tina4ruby 3.13.137 → 3.13.139

data/lib/tina4/drivers/ultipa_graph_driver.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Ultipa graph adapter — the portable core built in GQL over tina4-ultipa.
 #

data/lib/tina4/env.rb

@@ -1,5 +1,9 @@
 # frozen_string_literal: true
-require "digest"
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 module Tina4
   # Legacy env var names that v3.12 has retired. If any of these are set in
@@ -84,11 +88,15 @@ module Tina4
     # signal for Auth.ensure_dev_secret to mint a per-machine random dev secret
     # (saved to gitignored .env.local) in dev, or to emit the actionable
     # "set TINA4_SECRET" warning in CI/prod. Parity with the Python master.
+    #
+    # TINA4_DEBUG is deliberately absent too: unset debug means OFF, and a boot
+    # side effect must never switch it on (ADR-0079 s3). `tina4ruby init`, an
+    # explicit developer action, writes TINA4_DEBUG=true into the project it
+    # scaffolds.
     DEFAULT_ENV = {
       "PROJECT_NAME" => "Tina4 Ruby Project",
       "TINA4_SWAGGER_VERSION" => "1.0.0",
       "TINA4_LOCALE" => "en",
-      "TINA4_DEBUG" => "true",
       "TINA4_LOG_LEVEL" => "ALL"
     }.freeze
 
@@ -260,11 +268,11 @@ module Tina4
         File.join(root_dir, ".env")
       end
 
+      # A missing .env gets the neutral defaults only. It no longer mints a
+      # TINA4_API_KEY: an MD5 of the clock is guessable, and that key opened
+      # the route auth gate and the dev-admin write gate (ADR-0079 s3).
       def create_default_env(path)
-        api_key = Digest::MD5.hexdigest(Time.now.to_s)
-        content = DEFAULT_ENV.map { |k, v| "#{k}=\"#{v}\"" }.join("\n")
-        content += "\nTINA4_API_KEY=\"#{api_key}\"\n"
-        File.write(path, content)
+        File.write(path, DEFAULT_ENV.map { |k, v| "#{k}=\"#{v}\"" }.join("\n") + "\n")
       end
 
       # Parse a dotenv file into ENV.

data/lib/tina4/error_overlay.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Debug — Rich error overlay for development mode.
 #

data/lib/tina4/events.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Events — Simple observer pattern for decoupled communication.
 #

data/lib/tina4/feedback.rb

@@ -1,8 +1,15 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "net/http"
 require "uri"
+require_relative "parse_json"
 
 module Tina4
   # ── Customer feedback widget — server-side plumbing ─────────────────
@@ -170,7 +177,7 @@ module Tina4
           req.body = JSON.generate(forward_body)
           resp = Net::HTTP.start(uri.host, uri.port, open_timeout: 5, read_timeout: 60) { |h| h.request(req) }
           parsed = begin
-            JSON.parse(resp.body.to_s)
+            Tina4.parse_json(resp.body.to_s)
           rescue JSON::ParserError
             nil
           end
@@ -293,7 +300,7 @@ module Tina4
         input.rewind if input.respond_to?(:rewind)
         raw = input.read
         return nil if raw.nil? || raw.empty?
-        JSON.parse(raw)
+        Tina4.parse_json(raw)
       rescue JSON::ParserError
         nil
       end

data/lib/tina4/field_types.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module FieldTypes

data/lib/tina4/form_parser.rb

@@ -0,0 +1,241 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+
+require "stringio"
+
+module Tina4
+  # multipart/form-data parsing, owned by Tina4 (no Rack).
+  #
+  # Replaces Rack::Request#POST, which Tina4::Request used for multipart bodies
+  # until rack stopped being a dependency. Field names nest exactly the way Rack
+  # nested them - `user[name]` becomes a hash, `tags[]` an array, `a[][x]` an
+  # array of hashes, a repeated plain name keeps its last value - so a Ruby app
+  # that posts nested forms sees the same body it always did. spec/form_parser_spec.rb
+  # pins every shape against values captured from Rack 3.2.7.
+  #
+  # Files are parsed in the SAME pass and keyed by field name, each name mapping
+  # to a LIST of descriptors so a repeated file field keeps every file
+  # (fileupload_contract upload-repeated-field-list).
+  #
+  # The part delimiter is CRLF + "--" + boundary, as RFC 2046 defines it, so a
+  # file whose bytes happen to contain "--boundary" mid-line is not cut short.
+  module FormParser
+    # A name nested deeper than this is refused rather than recursed into.
+    # Rack's QueryParser param_depth_limit, kept for the same reason.
+    PARAM_DEPTH_LIMIT = 32
+
+    # A field name that is both a value and a container (`a=1` then `a[b]=2`)
+    # or nests past PARAM_DEPTH_LIMIT. Rack raised here too.
+    class ParameterError < StandardError; end
+
+    # Marks a hash the NESTING built, as opposed to a value that happens to be a
+    # hash. Only these may be descended into.
+    class NestedParams < Hash; end
+    private_constant :NestedParams
+
+    module_function
+
+    # The boundary token from a multipart Content-Type, quotes removed; nil when
+    # there is none.
+    def boundary(content_type)
+      content_type.to_s.split(";").each do |part|
+        part = part.strip
+        next unless part.downcase.start_with?("boundary=")
+
+        value = part[9..].to_s.strip
+        value = value[1...-1] if value.length >= 2 && value.start_with?('"') && value.end_with?('"')
+        return value.empty? ? nil : value
+      end
+      nil
+    end
+
+    # Parse a multipart body.
+    #
+    # @return [Hash] { fields: Hash (nested, Rack-shaped), files: Hash{name => [descriptor]},
+    #   error: ParameterError or nil }
+    #   A descriptor is { filename:, type:, content:, size:, tempfile: } with the
+    #   RAW client filename - Tina4::Request.save_upload sanitises it on write.
+    #   A name conflict or over-deep nesting empties the fields and is returned
+    #   as :error rather than raised, so one bad field name cannot lose the files.
+    def parse_multipart(body, content_type)
+      token = boundary(content_type)
+      fields = NestedParams.new
+      files = {}
+      return { fields: {}, files: files, error: nil } if token.nil? || body.nil? || body.empty?
+
+      pairs = []
+      each_part(body.b, token) do |headers, content|
+        name, filename = disposition_params(headers["content-disposition"].to_s)
+        next if name.nil? || name.empty?
+
+        if filename.nil?
+          pairs << [name.dup.force_encoding(Encoding::UTF_8), text_value(content, headers["content-type"])]
+        else
+          (files[name] ||= []) << {
+            filename: filename.dup.force_encoding(Encoding::UTF_8).scrub,
+            type: headers["content-type"] || "application/octet-stream",
+            content: content,
+            size: content.bytesize,
+            tempfile: StringIO.new(content)
+          }
+        end
+      end
+      # A name conflict voids the FIELDS only (Rack raised for the whole form);
+      # the files were collected independently and survive it.
+      error = nil
+      begin
+        pairs.each { |name, value| normalize_params(fields, name, value, 0) }
+      rescue ParameterError => e
+        error = e
+        fields = NestedParams.new
+      end
+      { fields: to_plain_hash(fields), files: files, error: error }
+    end
+
+    # Yield [headers, content] for every part. headers keys are lowercased.
+    def each_part(body, token)
+      delimiter = "--#{token}".b
+      position = body.index(delimiter)
+      return if position.nil?
+
+      position += delimiter.bytesize
+      separator = "\r\n#{delimiter}".b
+      while position < body.bytesize
+        # "--" straight after a delimiter closes the body.
+        break if body.byteslice(position, 2) == "--"
+
+        position += 2 if body.byteslice(position, 2) == "\r\n"
+        header_end = body.index("\r\n\r\n", position)
+        break if header_end.nil?
+
+        next_delimiter = body.index(separator, header_end + 4)
+        break if next_delimiter.nil?
+
+        yield part_headers(body.byteslice(position, header_end - position)),
+              body.byteslice(header_end + 4, next_delimiter - header_end - 4)
+        position = next_delimiter + separator.bytesize
+      end
+    end
+
+    def part_headers(block)
+      headers = {}
+      block.split("\r\n").each do |line|
+        name, value = line.split(":", 2)
+        next if value.nil?
+
+        headers[name.strip.downcase] = value.strip.force_encoding(Encoding::UTF_8).scrub
+      end
+      headers
+    end
+
+    # name= and filename= from a Content-Disposition value, by PARAMETER (not by
+    # a substring match, which found "name=" inside "filename=").
+    def disposition_params(disposition)
+      params = {}
+      disposition.scan(/;\s*([A-Za-z0-9!#$%&'*+.^_`|~-]+)\s*=\s*("(?:[^"\\]|\\.)*"|[^;]*)/) do |key, raw|
+        value = raw.strip
+        value = value[1...-1].gsub(/\\(.)/, '\1') if value.start_with?('"') && value.end_with?('"') && value.length >= 2
+        params[key.downcase] ||= value
+      end
+      [params["name"], params["filename"]]
+    end
+
+    # A text field is UTF-8 unless the part says `text/plain; charset=...`
+    # (Rack's rule). An unknown charset falls back to binary, never raises.
+    def text_value(content, part_type)
+      encoding = Encoding::UTF_8
+      if part_type
+        type, *parameters = part_type.split(";").map(&:strip)
+        if type.casecmp?("text/plain")
+          parameters.each do |parameter|
+            key, value = parameter.split("=", 2)
+            next unless key&.casecmp?("charset") && value
+
+            encoding = begin
+              Encoding.find(value.delete('"'))
+            rescue ArgumentError
+              Encoding::BINARY
+            end
+          end
+        end
+      end
+      content.dup.force_encoding(encoding)
+    end
+
+    # Rack::QueryParser#normalize_params, ported. Returns params.
+    def normalize_params(params, name, value, depth)
+      raise ParameterError, "field name nests deeper than #{PARAM_DEPTH_LIMIT} levels" if depth >= PARAM_DEPTH_LIMIT
+
+      if depth.zero?
+        start = name.index("[", 1)
+        key = start ? name[0, start] : name
+        after = start ? name[start..] : ""
+      elsif name.start_with?("[]")
+        key = "[]"
+        after = name[2..]
+      elsif name.start_with?("[") && (close = name.index("]", 1))
+        key = name[1, close - 1]
+        after = name[(close + 1)..]
+      else
+        key = name
+        after = ""
+      end
+      return if key.empty?
+
+      if after.empty?
+        return [value] if key == "[]" && !depth.zero?
+
+        params[key] = value
+      elsif after == "["
+        params[name] = value
+      elsif after == "[]"
+        params[key] ||= []
+        raise ParameterError, "expected Array for `#{key}'" unless params[key].is_a?(Array)
+
+        params[key] << value
+      elsif after.start_with?("[]")
+        child_key = after[3, after.length - 4] if after[2] == "[" && after.end_with?("]")
+        child_key = after[2..] if child_key.nil? || child_key.empty? || child_key.include?("[") || child_key.include?("]")
+        params[key] ||= []
+        raise ParameterError, "expected Array for `#{key}'" unless params[key].is_a?(Array)
+
+        last = params[key].last
+        if last.is_a?(NestedParams) && !nested_key?(last, child_key)
+          normalize_params(last, child_key, value, depth + 1)
+        else
+          params[key] << normalize_params(NestedParams.new, child_key, value, depth + 1)
+        end
+      else
+        params[key] ||= NestedParams.new
+        raise ParameterError, "expected Hash for `#{key}'" unless params[key].is_a?(NestedParams)
+
+        params[key] = normalize_params(params[key], after, value, depth + 1)
+      end
+      params
+    end
+
+    def nested_key?(hash, key)
+      return false if key.include?("[]")
+
+      key.split(/[\[\]]+/).reject(&:empty?).reduce(hash) do |level, part|
+        return false unless level.is_a?(NestedParams) && level.key?(part)
+
+        level[part]
+      end
+      true
+    end
+
+    def to_plain_hash(value)
+      case value
+      when Hash then value.each_with_object({}) { |(key, child), plain| plain[key] = to_plain_hash(child) }
+      when Array then value.map { |child| to_plain_hash(child) }
+      else value
+      end
+    end
+  end
+end