tina4ruby 3.13.138 → 3.13.140

data/lib/tina4/sqlite_path_resolver.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+require "fileutils"
+
+module Tina4
+  # Shared SQLite database-path resolution for the two SQLite resolvers.
+  #
+  # `resolve_path` used to be copy-pasted into Tina4::Drivers::SqliteDriver and
+  # Tina4::Adapters::Sqlite3Adapter with drifted scheme-stripping. This module is
+  # the single home for the logic; both classes `extend` it, so both keep a
+  # `.resolve_path` class method backed by ONE implementation and can never
+  # drift again.
+  #
+  # Convention (matches tina4-python, tina4-php, tina4-nodejs):
+  #   sqlite::memory:              → :memory:
+  #   sqlite:///:memory:           → :memory:
+  #   sqlite:///app.db             → {cwd}/app.db          (relative)
+  #   sqlite:///data/app.db        → {cwd}/data/app.db     (relative; auto-mkdir under cwd)
+  #   sqlite:////var/data/app.db   → /var/data/app.db      (absolute; no auto-mkdir)
+  #   sqlite:///C:/Users/app.db    → C:/Users/app.db       (Windows absolute)
+  #
+  # `sqlite3:` is a documented alias for `sqlite:` and is normalised first.
+  # Never mkdir outside cwd — that was the root cause of the
+  # "Read-only file system: '/data'" crash on macOS.
+  module SqlitePathResolver
+    # Resolve a SQLite URL / path against the project root (cwd).
+    #
+    # @param connection_string [String] a sqlite: / sqlite3: URL or bare path
+    # @return [String] the resolved path to hand to the driver, or ":memory:"
+    def resolve_path(connection_string)
+      return ":memory:" if connection_string == "sqlite::memory:" || connection_string == "sqlite:///:memory:"
+
+      # `sqlite3:` is a documented alias for `sqlite:`; normalise it FIRST or the
+      # strips below miss and the file ends up literally named "sqlite3:app.db"
+      # (and a colon is an illegal filename character on Windows).
+      normalised = connection_string.to_s.sub(/^sqlite3:/, "sqlite:")
+      raw = normalised.sub(%r{^sqlite:///}, "").sub(%r{^sqlite://}, "").sub(/^sqlite:/, "")
+      return ":memory:" if raw == ":memory:"
+
+      is_windows_abs = raw.match?(%r{^[A-Za-z]:[/\\]})
+      is_unix_abs    = raw.start_with?("/")
+
+      if is_windows_abs || is_unix_abs
+        # Absolute — trust the user; don't auto-mkdir outside cwd.
+        raw
+      else
+        # Relative — resolve under cwd; create the parent (mode 0775) ONLY when
+        # it stays inside cwd (ADR-0086). A relative path whose parent escapes
+        # the project (e.g. "../../etc/foo.db") is REFUSED loudly here — never
+        # the silent mkdir outside the project that used to happen.
+        resolved = File.join(Dir.pwd, raw)
+        parent = File.dirname(resolved)
+        expanded_parent = File.expand_path(parent)
+        cwd = File.expand_path(Dir.pwd)
+        unless expanded_parent == cwd || expanded_parent.start_with?(cwd + File::SEPARATOR)
+          raise ArgumentError,
+                "SQLite path #{connection_string.inspect} resolves outside the project " \
+                "directory: #{expanded_parent.inspect} is not within #{cwd.inspect}. " \
+                "Tina4 refuses to create directories outside the project (ADR-0086). " \
+                "Use an absolute path for a database that lives outside the project."
+        end
+        FileUtils.mkdir_p(parent, mode: 0o775) unless File.directory?(parent)
+        resolved
+      end
+    end
+  end
+end

