tina4ruby 3.13.138 → 3.13.139

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d0175b940e39eb271fcdda84cecc6893217d9d660febdcd0afc2f96d8c38dfe
-  data.tar.gz: b44423de677c9523749b49db4814e156bc621090167a8870d0335ca46cef7af3
+  metadata.gz: 49ef08b44463d47d804c054dce8bb194276945134a618369e9d951ce239fd4cb
+  data.tar.gz: 69b761361564c42e91584a7029fcd5fb067d2d3dc9103614f37662a7a17be707
 SHA512:
-  metadata.gz: eb1cf1ca28e038b3d3704fd41bfad3a3e176a114e0b82875ae26af0d0a15e7f8117003c6d0f48c5f44c87a3096eaa27f6683f944df80c04845536ee431ed782d
-  data.tar.gz: e48d0a97a012fbc94b256dbddbf1fd911b39dfdff548e63516d9daf3f2b6aad2028e8706fe3da9c2f522aca427ab8440f5c24689d3f448161ea24f748fb91cc3
+  metadata.gz: c7db9c5c8d7c0242fdbb2e3a7b43b80b5567d46443a3b029e7e546daf4b8f6eb508b7671ae077e3a661e8f07bf15e0ba809fe9e5259e5bb7117ee67afc35828d
+  data.tar.gz: 975471f353c0f9804bc7678e9f2bafdd8f47d7eb44f50d54347ea08454b8560fc15b3bb8c740851cef08926a28f349e7a8121c5c09e7ca90f4e9a797f418ad0d

data/CHANGELOG.md

@@ -6,6 +6,10 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.139
+
+Outbound requests from the Api client and Web Push are guarded against SSRF: private, loopback and link-local targets are refused unless explicitly allowed (ADR-0084). The development admin surface is hardened -- the health endpoint no longer discloses the framework version outside debug, and development binds loopback by default (ADR-0078). Production refuses to boot with a blank or short HMAC secret so tokens cannot be forged (ADR-0079). Queue reject() dead-letters immediately and size("dead") reports the dead-letter depth (ADR-0022, ADR-0023). Session table first-use is concurrency-safe across every engine. Mail encryption follows the configured TLS/STARTTLS contract (ADR-0071). Log output, driver-install hints and WSDL/mail diagnostics redact credentials and URLs. Publishing is gated behind a protected environment with release actions pinned by commit SHA, and a medium-severity API token-leak path is closed. The framework still has no required runtime dependencies.
+
 ## 3.13.138
 
 HTTP clients strip configured-origin Authorization and Cookie credentials from off-origin initial targets across normal, upload, download and streaming paths. Forwarded Host and Proto require a trusted raw transport peer. Every development HTTP method uses the peer, Host and Origin boundary; resolved file paths and database identifiers are confined. Remote non-MCP development routes require the dedicated token while the accepted MCP transport API_KEY fallback remains supported. Development file readers validate and read one descriptor, preserving public in-project symlinks and existing size behavior. Database, MQTT and malformed Redis backplane diagnostics redact connection credentials; raw file responses preserve exact binary bytes.

data/lib/tina4/api.rb

@@ -13,6 +13,7 @@ require "json"
 require_relative "base64"
 require "securerandom"
 require_relative "parse_json"
+require_relative "ssrf"
 
 module Tina4
   # Statuses that warrant an automatic retry when max_retries > 0: rate-limit
@@ -108,7 +109,7 @@ module Tina4
     def initialize(base_url, headers: {}, timeout: 30,
                    bearer_token: nil, username: nil, password: nil,
                    verify_ssl: nil, max_retries: 0, retry_backoff: 0.5,
-                   transport: nil, cookies: false)
+                   transport: nil, cookies: false, allow_hosts: nil)
       if !transport.nil? && !transport.respond_to?(:call)
         raise ArgumentError, "transport must respond to #call(method, url, headers, body, timeout)"
       end
@@ -130,6 +131,8 @@ module Tina4
       @transport = transport
       @cookies_enabled = cookies ? true : false
       @cookies = {}
+      # SSRF guard (ADR-0084): explicit allow-list of hosts / host:port / CIDRs.
+      @allow_hosts = allow_hosts || []
 
       # Bearer wins over basic-auth when both passed
       if bearer_token
@@ -455,6 +458,13 @@ module Tina4
                       when "HEAD"   then Net::HTTP::Head
                       else raise ArgumentError, "unsupported stream method: #{method}"
                       end
+      # SSRF guard (ADR-0084): refuse a private/internal target before connect.
+      begin
+        Tina4::Ssrf.guard_url!(uri, @allow_hosts)
+      rescue Tina4::SsrfError => e
+        raise APIStreamError.new(e.message)
+      end
+
       request = request_class.new(uri)
       apply_headers(request, headers || {})
       cookie = cookie_header
@@ -596,6 +606,12 @@ module Tina4
       current_body = body
 
       loop do
+        # SSRF guard (ADR-0084): re-validated per hop, so a redirect to a
+        # private/internal address is refused even when the initial URL was
+        # public. Raises SsrfError; attempt_request/download turn it into a
+        # status-0 error response.
+        Tina4::Ssrf.guard_url!(current_uri, @allow_hosts)
+
         http = Net::HTTP.new(current_uri.host, current_uri.port)
         http.use_ssl = current_uri.scheme == "https"
         # Only disable verification when EXPLICITLY false — nil/true keep the

data/lib/tina4/auth.rb

@@ -68,13 +68,72 @@ module Tina4
     # rejected for no real reason; RFC 7519 explicitly allows "a small leeway".
     JWT_LEEWAY_SECONDS = 60
 
+    # Token purposes that are never an identity (ADR-0079 s1). Frond's
+    # form_token signs a JWT with the same TINA4_SECRET as an auth token, marked
+    # "type" => "form". A form token proves where a write came from, never who
+    # the caller is, so every identity gate refuses these purposes. valid_token
+    # itself stays purpose-neutral: CsrfMiddleware needs it for form tokens.
+    NON_IDENTITY_TOKEN_TYPES = %w[form].freeze
+
+    # Minimum HMAC key length in bytes (ADR-0079 s2): the HS256 output size,
+    # RFC 7518 s3.2. A blank key is the shortest case - anyone can reproduce an
+    # HMAC made with it.
+    MIN_SECRET_BYTES = 32
+
+    # The HMAC signing key is blank or shorter than MIN_SECRET_BYTES. An
+    # ArgumentError, Ruby's equivalent of Python's ValueError.
+    class InsecureSecretError < ArgumentError; end
+
     class << self
+      # Explicitly provision an RS256 key pair in <root_dir>/.keys (opt-in). The
+      # framework never calls this on its own: a blank TINA4_SECRET used to mint
+      # a key pair implicitly at boot (ADR-0079 s2).
       def setup(root_dir = Dir.pwd)
         @keys_dir = File.join(root_dir, KEYS_DIR)
         FileUtils.mkdir_p(@keys_dir)
         ensure_keys
       end
 
+      # Point RS256 at <root_dir>/.keys WITHOUT creating anything. Boot uses
+      # this, so an operator-provisioned key pair there keeps working.
+      def keys_root=(root_dir)
+        @keys_dir = File.join(root_dir, KEYS_DIR)
+        @private_key = nil
+        @public_key = nil
+      end
+
+      # True when a VERIFIED payload may stand for a caller's identity. A payload
+      # whose "type" is a reserved non-identity purpose (a Frond form token) is
+      # refused; application payloads are otherwise untouched.
+      def identity_payload?(payload)
+        payload.is_a?(Hash) && !NON_IDENTITY_TOKEN_TYPES.include?(payload["type"])
+      end
+
+      # The actionable error for a weak HMAC key, or nil when the key is usable.
+      def insecure_secret_message(secret)
+        length = secret.to_s.bytesize
+        return nil if length >= MIN_SECRET_BYTES
+
+        what = length.zero? ? "is not set" : "is #{length} bytes"
+        "Auth: TINA4_SECRET #{what}; an HMAC JWT secret must be at least " \
+          "#{MIN_SECRET_BYTES} bytes. Generate one with `openssl rand -hex 32` and set " \
+          "TINA4_SECRET in your environment or .env."
+      end
+
+      # Refuse to boot with a secret that makes tokens forgeable (ADR-0079 s2).
+      # Outside dev a blank TINA4_SECRET is refused; in any mode a set-but-short
+      # one is refused. An operator-provisioned RS256 key pair in .keys/ stands
+      # in for the secret. Raises InsecureSecretError with the actionable message.
+      def require_boot_secret!
+        return if rsa_keys_present?
+
+        secret = ENV["TINA4_SECRET"].to_s
+        return if secret.empty? && dev?
+
+        message = insecure_secret_message(secret)
+        raise InsecureSecretError, message if message
+      end
+
       # Boot-time bootstrap (run once after env load, before auth is used).
       #
       # Mirrors the Python master's tina4_python.auth.ensure_dev_secret:
@@ -123,15 +182,17 @@ module Tina4
 
       # ── HS256 helpers (stdlib only, no gem) ──────────────────────
 
-      # Returns true when SECRET env var is set and no RSA keys exist in .keys/
+      # HMAC with TINA4_SECRET unless an RS256 key pair has been provisioned in
+      # .keys/ (kept for existing deployments). A blank secret no longer falls
+      # back to an implicitly generated key pair: it is refused (ADR-0079 s2).
       def use_hmac?
-        secret = ENV["TINA4_SECRET"]
-        return false if secret.nil? || secret.empty?
+        !rsa_keys_present?
+      end
 
-        # If RSA keys already exist on disk, prefer RS256 for backward compat
+      def rsa_keys_present?
         @keys_dir ||= File.join(Dir.pwd, KEYS_DIR)
-        !(File.exist?(File.join(@keys_dir, "private.pem")) &&
-          File.exist?(File.join(@keys_dir, "public.pem")))
+        File.exist?(File.join(@keys_dir, "private.pem")) &&
+          File.exist?(File.join(@keys_dir, "public.pem"))
       end
 
       # Lazy per-call secret resolver. When the secret is blank, emit the
@@ -180,6 +241,9 @@ module Tina4
       # HMAC the signing input with the digest the algorithm actually names, so the
       # header's "alg" can never disagree with the bytes we produced.
       def hmac_signature(algorithm, secret, signing_input)
+        weak = insecure_secret_message(secret)
+        raise InsecureSecretError, weak if weak
+
         OpenSSL::HMAC.digest(HMAC_ALGORITHMS.fetch(algorithm).new, secret.to_s, signing_input)
       end
 
@@ -253,6 +317,15 @@ module Tina4
         # configuration error that must surface, not become a nil "invalid token".
         alg = resolve_algorithm(algorithm)
 
+        # A blank or short key verifies tokens anyone can mint, so the token is
+        # REJECTED (fail closed with a 401, never a 500) and the operator is
+        # told why. ADR-0079 s2.
+        weak = insecure_secret_message(secret)
+        if weak
+          log_warning(weak)
+          return nil
+        end
+
         decode_envelope(token, alg) do |input, signature|
           expected = hmac_signature(alg, secret, input)
           # Constant-time comparison to prevent timing attacks. Lengths must match
@@ -310,7 +383,6 @@ module Tina4
         elsif use_hmac?
           hmac_encode(claims, hmac_secret, algorithm: algorithm)
         else
-          ensure_keys
           rs256_encode(claims)
         end
       end
@@ -327,7 +399,6 @@ module Tina4
         if use_hmac?
           hmac_decode(token, hmac_secret) # returns Hash payload or nil
         else
-          ensure_keys
           rs256_decode(token)
         end
       end
@@ -407,10 +478,11 @@ module Tina4
         # than this process's env-resolved defaults.
         payload = if secret || algorithm
                     hmac_decode(token, secret || hmac_secret, algorithm: algorithm)
-                  elsif valid_token(token)
-                    get_payload(token)
+                  else
+                    valid_token(token)
                   end
-        return payload if payload
+        # A form token is not an identity (ADR-0079 s1).
+        return identity_payload?(payload) ? payload : nil if payload
 
