tina4ruby 3.13.142 → 3.13.144

data/lib/tina4/session.rb

@@ -175,23 +175,72 @@ module Tina4
     def clear
       @data = {}
       @modified = true
+      @cleared = true
     end
 
     def to_hash
       @data.dup
     end
 
-    # Persist the session if dirty. On a backend write failure the error is
-    # logged and false is returned — the @modified (dirty) flag is RETAINED so
-    # a later save can retry. Returns true on a successful (or no-op) write.
+    # Persist this request's session. On a backend failure the error is logged
+    # and false is returned — the @modified (dirty) flag is RETAINED so a later
+    # save can retry. Returns true on a successful (or no-op) write.
     #
     # A cleared id (@id nil, e.g. after #destroy) is a no-op: there is nothing
-    # to persist, and a write would re-create the just-destroyed record. Mirrors
-    # the Python master's `if self._session_id and self._dirty`.
+    # to persist, and a write would re-create the just-destroyed record.
+    #
+    # Another request may have changed or ended this session since this one
+    # loaded it: a logout, a #regenerate, a set that took a privilege away.
+    # Writing back the whole snapshot loaded at the start undid all of those, so
+    # a request in flight across a logout logged the user straight back in. The
+    # save therefore re-reads the stored record and writes only what THIS
+    # request changed onto it, and never re-creates a record another request
+    # removed: it ends the session for this request instead, so no cookie goes
+    # out for it.
+    #
+    # SLIDING EXPIRY (ADR-0087): a started session the store already holds is
+    # re-written on EVERY save, even when this request changed nothing. That
+    # write re-stamps the backend deadline to now + TINA4_SESSION_TTL, so expiry
+    # is measured from the last request that TOUCHED the session, not from its
+    # last change — a user actively reading pages stays logged in. The re-write
+    # is the SAME re-read, merged record the concurrent-save contract computes,
+    # so sliding never clobbers a concurrent change. PHP is the reference. The
+    # guards above take precedence over the slide: no id → nothing to slide;
+    # a record another request ended → forget + end, never re-created; a failed
+    # read → deadline untouched, dirty kept for a retry; TINA4_SESSION_TTL=0 →
+    # the slide re-stamps a zero (immortal) deadline (ADR-0027).
+    #
+    # The slide is scoped to @stored — an id the STORE actually holds (adopted,
+    # not freshly minted). ADR-0087's own guard: "a request with no session (no
+    # id issued, OR THE ID WAS NEVER ADOPTED) writes nothing — there is no
+    # deadline to move." A brand-new, unmodified session (minted id, @stored
+    # false) therefore still no-ops, exactly as before; a modified session of
+    # any kind still writes.
     def save
-      return true unless @id && @modified
-      if safe_write(@id, @data, @ttl)
+      return true unless @id && (@modified || @stored)
+
+      record = @data
+      if @stored
+        current, failed = current_record
+        # Whether the record still exists is unknown, so nothing is written;
+        # the dirty flag is kept for a later retry.
+        return false if failed
+
+        if current.nil?
+          forget
+          @ended = true
+          return true
+        end
+        record = merged(current) unless @cleared
+      end
+      if safe_write(@id, record, @ttl)
         @modified = false
+        # An empty record is no session (#start never adopts one), so the next
+        # save writes whole rather than take this request's own empty write for
+        # a logout.
+        @stored = !record.empty?
+        @cleared = false
+        @loaded = fingerprints(@data)
         true
       else
         false # dirty flag retained for retry
@@ -205,9 +254,7 @@ module Tina4
     # (nulls sessionId). A fresh session needs a new #start, which mints a new id.
     def destroy
       safe_destroy(@id) if @id
-      @id = nil
-      @data = {}
-      @modified = false
+      forget
     end
 
     # Get a session value with optional default.
@@ -272,11 +319,32 @@ module Tina4
     # session fixation (a pre-auth session ID must not survive into the
     # authenticated session). Destroys the old backend record (best-effort)
     # and persists under the new ID.
+    #
+    # What is carried is the session as it is stored now with this request's
+    # own changes applied, the same merge #save does. If another request ended
+    # the session after this one loaded it (a logout, or a regenerate of its
+    # own), it stays ended: nothing is carried, no id is minted and nil is
+    # returned, so no cookie goes out to replace the one that request sent.
     def regenerate
+      return nil if @ended
+
       old_id = @id
+      if old_id && @stored
+        current, failed = current_record
+        unless failed
+          if current.nil?
+            forget
+            @ended = true
+            return nil
+          end
+          @data.replace(merged(current)) unless @cleared
+        end
+      end
       @id = SecureRandom.hex(32)
       safe_destroy(old_id)
       @modified = true
+      # Nothing is stored under the new id yet, so the save writes it whole.
+      @stored = false
       save
       @id
     end
@@ -383,9 +451,76 @@ module Tina4
       @id = session_id
       @data = data
       @modified = false
+      # @stored: this request is working on a record the store holds, so a save
+      # must never re-create it once it has gone. An empty record does not
+      # count: it is no session. A failed read adopts the id with {}
+      # (#existing_session_data): not a record this request has seen, so its
+      # first save writes whole.
+      @stored = !data.empty?
+      # @loaded: one fingerprint per key of what this request last saw stored;
+      # #save compares the live data against it to find what THIS request
+      # changed. @cleared: #clear ran since the last save, so the save replaces
+      # the stored record instead of merging into it.
+      @loaded = @stored ? fingerprints(@data) : {}
+      @cleared = false
+      # @ended: this request found its session ended by another request (the
+      # record it loaded is gone). It stays ended for the rest of the request:
+      # #regenerate mints nothing either.
+      @ended = false
       @id
     end
 
+    # Forget the session in memory: no data, no id, nothing left to save. What
+    # #destroy does after removing the record, and what #save does when it
+    # finds another request already removed it.
+    def forget
+      @id = nil
+      @data = {}
+      @modified = false
+      @stored = false
+      @cleared = false
+      @loaded = {}
+    end
+
+    # The record as stored right now, as [data, failed]. nil and empty both mean
+    # "no session", exactly as in #existing_session_data.
+    def current_record
+      return [nil, true] if degraded?
+
+      data = @handler.read(@id)
+      [data.nil? || (data.respond_to?(:empty?) && data.empty?) ? nil : data, false]
+    rescue StandardError => e
+      log_backend_error("read", e)
+      raise if @strict
+      [nil, true]
+    end
+
+    # The stored record with only this request's own changes applied to it: the
+    # keys it set or changed since it last loaded or saved, minus the keys it
+    # removed. Every other key keeps the value the store holds now.
+    def merged(current)
+      record = current.dup
+      @data.each do |key, value|
+        now = fingerprint(value)
+        record[key] = value if now.nil? || @loaded[key] != now
+      end
+      @loaded.each_key { |key| record.delete(key) unless @data.key?(key) }
+      record
+    end
+
+    def fingerprints(data)
+      data.each_with_object({}) { |(key, value), prints| prints[key] = fingerprint(value) }
+    end
+
+    # The stored form of a value, for telling whether a request changed it.
+    # nil when it cannot be serialised: that always counts as changed, because
+    # writing a value again is harmless and missing a change is not.
+    def fingerprint(value)
+      JSON.generate(value)
+    rescue StandardError
+      nil
+    end
+
     # The stored data for session_id when the backend HOLDS a session under it,
     # else nil — strict mode's signal to mint a fresh id rather than adopt one
     # the client chose.

data/lib/tina4/template.rb

@@ -56,7 +56,11 @@ module Tina4
       end
 
       def globals
-        @globals ||= {}
+        # csp_nonce() is a built-in template global (ADR-0088): a template can
+        # stamp the current response's CSP nonce on an inline <style>/<script>
+        # — <style nonce="{{ csp_nonce() }}">. Matches the Frond engine global
+        # and the value the security middleware names in the CSP header.
+        @globals ||= { "csp_nonce" => -> { Tina4::Csp.current_nonce } }
       end
 
       def add_global(key, value)
@@ -87,7 +91,11 @@ module Tina4
         error_dirs = TEMPLATE_DIRS.map { |d| File.join(Dir.pwd, d, "errors") }
         error_dirs << File.join(File.dirname(__FILE__), "templates", "errors")
 
-        context = { "code" => code }.merge(data.transform_keys(&:to_s))
+        # csp_nonce() (ADR-0088) so the error twigs can carry a nonce on their
+        # inline <style>; render_error builds its own context and does not merge
+        # globals, so inject it here explicitly.
+        context = { "code" => code, "csp_nonce" => -> { Tina4::Csp.current_nonce } }
+                  .merge(data.transform_keys(&:to_s))
 
         error_dirs.each do |dir|
           %w[.twig .html .erb].each do |ext|
@@ -152,7 +160,7 @@ module Tina4
 
       def error_overlay_css(color)
         <<~CSS
-          <style>
+          <style nonce="#{Tina4::Csp.current_nonce}">
           * { box-sizing: border-box; margin: 0; padding: 0; }
           body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #e2e8f0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
           .error-card { background: #1e293b; border: 1px solid #334155; border-radius: 1rem; padding: 3rem; text-align: center; max-width: 520px; width: 90%; }

data/lib/tina4/templates/errors/302.twig

@@ -9,6 +9,6 @@
     <div class="spinner"></div>
     <div class="error-title">Redirecting…</div>
     <div class="error-msg">You are being redirected to a new location.</div>
-    <div class="error-path" style="color:var(--primary)">{{ redirect_url }}</div>
+    <div class="error-path c-primary">{{ redirect_url }}</div>
     <a href="{{ redirect_url }}" class="error-home">Click here if not redirected</a>
 {% endblock %}

data/lib/tina4/templates/errors/401.twig

@@ -1,9 +1,9 @@
 {% extends "errors/base.twig" %}
 {% block title %}401 — Unauthorized{% endblock %}
 {% block content %}
-    <div class="error-code" style="color:var(--danger)">401</div>
+    <div class="error-code c-danger">401</div>
     <div class="error-title">Unauthorized</div>
     <div class="error-msg">You need to sign in to access this resource.</div>
-    <div class="error-path" style="color:var(--danger)">{{ path }}</div>
+    <div class="error-path c-danger">{{ path }}</div>
     <a href="/" class="error-home">Go Home</a>
 {% endblock %}

data/lib/tina4/templates/errors/403.twig

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>403 — Forbidden</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 * { box-sizing: border-box; margin: 0; padding: 0; }
 body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #e2e8f0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
 .error-card { background: #1e293b; border: 1px solid #334155; border-radius: 1rem; padding: 3rem; text-align: center; max-width: 520px; width: 90%; }

data/lib/tina4/templates/errors/404.twig

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>404 - Not Found</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 * { box-sizing: border-box; margin: 0; padding: 0; }
 body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #e2e8f0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
 .error-card { background: #1e293b; border: 1px solid #334155; border-radius: 1rem; padding: 3rem; text-align: center; max-width: 520px; width: 90%; }

data/lib/tina4/templates/errors/500.twig

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>500 - Server Error</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 * { box-sizing: border-box; margin: 0; padding: 0; }
 body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; color: #e2e8f0; min-height: 100vh; display: flex; align-items: center; justify-content: center; }
 .error-card { background: #1e293b; border: 1px solid #334155; border-radius: 1rem; padding: 3rem; text-align: left; max-width: 700px; width: 90%; }

data/lib/tina4/templates/errors/502.twig

@@ -1,9 +1,9 @@
 {% extends "errors/base.twig" %}
 {% block title %}502 — Bad Gateway{% endblock %}
 {% block content %}
-    <div class="error-code" style="color:var(--danger)">502</div>
+    <div class="error-code c-danger">502</div>
     <div class="error-title">Bad Gateway</div>
     <div class="error-msg">The upstream server returned an invalid response.</div>
-    <div class="error-path" style="color:var(--danger)">{{ path }}</div>
+    <div class="error-path c-danger">{{ path }}</div>
     <a href="/" class="error-home">Go Home</a>
 {% endblock %}

data/lib/tina4/templates/errors/503.twig

@@ -4,9 +4,9 @@
 .error-code { color: var(--warn); }
 {% endblock %}
 {% block content %}
-    <div class="error-code" style="color:var(--warn)">503</div>
+    <div class="error-code c-warn">503</div>
     <div class="error-title">Service Unavailable</div>
     <div class="error-msg">The server is temporarily unavailable. Please try again shortly.</div>
-    <div class="error-path" style="color:var(--warn)">{{ path }}</div>
+    <div class="error-path c-warn">{{ path }}</div>
     <a href="/" class="error-home">Go Home</a>
 {% endblock %}

data/lib/tina4/templates/errors/base.twig

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
 {% block meta %}{% endblock %}
 <title>{% block title %}Error{% endblock %}</title>
-<style>
+<style nonce="{{ csp_nonce() }}">
 :root {
     --bg: #0f172a; --surface: #1e293b; --border: #334155;
     --text: #e2e8f0; --muted: #94a3b8; --primary: #3b82f6;
@@ -23,6 +23,9 @@ body { font-family: var(--font); background: var(--bg); color: var(--text); min-
 .error-home { display: inline-block; margin-top: 1.5rem; padding: 0.5rem 1.5rem; background: var(--primary); color: #fff; text-decoration: none; border-radius: 0.5rem; font-size: 0.85rem; }
 .error-home:hover { opacity: 0.9; }
 .logo { width: 3rem; height: 3rem; margin-bottom: 1rem; opacity: 0.5; }
+.c-danger { color: var(--danger); }
+.c-warn { color: var(--warn); }
+.c-primary { color: var(--primary); }
 {% block extra_styles %}{% endblock %}
 </style>
 </head>

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.142"
+  VERSION = "3.13.144"
 end

data/lib/tina4/webserver.rb

@@ -126,20 +126,9 @@ module Tina4
       # drains in-flight requests (bounded by TINA4_SHUTDOWN_TIMEOUT).
       Tina4::Shutdown.setup(server: @server)
 
-      # Test port (port + 1000) — stable, no-browser
-      no_ai_port = %w[true 1 yes].include?(ENV.fetch("TINA4_NO_AI_PORT", "").downcase)
-      is_debug   = %w[true 1 yes].include?(ENV.fetch("TINA4_DEBUG", "").downcase)
-
-      if is_debug && !no_ai_port
-        ai_port = @port + 1000
-        begin
-          # Tagged so the pipeline suppresses live reload on this port.
-          @server.listen(@host, ai_port, Tina4::AiPortRackApp.new(@app))
-          puts "  Test Port: http://localhost:#{ai_port} (stable — no hot-reload)"
-        rescue Errno::EADDRINUSE
-          puts "  Test Port: SKIPPED (port #{ai_port} in use)"
-        end
-      end
+      # Test port (port + 1000) — stable, no-browser. Extracted so its bind
+      # rescue stays out of #start's cyclomatic complexity.
+      bind_auxiliary_ai_port
 
       @server.start
 
@@ -156,6 +145,33 @@ module Tina4
       Tina4::PortTakeover.remove_pidfile(@port)
     end
 
+    # Bind the auxiliary AI/test port (main port + 1000), a debug-only, stable,
+    # no-hot-reload sibling of the main port. It is a CONVENIENCE, never
+    # load-bearing: any bind failure here must DEGRADE to no-aux-port and leave
+    # the main server the operator asked for untouched. The rescue used to catch
+    # only Errno::EADDRINUSE, so any OTHER bind failure propagated out of #start
+    # and crashed the whole boot: a transient getaddrinfo/Socket::ResolutionError
+    # on a fresh host under process churn (a measured macOS artifact),
+    # Errno::EADDRNOTAVAIL, Errno::EACCES. Catch the broad bind-failure set
+    # (SocketError covers Socket::ResolutionError; SystemCallError covers every
+    # Errno::*), log LOUD so it is never silent, and carry on main-port only.
+    # Parity with Python (`except OSError`) and PHP (`\Throwable`).
+    def bind_auxiliary_ai_port
+      no_ai_port = %w[true 1 yes].include?(ENV.fetch("TINA4_NO_AI_PORT", "").downcase)
+      is_debug   = %w[true 1 yes].include?(ENV.fetch("TINA4_DEBUG", "").downcase)
+      return unless is_debug && !no_ai_port
+
+      ai_port = @port + 1000
+      # Tagged so the pipeline suppresses live reload on this port.
+      @server.listen(@host, ai_port, Tina4::AiPortRackApp.new(@app))
+      puts "  Test Port: http://localhost:#{ai_port} (stable — no hot-reload)"
+    rescue Errno::EADDRINUSE
+      puts "  Test Port: SKIPPED (port #{ai_port} in use)"
+    rescue SocketError, SystemCallError => e
+      Tina4::Log.error("Test Port: SKIPPED — auxiliary port #{ai_port} bind failed (#{e.class}: #{e.message})")
+      puts "  Test Port: SKIPPED (#{e.class})"
+    end
+
     # Dispatch a Rack-style env through the Tina4 app and return [status, headers, body].
     #
     # Useful for testing and embedding — does not require a running server.

data/lib/tina4.rb

@@ -12,6 +12,7 @@ require_relative "tina4/constants"
 require_relative "tina4/log"
 require_relative "tina4/debug"  # backward compat alias
 require_relative "tina4/env"
+require_relative "tina4/csp"  # per-response CSP nonce (ADR-0088) — before response
 require_relative "tina4/sqlite_path_resolver"
 require_relative "tina4/row_symbolizer"
 require_relative "tina4/router"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.142
+  version: 3.13.144
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-30 00:00:00.000000000 Z
+date: 2026-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3
@@ -212,6 +212,7 @@ files:
 - lib/tina4/context/chunker.rb
 - lib/tina4/cors.rb
 - lib/tina4/crud.rb
+- lib/tina4/csp.rb
 - lib/tina4/database.rb
 - lib/tina4/database/sqlite3_adapter.rb
 - lib/tina4/database_adapter.rb