tina4ruby 3.13.147 → 3.13.148

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9a60268ad13cea010f5fc994563e37b77d62c93bf73a67d075cd8086b4fa431
-  data.tar.gz: 740402d29d856535fe82468ce329ea754760a180f24436b22ae36f1d16fc25b8
+  metadata.gz: 5f81aa317ab408c5f85fa182149d2bddf74f76a6dbe0d07eab1346335f2feb18
+  data.tar.gz: a877a9d71c42570d719c721427d164581919c15e235e17d366891a5337a7920c
 SHA512:
-  metadata.gz: 0a63f77fa42d0b2dfb1ce82a6c600c0b83b3336a68826302e27179dd92eb0bb79d57f0d4b5c183b279178d0d600fbac33a4f97ae0a1c415cae09cab3e2eaa2c5
-  data.tar.gz: 6bbd112086e7b380d4a9748ae96192fba1721b17bd7b57cff1a682e60c062c308b817e5053ee3d1fb7293f1a27e9f448857a526f1d4fd7fe72889308bbf56643
+  metadata.gz: 4da03de83c10544ac690ce24d6b951b6ba688fab57fb01cb4cf5a630d1e1d41dd5fbab7397538a2910708409c3fb6fea74285ce84fd74559fb883d83303b66d6
+  data.tar.gz: cb21b614d729b774a1d9ec16ada8674cab6663e675a370ed7cb8b3f588b3c038036ba0d43bedcf764f1ab673b117df005e30063d50612ce8ace479300104d127

data/CHANGELOG.md

@@ -6,6 +6,14 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.148 — 2026-10-05
+
+### Session
+- An anonymous request stores no session — a request that never reads or writes session state no longer emits a `Set-Cookie` or persists an empty session record (cross-framework fix, at parity across Python, PHP, Ruby, Node.js).
+
+### AI skills
+- `tina4-developer-ruby` skill `updated_for_version` bumped to this release.
+
 ## 3.13.147 — 2026-10-05
 
 ### Dev MCP tools (fixes #271)

data/lib/tina4/dispatch_pipeline.rb

@@ -649,12 +649,11 @@ module Tina4
       # renamed through TINA4_SESSION_NAME, so the auto-Set-Cookie would be
       # needlessly re-emitted on every request that already carries the renamed
       # cookie. Parity with Python's core/server._init_session cookie_prefix.
-      sid = sess.id
       cookie_prefix = "#{Tina4::Session.cookie_name}="
       cookie_val = (ctx.env["HTTP_COOKIE"] || "").split(";").map(&:strip)
                                                  .find { |part| part.start_with?(cookie_prefix) }
                                                  &.slice(cookie_prefix.length..)
-      if sid && sid != cookie_val
+      if session_needs_cookie?(sess, cookie_val)
         # Route through Session#cookie_header rather than hand-writing the
         # header, so TINA4_SESSION_SECURE / _SAMESITE / _HTTPONLY / _NAME / _TTL
         # are all honoured and Secure reflects the request scheme. The old
@@ -666,6 +665,19 @@ module Tina4
       [status, headers, body_parts]
     end
 
+    # Whether the response must carry a session cookie: the session has an id the
+    # request did not already send, and it is not a fresh one. A fresh session
+    # (minted for this request and never written: a route that only read it, or
+    # the replacement for a cookie the store does not know) was not stored, so a
+    # cookie for it would name nothing - the next request could not resume it and
+    # would be handed another one.
+    def session_needs_cookie?(sess, cookie_val)
+      sid = sess.id
+      return false unless sid && sid != cookie_val
+
+      !(sess.respond_to?(:fresh?) && sess.fresh?)
+    end
+
     # Milliseconds since the request entered the pipeline.
     def elapsed_ms(ctx)
       ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - ctx.started_at) * 1000).round(3)

data/lib/tina4/session.rb

@@ -217,7 +217,7 @@ module Tina4
     # false) therefore still no-ops, exactly as before; a modified session of
     # any kind still writes.
     def save
-      return true unless @id && (@modified || @stored)
+      return true if @id.nil? || fresh?
 
       record = @data
       if @stored
@@ -247,6 +247,17 @@ module Tina4
       end
     end
 
+    # Whether this session is only an id: nothing has stored it and it holds no
+    # data. Such a session has no record and needs no cookie, so #save writes
+    # nothing for it and the dispatcher sends no cookie for it. It stops being
+    # fresh when something is stored in it. Calls that mark a session changed
+    # without leaving anything in it (deleting a key it never had, #clear,
+    # #regenerate on an empty session) leave it fresh: a record with no data is
+    # not a session.
+    def fresh?
+      !@stored && @data.empty?
+    end
+
     # Destroy the current session. ENDS the session: the stored record is
     # removed and the id is CLEARED (@id = nil), so a later set()+save() with no
     # new #start has no id to persist under and cannot RESURRECT the just-

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.147"
+  VERSION = "3.13.148"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.147
+  version: 3.13.148
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3