tina4ruby 3.13.133 → 3.13.135

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83f372e751a027c81f97a04d5002b5dd756f16d9f94bc9a9b771c820f0878619
-  data.tar.gz: 6436d18bc08e5dd6f5b6232feb90a7e2650a728064420f12e505eb279e3b941c
+  metadata.gz: 96ecd0fafd99947cd5435ae06d6c143232ddefb23716b6f7ed1c5f87fc2652d5
+  data.tar.gz: a333fd4f697a9d7284e15809c9e6f9e626db38f1c11bd92582b76c08103d71dc
 SHA512:
-  metadata.gz: 8c214ae801254e82779984e62aabf4c07895c45109e25a75a28ea48aecb41aef707edfdbaed6a86db94e458b3bfdf06df783fc1e398bd7e77a1bc7796cc967b8
-  data.tar.gz: e98653bdc54a68d5c9c205645651b0b682ce1d23912d5dc437d774161636d09abfe1225fc01366ddcc2f0ad38f69fe2bd9984dc77579541f5876bae41e973c4b
+  metadata.gz: 005d92cc99c52488903fe6e753ebe14bdb0bf05b5e9e7c254fb6202fe38564edbc4efc8dc23ac1536a9f5d51d6bd1c66857ae394f03748e4ee75309d2dd3f1d5
+  data.tar.gz: def97142d30947a7b508a68656f91eb030bf254f550e52e9f3a8997b0d1928d3f0cb15cc7083c35e0ce906ea873d9cc491e96987954f0c07b96b218f19cf2c25

data/CHANGELOG.md

@@ -6,6 +6,13 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.134
+
+Feature 140 Web Push is now available with provider-neutral subscription delivery,
+native result envelopes, fail-closed configuration, and the documented runtime
+configuration. Developer skills now include the Web Push API and configuration
+reference for all supported language stacks.
+
 ## 3.13.133
 
 Maintainability pass, no behavior changes. Swagger.generate decomposed into cohesive

data/README.md

@@ -102,7 +102,7 @@ Benchmarked with `wrk`: 5,000 requests, 50 concurrent, median of 3 runs:
 | **Tina4 Ruby** | **10,243** | 0 | 55 |
 | Sinatra | 9,548 | 5+ | ~4 |
 
-Tina4 Ruby outperforms Sinatra while delivering **98 features vs ~4**, with zero runtime dependencies.
+Tina4 Ruby outperforms Sinatra while delivering **140 cataloged features vs ~4**, with zero runtime dependencies.
 
 **Across all 4 Tina4 implementations:**
 
@@ -116,7 +116,7 @@ Tina4 Ruby outperforms Sinatra while delivering **98 features vs ~4**, with zero
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages: same architecture, same conventions, same 98 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, the same 140 cataloged features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

data/lib/tina4/dev_admin.rb

@@ -842,23 +842,43 @@ module Tina4
         [status, { "content-type" => "application/json; charset=utf-8" }, [body]]
       end
 
+      # A version check that did not happen says so.
+      #
+      # This used to fall back to latest = current on any failure, and the
+      # toolbar renders that as a green "Latest: vX — You are up to date!". A
+      # developer several releases behind, on a machine with no route out, was
+      # told the opposite of the truth — and the toolbar's own "Could not check
+      # for updates" branch could never fire, because the failure arrived as a
+      # success.
+      #
+      # latest is nil when the check could not be made, and error says why. The
+      # registry URL is TINA4_VERSION_CHECK_URL when set (a mirror, or a test's
+      # own server), else RubyGems.
       def version_check_payload
         current = Tina4::VERSION
-        latest = current
+        url = ENV.fetch("TINA4_VERSION_CHECK_URL",
+                        "https://rubygems.org/api/v1/versions/tina4ruby/latest.json")
         begin
-          uri = URI.parse("https://rubygems.org/api/v1/versions/tina4ruby/latest.json")
+          uri = URI.parse(url)
           http = Net::HTTP.new(uri.host, uri.port)
-          http.use_ssl = true
+          http.use_ssl = (uri.scheme == "https")
           http.open_timeout = 5
           http.read_timeout = 5
-          req = Net::HTTP::Get.new(uri)
-          resp = http.request(req)
-          if resp.is_a?(Net::HTTPSuccess)
-            data = JSON.parse(resp.body)
-            latest = data["version"] || current
+          resp = http.request(Net::HTTP::Get.new(uri))
+          unless resp.is_a?(Net::HTTPSuccess)
+            return { current: current, latest: nil,
+                     error: "RubyGems answered #{resp.code}" }
           end
-        rescue StandardError
-          # Offline or timeout — return current as latest
+          latest = JSON.parse(resp.body)["version"]
+          # Reaching RubyGems is not the same as learning the version: an
+          # answer with none in it is the same lie by another route.
+          if latest.nil? || latest.to_s.empty?
+            return { current: current, latest: nil,
+                     error: "RubyGems did not report a version" }
+          end
+        rescue StandardError => e
+          return { current: current, latest: nil,
+                   error: "#{e.class}: #{e.message}" }
         end
         { current: current, latest: latest }
       end

data/lib/tina4/push.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "base64"
+require "json"
+require "net/http"
+require "uri"
+
+module Tina4
+  class PushError < StandardError; end
+
+  # Provider-neutral Web Push sender using Ruby's stdlib OpenSSL and Net::HTTP.
+  # Web Push remains optional at use time; a Ruby build without OpenSSL fails
+  # loudly when the feature is selected rather than silently sending plaintext.
+  class Push
+    RECORD_SIZE = 4096
+    MAX_PAYLOAD = RECORD_SIZE - 17
+
+    def self.generate_vapid_keys
+      require_openssl
+      key = OpenSSL::PKey::EC.generate("prime256v1")
+      {
+        # The public point keeps its width -- the 0x04 lead byte is non-zero, so
+        # to_s(2) never drops it. The private SCALAR has no such guard: OpenSSL
+        # strips a leading zero byte, so ~0.3% of keys come back 31 bytes and the
+        # app's own 32-byte validation would then reject the key it just made.
+        "publicKey" => b64(key.public_key.to_bn.to_s(2)),
+        "privateKey" => b64(pad32(key.private_key.to_s(2)))
+      }
+    end
+
+    # Left-pad big-endian EC material to the fixed 32-byte P-256 field width.
+    def self.pad32(bytes)
+      bytes.b.rjust(32, "\x00".b)
+    end
+
+    def initialize(subject: nil, public_key: nil, private_key: nil, ttl: 60, urgency: nil)
+      @subject = (subject || ENV.fetch("TINA4_VAPID_SUBJECT", "")).strip
+      @public_key = (public_key || ENV.fetch("TINA4_VAPID_PUBLIC", "")).strip
+      @private_key = (private_key || ENV.fetch("TINA4_VAPID_PRIVATE", "")).strip
+      @ttl = ttl
+      @urgency = urgency
+      if %w[0 false off no].include?(ENV.fetch("TINA4_WEB_PUSH", "").strip.downcase)
+        raise PushError, "Web Push is disabled by TINA4_WEB_PUSH"
+      end
+      configuration if [@subject, @public_key, @private_key].any? { |value| !value.empty? }
+    end
+
+    def send(subscription, payload)
+      endpoint, uri = endpoint_for(subscription)
+      subject, public_key, private_key = configuration
+      public, private = vapid_keys(public_key, private_key)
+      deliver(endpoint, uri, subject, public_key, private, public, encrypt(payload_bytes(payload), subscription))
+    rescue URI::InvalidURIError => e
+      raise PushError, "Push subscription endpoint must be a valid URL: #{e.message}"
+    rescue Net::HTTPError, SocketError, SystemCallError => e
+      raise PushError, "Web Push request failed: #{e.message}"
+    end
+
+    private
+
+    def endpoint_for(subscription)
+      endpoint = subscription.is_a?(Hash) ? (subscription["endpoint"] || subscription[:endpoint]) : nil
+      raise PushError, "A Web Push subscription with an endpoint is required" unless endpoint.is_a?(String) && !endpoint.empty?
+      uri = URI.parse(endpoint)
+      raise PushError, "Push subscription endpoint must use HTTP or HTTPS" unless %w[http https].include?(uri.scheme) && uri.host
+      [endpoint, uri]
+    end
+
+    def vapid_keys(public_key, private_key)
+      public = decode(public_key, "TINA4_VAPID_PUBLIC")
+      private = decode(private_key, "TINA4_VAPID_PRIVATE")
+      raise PushError, "TINA4_VAPID_PUBLIC must be a 65-byte P-256 public key" unless public.bytesize == 65 && public.getbyte(0) == 4
+      raise PushError, "TINA4_VAPID_PRIVATE must be a 32-byte P-256 private key" unless private.bytesize == 32
+      begin
+        derived = private_key_from_raw(private, public).public_key.to_bn.to_s(2)
+      rescue OpenSSL::PKey::PKeyError => e
+        raise PushError, "TINA4_VAPID_PRIVATE is not a valid P-256 private key: #{e.message}"
+      end
+      raise PushError, "TINA4_VAPID_PUBLIC does not match TINA4_VAPID_PRIVATE" unless derived == public
+      [public, private]
+    end
+
+    def deliver(endpoint, uri, subject, public_key, private, public, body)
+      request = Net::HTTP::Post.new(uri)
+      request["Authorization"] = "vapid t=#{vapid_token(uri, subject, private, public)}, k=#{public_key}"
+      request["Content-Encoding"] = "aes128gcm"
+      request["Content-Type"] = "application/octet-stream"
+      request["TTL"] = @ttl.to_i.to_s
+      request["Urgency"] = @urgency if @urgency && !@urgency.empty?
+      request.body = body
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      response = http.start { |client| client.request(request) }
+      status = response.code.to_i
+      { "ok" => status < 400, "status" => status, "dead" => [404, 410].include?(status), "retryable" => [408, 429].include?(status) || status >= 500, "endpoint" => endpoint, "response" => response.body.to_s }
+    end
+
+    def configuration
+      missing = []
+      missing << "TINA4_VAPID_SUBJECT" if @subject.empty?
+      missing << "TINA4_VAPID_PUBLIC" if @public_key.empty?
+      missing << "TINA4_VAPID_PRIVATE" if @private_key.empty?
+      raise PushError, "Web Push is configured but missing: #{missing.join(', ')}" unless missing.empty?
+      self.class.send(:require_openssl)
+      [@subject, @public_key, @private_key]
+    end
+
+    def self.require_openssl
+      return if defined?(OpenSSL::PKey::EC)
+
+      raise PushError, "Web Push requires Ruby's OpenSSL stdlib capability; rebuild Ruby with OpenSSL support"
+    end
+
+    def self.b64(value)
+      Base64.urlsafe_encode64(value, padding: false)
+    end
+
+    def decode(value, name)
+      raise PushError, "#{name} must be a non-empty base64url string" unless value.is_a?(String) && value.match?(/\A[A-Za-z0-9_-]+\z/)
+
+      Base64.urlsafe_decode64(value)
+    rescue ArgumentError => e
+      raise PushError, "#{name} must be base64url encoded: #{e.message}"
+    end
+
+    def payload_bytes(payload)
+      return payload.b if payload.is_a?(String)
+      JSON.generate(payload)
+    rescue JSON::GeneratorError => e
+      raise PushError, "Push payload is not JSON serializable: #{e.message}"
+    end
+
+    def private_key_from_raw(private, public)
+      body = OpenSSL::ASN1::Sequence.new([
+        OpenSSL::ASN1::Integer.new(1),
+        OpenSSL::ASN1::OctetString.new(private),
+        OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::ObjectId.new("prime256v1")], 0, :CONTEXT_SPECIFIC),
+        OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::BitString.new(public)], 1, :CONTEXT_SPECIFIC)
+      ])
+      OpenSSL::PKey.read(body.to_der)
+    end
+
+    def public_key_from_raw(public)
+      algorithm = OpenSSL::ASN1::Sequence.new([OpenSSL::ASN1::ObjectId.new("id-ecPublicKey"), OpenSSL::ASN1::ObjectId.new("prime256v1")])
+      OpenSSL::PKey.read(OpenSSL::ASN1::Sequence.new([algorithm, OpenSSL::ASN1::BitString.new(public)]).to_der)
+    end
+
+    def encrypt(payload, subscription)
+      raise PushError, "Push payload is too large; maximum is #{MAX_PAYLOAD} bytes" if payload.bytesize > MAX_PAYLOAD
+      keys = subscription.is_a?(Hash) ? (subscription["keys"] || subscription[:keys] || {}) : {}
+      p256dh = keys["p256dh"] || keys[:p256dh]
+      auth = keys["auth"] || keys[:auth]
+      client = decode(p256dh.to_s, "subscription.keys.p256dh")
+      auth_secret = decode(auth.to_s, "subscription.keys.auth")
+      raise PushError, "subscription.keys.p256dh must be a 65-byte P-256 public key" unless client.bytesize == 65 && client.getbyte(0) == 4
+      raise PushError, "subscription.keys.auth must be a 16-byte authentication secret" unless auth_secret.bytesize == 16
+
+      ephemeral = OpenSSL::PKey::EC.generate("prime256v1")
+      server = ephemeral.public_key.to_bn.to_s(2)
+      shared = ephemeral.derive(public_key_from_raw(client))
+      ikm = hkdf(hmac(auth_secret, shared), "WebPush: info\0" + client + server, 32)
+      salt = OpenSSL::Random.random_bytes(16)
+      prk = hmac(salt, ikm)
+      cek = hkdf(prk, "Content-Encoding: aes128gcm\0", 16)
+      nonce = hkdf(prk, "Content-Encoding: nonce\0", 12)
+      cipher = OpenSSL::Cipher.new("aes-128-gcm")
+      cipher.encrypt
+      cipher.key = cek
+      cipher.iv = nonce
+      ciphertext = cipher.update(payload + "\x02") + cipher.final
+      tag = cipher.auth_tag
+      salt + [RECORD_SIZE].pack("N") + [server.bytesize].pack("C") + server + ciphertext + tag
+    end
+
+    def hmac(key, value)
+      OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, key, value)
+    end
+
+    def hkdf(prk, info, length)
+      output = +""
+      previous = +""
+      counter = 1
+      while output.bytesize < length
+        previous = hmac(prk, previous + info + [counter].pack("C"))
+        output << previous
+        counter += 1
+        raise PushError, "HKDF output is too large" if counter > 255
+      end
+      output.byteslice(0, length)
+    end
+
+    def vapid_token(uri, subject, private, public)
+      aud = "#{uri.scheme}://#{uri.host}#{uri.port && ![80, 443].include?(uri.port) ? ":#{uri.port}" : ""}"
+      header = self.class.send(:b64, JSON.generate({ typ: "JWT", alg: "ES256" }))
+      claims = self.class.send(:b64, JSON.generate({ aud: aud, exp: Time.now.to_i + 43_200, sub: subject }))
+      input = "#{header}.#{claims}"
+      signature = private_key_from_raw(private, public).sign(OpenSSL::Digest::SHA256.new, input)
+      asn = OpenSSL::ASN1.decode(signature)
+      raw = [asn.value[0].value.to_s(2), asn.value[1].value.to_s(2)].map { |value| value.rjust(32, "\0") }.join
+      "#{input}.#{self.class.send(:b64, raw)}"
+    end
+  end
+end

