tina4ruby 3.13.147 → 3.13.149

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9a60268ad13cea010f5fc994563e37b77d62c93bf73a67d075cd8086b4fa431
-  data.tar.gz: 740402d29d856535fe82468ce329ea754760a180f24436b22ae36f1d16fc25b8
+  metadata.gz: '08653f37ab3b3baf01b6103f97ec3893f910fbaf5a50b4b34a5521c872e9a225'
+  data.tar.gz: 2df60c055ca63a7957f79da033add45a12e3418f1e5890a3a986c254a8f4f6ec
 SHA512:
-  metadata.gz: 0a63f77fa42d0b2dfb1ce82a6c600c0b83b3336a68826302e27179dd92eb0bb79d57f0d4b5c183b279178d0d600fbac33a4f97ae0a1c415cae09cab3e2eaa2c5
-  data.tar.gz: 6bbd112086e7b380d4a9748ae96192fba1721b17bd7b57cff1a682e60c062c308b817e5053ee3d1fb7293f1a27e9f448857a526f1d4fd7fe72889308bbf56643
+  metadata.gz: dafb902ac5f0b385862acf78fbc1ded074233082a98d7dac462f095fb82fc4043a0ff5369eb9a7dbcd0c4662daab0c00b34a1c1647bcb6f29332a7d4882bbc30
+  data.tar.gz: 2408c4a0f724372a555efb9a39d3dd30b4334476109e257e4eb301d38db666f27f932bcd6b278c0087e3080f109042924236b550c6fafb6d8763b0db9e9c505d

data/CHANGELOG.md

@@ -6,6 +6,30 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.149 — 2026-10-10
+
+### CRUD
+- A CRUD admin page out of the box: `Tina4::Crud.to_crud(request, model: Model)` renders a
+  searchable, sortable, paginated admin screen and registers the model's AutoCrud routes (ADR-0094).
+
+### Migrations
+- Startup auto-migration holds a cross-process lock, so concurrent boots apply each migration
+  exactly once; the SQLite/Firebird lock file now lives in the system temp dir (#277).
+
+### Dev server
+- The dev dashboard and toolbar are reachable from a Docker dev box via `TINA4_DEV_ALLOWED_PEERS`;
+  a viewer the gate refuses gets no toolbar (#279).
+- The database layer accepts the `pgsql://` scheme as an alias of postgres (#280).
+- A configurable SMTP timeout is reported as a timeout instead of hanging the request (#278).
+
+## 3.13.148 — 2026-10-05
+
+### Session
+- An anonymous request stores no session — a request that never reads or writes session state no longer emits a `Set-Cookie` or persists an empty session record (cross-framework fix, at parity across Python, PHP, Ruby, Node.js).
+
+### AI skills
+- `tina4-developer-ruby` skill `updated_for_version` bumped to this release.
+
 ## 3.13.147 — 2026-10-05
 
 ### Dev MCP tools (fixes #271)

data/lib/tina4/auto_crud.rb

@@ -149,9 +149,21 @@ module Tina4
             end
             next res.error("UNKNOWN_FIELD", "Unknown filter field '#{unknown_filter_field}'", 400) if unknown_filter_field
 
+            # ADR-0094: ?search=term full-text filters the list — a
+            # case-insensitive LIKE %term% OR'd across the model's declared
+            # string/text columns, added to the WHERE before limit/offset so the
+            # envelope's total reflects the filtered set. A model with no
+            # string/text column simply matches nothing; it never errors. This is
+            # what the CRUD admin grid (and any client) uses to search.
+            apply_search_clause(model_class, req.query["search"], filter_conditions, filter_values)
+
             order_by, unknown_sort_field = parse_sort(model_class, req.query["sort"])
             next res.error("UNKNOWN_FIELD", "Unknown sort field '#{unknown_sort_field}'", 400) if unknown_sort_field
 
+            # ADR-0094: honour an explicit ?sort_dir=asc|desc for a single bare
+            # ?sort=column (the CRUD grid's spelling). See #apply_sort_direction.
+            order_by = apply_sort_direction(order_by, req.query["sort"], req.query["sort_dir"])
+
             if filter_conditions.empty?
               records = model_class.all(limit: limit, offset: offset, order_by: order_by)
               total = model_class.count
@@ -370,6 +382,43 @@ module Tina4
         id.nil? ? nil : model_class.find_by_id(id)
       end
 