data/lib/tina4/sso.rb

@@ -22,6 +22,30 @@ module Tina4
   class Sso
     PENDING_KEY = "_tina4_sso_pending"
     SESSION_KEY = "_tina4_sso"
+
+    # The stored SSO identity, only while it is live (ADR-0079 s5). +stored+ is
+    # the reserved _tina4_sso session value. The identity needs an issuer and a
+    # subject, and a numeric expires_at that is 0 (the provider gave no
+    # lifetime) or still in the future.
+    def self.live_session_identity(stored)
+      return nil unless stored.is_a?(Hash)
+
+      identity = stored["identity"]
+      return nil unless identity.is_a?(Hash) && identity["issuer"] && identity["subject"]
+
+      expires_at = stored.fetch("expires_at", 0)
+      return nil unless expires_at.is_a?(Integer) || expires_at.is_a?(Float)
+      return nil if expires_at.positive? && Time.now.to_i >= expires_at
+
+      identity
+    end
+
+    # When the provider's access token lapses; 0 when it gave no lifetime.
+    # Never "now", which is already in the past by the next request.
+    def self.expires_at(tokens)
+      lifetime = tokens.fetch("expires_in", 0).to_i
+      lifetime.positive? ? Time.now.to_i + lifetime : 0
+    end
     attr_reader :issuer, :client_id, :client_secret, :redirect_uri, :scopes,
                 :verify, :post_logout_redirect_uri, :claim_map
     @mounted = false
@@ -221,14 +245,13 @@ module Tina4
       current.set(SESSION_KEY, {
                     "version" => 1, "identity" => identity, "access_token" => tokens["access_token"],
                     "refresh_token" => tokens["refresh_token"], "id_token" => tokens["id_token"],
-                    "expires_at" => Time.now.to_i + tokens.fetch("expires_in", 0).to_i
+                    "expires_at" => self.class.expires_at(tokens)
                   })
       { "identity" => identity, "return_to" => self.class.safe_return(pending["return_to"]) }
     end
 
     def identity(request_or_session)
-      stored = session(request_or_session)&.get(SESSION_KEY)
-      value = stored.is_a?(Hash) ? stored["identity"] : nil
+      value = self.class.live_session_identity(session(request_or_session)&.get(SESSION_KEY))
       request_or_session.user = value if value && !request_or_session.is_a?(Tina4::Session)
       value
     end
@@ -251,7 +274,7 @@ module Tina4
         "identity" => value, "access_token" => tokens["access_token"],
         "refresh_token" => tokens["refresh_token"] || stored["refresh_token"],
         "id_token" => tokens["id_token"] || stored["id_token"],
-        "expires_at" => Time.now.to_i + tokens.fetch("expires_in", 0).to_i
+        "expires_at" => self.class.expires_at(tokens)
       ))
       value
     rescue StandardError