         # API_KEY bypass — timing-safe comparison via validate_api_key
         # (OpenSSL.fixed_length_secure_compare). Parity with Python's
@@ -451,9 +523,13 @@ module Tina4
           token = Regexp.last_match(1)
 
           # JWT first, then the API key — same order and same payload shape as
-          # authenticate_request above (and as Python/PHP/Node).
-          if valid_token(token)
-            env["tina4.auth"] = get_payload(token)
+          # authenticate_request above (and as Python/PHP/Node). A form token is
+          # not an identity (ADR-0079 s1).
+          payload = valid_token(token)
+          if payload
+            return false unless identity_payload?(payload)
+
+            env["tina4.auth"] = payload
             return true
           end
 

data/lib/tina4/cache_backends/base_backend.rb

@@ -78,6 +78,14 @@ module Tina4
       def available?
         true
       end
+
+      # When available? is false because a required gem is not installed, the
+      # sentence that names the gem and the install command; nil otherwise.
+      #
+      # @return [String, nil]
+      def missing_driver_message
+        nil
+      end
     end
   end
 end

data/lib/tina4/cache_backends/mongo_backend.rb

@@ -23,6 +23,7 @@ module Tina4
         @hits = 0
         @misses = 0
         @coll = nil
+        @driver_missing = false
         begin
           require "mongo"
           Mongo::Logger.logger.level = Logger::FATAL if defined?(Mongo::Logger)
@@ -39,7 +40,12 @@ module Tina4
           @coll = client[:tina4_cache]
           @coll.indexes.create_one({ expires_at: 1 }, expire_after: 0)
           client.database.command(ping: 1)
-        rescue LoadError, StandardError
+        rescue LoadError
+          # Recorded apart from a service failure so the factory's fallback
+          # warning names the gem only when the gem is really what is missing.
+          @driver_missing = true
+          @coll = nil
+        rescue StandardError
           @coll = nil
         end
       end
@@ -48,6 +54,15 @@ module Tina4
         !@coll.nil?
       end
 
+      # The install hint for the factory's fallback warning, or nil when the
+      # gem loaded and the service is what failed.
+      def missing_driver_message
+        return nil unless @driver_missing
+
+        "The 'mongo' gem is required for the mongodb cache backend. Install it with: " \
+          "bundle add mongo (or add gem \"mongo\" to your Gemfile)"
+      end
+
       def get(key)
         if @coll.nil?
           @misses += 1

data/lib/tina4/cache_backends.rb

@@ -92,9 +92,11 @@ module Tina4
 
       # Configured backend unusable — degrade to the file backend.
       begin
+        install_hint = be.missing_driver_message
         Tina4::Log.warning(
           "Cache backend '#{backend}' is unavailable " \
-          "(driver missing or service unreachable) — falling back to 'file'."
+          "(driver missing or service unreachable) — falling back to 'file'." \
+          "#{install_hint ? " #{install_hint}" : ""}"
         )
       rescue StandardError
         # Logging must never break cache construction.

data/lib/tina4/cli.rb

@@ -715,6 +715,11 @@ module Tina4
 
       require_relative "../tina4"
 
+      # --production turns debug off: the explicit flag beats .env and the
+      # environment (ADR-0041, ADR-0079 s3). Set before the env files load,
+      # which are first-wins. It used to only choose Puma.
+      ENV["TINA4_DEBUG"] = "false" if options[:production]
+
       root_dir = Dir.pwd
       Tina4.initialize!(root_dir)
 

data/lib/tina4/dev_admin.rb

@@ -822,10 +822,17 @@ module Tina4
         resolved = begin
           safe_project_path(file_path, extra_roots: [scan_root])
         rescue ArgumentError
-          begin
-            scan_root ? safe_project_path(File.join(scan_root, file_path), extra_roots: [scan_root]) : nil
-          rescue ArgumentError
-            nil
+          # A RELATIVE path may be retried against the last scan root; an
+          # absolute path that resolved outside the project is simply outside -
+          # never re-based under the scan root (File.join would fold it into a
+          # bogus in-root path that 404s instead of refusing 403). Parity with
+          # Python/Node: outside -> 403.
+          if scan_root && !file_path.empty? && !File.absolute_path?(file_path)
+            begin
+              safe_project_path(File.join(scan_root, file_path), extra_roots: [scan_root])
+            rescue ArgumentError
+              nil
+            end
           end
         end
         return json_response({ "error" => "Path outside project" }, 403) if !file_path.empty? && resolved.nil?

data/lib/tina4/drivers/sqlite_driver.rb

@@ -39,6 +39,14 @@ module Tina4
 
         @connection = SQLite3::Database.new(db_path)
         @connection.results_as_hash = true
+        # Wait up to 5 s for another process's write lock instead of failing at
+        # once with SQLite3::BusyException. The sqlite3 gem's default is NO wait,
+        # so two processes writing the same file collided on the first overlap:
+        # MEASURED on the lab, five of six processes racing a first session write
+        # died with "database is locked". 5000 ms matches PHP's busyTimeout(5000)
+        # and Python's sqlite3 default. Set BEFORE the WAL pragma so that write
+        # waits too.
+        @connection.busy_timeout = 5000
         @connection.execute("PRAGMA journal_mode=WAL")
         @connection.execute("PRAGMA foreign_keys=ON")
       end

data/lib/tina4/env.rb

@@ -5,8 +5,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
-require "digest"
-
 module Tina4
   # Legacy env var names that v3.12 has retired. If any of these are set in
   # the environment we refuse to boot — silently ignoring them would cause
@@ -90,11 +88,15 @@ module Tina4
     # signal for Auth.ensure_dev_secret to mint a per-machine random dev secret
     # (saved to gitignored .env.local) in dev, or to emit the actionable
     # "set TINA4_SECRET" warning in CI/prod. Parity with the Python master.
+    #
+    # TINA4_DEBUG is deliberately absent too: unset debug means OFF, and a boot
+    # side effect must never switch it on (ADR-0079 s3). `tina4ruby init`, an
+    # explicit developer action, writes TINA4_DEBUG=true into the project it
+    # scaffolds.
     DEFAULT_ENV = {
       "PROJECT_NAME" => "Tina4 Ruby Project",
       "TINA4_SWAGGER_VERSION" => "1.0.0",
       "TINA4_LOCALE" => "en",
-      "TINA4_DEBUG" => "true",
       "TINA4_LOG_LEVEL" => "ALL"
     }.freeze
 
@@ -266,11 +268,11 @@ module Tina4
         File.join(root_dir, ".env")
       end
 
+      # A missing .env gets the neutral defaults only. It no longer mints a
+      # TINA4_API_KEY: an MD5 of the clock is guessable, and that key opened
+      # the route auth gate and the dev-admin write gate (ADR-0079 s3).
       def create_default_env(path)
-        api_key = Digest::MD5.hexdigest(Time.now.to_s)
-        content = DEFAULT_ENV.map { |k, v| "#{k}=\"#{v}\"" }.join("\n")
-        content += "\nTINA4_API_KEY=\"#{api_key}\"\n"
-        File.write(path, content)
+        File.write(path, DEFAULT_ENV.map { |k, v| "#{k}=\"#{v}\"" }.join("\n") + "\n")
       end
 
       # Parse a dotenv file into ENV.

data/lib/tina4/frond.rb

@@ -3258,9 +3258,11 @@ module Tina4
       sid = form_token_session_id.to_s
       payload["session_id"] = sid unless sid.empty?
 
+      # get_token's expires_in is MINUTES, like every framework's. This used to
+      # pass minutes * 60, so a form token lived 60 hours, not 60 minutes
+      # (ADR-0079 s5).
       ttl_minutes = (ENV["TINA4_TOKEN_LIMIT"] || "60").to_i
-      expires_in = ttl_minutes * 60
-      Tina4::Auth.create_token(payload, expires_in: expires_in)
+      Tina4::Auth.create_token(payload, expires_in: ttl_minutes)
     end
 
     def self.generate_form_token(descriptor = "")

data/lib/tina4/graphql.rb

@@ -227,6 +227,14 @@ module Tina4
       @source = source
       @tokens = tokenize(source)
       @pos = 0
+      # F2: bound the parser's own recursion. A deeply nested query
+      # ("{a{a{a...}}}") otherwise recurses in parse_selection_set until Ruby
+      # raises SystemStackError — which is NOT a StandardError, so the public
+      # execute's `rescue => e` misses it and it escapes as a 500. Raising a
+      # GraphQLError (a StandardError) at the depth bound keeps it caught and
+      # returned as a clean GraphQL error. Reuses TINA4_GRAPHQL_MAX_DEPTH.
+      @depth = 0
+      @max_depth = Integer(ENV.fetch("TINA4_GRAPHQL_MAX_DEPTH", "50"), exception: false) || 50
     end
 
     def parse
@@ -439,6 +447,19 @@ module Tina4
     end
 
     def parse_selection_set
+      @depth += 1
+      if @max_depth.positive? && @depth > @max_depth
+        @depth -= 1
+        raise GraphQLError, "Query exceeds maximum depth of #{@max_depth}"
+      end
+      begin
+        parse_selection_set_inner
+      ensure
+        @depth -= 1
+      end
+    end
+
+    def parse_selection_set_inner
       expect(:punct, "{")
       selections = []
       until current&.value == "}"
@@ -599,14 +620,47 @@ module Tina4
   class GraphQLExecutor
     # max_depth bounds selection-set nesting (DoS / stack-overflow guard).
     # Threaded down from the owning GraphQL instance; <= 0 disables the guard.
-    attr_accessor :max_depth
+    attr_accessor :max_depth, :max_nodes
 
-    def initialize(schema, max_depth: 50)
+    def initialize(schema, max_depth: 50, max_nodes: 1000)
       @schema = schema
       @max_depth = max_depth
+      # F2: maximum expanded selection nodes per query. The depth guard bounds
+      # NESTING but not WIDTH — a fragment bomb stays shallow while expanding to
+      # millions of fields, and an alias explosion is not deep at all. This
+      # budget bounds the expanded selection tree (fragments expanded, each
+      # alias counted) so both are rejected before any resolver runs.
+      @max_nodes = max_nodes
+    end
+
+    # F2: count the expanded selection nodes, aborting past max_nodes. Fragment
+    # spreads are expanded (so a fragment bomb is counted, not the small
+    # unexpanded document) and every field — including each alias — counts once.
+    # Capped by max_nodes and by the depth cap, so a circular fragment trips the
+    # budget instead of looping and the check can never cost more than the budget.
+    def query_complexity(selections, fragments, depth, count)
+      depth_cap = (@max_depth && @max_depth.positive?) ? @max_depth : 1000
+      return count if depth > depth_cap
+
+      selections.each do |sel|
+        count += 1
+        return count if count > @max_nodes
+
+        case sel[:kind]
+        when :fragment_spread
+          frag = fragments[sel[:name]]
+          count = query_complexity(frag[:selection_set], fragments, depth + 1, count) if frag
+        when :inline_fragment
+          count = query_complexity(sel[:selection_set] || [], fragments, depth + 1, count)
+        else
+          count = query_complexity(sel[:selection_set], fragments, depth + 1, count) if sel[:selection_set]
+        end
+        return count if count > @max_nodes
+      end
+      count
     end
 
-    def execute(document, variables: {}, context: {}, operation_name: nil)
+    def execute(document, variables: {}, context: {}, operation_name: nil, allow_mutations: true)
       # Collect fragments
       fragments = {}
       operations = []
@@ -631,9 +685,28 @@ module Tina4
 
       raise GraphQLError, "Unknown operation: #{operation_name}" unless operation
 
+      # F2: reject an over-complex query (fragment bomb / alias explosion) before
+      # any resolver runs.
+      if @max_nodes && @max_nodes.positive?
+        complexity = query_complexity(operation[:selection_set], fragments, 1, 0)
+        if complexity > @max_nodes
+          return { "data" => nil,
+                   "errors" => [{ "message" => "Query exceeds maximum complexity of #{@max_nodes} nodes" }] }
+        end
+      end
+
       # Resolve variables
       resolved_vars = resolve_variables(operation[:variables], variables)
 
+      # F4 (CSRF): a mutation must never run over a GET. A cross-site GET (an
+      # <img>/<script> src, a pre-rendered link) carries the victim's cookies
+      # and would otherwise trigger a state change. The GET handler passes
+      # allow_mutations: false; POST (which a browser cannot cross-site forge
+      # with a JSON content-type without a CORS preflight) still allows them.
+      if operation[:operation] == :mutation && !allow_mutations
+        raise GraphQLError, "Mutations are not allowed over GET"
+      end
+
       # Choose root fields
       root_fields = case operation[:operation]
                     when :query    then @schema.queries
@@ -897,6 +970,15 @@ module Tina4
       @executor&.max_depth = value
     end
 
+    # F2 complexity budget — see GraphQLExecutor#max_nodes. Writer keeps the
+    # executor in sync so tests/app code can override it.
+    attr_reader :max_nodes
+
+    def max_nodes=(value)
+      @max_nodes = value
+      @executor&.max_nodes = value
+    end
+
     # Class-level toggle for ORM auto-schema generation. Defaults to true,
     # can be disabled via TINA4_GRAPHQL_AUTO_SCHEMA=false. Initializers and
     # user app code can branch on this before calling `schema.from_orm(...)`.
@@ -969,7 +1051,10 @@ module Tina4
       # GraphQL DoS / stack-overflow vector. Default 50 is far beyond any
       # legitimate query; TINA4_GRAPHQL_MAX_DEPTH <= 0 disables the guard.
       @max_depth = Integer(ENV.fetch("TINA4_GRAPHQL_MAX_DEPTH", "50"), exception: false) || 50
-      @executor = GraphQLExecutor.new(@schema, max_depth: @max_depth)
+      # F2: expanded-node (complexity) budget — bounds query WIDTH (fragment
+      # bombs, alias explosions), which the depth guard does not.
+      @max_nodes = Integer(ENV.fetch("TINA4_GRAPHQL_MAX_NODES", "1000"), exception: false) || 1000
+      @executor = GraphQLExecutor.new(@schema, max_depth: @max_depth, max_nodes: @max_nodes)
       @field_resolvers = {}
 
       # Drain any resolvers registered via the class-level GraphQL.resolve()
@@ -1010,10 +1095,11 @@ module Tina4
     end
 
     # Execute a query string directly
-    def execute(query, variables: {}, context: {}, operation_name: nil)
+    def execute(query, variables: {}, context: {}, operation_name: nil, allow_mutations: true)
       parser = GraphQLParser.new(query)
       document = parser.parse
-      @executor.execute(document, variables: variables, context: context, operation_name: operation_name)
+      @executor.execute(document, variables: variables, context: context,
+                        operation_name: operation_name, allow_mutations: allow_mutations)
     rescue GraphQLError => e
       { "data" => nil, "errors" => [{ "message" => e.message }] }
     rescue => e
@@ -1083,6 +1169,16 @@ module Tina4
 
       graphql = self
       Tina4.post path, auth: false do |request, response|
+        # F4 (CSRF): require an application/json content-type. A browser can
+        # only send a cross-site POST with text/plain, form-urlencoded or
+        # multipart bodies without a CORS preflight; demanding JSON forces the
+        # preflight (and its same-origin/allow-list check) for any cross-site
+        # caller, so a forged form cannot drive a mutation. Same-origin XHR/
+        # fetch and server clients set application/json and are unaffected.
+        unless request.content_type.to_s.downcase.include?("application/json")
+          next response.json({ "data" => nil, "errors" => [{ "message" =>
+            "GraphQL requires a Content-Type of application/json" }] }, 415)
+        end
         # handle_request expects the raw JSON text (it JSON.parses internally),
         # so read body_raw — request.body now returns the PARSED payload.
         body = request.body_raw
@@ -1090,13 +1186,15 @@ module Tina4
         response.json(result)
       end
 
-      # Optional: GET for GraphiQL/introspection
+      # Optional: GET for GraphiQL/introspection. Queries only — a mutation over
+      # GET is refused (F4), since a cross-site GET carries the victim's cookies.
       Tina4.get path, auth: false do |request, response|
         query = request.query["query"]
         if query
           variables = request.query["variables"]
           variables = Tina4.parse_json(variables) if variables.is_a?(String) && !variables.empty?
-          result = graphql.execute(query, variables: variables || {}, context: { request: request })
+          result = graphql.execute(query, variables: variables || {},
+                                   context: { request: request }, allow_mutations: false)
           response.json(result)
         else
           response.html(graphiql_html(path))

data/lib/tina4/job.rb

@@ -113,9 +113,22 @@ module Tina4
       self
     end
 
-    # Reject this job with a reason. Alias for fail().
+    # Reject this job permanently — dead-letter it NOW, no retry (ADR-0023).
+    #
+    # Distinct from fail(): fail() records a failed attempt and only
+    # dead-letters once max_retries is exhausted (the job is retried first).
+    # reject() is for a message the consumer KNOWS is poison — it goes straight
+    # to the dead-letter store on this call. AMQP basic.reject(requeue=false)
+    # semantics. Was a literal alias for fail() before 3.13.139.
     def reject(reason = "")
-      fail(reason)
+      unless @queue
+        @attempts += 1
+        @status = :dead
+        return self
+      end
+      @queue.backend.reject(self, reason)
+      @status = :dead
+      self
     end
   end
 end

data/lib/tina4/mcp.rb

@@ -159,7 +159,9 @@ module Tina4
   #
   # Python master parity: tina4_python.mcp.is_loopback.
   def self.is_loopback?(ip)
-    return true if ip.nil? || ip.to_s.empty?
+    # An empty or missing peer is UNKNOWN and is not loopback: a runtime path
+    # that lost its socket address must fail closed (ADR-0079 s4).
+    return false if ip.nil? || ip.to_s.empty?
 
     addr = ip.to_s.strip.downcase
     addr = addr[7..] if addr.start_with?("::ffff:")

data/lib/tina4/middleware.rb

@@ -677,7 +677,9 @@ module Tina4
         auth_header = (headers["authorization"] || headers["Authorization"] || "").to_s
         if auth_header.start_with?("Bearer ")
           bearer_token = auth_header[7..].to_s.strip
-          return [request, response] if !bearer_token.empty? && Tina4::Auth.valid_token(bearer_token)
+          # Only an IDENTITY token marks an API client; a form token in the
+          # Bearer slot is not one and does not skip the check (ADR-0079 s1).
+          return [request, response] if !bearer_token.empty? && Tina4::Auth.identity_payload?(Tina4::Auth.valid_token(bearer_token))
         end
 
         # 7. A token in the query string leaks through logs/referers/history --