tina4ruby 3.13.103 → 3.13.104

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6097dca4375329be7c8539cf9e40a8cde39fd9a6041169e58b9edf6bcbcf491a
-  data.tar.gz: 9d90b71f00d6a59a151a5a3108319aed79faccaac0858f40c3572825765f0acf
+  metadata.gz: b2e628488f2b0de1d7ec0d271cc07562ff66aa22c198adfea5fb2d9f61581987
+  data.tar.gz: 1416a35dac038e0a20befbec32f68d5e2cdd4d160ec440c1c18d40c38a3b2034
 SHA512:
-  metadata.gz: 74d5064e7aca1cffcdfd0389b6662a4f2d921ed18de43f8d9f0741bffa6a8ceb7d381af281b44b9e114237d7c783068c1adef1b709eb8c36efa017aa6eeb633e
-  data.tar.gz: 13fd4fa1ea1e667eee942d516cd48c14a2488e686ace7d9597d3affe368d2e7ad8e86772367b8d5ed5b3cc94b9a5631a41d62694abf055999ccbab30c9efad99
+  metadata.gz: 118eb151f7ceab9069f13f2e147a81c9e24468fb97d850acddb0054b15acd6e922369c59a83127a09e09605cf8460b0cc606268911325e63651bbda64c315b36
+  data.tar.gz: 6045f620f3e0b1a6f489cd9215b1c8d52dba5ea3eb4f6db15ee768963a763ac6deb51f84e1809ea10de660cd89ad035a8cca06779f3373796ebf455b324631a2

data/lib/tina4/field_types.rb

@@ -108,6 +108,11 @@ module Tina4
         register_field(name, :json, nullable: nullable, default: default)
       end
 
+      def point_field(name, srid: Tina4::Point::DEFAULT_SRID, spatial_index: true, nullable: true, default: nil)
+        register_field(name, :point, srid: Integer(srid), spatial_index: spatial_index,
+                       nullable: nullable, default: default)
+      end
+
       # Declare a foreign key integer column and auto-wire relationships.
       #
       # Automatically:
@@ -230,6 +235,13 @@ module Tina4
         # __setattr__ + object.__setattr__ default-seeding.
         attr_reader name
         define_method("#{name}=") do |value|
+          if type == :point && !value.nil?
+            point = Tina4::Point.parse(value, srid: options[:srid])
+            if point.srid != options[:srid]
+              raise ArgumentError, "Point field '#{name}' expects SRID #{options[:srid]}; received #{point.srid}"
+            end
+            value = point
+          end
           fields = (@assigned_fields ||= [])
           fields << name unless fields.include?(name)
           instance_variable_set("@#{name}", value)

data/lib/tina4/orm.rb

@@ -245,7 +245,7 @@ module Tina4
       #
       # @return [Tina4::QueryBuilder]
       def query
-        QueryBuilder.from_table(table_name, db: db)
+        QueryBuilder.from_table(table_name, db: db, primary_key: get_db_column(primary_key_field || :id))
       end
 
       def find(id_or_filter = nil, filter = nil, **kwargs)
@@ -529,7 +529,7 @@ module Tina4
       end
 
       def create_table
-        return true if db.table_exists?(table_name)
+        return create_spatial_indexes if db.table_exists?(table_name)
 
         # v3.13.16: engine-aware DDL. Ruby used to emit SQLite-only DDL on
         # every driver — INTEGER for booleans, DATETIME for datetimes, and a
@@ -594,12 +594,17 @@ module Tina4
           datetime: datetime_sql,
           timestamp: "TIMESTAMP",
           blob: "BLOB",
-          json: json_sql
+          json: json_sql,
+          point: nil
         }
 
         col_defs = []
         field_definitions.each do |name, opts|
-          sql_type = type_map[opts[:type]] || "TEXT"
+          sql_type = if opts[:type] == :point
+                       SQLTranslator.point_column_type(engine, opts[:srid] || Point::DEFAULT_SRID)
+                     else
+                       type_map[opts[:type]] || "TEXT"
+                     end
           if opts[:type] == :string && opts[:length]
             sql_type = "VARCHAR(#{opts[:length]})"
           elsif opts[:type] == :decimal
@@ -687,13 +692,35 @@ module Tina4
             # ONE case is benign - re-raise anything else.
             raise ce unless ce.message.to_s =~ /no corresponding begin/i
           end
-          true
+          create_spatial_indexes
+        rescue SpatialNotSupportedError
+          raise
         rescue => e
           Tina4::Log.error("create_table failed for #{table_name}: #{db.get_error || e.message}", { sql: sql })
           false
         end
       end
 