+      # ADR-0094: append the ?search=term clause — a case-insensitive LIKE
+      # %term% OR'd across the model's declared string/text columns — onto the
+      # WHERE being built (conditions + bound values), before limit/offset so
+      # the envelope's total reflects the filtered set. A blank term, or a
+      # model with no string/text column, adds nothing (matches nothing, never
+      # errors). Mutates the two arrays in place and returns nil.
+      def apply_search_clause(model_class, raw_term, conditions, values)
+        term = raw_term.to_s.strip
+        return if term.empty?
+
+        columns = model_class.field_definitions
+                             .select { |_name, opts| %i[string text].include?(opts[:type]) }
+                             .keys
+                             .map { |attr| model_class.resolve_field_column(attr) || attr.to_s }
+        return if columns.empty?
+
+        conditions << "(#{columns.map { |col| "#{col} LIKE ?" }.join(' OR ')})"
+        columns.each { values << "%#{term}%" }
+        nil
+      end
+
+      # ADR-0094: honour an explicit ?sort_dir=asc|desc for a single bare
+      # ?sort=column (the CRUD grid's spelling). The Mongo-style "-field,field"
+      # sort keeps its own inline direction and ignores sort_dir. An unknown
+      # sort column is already a 400 (ADR-0069); the CRUD grid only ever emits
+      # real model columns, so it never trips that — this just adds the
+      # direction toggle its headers need. Returns order_by with its trailing
+      # direction replaced, or unchanged when sort_dir does not apply.
+      def apply_sort_direction(order_by, sort_param, sort_dir)
+        param = sort_param.to_s.strip
+        return order_by if order_by.nil? || sort_dir.nil? || param.empty? ||
+                           param.include?(",") || param.start_with?("-")
+
+        direction = sort_dir.to_s.downcase == "desc" ? "DESC" : "ASC"
+        order_by.sub(/\s+(?:ASC|DESC)\s*\z/i, " #{direction}")
+      end
+
       # Parse the sort parameter: "-name,created_at" => "name DESC, created_at ASC".
       #
       # ADR-0069: each part (empty parts skipped, a leading "-" means DESC) must

data/lib/tina4/cli.rb

@@ -39,7 +39,7 @@ module Tina4
     GENERATORS = {
       "model"      => { handler: :generate_model,      usage: '<Name> [--fields "name:string,price:float"] [--table-name <name>]', summary: "ORM model + matching migration" },
       "route"      => { handler: :generate_route,      usage: "<name> [--model Name] [--public]",             summary: "CRUD route file, secure by default (--public opens writes)" },
-      "crud"       => { handler: :generate_crud,       usage: '<Name> [--fields "..."] [--public]',           summary: "Model + migration + routes + form + view + test" },
+      "crud"       => { handler: :generate_crud,       usage: '<Name> [--fields "..."] [--public] [--no-templates]', summary: "Model + migration + AutoCrud-backed admin page (to_crud) + editable crud/ templates + gate test" },
       "migration"  => { handler: :generate_migration,  usage: "<description>",                                 summary: "Timestamped migration file (UP/DOWN)" },
       "middleware" => { handler: :generate_middleware, usage: "<Name>",                                        summary: "Middleware with before/after hooks" },
       "test"       => { handler: :generate_test,       usage: "<name> [--model Name]",                         summary: "RSpec test file" },
@@ -2152,38 +2152,97 @@ module Tina4
     # ── Generator: crud ──────────────────────────────────────────────────
 
     def generate_crud(name, flags)
-      # Quiet here — the generate_model sub-call below announces once (#123).
+      # ADR-0094: `generate crud` scaffolds an admin PAGE rendered by
+      # Tina4::Crud.to_crud, whose REST backend is delegated entirely to
+      # AutoCrud (no hand-written list/detail/write routes). The generated page
+      # route registers AutoCrud for the model (secure-by-default; --public opens
+      # writes) and renders to_crud; the overridable crud/*.twig templates are
+      # copied into the app so the developer can edit them immediately.
+      #
+      # The table name (singular, e.g. "widget") is the canonical path: the model
+      # declares table_name "<table>", AutoCrud serves /api/<table>, and the gate
+      # test + page route all key off it.
       table = resolve_table(name, flags)
-      # Always derive the plural route from the CLASS NAME, not by appending
-      # "s" to the table — otherwise a reserved-word table (already plural,
-      # Order -> orders) becomes orderss, and a `y`-ending class (Category)
-      # becomes categorys instead of categories.
-      route_name = to_route_name(name)
       is_public = flags["public"] ? true : false
 
       puts "\n  Generating CRUD for #{name}...\n"
 
       # 1. Model + migration (emit_test: false — crud emits its own broader gate
-      #    spec at step 5, so the sub-generators stay quiet to avoid double-emit).
+      #    spec at step 4, so the sub-generators stay quiet to avoid double-emit).
       generate_model(name, flags, emit_test: false)
 
-      # 2. Routes with model — secure-by-default; thread --public through so
-      #    `generate crud X --public` opens the writes (mirrors AutoCrud public:).
-      #    emit_test: false — the crud gate spec at step 5 targets the same file.
-      generate_route(route_name, { "model" => name, "public" => is_public }, emit_test: false)
-
-      # 3. Form
-      generate_form(name, flags)
+      # 2. Admin page route: registers AutoCrud (secure-by-default; --public
+      #    opens writes) and renders the to_crud admin UI at /admin/<table>.
+      generate_crud_admin_route(name, table, is_public)
 
-      # 4. View (list + detail)
-      generate_view(name, flags)
+      # 3. Copy the overridable crud/*.twig templates into the app (unless
+      #    --no-templates) so the developer owns an editable copy straight away.
+      copy_crud_templates unless flags["no-templates"]
 
-      # 5. Test — secure-by-default gate test (behavioural, real TestClient).
-      generate_test(route_name, { "model" => name, "secure_writes" => true, "public" => is_public })
+      # 4. Test — secure-by-default gate test (behavioural, real TestClient).
+      #    Keyed off the table, matching the AutoCrud routes + the route file.
+      generate_test(table, { "model" => name, "secure_writes" => true, "public" => is_public })
 
       puts "\n  CRUD generation complete for #{name}."
       puts "  Run: tina4ruby migrate"
-      puts "  Visit: /swagger to see the API docs"
+      puts "  Visit: /admin/#{table} for the admin UI, or /swagger for the API docs"
+    end
+
+    # Write the admin page route (src/routes/<table>.rb). It wires the AutoCrud
+    # REST backend for the model and renders the to_crud admin page — ADR-0094:
+    # to_crud owns no routes of its own, so the backend is AutoCrud and only the
+    # GET page lives here. Secure-by-default; `is_public` opens the writes.
+    def generate_crud_admin_route(model, table, is_public)
+      model_snake = to_snake_case(model)
+      dir = "src/routes"
+      FileUtils.mkdir_p(dir)
+      path = File.join(dir, "#{table}.rb")
+      if File.exist?(path)
+        puts "  File already exists: #{path}"
+        return
+      end
+
+      page_verb = is_public ? "get" : "secure_get"
+      write_doc = is_public ? "--public: the admin page and the writes are OPEN (no token)." : "Secure by default: the admin page AND the writes require a valid Bearer token (pass --public to open them)."
+      page_doc = is_public ? "" : "\n        # NOTE: the admin page is secured (secure_get). A browser needs a valid\n        # token/session to open it; wire your login (Tina4::Auth / Session) or run\n        # `generate crud #{model} --public` for an open page. The AutoCrud READ\n        # API (GET #{table}, GET #{table}/{id}) stays public by AutoCrud's default."
+      content = <<~RUBY
+        require_relative "../orm/#{model_snake}"
+
+        # #{model} admin — one server-rendered CRUD page (searchable, sortable,
+        # paginated table + create/edit/delete modals). The REST backend (GET
+        # list, GET/{id}, POST, PUT, DELETE) is AutoCrud; this file owns only the
+        # GET admin page. #{write_doc}#{page_doc}
+        #
+        # Restyle the UI by editing templates/crud/*.twig (copied into this app).
+        Tina4::AutoCrud.register(#{model}, public: #{is_public})
+        Tina4::AutoCrud.generate_routes
+
+        Tina4.#{page_verb} "/admin/#{table}" do |request, response|
+          response.html(Tina4::Crud.to_crud(request, model: #{model}, title: "#{model} Admin"))
+        end
+      RUBY
+
+      File.write(path, content)
+      puts "  Created #{path}"
+    end
+
+    # Copy the framework's overridable crud/*.twig templates into the app's
+    # src/templates/crud/ so the developer can edit them in place (an app copy
+    # wins over the gem's via Tina4::Template's app-first resolution). Existing
+    # files are left untouched.
+    def copy_crud_templates
+      source_dir = File.join(__dir__, "templates", "crud")
+      target_dir = File.join("src", "templates", "crud")
+      FileUtils.mkdir_p(target_dir)
+      Dir.glob(File.join(source_dir, "*.twig")).sort.each do |src|
+        dest = File.join(target_dir, File.basename(src))
+        if File.exist?(dest)
+          puts "  File already exists: #{dest}"
+        else
+          FileUtils.cp(src, dest)
+          puts "  Created #{dest}"
+        end
+      end
     end
 
     # ── Generator: migration ─────────────────────────────────────────────