6 +524,13 @@ module Tina4
     results
   end
 
+  # Run all seed files in the given folder.
+  #
+  # @param seed_folder [String] path to seed files (default: "seeds")
+  def self.seed(seed_folder: "seeds", clear: false)
+    seed_dir(seed_folder: seed_folder, clear: clear)
+  end
+
   # Run all seed files in the given folder.
   #
   # @param seed_folder [String] path to seed files (default: "seeds")

data/lib/tina4/template.rb

@@ -230,16 +230,112 @@ module Tina4
           parent_path = Regexp.last_match(1)
           full_parent = resolve_template(parent_path)
           if full_parent && File.exist?(full_parent)
-            @parent_template = File.read(full_parent)
-            content.scan(/\{%\s*block\s+(\w+)\s*%\}(.*?)\{%\s*endblock\s*%\}/m) do |name, body|
-              @blocks[name] = body
-            end
-            content = @parent_template
+            parent_source = File.read(full_parent)
+            child_blocks = extract_blocks(content)
+            @blocks.merge!(child_blocks)
+            content = render_with_blocks(parent_source, @blocks)
           end
         end
         content
       end
 
+      # Extract {% block name %}...{% endblock %} pairs using depth counting
+      # so that nested blocks are handled correctly (non-greedy regex fails
+      # when blocks are nested inside other blocks).
+      def extract_blocks(source)
+        blocks = {}
+        block_open = /\{%[-\s]*block\s+(\w+)\s*-?%\}/
+        block_close = /\{%[-\s]*endblock\s*-?%\}/
+
+        pos = 0
+        while pos < source.length
+          m_open = block_open.match(source, pos)
+          break unless m_open
+
+          name = m_open[1]
+          content_start = m_open.end(0)
+          depth = 1
+          scan = content_start
+
+          while depth > 0 && scan < source.length
+            next_open = block_open.match(source, scan)
+            next_close = block_close.match(source, scan)
+
+            break unless next_close # malformed — no matching endblock
+
+            if next_open && next_open.begin(0) < next_close.begin(0)
+              depth += 1
+              scan = next_open.end(0)
+            else
+              depth -= 1
+              if depth == 0
+                blocks[name] = source[content_start...next_close.begin(0)]
+                pos = next_close.end(0)
+                break
+              end
+              scan = next_close.end(0)
+            end
+          end
+
+          # If we didn't break out via depth==0, skip forward to avoid infinite loop
+          pos = content_start if depth > 0
+        end
+
+        blocks
+      end
+
+      # Render a parent template replacing blocks with child overrides.
+      # Supports multi-level inheritance: if the parent itself extends a
+      # grandparent, blocks are merged (child overrides parent) and the
+      # chain is followed recursively.
+      def render_with_blocks(parent_source, child_blocks)
+        extends_re = /\A\s*\{%\s*extends\s+["'](.+?)["']\s*%\}/
+
+        # Multi-level: if the parent itself extends another template, recurse
+        if parent_source =~ extends_re
+          grandparent_name = Regexp.last_match(1)
+          full_grandparent = resolve_template(grandparent_name)
+          if full_grandparent && File.exist?(full_grandparent)
+            grandparent_source = File.read(full_grandparent)
+
+            # Extract block defaults defined in the parent template
+            parent_blocks = extract_blocks(parent_source)
+
+            # Child blocks override parent blocks at the same name
+            merged_blocks = parent_blocks.merge(child_blocks)
+
+            # Resolve nested blocks: if a block value contains {% block inner %}
+            # tags, replace them with merged_blocks values too
+            block_re = /\{%[-\s]*block\s+(\w+)\s*-?%\}(.*?)\{%[-\s]*endblock\s*-?%\}/m
+            changed = true
+            while changed
+              changed = false
+              merged_blocks.each do |bname, bsource|
+                resolved = bsource.gsub(block_re) do
+                  inner_name = Regexp.last_match(1)
+                  inner_default = Regexp.last_match(2)
+                  merged_blocks[inner_name] || inner_default
+                end
+                if resolved != bsource
+                  merged_blocks[bname] = resolved
+                  changed = true
+                end
+              end
+            end
+
+            # Recurse up the chain (handles 3+, 4+, ... levels)
+            return render_with_blocks(grandparent_source, merged_blocks)
+          end
+        end
+
+        # Leaf parent (no extends) — resolve blocks and render
+        parent_source.gsub(/\{%[-\s]*block\s+(\w+)\s*-?%\}(.*?)\{%[-\s]*endblock\s*-?%\}/m) do
+          name = Regexp.last_match(1)
+          default_body = Regexp.last_match(2)
+          child_blocks[name] || default_body
+        end
+      end
+
       def process_blocks(content)
         content.gsub(/\{%\s*block\s+(\w+)\s*%\}(.*?)\{%\s*endblock\s*%\}/m) do
           name = Regexp.last_match(1)

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.10.92"
+  VERSION = "3.10.93"
 end

data/lib/tina4.rb

@@ -170,6 +170,9 @@ module Tina4
       # Load translations
       Tina4::Localization.load(root_dir)
 
+      # Auto-wire t() into template globals if locales were loaded
+      autowire_i18n_template_global
+
       # Connect database if configured
       setup_database
 
@@ -412,6 +415,17 @@ module Tina4
       end
     end
 
+    def autowire_i18n_template_global
+      # Only register if translations were actually loaded
+      return if Tina4::Localization.translations.empty?
+
+      # Don't overwrite a user-registered t() global
+      return if Tina4::Template.globals.key?("t")
+
+      Tina4::Template.add_global("t", ->(key, **opts) { Tina4::Localization.t(key, **opts) })
+      Tina4::Log.debug("Auto-wired i18n t() as template global")
+    end
+
     def setup_database
       db_url = ENV["DATABASE_URL"] || ENV["DB_URL"]
       if db_url && !db_url.empty?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.10.92
+  version: 3.10.93
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-04-10 00:00:00.000000000 Z
+date: 2026-04-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack