tina4ruby 3.13.108 → 3.13.109

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c940eabf57b7ba299db01f414b5d24d949af99cf970d49fa677e69f77b9192c9
-  data.tar.gz: 83fb893d4db991b8393f22e727d3b7b9e220553f9118eb8a8a52a176dbea390b
+  metadata.gz: 88f7a221999f8c02e97a6e49f5002065f85dce2605f0bb26ccf05749667c44a0
+  data.tar.gz: a62e0e3746c4f0e8e2d1b01269c72fd93c2f89885c051c9642086a3074d901f9
 SHA512:
-  metadata.gz: 7a04a51dbdd80fb05f7213c3983a03e5bf351eebf8ad5ef197e8e80c6489e47ace86a0417131cc2d3a8bbca6554c42dc96016f66c098cc103a5c4f411980137f
-  data.tar.gz: f4e952bb42149b90c62b4bba12695c02234fdf11c19f30bb0744031190144bc0b02c13c7d55916ac1bc9c18f130e66a504e071383ac221413a3b7980e2d1f5ac
+  metadata.gz: 750fbc4f76f70bf58b2290a60ba9bc120f51fba91869c7b225bb326ce19b9d08e1a682c7a6aba8c9ddbc441acc0179daffe0493d49f3680761a92146ff621398
+  data.tar.gz: f5e2eb88d2c544c2d549f09fd6f2fb060866b452d45a7cb2db01c10da73e0829d65b9ad7daba092f9d5881cf5ac05bdc52067512a0d00d31fcd544376d54746d

data/lib/tina4/response_cache.rb

@@ -454,6 +454,28 @@ module Tina4
       raw.split(",").map { |f| f.strip.downcase }.reject(&:empty?)
     end
 
+    # The Cache-Control directive NAMES on a request or response, lowercased.
+    #
+    # Parsed as comma-separated tokens with any `=value` stripped, rather than by
+    # substring search, so `no-cache="Set-Cookie"` is recognised as `no-cache`
+    # and a directive name never matches as a fragment of a longer one.
+    #
+    # @param carrier [Object, nil]
+    # @return [Array<String>]
+    def cache_control_tokens(carrier)
+      raw = header_value(carrier, "Cache-Control").to_s
+      raw.split(",").map { |token| token.split("=", 2).first.to_s.strip.downcase }.reject(&:empty?)
+    end
+
+    # Does the response carry a directive that lets a SHARED cache store it?
+    # (public / s-maxage / must-revalidate — RFC 9111 s3.5.)
+    #
+    # @param response [Object, nil]
+    # @return [Boolean]
+    def shared_cache_allowed?(response)
+      !(cache_control_tokens(response) & SHARED_CACHE_DIRECTIVES).empty?
+    end
+
     # May a SHARED cache store this response? (RFC 9111 s3, s4.1)
     #
     # s3 -- "if the cache is shared: the Authorization header field is not
@@ -464,15 +486,33 @@ module Tina4
     # s4.1 -- a stored response whose Vary contains "*" "always fails to
     # match", so storing one is pointless.
     #
+    # The same s3 reasoning covers two cases the Authorization check alone does
+    # not:
+    #
+    #   - `no-store` forbids storage in any cache and `private` forbids it in a
+    #     shared one (`no-cache` too, without revalidation) -- so a handler can
+    #     keep a response out of this cache with the standard header.
+    #   - A caller identified by a session Cookie is as specific as one carrying
+    #     Authorization, and Tina4's own session mechanism IS a cookie. Because
+    #     the key is method + URL, storing such a response replays one signed-in
+    #     user's page to whoever asks for that URL next; a response that installs
+    #     a session (Set-Cookie) is per-user by construction for the same reason.
+    #
+    # Both cookie cases stay cacheable when the response opts in explicitly with
+    # a shared-cache directive, which is how a genuinely public page served to
+    # cookie-bearing browsers keeps its hit rate.
+    #
     # @param request [Object, nil]
     # @param response [Object, nil]
     # @return [Boolean]
     def may_store?(request, response)
       return false if vary_fields(response).include?("*")
-      return true if header_value(request, "Authorization").nil?
+      return false unless (cache_control_tokens(response) & %w[no-store private no-cache]).empty?
+      return shared_cache_allowed?(response) unless header_value(request, "Authorization").nil?
+      return shared_cache_allowed?(response) unless header_value(request, "Cookie").nil?
+      return shared_cache_allowed?(response) unless header_value(response, "Set-Cookie").nil?
 
-      cache_control = header_value(response, "Cache-Control").to_s.downcase
-      SHARED_CACHE_DIRECTIVES.any? { |directive| cache_control.include?(directive) }
+      true
     end
 
     # Do the nominated request headers match the ones recorded on the entry?

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.108"
+  VERSION = "3.13.109"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.108
+  version: 3.13.109
 platform: ruby
 authors:
 - Tina4 Team