+      def create_spatial_indexes
+        fields = field_definitions.select { |_name, opts| opts[:type] == :point }
+        return true if fields.empty?
+        engine = db.get_database_type.to_s.downcase
+        begin
+          fields.each do |name, opts|
+            SQLTranslator.point_column_type(engine, opts[:srid] || Point::DEFAULT_SRID)
+            next unless opts.fetch(:spatial_index, true)
+            db.execute(SQLTranslator.spatial_index(engine, table_name, get_db_column(name)))
+          end
+          db.commit
+          true
+        rescue SpatialNotSupportedError
+          raise
+        rescue => e
+          Tina4::Log.error("spatial index creation failed for #{table_name}: #{e.message}")
+          false
+        end
+      end
+
       def scope(name, filter_sql, params = [])
         define_singleton_method(name) do |limit: 100, offset: 0|
           where(filter_sql, params, limit: limit, offset: offset)
@@ -721,6 +748,9 @@ module Tina4
               # leave the raw string in place
             end
           end
+          if fdef && fdef[:type] == :point && !value.nil?
+            value = Point.parse(value, srid: fdef[:srid] || Point::DEFAULT_SRID)
+          end
           setter = "#{attr_name}="
           instance.__send__(setter, value) if instance.respond_to?(setter)
         end
@@ -857,6 +887,12 @@ module Tina4
           # a.meta must not leak into b.meta). Parity with the Python master,
           # which deepcopies a JSONField's dict/list default per instance.
           d = Marshal.load(Marshal.dump(d)) if d.is_a?(Hash) || d.is_a?(Array)
+          if opts[:type] == :point && !d.nil?
+            d = Point.parse(d, srid: opts[:srid] || Point::DEFAULT_SRID)
+            if d.srid != (opts[:srid] || Point::DEFAULT_SRID)
+              raise ArgumentError, "Point field '#{name}' expects SRID #{opts[:srid] || Point::DEFAULT_SRID}; received #{d.srid}"
+            end
+          end
           # #165: seed the default straight into the ivar, BYPASSING the
           # tracking setter, so a default is not recorded as a caller
           # assignment (mirrors the Python master's object.__setattr__).
@@ -1283,7 +1319,8 @@ module Tina4
       key_case = binding.local_variable_get(:case)  # :case is a reserved word
       hash = {}
       self.class.field_definitions.each_key do |name|
-        hash[name] = __send__(name)
+        value = __send__(name)
+        hash[name] = value.is_a?(Point) ? value.geojson : value
       end
 
       if include
@@ -1321,6 +1358,19 @@ module Tina4
       hash
     end
 
+    def to_feature(geometry_field: nil, include: nil)
+      point_fields = self.class.field_definitions.select { |_name, opts| opts[:type] == :point }.keys
+      geometry_field = (geometry_field || point_fields.first)&.to_sym
+      raise ArgumentError, "to_feature needs a declared point_field" unless geometry_field && point_fields.include?(geometry_field)
+      properties = to_h(include: include)
+      geometry = properties.delete(geometry_field)
+      { type: "Feature", geometry: geometry, properties: properties }
+    end
+
+    def self.feature_collection(models, geometry_field: nil, include: nil)
+      { type: "FeatureCollection", features: models.map { |model| model.to_feature(geometry_field: geometry_field, include: include) } }
+    end
+
     alias to_hash to_h
     alias to_dict to_h
     alias to_object to_h
@@ -1377,6 +1427,7 @@ module Tina4
         if opts[:type] == :json && !value.nil? && !value.is_a?(String)
           value = JSON.generate(value)
         end
+        value = value.ewkt if opts[:type] == :point && value.is_a?(Point)
         db_col = mapping[name.to_s] || name
         hash[db_col.to_sym] = value
       end
@@ -1400,6 +1451,7 @@ module Tina4
         if opts[:type] == :json && !value.nil? && !value.is_a?(String)
           value = JSON.generate(value)
         end
+        value = value.ewkt if opts[:type] == :point && value.is_a?(Point)
         db_col = mapping[name.to_s] || name
         hash[db_col.to_sym] = value
       end

data/lib/tina4/point.rb

@@ -0,0 +1,106 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Tina4
+  class SpatialNotSupportedError < StandardError; end
+
+  # Immutable SRID-aware longitude/latitude point (ADR-0057).
+  class Point
+    DEFAULT_SRID = 4326
+    EWKB_SRID = 0x20000000
+    EWKB_M = 0x40000000
+    EWKB_Z = 0x80000000
+
+    attr_reader :lon, :lat, :srid
+
+    def initialize(lon, lat, srid: DEFAULT_SRID)
+      raise ArgumentError, "Point longitude and latitude must be numbers" if lon == true || lon == false || lat == true || lat == false
+      @lon = Float(lon)
+      @lat = Float(lat)
+      @srid = Integer(srid)
+      raise ArgumentError, "Point longitude and latitude must be finite" unless @lon.finite? && @lat.finite?
+      if @srid == DEFAULT_SRID
+        raise ArgumentError, "Point longitude #{@lon} is outside -180..180; Tina4 uses longitude, latitude order" unless (-180.0..180.0).cover?(@lon)
+        raise ArgumentError, "Point latitude #{@lat} is outside -90..90; Tina4 uses longitude, latitude order" unless (-90.0..90.0).cover?(@lat)
+      end
+      freeze
+    rescue TypeError, ArgumentError => e
+      raise e if e.message.start_with?("Point ")
+      raise ArgumentError, "Point longitude, latitude and SRID must be numeric"
+    end
+
+    def wkt = "POINT(#{format_coordinate(@lon)} #{format_coordinate(@lat)})"
+    def ewkt = "SRID=#{@srid};#{wkt}"
+    def geojson = { type: "Point", coordinates: [@lon, @lat] }
+    def to_h = geojson
+    def to_a = [@lon, @lat]
+    def to_json(*args) = geojson.to_json(*args)
+
+    def self.parse(value, srid: DEFAULT_SRID)
+      return value if value.is_a?(Point)
+      if value.is_a?(Array)
+        raise ArgumentError, "Point coordinate pair needs longitude and latitude" if value.length < 2
+        return new(value[0], value[1], srid: srid)
+      end
+      return from_geojson(value, srid) if value.is_a?(Hash)
+      if value.is_a?(String)
+        text = value.strip
+        match = text.match(/\A(?:SRID\s*=\s*(\d+)\s*;\s*)?POINT\s*(?:Z|M|ZM)?\s*\(\s*([-+0-9.eE]+)\s+([-+0-9.eE]+)(?:\s+[-+0-9.eE]+)*\s*\)\z/i)
+        return new(match[2], match[3], srid: match[1] ? match[1].to_i : srid) if match
+        raw = [text].pack("H*") if text.length >= 42 && text.length.even? && text.match?(/\A[0-9a-f]+\z/i)
+        raw ||= value.b if [0, 1].include?(value.getbyte(0))
+        return from_wkb(raw, srid) if raw
+      end
+      raise ArgumentError, "Point must be Point, [longitude, latitude], WKT/EWKT, GeoJSON or WKB/EWKB"
+    end
+
+    def self.geometry_binding(value, srid: DEFAULT_SRID)
+      return [parse(value, srid: srid).ewkt, :ewkt] if value.is_a?(Point) || value.is_a?(Array)
+      if value.is_a?(Hash)
+        geometry = value.fetch(:type, value["type"]).to_s.downcase == "feature" ? (value[:geometry] || value["geometry"]) : value
+        type = (geometry[:type] || geometry["type"]).to_s.downcase
+        allowed = %w[point linestring polygon multipoint multilinestring multipolygon geometrycollection]
+        raise ArgumentError, "GeoJSON geometry has an unsupported type" unless allowed.include?(type)
+        return [JSON.generate(geometry), :geojson]
+      end
+      if value.is_a?(String) && value.match?(/\A\s*(?:SRID\s*=\s*\d+\s*;\s*)?(?:POINT|LINESTRING|POLYGON|MULTIPOINT|MULTILINESTRING|MULTIPOLYGON|GEOMETRYCOLLECTION)\b/i)
+        return [value.match?(/\A\s*SRID/i) ? value.strip : "SRID=#{srid};#{value.strip}", :ewkt]
+      end
+      raise ArgumentError, "Geometry must be Point, coordinate pair, WKT/EWKT or GeoJSON"
+    end
+
+    def self.from_geojson(data, srid)
+      type = (data[:type] || data["type"]).to_s.downcase
+      geometry = type == "feature" ? (data[:geometry] || data["geometry"] || {}) : data
+      raise ArgumentError, "Point GeoJSON type must be Point" unless (geometry[:type] || geometry["type"]).to_s.downcase == "point"
+      coordinates = geometry[:coordinates] || geometry["coordinates"]
+      raise ArgumentError, "Point GeoJSON coordinates must be [longitude, latitude]" unless coordinates.is_a?(Array) && coordinates.length >= 2
+      new(coordinates[0], coordinates[1], srid: srid)
+    end
+    private_class_method :from_geojson
+
+    def self.from_wkb(raw, srid)
+      raise ArgumentError, "Point WKB is too short" if raw.bytesize < 21
+      little = raw.getbyte(0) == 1
+      type_word = raw.byteslice(1, 4).unpack1(little ? "V" : "N")
+      offset = 5
+      if (type_word & EWKB_SRID) != 0
+        srid = raw.byteslice(5, 4).unpack1(little ? "V" : "N")
+        offset = 9
+      end
+      code = (type_word & ~(EWKB_SRID | EWKB_Z | EWKB_M)) % 1000
+      raise ArgumentError, "WKB geometry is not a Point" unless code == 1 && raw.bytesize >= offset + 16
+      lon, lat = raw.byteslice(offset, 16).unpack(little ? "E2" : "G2")
+      new(lon, lat, srid: srid)
+    end
+    private_class_method :from_wkb
+
+    private
+
+    def format_coordinate(value)
+      text = format("%.15g", value)
+      text == "-0" ? "0" : text
+    end
+  end
+end

data/lib/tina4/query_builder.rb

@@ -19,10 +19,11 @@ module Tina4
   #     .get
   #
   class QueryBuilder
-    def initialize(table, db: nil)
+    def initialize(table, db: nil, primary_key: nil)
       @table = table
       @db = db
       @columns = ["*"]
+      @select_params = []
       @wheres = []
       @params = []
       @joins = []
@@ -30,6 +31,8 @@ module Tina4
       @havings = []
       @having_params = []
       @order_by_cols = []
+      @order_by_params = []
+      @primary_key = primary_key&.to_s
       @limit_val = nil
       @offset_val = nil
     end
@@ -39,8 +42,8 @@ module Tina4
     # @param table_name [String] The database table name.
     # @param db [Object, nil] Optional database connection.
     # @return [QueryBuilder]
-    def self.from_table(table_name, db: nil)
-      new(table_name, db: db)
+    def self.from_table(table_name, db: nil, primary_key: nil)
+      new(table_name, db: db, primary_key: primary_key)
     end
 
     # Set the columns to select.
@@ -48,7 +51,10 @@ module Tina4
     # @param columns [Array<String>] Column names.
     # @return [self]
     def select(*columns)
-      @columns = columns unless columns.empty?
+      unless columns.empty?
+        @columns = columns
+        @select_params = []
+      end
       self
     end
 
@@ -123,6 +129,46 @@ module Tina4
       self
     end
 
+    def within_distance(column, point, radius_metres, srid: Point::DEFAULT_SRID)
+      radius = Float(radius_metres)
+      raise ArgumentError, "Spatial radius must be finite and greater than or equal to zero" unless radius.finite? && radius >= 0
+      point = Point.parse(point, srid: srid)
+      where(SQLTranslator.within_distance(engine, column, point.srid), [point.lon, point.lat, radius])
+    end
+
+    def intersects(column, geometry, srid: Point::DEFAULT_SRID)
+      bound, form = Point.geometry_binding(geometry, srid: srid)
+      where(SQLTranslator.intersects(engine, column, form, srid), [bound])
+    end
+
+    def bbox(column, min_lon, min_lat, max_lon, max_lat, srid: Point::DEFAULT_SRID)
+      values = [min_lon, min_lat, max_lon, max_lat].map { |value| Float(value) }
+      raise ArgumentError, "Bounding-box coordinates must be finite" unless values.all?(&:finite?)
+      west, south, east, north = values
+      Point.new(west, south, srid: srid)
+      Point.new(east, north, srid: srid)
+      raise ArgumentError, "Bounding box must be ordered west, south, east, north" if west > east || south > north
+      where(SQLTranslator.bbox(engine, column, srid), values)
+    end
+
+    def select_distance(column, point, alias_name: "distance", srid: Point::DEFAULT_SRID)
+      point = Point.parse(point, srid: srid)
+      @columns << SQLTranslator.distance_as(engine, column, alias_name, point.srid)
+      @select_params.concat([point.lon, point.lat])
+      self
+    end
+
+    def order_by_distance(column, point, direction: "ASC", srid: Point::DEFAULT_SRID)
+      direction = direction.to_s.upcase
+      raise ArgumentError, "Distance order direction must be ASC or DESC" unless %w[ASC DESC].include?(direction)
+      raise ArgumentError, "Stable spatial ordering needs a primary key; use ORM.query or pass primary_key:" if @primary_key.to_s.empty?
+      point = Point.parse(point, srid: srid)
+      @order_by_cols << "#{SQLTranslator.distance(engine, column, point.srid)} #{direction}"
+      @order_by_params.concat([point.lon, point.lat])
+      @order_by_cols << "#{SQLTranslator.spatial_identifier(@primary_key, 'primary key')} ASC"
+      self
+    end
+
     # Set LIMIT and optional OFFSET.
     #
     # @param count [Integer] Maximum rows to return.
@@ -167,7 +213,7 @@ module Tina4
     def get
       ensure_db!
       sql = to_sql
-      all_params = @params + @having_params
+      all_params = @select_params + @params + @having_params + @order_by_params
 
       @db.fetch(
         sql,
@@ -183,7 +229,7 @@ module Tina4
     def first
       ensure_db!
       sql = to_sql
-      all_params = @params + @having_params
+      all_params = @select_params + @params + @having_params + @order_by_params
 
       @db.fetch_one(sql, all_params.empty? ? [] : all_params)
     end
@@ -196,9 +242,18 @@ module Tina4
 
       # Build a count query by replacing columns
       original = @columns
+      original_select_params = @select_params
+      original_order = @order_by_cols
+      original_order_params = @order_by_params
       @columns = ["COUNT(*) as cnt"]
+      @select_params = []
+      @order_by_cols = []
+      @order_by_params = []
       sql = to_sql
       @columns = original
+      @select_params = original_select_params
+      @order_by_cols = original_order
+      @order_by_params = original_order_params
 
       all_params = @params + @having_params
 
@@ -272,6 +327,11 @@ module Tina4
 
     private
 
+    def engine
+      ensure_db!
+      @db.get_database_type
+    end
+
     # Parse a single SQL condition into a MongoDB filter hash.
     #
     # @return [Array(Hash, Integer)] [mongo_condition, updated_param_index]

data/lib/tina4/rack_app.rb

@@ -1174,6 +1174,12 @@ module Tina4
         # the auth gate into a 500. It degrades to an empty session, which means
         # no token, which means the ordinary 401 below - a SERVED request.
         session = Tina4::Session.new(env, degrade_on_backend_failure: true)
+        sso = session.get("_tina4_sso")
+        identity = sso.is_a?(Hash) ? sso["identity"] : nil
+        if identity.is_a?(Hash) && identity["issuer"] && identity["subject"]
+          env["tina4.auth_payload"] = identity
+          return nil
+        end
         session_token = session.get("token")
         if session_token && !session_token.empty?
           token = session_token

data/lib/tina4/session.rb

@@ -237,7 +237,7 @@ module Tina4
 
     # Return all session data
     def all
-      @data.dup
+      @data.reject { |key, _| %w[_tina4_sso _tina4_sso_pending].include?(key.to_s) }
     end
 
