tina4ruby 3.13.137 → 3.13.138

data/lib/tina4/public/licenses/tina4-js-MIT.txt

@@ -0,0 +1,20 @@
+MIT License
+
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/lib/tina4/push.rb

@@ -1,7 +1,13 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "openssl"
-require "base64"
+require_relative "base64"
 require "json"
 require "net/http"
 require "uri"
@@ -113,13 +119,13 @@ module Tina4
     end
 
     def self.b64(value)
-      Base64.urlsafe_encode64(value, padding: false)
+      Tina4::Base64.urlsafe_encode64(value, padding: false)
     end
 
     def decode(value, name)
       raise PushError, "#{name} must be a non-empty base64url string" unless value.is_a?(String) && value.match?(/\A[A-Za-z0-9_-]+\z/)
 
-      Base64.urlsafe_decode64(value)
+      Tina4::Base64.urlsafe_decode64(value)
     rescue ArgumentError => e
       raise PushError, "#{name} must be base64url encoded: #{e.message}"
     end

data/lib/tina4/query_builder.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   # QueryBuilder — Fluent SQL query builder.

data/lib/tina4/queue.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 require "securerandom"
 require "uri"

data/lib/tina4/queue_backends/kafka_backend.rb

@@ -1,4 +1,12 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require_relative "../parse_json"
 
 module Tina4
   module QueueBackends
@@ -120,7 +128,7 @@ module Tina4
         end
         return nil unless msg
 
-        data = JSON.parse(msg.payload)
+        data = Tina4.parse_json(msg.payload)
         @last_message = msg
 
         # attempts and error MUST be carried back. Rebuilding from
@@ -243,7 +251,7 @@ module Tina4
           loop do
             msg = reader.poll(500)
             if msg
-              data = JSON.parse(msg.payload)
+              data = Tina4.parse_json(msg.payload)
               data["status"] = "dead"
               out << data
               next

data/lib/tina4/queue_backends/lite_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 require "fileutils"
 require "time"

data/lib/tina4/queue_backends/mongo_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module QueueBackends

data/lib/tina4/queue_backends/rabbitmq_backend.rb

@@ -1,4 +1,12 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require_relative "../parse_json"
 
 module Tina4
   module QueueBackends
@@ -62,7 +70,7 @@ module Tina4
         delivery_info, _properties, payload = queue.pop(manual_ack: true)
         return nil unless payload
 
-        data = JSON.parse(payload)
+        data = Tina4.parse_json(payload)
         # attempts and error MUST be carried back. Rebuilding the Job from
         # topic/payload/id alone reset attempts to 0 on every redelivery, so
         # fail()'s attempts >= max_retries check could never trip and a poison
@@ -282,7 +290,7 @@ module Tina4
           _info, _props, payload = queue.pop(manual_ack: false)
           break unless payload
 
-          out << JSON.parse(payload)
+          out << Tina4.parse_json(payload)
         end
         out.each { |data| publish_to(name, data) }
         out

data/lib/tina4/rack_app.rb

@@ -1,9 +1,16 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 require "securerandom"
 require "time"
 require "uri"
 require "cgi"
+require_relative "parse_json"
 
 module Tina4
   # Middleware wrapper that tags requests arriving on the AI dev port.
@@ -503,6 +510,9 @@ module Tina4
 
       # Skip underscore-prefixed segments — private files even within pages/.
       return nil if clean_path.split("/").any? { |seg| seg.start_with?("_") }
+      # ADR-0082: a "." / ".." segment (or a backslash) could walk out of
+      # pages/ - the only directory that auto-routes. Refuse it outright.
+      return nil if clean_path.include?("\\") || clean_path.split("/", -1).any? { |seg| ["", ".", ".."].include?(seg) }
 
       is_dev = %w[true 1 yes].include?(ENV.fetch("TINA4_DEBUG", "false").downcase)
 
@@ -1316,7 +1326,7 @@ module Tina4
 
       if content_type.include?("application/json")
         begin
-          parsed = JSON.parse(body_str)
+          parsed = Tina4.parse_json(body_str)
           return parsed["formToken"] if parsed.is_a?(Hash) && parsed["formToken"]
         rescue JSON::ParserError
           # Not valid JSON — fall through

data/lib/tina4/rate_limiter.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   class RateLimiter

data/lib/tina4/realtime/attachment.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/channel.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/channel_member.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/local_storage.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "fileutils"
 

data/lib/tina4/realtime/message.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/s3_storage.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/storage.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "securerandom"
 

data/lib/tina4/realtime/storage_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/workspace.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime.rb

@@ -1,9 +1,15 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "time"
 require "openssl"
-require "base64"
+require_relative "base64"
 
 require_relative "realtime/workspace"
 require_relative "realtime/channel"
@@ -14,6 +20,7 @@ require_relative "realtime/storage_backend"
 require_relative "realtime/local_storage"
 require_relative "realtime/s3_storage"
 require_relative "realtime/storage"
+require_relative "parse_json"
 
 module Tina4
   # Real-time collaboration mount for Tina4 (Ruby), parity with the Python
@@ -57,7 +64,7 @@ module Tina4
       if turn_url && !turn_url.empty? && secret && !secret.empty?
         ttl = (ENV["TINA4_RTC_TURN_TTL"] || "3600").to_i
         username = (Time.now.to_i + ttl).to_s
-        credential = Base64.strict_encode64(OpenSSL::HMAC.digest("SHA1", secret, username))
+        credential = Tina4::Base64.strict_encode64(OpenSSL::HMAC.digest("SHA1", secret, username))
         servers << { "urls" => split_urls(turn_url), "username" => username, "credential" => credential }
       end
       servers
@@ -312,7 +319,7 @@ module Tina4
     def parse_json(data)
       return data if data.is_a?(Hash)
 
-      JSON.parse(data.to_s)
+      Tina4.parse_json(data.to_s)
     rescue JSON::ParserError, TypeError
       nil
     end

data/lib/tina4/request.rb

@@ -1,8 +1,16 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "uri"
 require "json"
 require "ipaddr"
 require "stringio"
+require_relative "parse_json"
+require_relative "form_parser"
 
 module Tina4
   # A Hash subclass that supports indifferent access (both string and symbol keys).
@@ -122,24 +130,36 @@ module Tina4
     # reads route.auth_required to honour a public write route (.no_auth).
     attr_accessor :user, :route
 
-    # Maximum upload size in bytes (default 10 MB). Override via TINA4_MAX_UPLOAD_SIZE env var.
-    TINA4_MAX_UPLOAD_SIZE = Integer(ENV.fetch("TINA4_MAX_UPLOAD_SIZE", 10_485_760))
+    # Default upload cap in bytes (10 MB). The live cap is max_upload_size, which
+    # reads TINA4_MAX_UPLOAD_SIZE when it is used (ADR-0072). This constant used
+    # to read the environment at require time, which raised on a bad value.
+    TINA4_MAX_UPLOAD_SIZE = 10_485_760
 
     class PayloadTooLarge < StandardError; end
 
     # Effective upload cap in bytes. Read at CALL TIME (not frozen into the
     # constant at load) so the limit honours a TINA4_MAX_UPLOAD_SIZE set after
     # this file was required, and so a test can lower it. Falls back to the
-    # constant default when the env var is unset/blank.
+    # constant default when the env var is unset/blank. A value that is not a
+    # positive whole number warns once and uses the default (ADR-0068): to_i
+    # used to turn "abc" into 0, which refused every request with a body.
     def self.max_upload_size
-      value = ENV["TINA4_MAX_UPLOAD_SIZE"]
-      value.nil? || value.empty? ? TINA4_MAX_UPLOAD_SIZE : value.to_i
+      raw = ENV["TINA4_MAX_UPLOAD_SIZE"].to_s.strip
+      return TINA4_MAX_UPLOAD_SIZE if raw.empty?
+      return raw.to_i if raw.match?(/\A\d+\z/) && raw.to_i.positive?
+
+      @warned_upload_limits ||= {}
+      unless @warned_upload_limits[raw]
+        @warned_upload_limits[raw] = true
+        Tina4::Log.warning("TINA4_MAX_UPLOAD_SIZE=#{raw} is not a usable limit - using #{TINA4_MAX_UPLOAD_SIZE}")
+      end
+      TINA4_MAX_UPLOAD_SIZE
     end
 
     # Read an IO in bounded chunks, raising PayloadTooLarge the MOMENT the
     # running total exceeds the upload cap, so an over-limit body is refused as
     # it arrives instead of after the whole thing is buffered. Rewinds the input
-    # before and after so a later reader (Rack's parser, form-token extraction)
+    # before and after so a later reader (the form parser, form-token extraction)
     # sees the same stream. Parity with the Python/Node per-chunk body readers.
     def self.read_stream_capped(input, limit = nil)
       return "" unless input
@@ -258,7 +278,7 @@ module Tina4
     # @return [Boolean] true when the client's scheme is https.
     def self.secure_scheme?(env)
       forwarded = (env["HTTP_X_FORWARDED_PROTO"] || "").to_s
-      unless forwarded.strip.empty?
+      if Tina4.trusted_proxy?(env["REMOTE_ADDR"].to_s) && !forwarded.strip.empty?
         return forwarded.split(",").first.to_s.strip.casecmp("https").zero?
       end
       scheme = (env["rack.url_scheme"] || "").to_s
@@ -272,7 +292,8 @@ module Tina4
     # still see the URL the client used. Matches Python/PHP/Node parity.
     def url
       scheme = self.class.secure_scheme?(env) ? "https" : "http"
-      host = env["HTTP_X_FORWARDED_HOST"] || env["HTTP_HOST"] || env["SERVER_NAME"] || "localhost"
+      forwarded_host = Tina4.trusted_proxy?(@remote_ip) ? env["HTTP_X_FORWARDED_HOST"] : nil
+      host = forwarded_host || env["HTTP_HOST"] || env["SERVER_NAME"] || "localhost"
       port = env["SERVER_PORT"]
       url_str = "#{scheme}://#{host}"
       # Only append :port when the host doesn't already include one
@@ -395,7 +416,7 @@ module Tina4
 
     def json_body
       @json_body ||= begin
-        JSON.parse(body_raw)
+        Tina4.parse_json(body_raw)
       rescue JSON::ParserError, TypeError
         {}
       end
@@ -474,36 +495,47 @@ module Tina4
       data
     end
 
-    # Resolve the parsed multipart form fields (+ file entries) for this request.
+    # The parsed multipart body, memoised: { fields:, files:, error: } from
+    # Tina4::FormParser, or nil when there is no raw body to parse.
     #
-    # A live Rack server (Puma/WEBrick) does NOT parse the request body for us -
-    # it hands the app the raw `rack.input` stream. `Rack::Request#POST` parses
-    # a multipart (or urlencoded) body and caches the result into the standard
-    # `rack.request.form_hash` env key, which both #parse_body and #extract_files
-    # then read. We only invoke it when the key isn't already populated, so a
-    # spec that injects `rack.request.form_hash` directly still short-circuits
-    # here (and we never re-parse a body twice). Without this, live multipart
-    # uploads arrived empty (fields AND files) - the parse only ran in specs.
+    # A live server hands the app the raw `rack.input` stream and parses nothing,
+    # so Tina4 parses it here. The body is read through read_stream_capped, so the
+    # running upload cap refuses an over-limit body as it arrives - OUTSIDE any
+    # rescue on purpose: PayloadTooLarge must reach the 413 handler.
+    def multipart_parsed
+      return @multipart_parsed if defined?(@multipart_parsed)
+
+      body = Tina4::Request.read_stream_capped(@env["rack.input"])
+      @multipart_parsed =
+        if body.nil? || body.empty?
+          nil
+        else
+          parsed = Tina4::FormParser.parse_multipart(body, @content_type)
+          if parsed[:error] && defined?(Tina4::Log)
+            Tina4::Log.warning("multipart parse failed: #{parsed[:error].message}")
+          end
+          parsed
+        end
+    end
+
+    # The request's form hash: fields plus file entries under the standard
+    # `rack.request.form_hash` env key, the same key (and shape) Rack::Request#POST
+    # used to fill, so middleware reading it keeps working. A spec or middleware
+    # that INJECTS the key short-circuits the parse entirely.
     def multipart_form_hash
       existing = @env["rack.request.form_hash"] rescue nil
       return existing if existing
 
-      # Enforce the running per-chunk upload cap BEFORE Rack reads the body, so
-      # an over-limit body is refused as it arrives rather than after Rack has
-      # buffered the whole thing. Outside the begin/rescue below on purpose: the
-      # PayloadTooLarge must propagate to the 413 handler, not be swallowed.
-      Tina4::Request.read_stream_capped(@env["rack.input"])
-
-      parsed = begin
-        require "rack"
-        Rack::Request.new(@env).POST
-      rescue Tina4::Request::PayloadTooLarge
-        raise
-      rescue StandardError => e
-        Tina4::Log.warning("multipart parse failed: #{e.message}") if defined?(Tina4::Log)
-        nil
+      parsed = multipart_parsed
+      return nil unless parsed
+
+      form = parsed[:fields].dup
+      parsed[:files].each do |name, list|
+        # Rack left an empty file field (filename="") out of the form hash.
+        kept = list.reject { |descriptor| descriptor[:filename].empty? }
+        form[name] = kept.length == 1 ? kept.first : kept unless kept.empty?
       end
-      @env["rack.request.form_hash"] || parsed
+      @env["rack.request.form_hash"] = form
     end
 
     def parse_body
@@ -521,14 +553,14 @@ module Tina4
         # NOT delegating to #json_body: that method keeps its own documented
         # always-a-Hash, {}-on-failure contract for direct callers.
         begin
-          JSON.parse(body_raw)
+          Tina4.parse_json(body_raw)
         rescue JSON::ParserError, TypeError
           body_raw
         end
       elsif @content_type.include?("application/x-www-form-urlencoded")
         parse_query_to_hash(body_raw)
       elsif @content_type.include?("multipart/form-data")
-        # Extract form fields from Rack's parsed multipart data.
+        # Form fields from the parsed multipart body (Tina4::FormParser).
         # Files are handled separately by extract_files.
         result = {}
         form_hash = multipart_form_hash
@@ -560,38 +592,27 @@ module Tina4
     def extract_files
       result = {}
       return result unless @content_type.include?("multipart/form-data")
-      begin
-        # LIVE path: hand-scan the raw body so a REPEATED file field name is
-        # preserved as a LIST (Rack's POST collapses a repeated non-bracket name
-        # to last-wins - the multi-file data-loss this fixes). The scan reads the
-        # body through the capped reader, so an over-limit upload is refused as
-        # it arrives. Falls through to the parsed form_hash when there is no raw
-        # body (e.g. a spec injecting rack.request.form_hash).
-        scanned = scan_multipart_files
-        if scanned && !scanned.empty?
-          scanned.each do |key, list|
-            files = list.map { |value| build_file_upload(value) }.compact
-            result[key] = files.length == 1 ? files.first : files unless files.empty?
-          end
-          return result
-        end
 
-        form_hash = multipart_form_hash
-        if form_hash
-          form_hash.each do |key, value|
-            if value.is_a?(Array)
-              files = value.map { |v| build_file_upload(v) }.compact
-              result[key] = files.length == 1 ? files.first : files unless files.empty?
-            else
-              file = build_file_upload(value)
-              result[key] = file if file
-            end
+      # LIVE path: the parser keeps a REPEATED file field name as a LIST (Rack's
+      # POST collapsed a repeated non-bracket name to last-wins - the multi-file
+      # data loss). Falls through to an injected rack.request.form_hash when
+      # there is no raw body to parse.
+      injected = @env["rack.request.form_hash"] unless multipart_parsed
+      if multipart_parsed
+        multipart_parsed[:files].each do |key, list|
+          files = list.map { |value| build_file_upload(value) }.compact
+          result[key] = files.length == 1 ? files.first : files unless files.empty?
+        end
+      elsif injected
+        injected.each do |key, value|
+          if value.is_a?(Array)
+            files = value.map { |v| build_file_upload(v) }.compact
+            result[key] = files.length == 1 ? files.first : files unless files.empty?
+          else
+            file = build_file_upload(value)
+            result[key] = file if file
           end
         end
-      rescue Tina4::Request::PayloadTooLarge
-        raise
-      rescue StandardError
-        # Multipart parsing failed
       end
       result
     end
@@ -612,68 +633,5 @@ module Tina4
       file["content"] = value[:content] if value.key?(:content) && !value[:content].nil?
       file
     end
-
-    # Extract the boundary token from a multipart Content-Type header.
-    def multipart_boundary(content_type)
-      content_type.to_s.split(";").each do |part|
-        part = part.strip
-        next unless part.start_with?("boundary=")
-
-        return part[9..].to_s.delete_prefix('"').delete_suffix('"')
-      end
-      nil
-    end
-
-    # Hand-roll the FILE parts out of the raw multipart body, keyed by field
-    # name, each name mapping to a LIST of descriptors so a repeated name keeps
-    # every file. Reads through read_stream_capped, so the running per-chunk
-    # upload cap is enforced here too (raising PayloadTooLarge). Returns {} when
-    # there is no raw body (the injected-form_hash path is used instead). Fields
-    # are handled by parse_body (via Rack) - this scans files only.
-    def scan_multipart_files
-      boundary = multipart_boundary(@content_type)
-      return {} unless boundary
-
-      body = Tina4::Request.read_stream_capped(@env["rack.input"])
-      return {} if body.nil? || body.empty?
-
-      body = body.dup.force_encoding("BINARY")
-      files = {}
-      delimiter = "--#{boundary}"
-      body.split(delimiter).each do |segment|
-        next if segment.empty? || segment.start_with?("--")
-
-        segment = segment.sub(/\A\r\n/, "")
-        header_end = segment.index("\r\n\r\n")
-        next unless header_end
-
-        header_section = segment[0...header_end]
-        content = segment[(header_end + 4)..] || ""
-        content = content.sub(/\r\n\z/, "")
-
-        name = nil
-        filename = nil
-        type = "application/octet-stream"
-        header_section.split("\r\n").each do |line|
-          if line =~ /content-disposition/i
-            name = Regexp.last_match(1) if line =~ /name="([^"]*)"/
-            filename = Regexp.last_match(1) if line =~ /filename="([^"]*)"/
-          elsif line =~ /content-type:\s*(.+)/i
-            type = Regexp.last_match(1).strip
-          end
-        end
-        next if name.nil? || filename.nil?
-
-        bytes = content.dup.force_encoding("BINARY")
-        (files[name] ||= []) << {
-          filename: filename,
-          type: type,
-          content: bytes,
-          size: bytes.bytesize,
-          tempfile: StringIO.new(bytes)
-        }
-      end
-      files
-    end
   end
 end