data/lib/tina4/ssrf.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+require "ipaddr"
+require "resolv"
+require "socket"
+require "uri"
+
+module Tina4
+  # Raised when the SSRF guard refuses an outbound request.
+  class SsrfError < StandardError; end
+
+  # Outbound SSRF guard (ADR-0084).
+  #
+  # The Api client and Web Push refuse, by default, to connect to a private or
+  # internal address. Before each connection - the initial URL and every redirect
+  # hop the Api client follows - the host is resolved to its IP address(es) and
+  # the request is refused if any resolved address is loopback, private,
+  # link-local (including the cloud metadata address 169.254.169.254), unspecified
+  # or CGNAT. A non-http(s) scheme is refused.
+  #
+  # Off by default; TINA4_ALLOW_PRIVATE_REQUESTS (truthy) or an explicit allow-list
+  # of hosts / host:port / CIDRs opts out. Zero external dependencies - Ruby
+  # stdlib IPAddr + Resolv.
+  module Ssrf
+    ALLOW_PRIVATE_ENV = "TINA4_ALLOW_PRIVATE_REQUESTS"
+
+    # Truthiness identical to ADR-0070's set (trimmed, lower-cased).
+    TRUTHY = %w[1 true yes on].freeze
+
+    # The blocked address space, one definition shared with the contract fixture.
+    # 0.0.0.0/8 covers the unspecified address and the "this network" block.
+    BLOCKED = %w[
+      0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16
+      172.16.0.0/12 192.168.0.0/16 100.64.0.0/10
+      ::1/128 ::/128 fc00::/7 fe80::/10
+    ].map { |cidr| IPAddr.new(cidr) }.freeze
+
+    module_function
+
+    # True when TINA4_ALLOW_PRIVATE_REQUESTS opts out of the guard.
+    def allow_private_requests?
+      TRUTHY.include?(ENV.fetch(ALLOW_PRIVATE_ENV, "").strip.downcase)
+    end
+
+    # Classify one IP string: true = private/internal, refuse it. An IPv4-mapped
+    # IPv6 address is classified by its embedded IPv4. An unparseable value is
+    # treated as blocked - the guard refuses what it cannot classify.
+    def blocked_address?(ip)
+      addr = IPAddr.new(ip.to_s.split("%").first)
+      addr = addr.native if addr.ipv6? && addr.ipv4_mapped?
+      BLOCKED.any? { |network| network.include?(addr) }
+    rescue IPAddr::Error
+      true
+    end
+
+    # Refuse +url+ when it targets a private/internal address. Raises SsrfError
+    # for a non-http(s) scheme, an unresolvable host, or any resolved address in
+    # the blocked space. allow_hosts is a list of hosts / host:port / CIDRs.
+    def guard_url!(url, allow_hosts = nil)
+      uri = url.is_a?(URI) ? url : URI.parse(url.to_s)
+      scheme = uri.scheme&.downcase
+      unless %w[http https].include?(scheme)
+        raise SsrfError, "Blocked request: URL scheme '#{scheme || '(none)'}' is not http or https"
+      end
+      host = uri.host.to_s
+      raise SsrfError, "Blocked request: URL has no host" if host.empty?
+
+      host = host.delete_prefix("[").delete_suffix("]")
+      port = uri.port || (scheme == "https" ? 443 : 80)
+
+      return if allow_private_requests?
+
+      resolved = resolve(host)
+      return if matches_allow_list?(host, port, resolved, allow_hosts)
+
+      resolved.each do |ip|
+        next unless blocked_address?(ip)
+
+        log_block(host, ip)
+        raise SsrfError,
+              "Blocked request to private/internal address #{ip} (host #{host}): " \
+              "set #{ALLOW_PRIVATE_ENV}=true to allow, or pass an allow-list."
+      end
+    end
+
+    # Resolve a host to its IP address(es). An IP literal resolves to itself.
+    def resolve(host)
+      begin
+        IPAddr.new(host)
+        return [host]
+      rescue IPAddr::Error
+        # not a literal - fall through to DNS
+      end
+      addresses = begin
+        Resolv.getaddresses(host)
+      rescue StandardError
+        []
+      end
+      if addresses.empty?
+        begin
+          addresses = [IPSocket.getaddress(host)]
+        rescue SocketError
+          addresses = []
+        end
+      end
+      raise SsrfError, "Blocked request to #{host}: cannot resolve host" if addresses.empty?
+
+      addresses
+    end
+
+    def matches_allow_list?(host, port, resolved, allow_hosts)
+      host_lower = host.downcase
+      Array(allow_hosts).each do |raw|
+        entry = raw.to_s.strip.downcase
+        next if entry.empty?
+        return true if entry == host_lower || entry == "#{host_lower}:#{port}"
+
+        next unless entry.include?("/")
+
+        begin
+          network = IPAddr.new(entry)
+        rescue IPAddr::Error
+          next
+        end
+        resolved.each do |ip|
+          begin
+            candidate = IPAddr.new(ip.to_s.split("%").first)
+          rescue IPAddr::Error
+            next
+          end
+          return true if network.include?(candidate)
+        end
+      end
+      false
+    end
+
+    def log_block(host, ip)
+      Tina4::Log.warning("SSRF guard blocked outbound request to #{host} (#{ip})") if defined?(Tina4::Log)
+    rescue StandardError
+      nil
+    end
+  end
+end

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.138"
+  VERSION = "3.13.140"
 end

data/lib/tina4/websocket.rb

@@ -113,7 +113,10 @@ module Tina4
     return [nil, false] unless token
 
     payload = Tina4::Auth.valid_token(token)
-    [payload, !payload.nil?]
+    # A form token is not an identity (ADR-0079 s1).
+    return [nil, false] unless Tina4::Auth.identity_payload?(payload)
+
+    [payload, true]
   end
 
   # Whether the client offered the "bearer" subprotocol — in which case the
@@ -199,6 +202,17 @@ module Tina4
       @connections
     end
 
+    # Seconds a client may take to send its upgrade request (Python uses 10).
+    HANDSHAKE_TIMEOUT = 10
+    # Upper bound on the request head; a longer one is not a WebSocket upgrade.
+    MAX_REQUEST_HEAD = 16_384
+
+    # Run a standalone WebSocket server. port: 0 picks a free port (see #port).
+    #
+    # Each accepted socket gets its own thread that reads the HTTP request head,
+    # builds the Rack-style env handle_upgrade expects, and upgrades. This loop
+    # used to hand handle_upgrade an EMPTY env, so no Sec-WebSocket-Key was ever
+    # seen and no handshake could complete (the socket was left open, too).
     def start(host: "0.0.0.0", port: 7147)
       require "socket"
       @server_socket = TCPServer.new(host, port)
@@ -207,9 +221,8 @@ module Tina4
         while @running
           begin
             client = @server_socket.accept
-            env = {}
-            handle_upgrade(env, client)
-          rescue => e
+            Thread.new(client) { |socket| serve_standalone(socket) }
+          rescue StandardError
             break unless @running
           end
         end
@@ -217,6 +230,53 @@ module Tina4
       self
     end
 
+    # The port the standalone server is listening on (useful with port: 0).
+    def port
+      @server_socket&.local_address&.ip_port
+    end
+
+    # Read one upgrade request from +socket+ and hand it to handle_upgrade; a
+    # request that is not a WebSocket upgrade gets a 400 and is closed.
+    def serve_standalone(socket)
+      env = read_upgrade_request(socket)
+      unless env && env["HTTP_SEC_WEBSOCKET_KEY"] && upgrade?(env)
+        socket.write("HTTP/1.1 400 Bad Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n") rescue nil
+        socket.close rescue nil
+        return
+      end
+      handle_upgrade(env, socket)
+    rescue StandardError => e
+      Tina4::Log.warning("WebSocket standalone upgrade failed: #{e.message}") if defined?(Tina4::Log)
+      socket.close rescue nil
+    end
+
+    # The request head as a Rack-style env (REQUEST_PATH, QUERY_STRING and
+    # HTTP_* headers), or nil when it does not arrive in time or is too long.
+    # Read a byte at a time so nothing after the head is consumed.
+    def read_upgrade_request(socket)
+      head = +""
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + HANDSHAKE_TIMEOUT
+      until head.end_with?("\r\n\r\n")
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        return nil if remaining <= 0 || head.bytesize > MAX_REQUEST_HEAD || !socket.wait_readable(remaining)
+
+        head << socket.readpartial(1)
+      end
+      request_line, *header_lines = head.split("\r\n")
+      method, target, = request_line.to_s.split(" ")
+      path, _, query = target.to_s.partition("?")
+      env = { "REQUEST_METHOD" => method.to_s, "REQUEST_PATH" => path, "PATH_INFO" => path, "QUERY_STRING" => query }
+      header_lines.each do |line|
+        name, value = line.split(":", 2)
+        next if value.nil?
+
+        env["HTTP_#{name.strip.upcase.tr("-", "_")}"] = value.strip
+      end
+      env
+    rescue IOError, SystemCallError
+      nil
+    end
+
     def stop
       @running = false
       @server_socket&.close rescue nil
@@ -739,13 +799,14 @@ module Tina4
 
     def send(message)
       data = message.is_a?(String) ? message : message.to_s
-      # Text frames must be valid UTF-8; binary payloads are sent verbatim.
-      data = data.encode("UTF-8") if data.encoding != Encoding::ASCII_8BIT
-      frame = build_frame(0x1, data)
-      @socket.write(frame)
-    rescue IOError
-      # Connection closed — mark dead so the broadcast path prunes it.
-      @closed = true
+      # A binary (ASCII-8BIT) payload goes out as a BINARY frame, verbatim. It
+      # used to go out as a TEXT frame, which is invalid UTF-8 on the wire and
+      # makes a browser fail the connection. Text frames must be valid UTF-8.
+      if data.encoding == Encoding::ASCII_8BIT
+        write_frame(build_frame(0x2, data))
+      else
+        write_frame(build_frame(0x1, data.encode("UTF-8")))
+      end
     end
 
