tina4ruby 3.13.137 → 3.13.139

data/lib/tina4/public/licenses/tina4-js-MIT.txt

@@ -0,0 +1,20 @@
+MIT License
+
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/lib/tina4/push.rb

@@ -1,10 +1,17 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "openssl"
-require "base64"
+require_relative "base64"
 require "json"
 require "net/http"
 require "uri"
+require_relative "ssrf"
 
 module Tina4
   class PushError < StandardError; end
@@ -34,7 +41,11 @@ module Tina4
       bytes.b.rjust(32, "\x00".b)
     end
 
-    def initialize(subject: nil, public_key: nil, private_key: nil, ttl: 60, urgency: nil)
+    def initialize(subject: nil, public_key: nil, private_key: nil, ttl: 60, urgency: nil, allow_hosts: nil)
+      # SSRF guard (ADR-0084): the push endpoint is refused when it resolves to a
+      # private/internal address unless TINA4_ALLOW_PRIVATE_REQUESTS is truthy or
+      # the host/CIDR is on this allow-list.
+      @allow_hosts = allow_hosts || []
       @subject = (subject || ENV.fetch("TINA4_VAPID_SUBJECT", "")).strip
       @public_key = (public_key || ENV.fetch("TINA4_VAPID_PUBLIC", "")).strip
       @private_key = (private_key || ENV.fetch("TINA4_VAPID_PRIVATE", "")).strip
@@ -82,6 +93,13 @@ module Tina4
     end
 
     def deliver(endpoint, uri, subject, public_key, private, public, body)
+      # SSRF guard (ADR-0084): refuse a private/internal push endpoint. Net::HTTP
+      # does not follow redirects, so guarding the endpoint is sufficient.
+      begin
+        Tina4::Ssrf.guard_url!(uri, @allow_hosts)
+      rescue Tina4::SsrfError => e
+        raise PushError, e.message
+      end
       request = Net::HTTP::Post.new(uri)
       request["Authorization"] = "vapid t=#{vapid_token(uri, subject, private, public)}, k=#{public_key}"
       request["Content-Encoding"] = "aes128gcm"
@@ -113,13 +131,13 @@ module Tina4
     end
 
     def self.b64(value)
-      Base64.urlsafe_encode64(value, padding: false)
+      Tina4::Base64.urlsafe_encode64(value, padding: false)
     end
 
     def decode(value, name)
       raise PushError, "#{name} must be a non-empty base64url string" unless value.is_a?(String) && value.match?(/\A[A-Za-z0-9_-]+\z/)
 
-      Base64.urlsafe_decode64(value)
+      Tina4::Base64.urlsafe_decode64(value)
     rescue ArgumentError => e
       raise PushError, "#{name} must be base64url encoded: #{e.message}"
     end

data/lib/tina4/query_builder.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   # QueryBuilder — Fluent SQL query builder.

data/lib/tina4/queue.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 require "securerandom"
 require "uri"

data/lib/tina4/queue_backends/kafka_backend.rb

@@ -1,4 +1,12 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require_relative "../parse_json"
 
 module Tina4
   module QueueBackends
@@ -120,7 +128,7 @@ module Tina4
         end
         return nil unless msg
 
-        data = JSON.parse(msg.payload)
+        data = Tina4.parse_json(msg.payload)
         @last_message = msg
 
         # attempts and error MUST be carried back. Rebuilding from
@@ -243,7 +251,7 @@ module Tina4
           loop do
             msg = reader.poll(500)
             if msg
-              data = JSON.parse(msg.payload)
+              data = Tina4.parse_json(msg.payload)
               data["status"] = "dead"
               out << data
               next
@@ -259,6 +267,14 @@ module Tina4
         out
       end
 
+      # Reject a job permanently — dead-letter it NOW, no retry (ADR-0023).
+      def reject(job, reason = "")
+        job.attempts = [job.attempts + 1, @max_retries].max
+        job.error = reason
+        dead_letter(job)
+        acknowledge(job)
+      end
+
       def failed(_topic, max_retries: 3)
         raise NotImplementedError,
               "The kafka queue backend cannot answer failed(): a job that failed " \

data/lib/tina4/queue_backends/lite_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 require "fileutils"
 require "time"
@@ -171,6 +177,18 @@ module Tina4
       # Aligns with retry_job(id) which had always unlinked the dead-letter
       # file — two spellings of the same intent that previously diverged.
       # Increments attempts, clears the error.
+      # Reject a job permanently — dead-letter it NOW, no retry (ADR-0023).
+      # Unlike fail(), which requeues until max_retries is spent, reject() moves
+      # a known-poison job straight to the dead-letter store. attempts is floored
+      # at max_retries so dead_letters (attempts >= limit) returns it and
+      # dead_letter_count agrees.
+      def reject(job, reason = "")
+        clear_reservation(job.topic, job.id)
+        job.attempts = [job.attempts + 1, @max_retries].max
+        job.error = reason
+        move_to_dead_letter(job, reason)
+      end
+
       def retry(job, delay_seconds: 0)
         clear_reservation(job.topic, job.id)
         # Drop any dead-letter file for this id BEFORE the re-queue: if this

data/lib/tina4/queue_backends/mongo_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module QueueBackends
@@ -278,6 +284,18 @@ module Tina4
       # the normal path. This method did not exist at all, and Queue#failed
       # silently returned [] for it — indistinguishable from "nothing has
       # failed" (ADR-0022 decision 7).
+      # Reject a job permanently — dead-letter it NOW, no retry (ADR-0023).
+      def reject(job, reason = "")
+        job.attempts = [job.attempts + 1, @max_retries].max
+        job.error = reason
+        collection.find_one_and_update(
+          { _id: job.id },
+          { "$set" => { status: "dead", topic: "#{job.topic}.dead_letter",
+                        attempts: job.attempts, error: reason, reserved_at: nil } },
+          upsert: true
+        )
+      end
+
       def failed(topic, max_retries: 3)
         collection.find(
           topic: topic,

data/lib/tina4/queue_backends/rabbitmq_backend.rb

@@ -1,4 +1,12 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require_relative "../parse_json"
 
 module Tina4
   module QueueBackends
@@ -62,7 +70,7 @@ module Tina4
         delivery_info, _properties, payload = queue.pop(manual_ack: true)
         return nil unless payload
 
-        data = JSON.parse(payload)
+        data = Tina4.parse_json(payload)
         # attempts and error MUST be carried back. Rebuilding the Job from
         # topic/payload/id alone reset attempts to 0 on every redelivery, so
         # fail()'s attempts >= max_retries check could never trip and a poison
@@ -169,6 +177,14 @@ module Tina4
         end
       end
 
+      # Reject a job permanently — dead-letter it NOW, no retry (ADR-0023).
+      def reject(job, reason = "")
+        job.attempts = [job.attempts + 1, @max_retries].max
+        job.error = reason
+        dead_letter(job)
+        complete(job)
+      end
+
       def failed(_topic, max_retries: 3)
         raise NotImplementedError,
               "The rabbitmq queue backend cannot answer failed(): a job that " \
@@ -282,7 +298,7 @@ module Tina4
           _info, _props, payload = queue.pop(manual_ack: false)
           break unless payload
 
-          out << JSON.parse(payload)
+          out << Tina4.parse_json(payload)
         end
         out.each { |data| publish_to(name, data) }
         out

data/lib/tina4/rack_app.rb

@@ -1,9 +1,16 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 require "securerandom"
 require "time"
 require "uri"
 require "cgi"
+require_relative "parse_json"
 
 module Tina4
   # Middleware wrapper that tags requests arriving on the AI dev port.
@@ -503,6 +510,9 @@ module Tina4
 
       # Skip underscore-prefixed segments — private files even within pages/.
       return nil if clean_path.split("/").any? { |seg| seg.start_with?("_") }
+      # ADR-0082: a "." / ".." segment (or a backslash) could walk out of
+      # pages/ - the only directory that auto-routes. Refuse it outright.
+      return nil if clean_path.include?("\\") || clean_path.split("/", -1).any? { |seg| ["", ".", ".."].include?(seg) }
 
       is_dev = %w[true 1 yes].include?(ENV.fetch("TINA4_DEBUG", "false").downcase)
 
@@ -1179,68 +1189,46 @@ module Tina4
     def self.enforce_route_auth(env, route)
       return nil unless route.auth_required
 
-      token = nil
-      token_source = nil  # :header, :body, :session
+      unauthorized = [401, { "content-type" => "application/json" }, [JSON.generate({ error: "Unauthorized" })]]
 
-      # Priority 1: Authorization Bearer header
+      # Token slots in priority order: Authorization Bearer header, then the
+      # body formToken (frond.js puts the auth token it received as a
+      # FreshToken there), then the session. The first slot holding a token
+      # decides, EXCEPT that a form token ("type" => "form") proves where a
+      # write came from, not who sent it: it is skipped and the next slot is
+      # tried (ADR-0079 s1). So a logged-in user posting a rendered form (form
+      # token in the body, auth token in the session) is still authenticated.
+      candidates = []
       auth_header = env["HTTP_AUTHORIZATION"] || ""
-      if auth_header =~ /\ABearer\s+(.+)\z/i
-        token = Regexp.last_match(1)
-        token_source = :header
-      end
+      candidates << [Regexp.last_match(1), :header] if auth_header =~ /\ABearer\s+(.+)\z/i
+      form_token = _extract_form_token(_read_rack_body(env), env)
+      candidates << [form_token, :body] if form_token && !form_token.empty?
 
-      # Priority 2: formToken from request body (for frond.js saveForm with {{ form_token() }})
-      if token.nil?
-        body_str = _read_rack_body(env)
-        form_token = _extract_form_token(body_str, env)
-        if form_token && !form_token.empty?
-          token = form_token
-          token_source = :body
-        end
+      verdict = candidates.each do |token, source|
+        outcome = _authenticate_token(env, token, source)
+        break outcome unless outcome == :skip
       end
+      return unauthorized if verdict == :denied
 
-      # Priority 3: Session token (for secured GET routes after login)
-      if token.nil?
+      unless env.key?("tina4.auth_payload")
         # Request path, so the same log-loud-then-degrade policy as
         # Request#session (ADR-0021): an unreachable session store must not turn
         # the auth gate into a 500. It degrades to an empty session, which means
         # no token, which means the ordinary 401 below - a SERVED request.
         session = Tina4::Session.new(env, degrade_on_backend_failure: true)
-        sso = session.get("_tina4_sso")
-        identity = sso.is_a?(Hash) ? sso["identity"] : nil
-        if identity.is_a?(Hash) && identity["issuer"] && identity["subject"]
+        # A provider-verified OIDC identity counts only while it is live
+        # (ADR-0079 s5).
+        identity = Tina4::Sso.live_session_identity(session.get("_tina4_sso"))
+        if identity
           env["tina4.auth_payload"] = identity
-          deny = rbac_forbidden(route, identity)
-          return deny if deny
-
-          return nil
-        end
-        session_token = session.get("token")
-        if session_token && !session_token.empty?
-          token = session_token
-          token_source = :session
-        end
-      end
-
-      # API_KEY bypass — routed through the timing-safe Tina4::Auth.validate_api_key
-      # (OpenSSL.fixed_length_secure_compare), matching tina4_python's _check_auth.
-      # It used to be a plain `token == api_key`, which returns as soon as two
-      # bytes differ — so response timing leaks the key prefix and the key can be
-      # recovered a character at a time. validate_api_key also covers the unset /
-      # blank / wrong-length cases the old guard spelled out by hand.
-      if Tina4::Auth.validate_api_key(token)
-        env["tina4.auth_payload"] = { "_auth" => "api_key" }
-      elsif token
-        unless Tina4::Auth.valid_token(token)
-          return [401, { "content-type" => "application/json" }, [JSON.generate({ error: "Unauthorized" })]]
+        else
+          session_token = session.get("token")
+          if session_token.is_a?(String) && !session_token.empty?
+            return unauthorized unless _authenticate_token(env, session_token, :session) == :accepted
+          end
         end
-        env["tina4.auth_payload"] = Tina4::Auth.get_payload(token)
-
-        # When body formToken validates, store a refreshed token for the FreshToken response header
-        env["tina4.fresh_token"] = Tina4::Auth.refresh_token(token) if token_source == :body
-      else
-        return [401, { "content-type" => "application/json" }, [JSON.generate({ error: "Unauthorized" })]]
       end
+      return unauthorized unless env.key?("tina4.auth_payload")
 
       # ── RBAC guards (Feature 138): authorization AFTER authentication ──
       # Auth has passed (401 ruled out above). If the route carries role/
@@ -1251,6 +1239,30 @@ module Tina4
       nil
     end
 
+    # Judge one token from one slot: :accepted (env["tina4.auth_payload"] set),
+    # :skip (a valid form token - not an identity, try the next slot) or
+    # :denied (anything else).
+    #
+    # API_KEY bypass - routed through the timing-safe Tina4::Auth.validate_api_key
+    # (OpenSSL.fixed_length_secure_compare), matching tina4_python's _check_auth.
+    # A plain `token == api_key` returns as soon as two bytes differ, so response
+    # timing would leak the key a character at a time.
+    def self._authenticate_token(env, token, source)
+      if Tina4::Auth.validate_api_key(token)
+        env["tina4.auth_payload"] = { "_auth" => "api_key" }
+        return :accepted
+      end
+      payload = Tina4::Auth.valid_token(token)
+      return :denied unless payload
+      return :skip unless Tina4::Auth.identity_payload?(payload)
+
+      env["tina4.auth_payload"] = payload
+      # When a body token authenticates, store a refreshed token for the
+      # FreshToken response header (identity tokens only).
+      env["tina4.fresh_token"] = Tina4::Auth.refresh_token(token) if source == :body
+      :accepted
+    end
+
     # Build a 403 Rack tuple when a route's RBAC guards are not satisfied by the
     # verified payload, else nil. AND across guard groups, OR within a group.
     # Roles read the `roles` claim (legacy singular `role` coerced); permissions
@@ -1316,7 +1328,7 @@ module Tina4
 
       if content_type.include?("application/json")
         begin
-          parsed = JSON.parse(body_str)
+          parsed = Tina4.parse_json(body_str)
           return parsed["formToken"] if parsed.is_a?(Hash) && parsed["formToken"]
         rescue JSON::ParserError
           # Not valid JSON — fall through

data/lib/tina4/rate_limiter.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   class RateLimiter

data/lib/tina4/realtime/attachment.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/channel.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/channel_member.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/local_storage.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "fileutils"
 

data/lib/tina4/realtime/message.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/s3_storage.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime
@@ -9,7 +15,15 @@ module Tina4
     class S3Storage < StorageBackend
       def initialize(endpoint: nil, key: nil, secret: nil, bucket: nil, region: nil)
         super()
-        require "aws-sdk-s3" # optional dependency, loaded lazily
+        begin
+          require "aws-sdk-s3" # optional dependency, loaded lazily
+        rescue LoadError
+          # Storage.select rescues this and falls back to local; its warning
+          # carries this message, so the remedy reaches the operator.
+          raise LoadError,
+                "The 'aws-sdk-s3' gem is required for S3Storage. Install it with: " \
+                "bundle add aws-sdk-s3 (or add gem \"aws-sdk-s3\" to your Gemfile)"
+        end
 
         @bucket = bucket || ENV["TINA4_STORAGE_BUCKET"]
         raise ArgumentError, "S3Storage requires TINA4_STORAGE_BUCKET" if @bucket.nil? || @bucket.empty?

data/lib/tina4/realtime/storage.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "securerandom"
 

data/lib/tina4/realtime/storage_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime/workspace.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module Realtime

data/lib/tina4/realtime.rb

@@ -1,9 +1,15 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "time"
 require "openssl"
-require "base64"
+require_relative "base64"
 
 require_relative "realtime/workspace"
 require_relative "realtime/channel"
@@ -14,6 +20,7 @@ require_relative "realtime/storage_backend"
 require_relative "realtime/local_storage"
 require_relative "realtime/s3_storage"
 require_relative "realtime/storage"
+require_relative "parse_json"
 
 module Tina4
   # Real-time collaboration mount for Tina4 (Ruby), parity with the Python
@@ -57,7 +64,7 @@ module Tina4
       if turn_url && !turn_url.empty? && secret && !secret.empty?
         ttl = (ENV["TINA4_RTC_TURN_TTL"] || "3600").to_i
         username = (Time.now.to_i + ttl).to_s
-        credential = Base64.strict_encode64(OpenSSL::HMAC.digest("SHA1", secret, username))
+        credential = Tina4::Base64.strict_encode64(OpenSSL::HMAC.digest("SHA1", secret, username))
         servers << { "urls" => split_urls(turn_url), "username" => username, "credential" => credential }
       end
       servers
@@ -312,7 +319,7 @@ module Tina4
     def parse_json(data)
       return data if data.is_a?(Hash)
 
-      JSON.parse(data.to_s)
+      Tina4.parse_json(data.to_s)
     rescue JSON::ParserError, TypeError
       nil
     end