tina4ruby 3.13.143 → 3.13.145

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 641d95c3ab74eeac0ce2b273ee7c6c44ca8aaab5e7e2a06d8e668eacffc5fb28
-  data.tar.gz: f8ad58627e7263bf560b499dc40fbd249d3267516d61b2c31696051f80b11852
+  metadata.gz: fdd61b88184de108dd6f4daefae312d7d26eab819ec084b88f5f257fce98167f
+  data.tar.gz: 336322ba4f2b6521d74af052391a0c1464310330935dd507c6a4ab2bfb5add11
 SHA512:
-  metadata.gz: 2354cb021a1136116236d2a94f6c5be38331823eda3e4ea4b37483ac395e3324af69b8a88d55e856039fe1951bb74be6e4918505bcbd6f6b70075f9b2ef0f232
-  data.tar.gz: f3c5de4a797f61db477db42c3a46e0f47dd132e7e2522b05d6127ee6c6d84b631215808fcb88953467308291a9754b39811f1ab8604f02fca93921b39b2ea67b
+  metadata.gz: e71cd5ffa73b75f87542f96e32fa4c503b38dacad2ea7444e381bd67ca94764be6a5c24f585e5cb1c4d4589b066303b02cef915effc1a8b8c92bd1b597176e6d
+  data.tar.gz: d0389a5a87a2911f7130647e12ee7f7b9c8476e75f8dcd824659d9f72c0099b640687a2a778f385ea322afb66dd8d62e435cd84467b788a9616868c1aa62d75d

data/CHANGELOG.md

@@ -6,6 +6,14 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.145 — 2026-10-03
+
+Two fixes land together. The Api client no longer carries an application-configured header onto a different origin: credentials travel under many names (`X-Api-Key`, a custom bearer header), so on a cross-origin redirect only content-negotiation and transport headers cross, and every configured or per-call header is bound to the origin it was meant for; a same-origin redirect keeps them. And `tina4ruby migrate` now exits 1 when there is no usable database (unreachable or misconfigured), so CI no longer reads a failed migration as success. Both are proven against real dependencies, no mocks. No runtime gems.
+
+## 3.13.144 — 2026-10-02
+
+HEAD responses are locked to exactly one `Content-Length` on the wire, equal to the length the GET would have sent. A HEAD emitting two differing `Content-Length` headers is malformed (RFC 7230 s3.3.2); a strict proxy (nginx) 502s it while lenient clients show 200. Ruby already writes a single, correct `Content-Length` with an empty body; this release LOCKS it with a conformance test that boots the real built-in server and reads the raw socket, because the in-process test reads a response object and cannot see the wire - the layer where tina4-php shipped `Content-Length: 0` on every routed HEAD (fixed in the same release). Also internal: the serve-debug readiness harness is unified on the `Server:`-banner identity guard across all four frameworks, and a carbon-benchmark drift (a `to_paginate` call with arguments, which ADR-0043 forbids) is fixed so `carbon_benchmarks.rb --carbon` runs clean. No runtime behaviour change in ruby. The framework still has no required runtime dependencies.
+
 ## 3.13.143 — 2026-10-01
 
 A fresh project's own styling now loads under the strict default Content-Security-Policy. The framework serves `default-src 'self'`, which a browser enforces by refusing every inline `<style>` and `<script>` -- so a new project rendered unstyled with its scripts blocked. The framework now mints one nonce per response, injects it into the `style-src` and `script-src` directives, and stamps it on every inline block it emits, de-inlining the `style=` and `on*=` attributes it used to rely on; a template that needs an inline block stamps `csp_nonce()` on it (ADR-0088, #96). A session's expiry now slides on activity: a read-only request that touched a stored session re-writes the merged record to move the deadline forward, so a request in flight next to a logout no longer loses the wrong state (ADR-0087, #94). Internally, the serve-debug readiness probe is identity-guarded so a foreign server on a reused ephemeral port can no longer be mistaken for the child under test -- a continuous-integration flake fix with no runtime change (#95). The framework still has no required runtime dependencies.

data/lib/tina4/api.rb

@@ -41,6 +41,14 @@ module Tina4
   # master's _STRIP_ON_CROSS_ORIGIN.
   API_STRIP_ON_CROSS_ORIGIN = %w[authorization cookie].freeze
 
+  # The only headers carried onto a different origin. A caller-set header can
+  # hold a credential under any name (X-Api-Key, X-Auth-Token, ...), so a
+  # denylist cannot contain it: the headers configured on the client (and any
+  # per-call header, on a redirect) are bound to the origin they were meant for,
+  # and only these content-negotiation headers cross. Compared case-insensitively.
+  API_KEEP_ON_CROSS_ORIGIN = %w[user-agent accept accept-encoding accept-language
+                                content-type content-length].freeze
+
   # A curated extension -> MIME map for guessing a multipart part's Content-Type
   # from its filename (Ruby core ships no mimetypes db, and pulling one in would
   # break the zero-dependency promise). tina4: a small built-in map covering the
@@ -265,7 +273,7 @@ module Tina4
       return error_response("download requires dest_path", path: nil) unless dest_path
 
       uri = build_uri(path, params)
-      headers = @headers.dup
+      headers = configured_headers(uri).dup
       cookie = cookie_header
       headers["Cookie"] = cookie if @cookies_enabled && cookie
       headers = origin_headers(uri, headers)
@@ -542,11 +550,21 @@ module Tina4
     end
 
     def apply_headers(request, extra_headers)
-      @headers.merge(extra_headers).each do |key, value|
+      configured_headers(request.uri).merge(extra_headers).each do |key, value|
         request[key] = value
       end
     end
 
+    # Headers configured on the client belong to its base origin, like the
+    # token: a target on another origin gets only the cross-origin-safe ones. A
+    # client with no base has no origin to bind them to, and sends them to the
+    # URL each call names.
+    def configured_headers(uri)
+      return @headers if @base_url.empty? || uri.nil? || same_origin?(uri, URI.parse(@base_url))
+
+      keep_cross_origin(@headers)
+    end
+
     # Execute the request with opt-in retry/backoff. Returns an APIResponse.
     #
     # With @max_retries > 0, a transport error (APIResponse#status == 0, the
@@ -591,7 +609,7 @@ module Tina4
     end
 
     # Perform a real HTTP round-trip via Net::HTTP, following redirects in a
-    # bounded loop and stripping Authorization/Cookie on a cross-origin hop.
+    # bounded loop and carrying only API_KEEP_ON_CROSS_ORIGIN headers onto a cross-origin hop.
     # When stream_to is given, a 2xx body is streamed to that path in chunks
     # (never buffered whole) and no file is written on a non-2xx status.
     #
@@ -668,7 +686,7 @@ module Tina4
 
         if location
           new_uri = URI.join(current_uri.to_s, location)
-          current_headers = strip_cross_origin(current_headers) unless same_origin?(current_uri, new_uri)
+          current_headers = keep_cross_origin(current_headers) unless same_origin?(current_uri, new_uri)
           # 301/302/303 downgrade a non-GET/HEAD to GET and drop the body
           # (matches urllib); 307/308 preserve method + body.
           if [301, 302, 303].include?(redirect_code) && !%w[GET HEAD].include?(current_method)
@@ -787,6 +805,10 @@ module Tina4
       headers.reject { |key, _| API_STRIP_ON_CROSS_ORIGIN.include?(key.to_s.downcase) }
     end
 
+    def keep_cross_origin(headers)
+      headers.select { |key, _| API_KEEP_ON_CROSS_ORIGIN.include?(key.to_s.downcase) }
+    end
+
     # Fetch a value from a Hash trying each key as both a symbol and a string.
     def result_value(result, *keys)
       keys.each do |key|

data/lib/tina4/cli.rb

@@ -757,6 +757,19 @@ module Tina4
 
     # ── migrate ───────────────────────────────────────────────────────────
 
+    # The migrate commands cannot do their job without a database, so they
+    # fail. Tina4.initialize! logs a connection error and leaves
+    # Tina4.database nil, and returning here used to exit 0 -- a deploy whose
+    # database URL was wrong, or missing, went on as though it had migrated.
+    def exit_without_database
+      if ENV["TINA4_DATABASE_URL"].to_s.strip.empty?
+        warn "No database configured. Set TINA4_DATABASE_URL in your .env file."
+      else
+        warn "Database unavailable: TINA4_DATABASE_URL is set but could not be opened (see the error above)."
+      end
+      exit 1
+    end
+
     def cmd_migrate(argv)
       options = {}
       parser = OptionParser.new do |opts|
@@ -769,11 +782,7 @@ module Tina4
       require_relative "../tina4"
       Tina4.initialize!(Dir.pwd)
 
-      db = Tina4.database
-      unless db
-        puts "No database configured. Set TINA4_DATABASE_URL in your .env file."
-        return
-      end
+      db = Tina4.database || exit_without_database
 
       migration = Tina4::Migration.new(db)
 
@@ -856,11 +865,7 @@ module Tina4
       require_relative "../tina4"
       Tina4.initialize!(Dir.pwd)
 
-      db = Tina4.database
-      unless db
-        puts "No database configured. Set TINA4_DATABASE_URL in your .env file."
-        return
-      end
+      db = Tina4.database || exit_without_database
 
       migration = Tina4::Migration.new(db)
       info = migration.status
@@ -899,11 +904,7 @@ module Tina4
       require_relative "../tina4"
       Tina4.initialize!(Dir.pwd)
 
-      db = Tina4.database
-      unless db
-        puts "No database configured. Set TINA4_DATABASE_URL in your .env file."
-        return
-      end
+      db = Tina4.database || exit_without_database
 
       migration = Tina4::Migration.new(db)
       results = migration.rollback(options[:steps])

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.143"
+  VERSION = "3.13.145"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.143
+  version: 3.13.145
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3