     alias_method :send_text, :send
@@ -757,16 +818,48 @@ module Tina4
     end
 
     def send_pong(data)
-      frame = build_frame(0xA, data || "")
-      @socket.write(frame)
-    rescue IOError
-      @closed = true
+      write_frame(build_frame(0xA, data || ""))
     end
 
     def close(code: 1000, reason: "")
       payload = [code].pack("n") + reason
       frame = build_frame(0x8, payload)
-      @socket.write(frame) rescue nil
+      # Best effort and never blocking: a peer that stopped reading must not
+      # hold up the reaper or a shutdown. The close frame only goes out when no
+      # earlier frame is still queued, so it can never land mid-frame.
+      write_lock.synchronize do
+        @socket.write_nonblock(frame, exception: false) if pending.empty?
+      end
+    rescue IOError, SystemCallError
+      nil
+    ensure
+      @closed = true
+      @socket.close rescue nil
+    end
+
+    # Hand a frame to the socket WITHOUT blocking the caller. What the kernel
+    # cannot take yet waits in a per-connection queue that a flusher thread
+    # drains as the peer reads. A peer whose queue passes TINA4_WS_MAX_BACKLOG
+    # bytes (default 1 MiB, 0 = unbounded; the same setting as tina4-nodejs) is
+    # hopelessly behind or never reads, so it is closed. A blocking write here
+    # used to stall every broadcast forever on one client that stopped reading.
+    def write_frame(frame)
+      return if @closed
+
+      write_lock.synchronize do
+        pending << frame.b
+        flush_pending
+        limit = max_backlog
+        if limit.positive? && pending.bytesize > limit
+          backlog = pending.bytesize
+          drop_slow_client("backlog #{backlog} bytes exceeds TINA4_WS_MAX_BACKLOG (#{limit})")
+        elsif !pending.empty?
+          start_flusher
+        end
+      end
+    rescue IOError, SystemCallError
+      # Broken pipe / reset / closed socket: mark dead so the broadcast path prunes it.
+      @closed = true
       @socket.close rescue nil
     end
 
@@ -802,6 +895,57 @@ module Tina4
     def build_frame(opcode, data)
       Tina4.build_frame(opcode, data)
     end
+
+    private
+
+    def write_lock
+      @write_lock ||= Mutex.new
+    end
+
+    def pending
+      @pending ||= +"".b
+    end
+
+    def max_backlog
+      Integer(ENV["TINA4_WS_MAX_BACKLOG"] || "1048576")
+    rescue ArgumentError, TypeError
+      1_048_576
+    end
+
+    # Write as much of the queue as the kernel takes right now. Caller holds the lock.
+    def flush_pending
+      until pending.empty?
+        written = @socket.write_nonblock(pending, exception: false)
+        break if written == :wait_writable
+
+        @pending = pending.byteslice(written..)
+      end
+    end
+
+    # One background drainer per connection while bytes are queued.
+    def start_flusher
+      return if @flusher&.alive?
+
+      @flusher = Thread.new do
+        until @closed
+          done = write_lock.synchronize { pending.empty? }
+          break if done
+
+          @socket.wait_writable(1)
+          write_lock.synchronize { flush_pending }
+        end
+      rescue IOError, SystemCallError
+        @closed = true
+        @socket.close rescue nil
+      end
+    end
+
+    def drop_slow_client(reason)
+      Tina4::Log.warning("WebSocket client #{@id} dropped as too slow: #{reason}") if defined?(Tina4::Log)
+      @pending = +"".b
+      @closed = true
+      @socket.close rescue nil
+    end
   end
 
   # Shared, process-wide manager for the dev-reload channel (/__dev_reload).

data/lib/tina4/websocket_backplane.rb

@@ -115,6 +115,12 @@ module Tina4
             block.call(msg) if @running
           end
         end
+      rescue StandardError => e
+        # A refused login or a dropped connection ends this listener for good.
+        # Say so in the framework log: before, the thread died with only a raw
+        # stack trace on stderr while "backplane active" stood as the last word.
+        # The redis client's messages carry the URL without its userinfo.
+        Tina4::Log.error("WebSocket backplane subscriber stopped on '#{channel}': #{e.message}") if @running && defined?(Tina4::Log)
       end
     end
 

data/lib/tina4/wsdl.rb

@@ -279,6 +279,14 @@ module Tina4
     def process_soap(xml_body)
       on_request(@request)
 
+      # The shared body rule, before anything reads the bytes: UTF-8 only, no
+      # byte order mark, no NUL byte, no other declared encoding.
+      begin
+        xml_body = XmlParser.utf8_text(xml_body)
+      rescue XmlParser::ParseError
+        return soap_fault("Client", "Malformed XML")
+      end
+
       # SOAP 1.1 (§3) forbids a Document Type Declaration in a SOAP message, so
       # reject any DOCTYPE up front with the same Client fault as the other three
       # frameworks. The parser has no DTD support at all (no entity expansion, no
@@ -499,14 +507,27 @@ module Tina4
       end
 
       def handle_soap_request(xml_body)
+        # Malformed XML is the CLIENT's fault, as in Python and WSDL#process_soap.
+        # Both refusals below used to fall into the operation catch-all at the end
+        # of this method and answer "Internal server error" (a soap:Server fault).
+        begin
+          xml_body = XmlParser.utf8_text(xml_body) # the shared body encoding rule
+        rescue XmlParser::ParseError
+          return _soap_fault("Malformed XML", code: "Client")
+        end
+
         # SOAP 1.1 (§3) forbids a DOCTYPE/DTD. Reject before parsing; the parser
         # itself has no DTD support and accepts UTF-8 only. Mirrors the
         # class-based process_soap path.
-        if xml_body.to_s.b.match?(/<!DOCTYPE/in)
+        if xml_body.b.match?(/<!DOCTYPE/in)
           return _soap_fault("DOCTYPE declarations are not allowed in SOAP messages")
         end
 
-        doc = XmlParser.parse(xml_body)
+        begin
+          doc = XmlParser.parse(xml_body)
+        rescue XmlParser::ParseError
+          return _soap_fault("Malformed XML", code: "Client")
+        end
 
         # Find Body element (namespace-agnostic)
         body_el = _find_child(doc.root, "Body")
@@ -590,11 +611,11 @@ module Tina4
         xml
       end
 
-      def _soap_fault(message)
+      def _soap_fault(message, code: "soap:Server")
         '<?xml version="1.0" encoding="UTF-8"?>' \
         '<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">' \
         "<soap:Body><soap:Fault>" \
-        "<faultcode>soap:Server</faultcode>" \
+        "<faultcode>#{code}</faultcode>" \
         "<faultstring>#{_escape_xml(message)}</faultstring>" \
         "</soap:Fault></soap:Body></soap:Envelope>"
       end

data/lib/tina4/xml_parser.rb

@@ -22,10 +22,11 @@ module Tina4
     #   * DTDs. `<!DOCTYPE` and every other `<!` declaration is a ParseError, so
     #     there is no entity expansion (billion laughs) and no external entity
     #     (XXE). The WSDL server also rejects DOCTYPE before parsing.
-    #   * Any encoding but UTF-8. A UTF-16/UTF-32 body (BOM or NUL bytes) or
-    #     invalid UTF-8 is a ParseError. A UTF-16 body used to slip past the
-    #     `<!DOCTYPE` regex guard, because the guard read "<\0!\0D\0..." while
-    #     REXML decoded the BOM and parsed the DTD. A UTF-8 BOM is skipped.
+    #   * Any encoding but UTF-8. Any byte order mark (UTF-8 included), a NUL
+    #     byte, invalid UTF-8, or an XML declaration naming another encoding is a
+    #     ParseError. A UTF-16 body used to slip past the `<!DOCTYPE` regex guard,
+    #     because the guard read "<\0!\0D\0..." while REXML decoded the BOM and
+    #     parsed the DTD.
     #
     # Element#text follows ElementTree (the Python master): the character data
     # before the first child element, entity- and CDATA-decoded; nil when there
@@ -71,7 +72,10 @@ module Tina4
 
       PREDEFINED_ENTITIES = { "lt" => "<", "gt" => ">", "amp" => "&", "quot" => '"', "apos" => "'" }.freeze
       NAME = /[A-Za-z_:\u00C0-\u{EFFFF}][A-Za-z0-9_:.\-\u00B7\u00C0-\u{EFFFF}]*/
-      UTF16_OR_32_BOMS = ["\xFE\xFF".b, "\xFF\xFE".b, "\x00\x00\xFE\xFF".b].freeze
+      # Every byte order mark, the UTF-8 one included (the shared SOAP body rule:
+      # a body is plain UTF-8, never a BOM, in all four frameworks).
+      BYTE_ORDER_MARKS = ["\xEF\xBB\xBF".b, "\xFE\xFF".b, "\xFF\xFE".b, "\x00\x00\xFE\xFF".b].freeze
+      DECLARED_ENCODING = /\A<\?xml\b[^>]*?\bencoding\s*=\s*["']([^"']*)["']/
 
       module_function
 
@@ -81,16 +85,21 @@ module Tina4
         Reader.new(utf8_text(xml)).document
       end
 
+      # The body as UTF-8 text, or a ParseError. Callers that must refuse BEFORE
+      # any parse (the WSDL server) call this first; #parse calls it too.
       def utf8_text(xml)
         bytes = xml.to_s.b
-        if UTF16_OR_32_BOMS.any? { |bom| bytes.start_with?(bom) } || bytes.include?("\x00")
-          raise ParseError, "only UTF-8 XML is accepted (UTF-16/UTF-32 body)"
-        end
+        raise ParseError, "only UTF-8 XML without a byte order mark is accepted" if BYTE_ORDER_MARKS.any? { |bom| bytes.start_with?(bom) }
+        raise ParseError, "only UTF-8 XML is accepted (NUL byte, UTF-16/UTF-32 body)" if bytes.include?("\x00")
 
-        bytes = bytes.byteslice(3..) if bytes.start_with?("\xEF\xBB\xBF".b)
         text = bytes.force_encoding(Encoding::UTF_8)
         raise ParseError, "only UTF-8 XML is accepted (invalid UTF-8 bytes)" unless text.valid_encoding?
 
+        declared = text[DECLARED_ENCODING, 1]
+        if declared && !declared.casecmp?("UTF-8")
+          raise ParseError, "only UTF-8 XML is accepted (declared encoding #{declared.inspect})"
+        end
+
         text
       end
 

data/lib/tina4.rb

@@ -12,6 +12,8 @@ require_relative "tina4/constants"
 require_relative "tina4/log"
 require_relative "tina4/debug"  # backward compat alias
 require_relative "tina4/env"
+require_relative "tina4/sqlite_path_resolver"
+require_relative "tina4/row_symbolizer"
 require_relative "tina4/router"
 require_relative "tina4/request"
 require_relative "tina4/response"
@@ -159,6 +161,8 @@ module Tina4
   autoload :CRUD,                File.expand_path("tina4/crud", __dir__)
   autoload :API,                 File.expand_path("tina4/api", __dir__)
   autoload :APIResponse,         File.expand_path("tina4/api", __dir__)
+  autoload :Ssrf,                File.expand_path("tina4/ssrf", __dir__)
+  autoload :SsrfError,           File.expand_path("tina4/ssrf", __dir__)
   autoload :GraphQLType,         File.expand_path("tina4/graphql", __dir__)
   autoload :GraphQLSchema,       File.expand_path("tina4/graphql", __dir__)
   autoload :GraphQLParser,       File.expand_path("tina4/graphql", __dir__)
@@ -479,8 +483,15 @@ module Tina4
       # boot after env load, before any auth use. Never crashes boot.
       Tina4::Auth.ensure_dev_secret(root_dir)
 
-      # Setup auth keys
-      Tina4::Auth.setup(root_dir)
+      # Point RS256 at <root>/.keys without creating anything: an
+      # operator-provisioned key pair keeps working, and a blank secret no
+      # longer mints one implicitly (ADR-0079 s2).
+      Tina4::Auth.keys_root = root_dir
+
+      # Refuse to serve with a secret anyone can reproduce: blank outside dev,
+      # or set but shorter than 32 bytes in any mode (ADR-0079 s2). Raises
+      # Tina4::Auth::InsecureSecretError naming TINA4_SECRET.
+      Tina4::Auth.require_boot_secret!
 
       # Auto-attach CSRF protection when TINA4_CSRF is enabled (OFF by default).
       # Mirrors the Python master's attach_csrf_from_env -- the env flag is the