tina4ruby 3.12.6 → 3.12.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f06595b833e1c285fbcadb4211e9a3ccbebda10bea925398a9c4f42e8efc243a
-  data.tar.gz: b6bf9dee3edcee5fb67bd566c64611f1f66e7543f672e4fe97e0ecdf014a247d
+  metadata.gz: 351a496d9e7573b3c2f9c45bb170612d3c9f553f787b937d1a402b0f351cb427
+  data.tar.gz: bec0461f253af01dbf747d346bda6d705eada5538fd36adb7741ae2d6a0fafd1
 SHA512:
-  metadata.gz: 9a853450a4e85d57a335e578cac344bc36d7af46c01e7593c4023ff05a87fcccf11a251950510d7ba821d4037f05c4d64372c67337323f580b7cc6e09e8baba5
-  data.tar.gz: ec476de6af1ec9b16a62263ccd97a2ce36942d729ec2d8b16ab449f64b39cc1926a9d0ba9271ef1ff4427aaf1a38db77273b95e0f28e3a03afbecd295c745d01
+  metadata.gz: a86b778c89cffba395091c7f1d5e7c9748ca6b95387b0748f4bef5f47d0c4c606f932f535ff0a6b5eef7de8e74970ba25b6c2b53a5d3bc63df3c3f29efae5020
+  data.tar.gz: 755890be8270b90bcbbc20d5fae1e76aad5e507346c6490196077143576268723736ed5f88e7ab6e10fc1391f59806dc25bcb18b5ca47730151e76c3b1946bab

data/lib/tina4/rack_app.rb

@@ -43,8 +43,18 @@ module Tina4
       path = env["PATH_INFO"] || "/"
       request_start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
 
-      # Fast-path: OPTIONS preflight
-      return Tina4::CorsMiddleware.preflight_response(env) if method == "OPTIONS"
+      # Fast-path: CORS preflight. Real CORS preflight requests carry an
+      # Origin header AND an Access-Control-Request-Method header — the
+      # browser is asking "may I send this method?" before the actual
+      # request. If neither is present, the OPTIONS is a plain protocol-
+      # introspection request (link checker, monitoring probe, RFC 9110
+      # §9.3.7 OPTIONS) and must fall through to the router's generic
+      # Allow-header response. Otherwise we'd shadow the framework's own
+      # OPTIONS support and force every operator to hand-register CORS
+      # exceptions for every introspection client.
+      if method == "OPTIONS" && (env["HTTP_ORIGIN"] || env["HTTP_ACCESS_CONTROL_REQUEST_METHOD"])
+        return Tina4::CorsMiddleware.preflight_response(env)
+      end
 
       # WebSocket upgrade — match against registered ws_routes
       if websocket_upgrade?(env)
@@ -87,8 +97,43 @@ module Tina4
         rack_response = handle_route(env, route, path_params)
         matched_pattern = route.path
       else
-        rack_response = handle_404(path)
-        matched_pattern = nil
+        # RFC 9110 conformance — before falling through to 404, check whether
+        # the PATH is known to the router under any OTHER method.
+        #   - OPTIONS request → 204 with Allow header (§9.3.7)
+        #   - Any other method (PUT on GET-only, TRACE, CONNECT, etc.)
+        #     → 405 with Allow header (§15.5.6 + §10.2.1)
+        allowed = Tina4::Router.methods_allowed_for_path(path)
+        if !allowed.empty?
+          allow_header = allowed.join(", ")
+          if method.to_s.upcase == "OPTIONS"
+            rack_response = [204, { "allow" => allow_header, "content-length" => "0" }, [""]]
+          else
+            body = %({"error":"Method Not Allowed","path":"#{path}","method":"#{method}","allow":[#{allowed.map { |m| %("#{m}") }.join(",")}],"status":405})
+            rack_response = [405, {
+              "allow" => allow_header,
+              "content-type" => "application/json",
+              "content-length" => body.bytesize.to_s
+            }, [body]]
+          end
+          matched_pattern = nil
+        else
+          rack_response = handle_404(path)
+          matched_pattern = nil
+        end
+      end
+
+      # RFC 9110 §9.3.2: a HEAD response MUST NOT include content. Strip
+      # the body unconditionally and record what Content-Length the GET
+      # would have sent. Cache validators / link checkers / monitoring
+      # probes use that header to estimate sizes.
+      if method.to_s.upcase == "HEAD"
+        status, headers, body_parts = rack_response
+        joined = body_parts.respond_to?(:join) ? body_parts.join : body_parts.to_s
+        unless joined.empty?
+          new_headers = headers.dup
+          new_headers["content-length"] = joined.bytesize.to_s
+          rack_response = [status, new_headers, [""]]
+        end
       end
 