     # Flash data: set a value that is removed after next read.

data/lib/tina4/sql_translator.rb

@@ -16,7 +16,70 @@ module Tina4
   #   # => "SELECT * FROM users ROWS 6 TO 15"
   #
   class SQLTranslator
+    SPATIAL_ENGINES = %w[postgres postgresql].freeze
+    SPATIAL_IDENTIFIER = /\A[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*\z/
+
     class << self
+      def require_spatial(engine, feature)
+        name = engine.to_s.downcase
+        return name if SPATIAL_ENGINES.include?(name)
+        raise SpatialNotSupportedError,
+              "#{feature} is not supported on the '#{name.empty? ? 'unknown' : name}' database engine. " \
+              "Tina4 GIS support is PostGIS-first: use PostgreSQL with CREATE EXTENSION postgis. " \
+              "Tina4 will not replace a spatial query with an approximate coordinate query."
+      end
+
+      def spatial_identifier(name, what = "column")
+        text = name.to_s
+        raise ArgumentError, "Spatial #{what} is not a valid SQL identifier: #{text}" unless SPATIAL_IDENTIFIER.match?(text)
+        text
+      end
+
+      def point_column_type(engine, srid = Point::DEFAULT_SRID)
+        require_spatial(engine, "PointField")
+        "geography(Point,#{Integer(srid)})"
+      end
+
+      def spatial_index(engine, table, column)
+        require_spatial(engine, "spatial index creation")
+        table = spatial_identifier(table, "table")
+        column = spatial_identifier(column)
+        "CREATE INDEX IF NOT EXISTS #{table.tr('.', '_')}_#{column}_gist ON #{table} USING GIST (#{column})"
+      end
+
+      def point_literal(engine, srid = Point::DEFAULT_SRID)
+        require_spatial(engine, "spatial predicates")
+        "ST_SetSRID(ST_MakePoint(?, ?), #{Integer(srid)})::geography"
+      end
+
+      def within_distance(engine, column, srid = Point::DEFAULT_SRID)
+        "ST_DWithin(#{spatial_identifier(column)}, #{point_literal(engine, srid)}, ?)"
+      end
+
+      def distance(engine, column, srid = Point::DEFAULT_SRID)
+        "ST_Distance(#{spatial_identifier(column)}, #{point_literal(engine, srid)})"
+      end
+
+      def distance_as(engine, column, alias_name, srid = Point::DEFAULT_SRID)
+        "#{distance(engine, column, srid)} AS #{spatial_identifier(alias_name, 'result alias')}"
+      end
+
+      def geometry_literal(engine, form = :ewkt, srid = Point::DEFAULT_SRID)
+        require_spatial(engine, "spatial predicates")
+        return "ST_GeogFromText(?)" if form.to_sym == :ewkt
+        return "ST_SetSRID(ST_GeomFromGeoJSON(?), #{Integer(srid)})::geography" if form.to_sym == :geojson
+        raise ArgumentError, "Unsupported spatial geometry form: #{form}"
+      end
+
+      def intersects(engine, column, form = :ewkt, srid = Point::DEFAULT_SRID)
+        "ST_Intersects(#{spatial_identifier(column)}, #{geometry_literal(engine, form, srid)})"
+      end
+
+      def bbox(engine, column, srid = Point::DEFAULT_SRID)
+        require_spatial(engine, "bbox")
+        "ST_Intersects(#{spatial_identifier(column)}, ST_MakeEnvelope(?, ?, ?, ?, #{Integer(srid)})::geography)"
+      end
+
       # ── Literal-safe rewriting ────────────────────────────────────
       #
       # A dialect rewrite (|| -> CONCAT, TRUE -> 1, ILIKE -> LOWER LIKE) must NEVER

data/lib/tina4/sso.rb

@@ -0,0 +1,284 @@
+# frozen_string_literal: true
+
+require "base64"
+require "digest"
+require "json"
+require "net/http"
+require "openssl"
+require "securerandom"
+require "uri"
+
+module Tina4
+  class SsoError < StandardError; end
+
+  # Provider-neutral, configuration-first OpenID Connect SSO.
+  class Sso
+    PENDING_KEY = "_tina4_sso_pending"
+    SESSION_KEY = "_tina4_sso"
+    attr_reader :issuer, :client_id, :client_secret, :redirect_uri, :scopes,
+                :verify, :post_logout_redirect_uri, :claim_map
+    @mounted = false
+
+    def initialize(options = {})
+      @issuer = (options[:issuer] || ENV["TINA4_SSO_ISSUER"] || "").sub(%r{/$}, "")
+      @client_id = options[:client_id] || ENV["TINA4_SSO_CLIENT_ID"] || ""
+      @client_secret = options.key?(:client_secret) ? options[:client_secret] : ENV["TINA4_SSO_CLIENT_SECRET"]
+      @redirect_uri = options[:redirect_uri] || ENV["TINA4_SSO_REDIRECT_URI"] || ""
+      @scopes = options[:scopes] || json_env("TINA4_SSO_SCOPES", %w[openid profile email])
+      @verify = (options[:verify] || ENV["TINA4_SSO_VERIFY"] || "introspection").downcase
+      @post_logout_redirect_uri = options[:post_logout_redirect_uri] || ENV["TINA4_SSO_POST_LOGOUT_REDIRECT_URI"]
+      @claim_map = options[:claim_map] || json_env("TINA4_SSO_CLAIM_MAP", {})
+      @metadata = {}
+      validate_config!
+    end
+
+    def self.from_issuer(options = {})
+      new(options).tap(&:discover)
+    end
+
+    def self.configured?
+      %w[TINA4_SSO_ISSUER TINA4_SSO_CLIENT_ID TINA4_SSO_REDIRECT_URI].all? { |key| !ENV[key].to_s.empty? }
+    end
+
+    def json_env(name, fallback)
+      raw = ENV[name]
+      raw.nil? || raw.empty? ? fallback : JSON.parse(raw)
+    rescue JSON::ParserError => e
+      raise SsoError, "#{name} must be valid JSON", cause: e
+    end
+
+    def self.secure_url!(value, name)
+      uri = URI.parse(value)
+      raise SsoError, "#{name} must be an absolute URL" unless uri.absolute? && uri.host
+
+      loopback = %w[localhost 127.0.0.1 ::1].include?(uri.host)
+      raise SsoError, "#{name} must use HTTPS except on loopback" unless uri.scheme == "https" || (uri.scheme == "http" && loopback)
+    rescue URI::InvalidURIError => e
+      raise SsoError, "#{name} must be an absolute URL", cause: e
+    end
+
+    def validate_config!
+      if @issuer.empty? || @client_id.empty? || @redirect_uri.empty?
+        raise SsoError, "TINA4_SSO_ISSUER, TINA4_SSO_CLIENT_ID and TINA4_SSO_REDIRECT_URI are required"
+      end
+      self.class.secure_url!(@issuer, "issuer")
+      self.class.secure_url!(@redirect_uri, "redirect URI")
+      raise SsoError, "TINA4_SSO_VERIFY must be introspection or jwks" unless %w[introspection jwks].include?(@verify)
+      raise SsoError, "jwks verification requires an installed cryptography capability" if @verify == "jwks"
+      raise SsoError, "introspection verification requires TINA4_SSO_CLIENT_SECRET" if @verify == "introspection" && @client_secret.to_s.empty?
+      raise SsoError, "TINA4_SSO_SCOPES must be a list containing openid" unless @scopes.is_a?(Array) && @scopes.include?("openid")
+    end
+
+    def request_json(url, form: nil, bearer: nil, basic: false)
+      uri = URI.parse(url)
+      request = form ? Net::HTTP::Post.new(uri) : Net::HTTP::Get.new(uri)
+      request["Accept"] = "application/json"
+      request.set_form_data(form.transform_values(&:to_s)) if form
+      request["Authorization"] = "Bearer #{bearer}" if bearer
+      request.basic_auth(@client_id, @client_secret) if basic
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.verify_mode = OpenSSL::SSL::VERIFY_PEER if http.use_ssl?
+      http.open_timeout = 10
+      http.read_timeout = 10
+      response = http.request(request)
+      raise SsoError, "OIDC provider request failed" unless response.is_a?(Net::HTTPSuccess)
+      result = JSON.parse(response.body)
+      raise SsoError, "OIDC provider returned a non-object response" unless result.is_a?(Hash)
+      result
+    rescue JSON::ParserError, IOError, SystemCallError, Timeout::Error => e
+      raise SsoError, "OIDC provider request failed", cause: e
+    end
+
+    def discover(force = false)
+      return @metadata.dup unless @metadata.empty? || force
+      result = request_json("#{@issuer}/.well-known/openid-configuration")
+      raise SsoError, "OIDC discovery issuer does not exactly match configuration" unless result["issuer"] == @issuer
+      required = %w[authorization_endpoint token_endpoint]
+      required << "introspection_endpoint" if @verify == "introspection"
+      required.each do |key|
+        raise SsoError, "OIDC discovery is missing #{key}" if result[key].to_s.empty?
+        self.class.secure_url!(result[key], key)
+      end
+      @metadata = result
+      result.dup
+    end
+
+    def self.safe_return(value)
+      return "/" if value.to_s.empty? || !value.start_with?("/") || value.start_with?("//") || value.include?("\\")
+      value.each_byte.any? { |byte| byte < 32 } ? "/" : value
+    end
+
+    def session(value)
+      value.is_a?(Tina4::Session) ? value : value&.session
+    end
+
+    def login(request_or_session, return_to = "/")
+      current = session(request_or_session)
+      raise SsoError, "SSO login requires a Tina4 Session" unless current
+      state = SecureRandom.urlsafe_base64(32)
+      nonce = SecureRandom.urlsafe_base64(32)
+      verifier = SecureRandom.urlsafe_base64(64)
+      challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
+      current.set(PENDING_KEY, {
+                    "state" => state, "nonce" => nonce, "verifier" => verifier,
+                    "return_to" => self.class.safe_return(return_to), "created_at" => Time.now.to_i
+                  })
+      query = URI.encode_www_form(
+        client_id: @client_id, redirect_uri: @redirect_uri, response_type: "code",
+        scope: @scopes.join(" "), state: state, nonce: nonce,
+        code_challenge: challenge, code_challenge_method: "S256"
+      )
+      "#{discover['authorization_endpoint']}?#{query}"
+    end
+
+    def self.secure_equal(left, right)
+      a = left.to_s
+      b = right.to_s
+      a.bytesize == b.bytesize && OpenSSL.fixed_length_secure_compare(a, b)
+    end
+
+    def self.jwt_payload(token)
+      part = token.split(".")[1].to_s
+      JSON.parse(Base64.urlsafe_decode64(part.ljust((part.length + 3) / 4 * 4, "=")))
+    rescue JSON::ParserError, ArgumentError
+      raise SsoError, "provider returned an invalid ID token"
+    end
+
+    def introspect(access_token)
+      result = request_json(discover["introspection_endpoint"],
+                            form: { token: access_token, token_type_hint: "access_token" }, basic: true)
+      unless result["active"] == true && result["iss"] == @issuer
+        raise SsoError, "OIDC access token is inactive or has the wrong issuer"
+      end
+      audience = result["aud"] || result["client_id"]
+      valid = audience.is_a?(Array) ? audience.include?(@client_id) : audience == @client_id
+      valid ||= result["client_id"] == @client_id
+      raise SsoError, "OIDC token audience mismatch" unless valid
+      result
+    end
+
+    def claim(claims, configured, fallback)
+      (configured || fallback).split(".").reduce(claims) { |value, key| value.is_a?(Hash) ? value[key] : nil }
+    end
+
+    def normalize(claims)
+      subject = claim(claims, @claim_map["subject"], "sub")
+      identity_issuer = claim(claims, @claim_map["issuer"], "iss") || @issuer
+      raise SsoError, "OIDC identity is missing a valid issuer or subject" if subject.to_s.empty? || identity_issuer != @issuer
+      roles = Array(claim(claims, @claim_map["roles"], "realm_access.roles"))
+      roles += Array(claims.dig("resource_access", @client_id, "roles"))
+      groups = Array(claim(claims, @claim_map["groups"], "groups"))
+      {
+        "issuer" => identity_issuer, "subject" => subject,
+        "username" => claim(claims, @claim_map["username"], "preferred_username"),
+        "email" => claim(claims, @claim_map["email"], "email"),
+        "name" => claim(claims, @claim_map["name"], "name"),
+        "roles" => roles.map(&:to_s).uniq.sort, "groups" => groups.map(&:to_s).uniq.sort
+      }
+    end
+
+    def callback(request_or_session, query = nil)
+      current = session(request_or_session)
+      values = query || request_or_session.params
+      pending = current&.get(PENDING_KEY)
+      current&.delete(PENDING_KEY)
+      unless pending.is_a?(Hash) && !values["code"].to_s.empty? && self.class.secure_equal(values["state"], pending["state"])
+        raise SsoError, "OIDC callback state is invalid or already consumed"
+      end
+      raise SsoError, "OIDC callback state has expired" if Time.now.to_i - pending.fetch("created_at", 0).to_i > 600
+      metadata = discover
+      tokens = request_json(metadata["token_endpoint"], form: {
+                              grant_type: "authorization_code", code: values["code"], redirect_uri: @redirect_uri,
+                              client_id: @client_id, code_verifier: pending["verifier"]
+                            }, basic: !@client_secret.to_s.empty?)
+      raise SsoError, "OIDC token response is incomplete" if tokens["access_token"].to_s.empty? || tokens["id_token"].to_s.empty?
+      raise SsoError, "JWKS verification requires an installed cryptography capability" if @verify == "jwks"
+      claims = introspect(tokens["access_token"])
+      unless self.class.secure_equal(self.class.jwt_payload(tokens["id_token"])["nonce"], pending["nonce"])
+        raise SsoError, "OIDC ID token nonce mismatch"
+      end
+      claims.merge!(request_json(metadata["userinfo_endpoint"], bearer: tokens["access_token"])) if metadata["userinfo_endpoint"]
+      identity = normalize(claims)
+      current.regenerate
+      current.set(SESSION_KEY, {
+                    "version" => 1, "identity" => identity, "access_token" => tokens["access_token"],
+                    "refresh_token" => tokens["refresh_token"], "id_token" => tokens["id_token"],
+                    "expires_at" => Time.now.to_i + tokens.fetch("expires_in", 0).to_i
+                  })
+      { "identity" => identity, "return_to" => self.class.safe_return(pending["return_to"]) }
+    end
+
+    def identity(request_or_session)
+      stored = session(request_or_session)&.get(SESSION_KEY)
+      value = stored.is_a?(Hash) ? stored["identity"] : nil
+      request_or_session.user = value if value && !request_or_session.is_a?(Tina4::Session)
+      value
+    end
+
+    def refresh(request_or_session)
+      current = session(request_or_session)
+      stored = current&.get(SESSION_KEY)
+      unless stored.is_a?(Hash) && !stored["refresh_token"].to_s.empty?
+        current&.delete(SESSION_KEY)
+        raise SsoError, "OIDC session cannot be refreshed"
+      end
+      metadata = discover
+      tokens = request_json(metadata["token_endpoint"], form: {
+                              grant_type: "refresh_token", refresh_token: stored["refresh_token"], client_id: @client_id
+                            }, basic: !@client_secret.to_s.empty?)
+      claims = introspect(tokens["access_token"])
+      claims.merge!(request_json(metadata["userinfo_endpoint"], bearer: tokens["access_token"])) if metadata["userinfo_endpoint"]
+      value = normalize(claims)
+      current.set(SESSION_KEY, stored.merge(
+        "identity" => value, "access_token" => tokens["access_token"],
+        "refresh_token" => tokens["refresh_token"] || stored["refresh_token"],
+        "id_token" => tokens["id_token"] || stored["id_token"],
+        "expires_at" => Time.now.to_i + tokens.fetch("expires_in", 0).to_i
+      ))
+      value
+    rescue StandardError
+      current&.delete(SESSION_KEY)
+      raise
+    end
+
+    def logout(request_or_session, return_to = "/")
+      current = session(request_or_session)
+      stored = current&.get(SESSION_KEY)
+      current&.destroy
+      endpoint = discover["end_session_endpoint"]
+      target = @post_logout_redirect_uri || self.class.safe_return(return_to)
+      return target unless endpoint
+      params = { post_logout_redirect_uri: target, client_id: @client_id }
+      params[:id_token_hint] = stored["id_token"] if stored.is_a?(Hash) && stored["id_token"]
+      "#{endpoint}?#{URI.encode_www_form(params)}"
+    end
+
+    def self.mount_configured
+      return false if @mounted || !configured?
+      owned = [["GET", "/auth/login"], ["GET", "/auth/callback"], ["POST", "/auth/logout"]]
+      collisions = Tina4::Router.routes.select { |route| owned.include?([route.method, route.path]) }
+      unless collisions.empty?
+        raise SsoError, "SSO route collision: #{collisions.map { |route| "#{route.method} #{route.path}" }.join(', ')}"
+      end
+      sso = from_issuer
+      Tina4::Router.get("/auth/login") do |request, response|
+        response.redirect(sso.login(request, request.params["return_to"] || "/"))
+      end
+      Tina4::Router.get("/auth/callback") do |request, response|
+        begin
+          response.redirect(sso.callback(request)["return_to"])
+        rescue SsoError => e
+          response.json({ error: "SSO_CALLBACK_FAILED", message: e.message }, 400)
+        end
+      end
+      Tina4::Router.post("/auth/logout") do |request, response|
+        response.redirect(sso.logout(request, request.params["return_to"] || "/"))
+      end
+      @mounted = true
+      true
+    end
+  end
+
+  SSO = Sso
+end

data/lib/tina4/swagger.rb

@@ -161,6 +161,17 @@ module Tina4
           }
         end
 
+        sso_issuer = ENV["TINA4_SSO_ISSUER"].to_s.sub(%r{/$}, "")
+        unless sso_issuer.empty?
+          schemes["oidc"] = {
+            "type" => "openIdConnect",
+            "openIdConnectUrl" => "#{sso_issuer}/.well-known/openid-configuration"
+          }
+          schemes["ssoSession"] = {
+            "type" => "apiKey", "in" => "cookie", "name" => "tina4_session"
+          }
+        end
+
         # Registered schemes win (let an app override bearerAuth or add oauth2).
         @registered_schemes.each { |name, defn| schemes[name] = defn }
         schemes
@@ -302,7 +313,11 @@ module Tina4
         #
         # Both flags are honoured. A custom auth_handler protects a route even
         # when auth_required is false for its method, so it is still documented.
-        return sanitize_security([{ default_scheme => [] }], schemes) if route.auth_required || route.auth_handler
+        if route.auth_required || route.auth_handler
+          requirements = [{ default_scheme => [] }]
+          requirements << { "ssoSession" => [] } if default_scheme == "bearerAuth" && schemes.key?("ssoSession")
+          return sanitize_security(requirements, schemes)
+        end
 
         nil
       end

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.103"
+  VERSION = "3.13.104"
 end

data/lib/tina4.rb

@@ -15,6 +15,7 @@ require_relative "tina4/database_adapter"
 require_relative "tina4/database_url"
 require_relative "tina4/database"
 require_relative "tina4/database_result"
+require_relative "tina4/point"
 require_relative "tina4/field_types"
 require_relative "tina4/orm"
 require_relative "tina4/query_builder"
@@ -25,6 +26,7 @@ require_relative "tina4/template"
 require_relative "tina4/frond"
 require_relative "tina4/auth"
 require_relative "tina4/session"
+require_relative "tina4/sso"
 require_relative "tina4/middleware"
 require_relative "tina4/cors"
 require_relative "tina4/rate_limiter"
@@ -487,6 +489,10 @@ module Tina4
       # Auto-discover routes
       auto_discover(root_dir)
 
+      # Configuration-first OIDC mounts after application discovery so a
+      # canonical-path collision fails loudly rather than being shadowed.
+      Tina4::Sso.mount_configured
+
       # Apply pending DB migrations on startup (non-breaking — see method doc).
       # Runs AFTER route discovery / DB bind, BEFORE serving.
       auto_migrate_on_startup!(root_dir)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.103
+  version: 3.13.104
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-16 00:00:00.000000000 Z
+date: 2026-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -397,6 +397,7 @@ files:
 - lib/tina4/mqtt_message.rb
 - lib/tina4/orm.rb
 - lib/tina4/plan.rb
+- lib/tina4/point.rb
 - lib/tina4/port_takeover.rb
 - lib/tina4/project_index.rb
 - lib/tina4/public/__feedback/widget.js
@@ -448,6 +449,7 @@ files:
 - lib/tina4/session_handlers/valkey_handler.rb
 - lib/tina4/shutdown.rb
 - lib/tina4/sql_translator.rb
+- lib/tina4/sso.rb
 - lib/tina4/swagger.rb
 - lib/tina4/template.rb
 - lib/tina4/templates/base.twig