data/lib/tina4/rack_app.rb

@@ -1033,6 +1033,14 @@ module Tina4
                 el.className = 't4-ok';
                 el.innerHTML = 'Latest: <strong class="t4-ok">v' + latest + '</strong> &mdash; You are up to date!';
             }
+            // A check that did not happen is not a clean bill of health. The
+            // server sends latest: null when it could not reach the registry,
+            // and saying so is the whole point -- "up to date" here would be a
+            // guess dressed as a fact.
+            function couldNotCheck(el, why) {
+                el.className = 't4-err';
+                el.textContent = 'Could not check for updates' + (why ? ' (' + why + ')' : '');
+            }
             function checkVersion() {
                 if (modal.style.display === 'block') { modal.style.display = 'none'; return; }
                 modal.style.display = 'block';
@@ -1041,6 +1049,10 @@ module Tina4
                 el.textContent = 'Checking for updates...';
                 fetch('/__dev/api/version-check').then(function (r) { return r.json(); }).then(function (d) {
                     var latest = d.latest, current = d.current;
+                    // A check that did not happen says so -- act on a missing
+                    // latest before comparing, so a null never falls into the
+                    // up-to-date branch.
+                    if (!latest) { couldNotCheck(el, d.error); return; }
                     if (latest === current) { upToDate(el, latest); return; }
                     var cP = current.split('.').map(Number), lP = latest.split('.').map(Number);
                     var isNewer = false, i, c, l;

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.133"
+  VERSION = "3.13.135"
 end

data/lib/tina4.rb

@@ -169,6 +169,8 @@ module Tina4
   autoload :MqttError,           File.expand_path("tina4/mqtt", __dir__)
   autoload :MqttTimeoutError,    File.expand_path("tina4/mqtt", __dir__)
   autoload :MqttMessage,         File.expand_path("tina4/mqtt_message", __dir__)
+  autoload :Push,                File.expand_path("tina4/push", __dir__)
+  autoload :PushError,           File.expand_path("tina4/push", __dir__)
   autoload :Testing,             File.expand_path("tina4/testing", __dir__)
   # Queue / Messenger / DocStore were the last three optional subsystems still
   # loaded eagerly, so every `require "tina4"` paid for a queue backend, an

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.133
+  version: 3.13.135
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-05 00:00:00.000000000 Z
+date: 2026-09-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -405,6 +405,7 @@ files:
 - lib/tina4/public/js/tina4js.min.js
 - lib/tina4/public/swagger/index.html
 - lib/tina4/public/swagger/oauth2-redirect.html
+- lib/tina4/push.rb
 - lib/tina4/query_builder.rb
 - lib/tina4/queue.rb
 - lib/tina4/queue_backends/kafka_backend.rb