       # Capture request for dev inspector

data/lib/tina4/router.rb

@@ -312,6 +312,25 @@ module Tina4
         add("ANY", path, block, middleware: middleware, swagger_meta: swagger_meta, template: template)
       end
 
+      # Register an explicit HEAD route. By default the framework auto-handles
+      # HEAD by falling back to the GET route and stripping the body
+      # (RFC 9110 §9.3.2). Use this only when you need a HEAD handler that
+      # does something different from GET — e.g. cheaper existence-check
+      # logic, custom validator headers without the cost of building the body.
+      # The framework still strips the response body for you on the way out.
+      def head(path, middleware: [], swagger_meta: {}, template: nil, &block)
+        add("HEAD", path, block, middleware: middleware, swagger_meta: swagger_meta, template: template)
+      end
+
+      # Register an explicit OPTIONS route. By default the framework auto-
+      # handles OPTIONS by building an Allow header from every method
+      # registered for the path and returning 204 (RFC 9110 §9.3.7). Use
+      # this to take over that behaviour — e.g. to return a richer OPTIONS
+      # payload describing the resource.
+      def options(path, middleware: [], swagger_meta: {}, template: nil, &block)
+        add("OPTIONS", path, block, middleware: middleware, swagger_meta: swagger_meta, template: template)
+      end
+
       def find_route(method, path)
         normalized_method = method.upcase
         # Normalize path once (not per-route)
@@ -325,9 +344,59 @@ module Tina4
           params = route.match_path(normalized_path)
           return [route, params] if params
         end
+
+        # RFC 9110 §9.3.2: HEAD is identical to GET except for the absence
+        # of a response body. If no explicit HEAD route matched, fall back
+        # to the GET route — the dispatcher strips the body on the way out
+        # so the handler doesn't need to know HEAD even happened.
+        if normalized_method == "HEAD"
+          (method_index["GET"] || []).each do |route|
+            params = route.match_path(normalized_path)
+            return [route, params] if params
+          end
+        end
+
         nil
       end
 
+      # Return the list of HTTP methods registered for ``path``, in the order
+      # GET / POST / PUT / PATCH / DELETE / HEAD / OPTIONS. Used by the
+      # dispatcher to build the ``Allow:`` header on 405 / OPTIONS responses
+      # (RFC 9110 §10.2.1, §9.3.7).
+      #
+      # If GET is registered for the path, HEAD is appended implicitly
+      # (HEAD auto-fallback). OPTIONS is appended whenever the path has any
+      # registered method (the framework auto-handles OPTIONS).
+      def methods_allowed_for_path(path)
+        normalized_path = path.gsub("\\", "/")
+        normalized_path = "/#{normalized_path}" unless normalized_path.start_with?("/")
+        normalized_path = normalized_path.chomp("/") unless normalized_path == "/"
+
+        method_order = %w[GET POST PUT PATCH DELETE HEAD OPTIONS]
+        seen = []
+        any_matched = false
+
+        method_index.each do |m, routes_for_method|
+          next if routes_for_method.empty?
+          matched = routes_for_method.any? { |r| r.match_path(normalized_path) }
+          next unless matched
+          if m == "ANY"
+            any_matched = true
+          elsif method_order.include?(m)
+            seen << m unless seen.include?(m)
+          end
+        end
+
+        seen = method_order.dup if any_matched
+
+        if !seen.empty?
+          seen << "HEAD" if seen.include?("GET") && !seen.include?("HEAD")
+          seen << "OPTIONS" unless seen.include?("OPTIONS")
+        end
+
+        method_order.select { |m| seen.include?(m) }
+      end
+
       # When TINA4_TRAILING_SLASH_REDIRECT is truthy, the rack app uses this
       # to detect whether the *original* (un-stripped) path differed from the
       # canonical form so it can issue a 301 redirect. Default false — silent

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.12.6"
+  VERSION = "3.12.8"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.12.6
+  version: 3.12.8
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-05-06 00:00:00.000000000 Z
+date: 2026-05-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack