tina4ruby 3.13.148 → 3.13.149

data/lib/tina4/dev_admin.rb

@@ -8,6 +8,7 @@
 
 require "json"
 require "digest"
+require "ipaddr"
 require "tmpdir"
 require "net/http"
 require "uri"
@@ -2134,6 +2135,11 @@ module Tina4
       # (with_mcp_gate -> 404), so the REST loopback arm skips these prefixes and
       # lets the MCP gate govern (keeps a disallowed mcp/call a 404, not a 403).
       DEV_MCP_PREFIXES = ["/__dev/api/mcp", "/__dev/mcp"].freeze
+
+      # Static dev-toolbar assets that carry no secrets and expose no actions, so
+      # the peer gate does not cover them: wherever the toolbar is injected its
+      # stylesheet and script must load (issue #279). Host + same-origin still apply.
+      DEV_PUBLIC_ASSETS = ["/__dev/toolbar.css", "/__dev/toolbar.js"].freeze
       # Private-key / credential basenames the file endpoints must never serve.
       DEV_SECRET_BASENAMES = %w[.env .envrc id_rsa id_dsa id_ecdsa id_ed25519].freeze
       DEV_SECRET_SUFFIXES = %w[.pem .key .pfx .p12 .keystore .jks].freeze
@@ -2186,9 +2192,14 @@ module Tina4
         return dev_refused("dev-admin: refused (host not allowed)") unless dev_host_allowed?(env)
         return dev_refused("dev-admin: refused (cross-origin request)") unless dev_same_origin_ok?(env)
 
+        # The static toolbar assets are exempt from the peer gate (#279): they
+        # carry no secrets and the toolbar needs them wherever it is injected.
+        # Host + same-origin above still apply.
+        return nil if DEV_PUBLIC_ASSETS.include?(path)
+
         unless path.start_with?(*DEV_MCP_PREFIXES)
           remote_ip = (env["REMOTE_ADDR"] || "").to_s
-          unless Tina4.is_loopback?(remote_ip) || mcp_token_ok?(env, dedicated: true)
+          unless dev_peer_allowed?(remote_ip) || mcp_token_ok?(env, dedicated: true)
             return dev_refused("dev-admin: refused (non-loopback peer)")
           end
         end
@@ -2216,6 +2227,47 @@ module Tina4
       end
       public :dev_host_allowed?
 
+      # True when raw peer +ip+ falls inside +entry+ (a bare IP or a CIDR). IPv4
+      # and IPv6; an IPv4-mapped IPv6 peer (::ffff:a.b.c.d) is matched as IPv4.
+      def ip_in_cidr?(ip, entry)
+        ip = ip.to_s.strip
+        ip = ip[7..] if ip.downcase.start_with?("::ffff:") # mapped -> compare as IPv4
+        net = IPAddr.new(entry.to_s.strip)
+        addr = IPAddr.new(ip)
+        return false unless net.family == addr.family # v4 peer never matches a v6 CIDR
+        net.include?(addr)
+      rescue IPAddr::Error, ArgumentError
+        false
+      end
+      public :ip_in_cidr?
+
+      # True when the RAW socket peer may reach /__dev: loopback always, plus any
+      # IP/CIDR in TINA4_DEV_ALLOWED_PEERS (comma-separated, opt-in, default none).
+      # Reads the real socket peer ONLY, never a forwarded header, so it cannot be
+      # spoofed by X-Forwarded-For. The documented way to reach the dev dashboard
+      # from a Docker dev box, where requests arrive from the container-network
+      # gateway rather than loopback (issue #279).
+      def dev_peer_allowed?(remote_ip)
+        return true if Tina4.is_loopback?(remote_ip)
+
+        configured = ENV["TINA4_DEV_ALLOWED_PEERS"].to_s.strip
+        return false if configured.empty?
+
+        configured.split(",").any? { |entry| !entry.strip.empty? && ip_in_cidr?(remote_ip, entry) }
+      end
+      public :dev_peer_allowed?
+
+      # True when the toolbar may be injected for this viewer - the Host allow-list
+      # and the raw-peer gate both pass. A viewer the /__dev gate would refuse gets
+      # NO toolbar markup, so its stylesheet and script are never requested only to
+      # 403 (issue #279).
+      def dev_toolbar_allowed?(env)
+        return false unless dev_host_allowed?(env)
+
+        dev_peer_allowed?((env["REMOTE_ADDR"] || "").to_s)
+      end
+      public :dev_toolbar_allowed?
+
       def dev_refused(message)
         [403, { "content-type" => "application/json; charset=utf-8" },
          [JSON.generate({ "ok" => false, "error" => message })]]

data/lib/tina4/dispatch_pipeline.rb

@@ -587,6 +587,9 @@ module Tina4
       status, headers, body_parts = response
       content_type = headers["content-type"] || ""
       return nil unless content_type.include?("text/html")
+      # Do not inject the toolbar for a viewer the /__dev gate would refuse (#279):
+      # otherwise the page carries toolbar markup whose stylesheet and script 403.
+      return nil unless Tina4::DevAdmin.dev_toolbar_allowed?(ctx.env)
 
       request_info = {
         method: ctx.method,

data/lib/tina4/messenger.rb

@@ -90,14 +90,15 @@ module Tina4
 
     attr_reader :host, :port, :username, :from_address, :from_name,
                 :imap_host, :imap_port, :use_tls, :encryption,
-                :imap_encryption, :imap_use_tls, :imap_username, :imap_password
+                :imap_encryption, :imap_use_tls, :imap_username, :imap_password,
+                :timeout
 
     # Initialize with SMTP config.
     # Priority: constructor params > ENV (TINA4_MAIL_*) > sensible defaults
     def initialize(host: nil, port: nil, username: nil, password: nil,
                    from_address: nil, from_name: nil, encryption: nil, use_tls: nil,
                    imap_host: nil, imap_port: nil, imap_encryption: nil,
-                   imap_username: nil, imap_password: nil)
+                   imap_username: nil, imap_password: nil, timeout: nil)
       # Whether a host was actually CONFIGURED, which is not the same as @host being
       # set: it falls back to "localhost", so it is never nil and cannot answer
       # "can this messenger send?". The capture gate needs that answer, so record it
@@ -143,7 +144,55 @@ module Tina4
       # account read the wrong mailbox. Explicit constructor args win (ADR-0041).
       @imap_username = imap_username || ENV["TINA4_MAIL_IMAP_USERNAME"] || @username
       @imap_password = imap_password || ENV["TINA4_MAIL_IMAP_PASSWORD"] || @password
+
+      # SMTP send timeout (seconds): constructor > TINA4_MAIL_TIMEOUT > 30.
+      # Whole seconds, at least 1. See resolve_timeout. Parity with the PHP
+      # master (Messenger::resolveTimeout, tina4-php#286).
+      @timeout = resolve_timeout(timeout, ENV["TINA4_MAIL_TIMEOUT"])
+    end
+
+    #: Default socket timeout, in seconds - the value this class has always used.
+    TIMEOUT_DEFAULT = 30
+    #: Raw TINA4_MAIL_TIMEOUT values already warned about, so a bad one is said once.
+    @timeout_warned = {}
+    class << self
+      attr_reader :timeout_warned
+    end
+
+    # Resolve the SMTP send timeout to whole seconds (issue #278).
+    #
+    # An explicit constructor value is the caller's own instruction, so one below
+    # a second is a programming error and raises. A bad env value is a
+    # misconfiguration: warn once and use the default rather than guess. Zero and
+    # negative are garbage, not an opt-out - to the socket 0 means "do not wait at
+    # all", so no send could succeed.
+    def resolve_timeout(explicit, raw)
+      unless explicit.nil?
+        seconds = Integer(explicit)
+        raise ArgumentError, "Messenger timeout must be at least 1 second, got #{seconds}." if seconds < 1
+
+        return seconds
+      end
+      return TIMEOUT_DEFAULT if raw.nil? || raw.to_s.strip.empty?
+
+      seconds = begin
+        Integer(raw.to_s.strip)
+      rescue ArgumentError
+        nil
+      end
+      if seconds.nil? || seconds < 1
+        unless self.class.timeout_warned.key?(raw)
+          self.class.timeout_warned[raw] = true
+          Tina4::Log.warning(
+            "TINA4_MAIL_TIMEOUT must be a whole number of seconds and at least 1, got " \
+            "#{raw.inspect} - using the default of #{TIMEOUT_DEFAULT} seconds"
+          )
+        end
+        return TIMEOUT_DEFAULT
+      end
+      seconds
     end
+    private :resolve_timeout
 
     def normalize_encryption(value, label)
       normalized = value.to_s.strip.downcase
@@ -486,6 +535,7 @@ module Tina4
         starttls: @use_tls,
         username: authenticate ? @username : nil,
         password: authenticate ? @password : nil,
+        timeout: @timeout,
         &block
       )
     end

data/lib/tina4/migration.rb

@@ -6,42 +6,51 @@
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 require "fileutils"
+require "digest"
+require "tmpdir"
 
 module Tina4
   class Migration
     TRACKING_TABLE = "tina4_migration"
+    # Lock name shared by GET_LOCK (MySQL) and sp_getapplock (MSSQL).
+    LOCK_NAME = "tina4_migration_lock"
 
     attr_reader :db, :migrations_dir
 
     def initialize(db, migrations_dir: nil)
       @db = db
       @migrations_dir = migrations_dir || resolve_migrations_dir
-      ensure_tracking_table
+      # Ruby boots once per process (no per-request re-entry like PHP's php -S),
+      # so there is no concurrent CONSTRUCT race here — the table is ensured
+      # eagerly as before. migrate also re-ensures it UNDER the run-wide lock
+      # (idempotent), which is where the #277 apply race is actually serialized.
+      ensure_tracking_table if @db
     end
 
-    # Run all pending migrations
+    # Run all pending migrations under a cross-process lock.
+    #
+    # The lock serializes concurrent startup migrations (#277): the hook runs per
+    # request under php -S-style servers and once per process on a long-lived
+    # server, so several workers could reach a fresh database at once and apply
+    # the same migration more than once (a data migration then inserted its rows
+    # twice). Now the winner migrates while the rest block, then re-read the
+    # applied set and find nothing pending. Every backend auto-releases the lock
+    # when the holder's session/process dies, so a crash never deadlocks boot.
     def migrate
-      pending = pending_migrations
-      if pending.empty?
-        Tina4::Log.info("No pending migrations")
-        return []
-      end
-
-      batch = next_batch_number
-      results = []
-      pending.each do |file|
-        result = run_migration(file, batch)
-        results << result
-        # Stop on failure
-        break if result[:status] == "failed"
+      lock = acquire_migration_lock
+      begin
+        ensure_tracking_table
+        run_pending
+      ensure
+        release_migration_lock(lock)
       end
-      results
     end
 
     alias run migrate
 
     # Rollback last batch (or N steps)
     def rollback(steps = 1)
+      ensure_tracking_table
       completed = completed_migrations_with_batch
       return [] if completed.empty?
 
@@ -60,6 +69,7 @@ module Tina4
     end
 
     def status
+      ensure_tracking_table
       {
         completed: completed_migrations,
         pending: pending_migrations.map { |f| File.basename(f) }
@@ -178,6 +188,112 @@ module Tina4
 
     private
 
+    # Apply every pending migration, in order. Caller holds the run-wide lock.
+    def run_pending
+      pending = pending_migrations
+      if pending.empty?
+        Tina4::Log.info("No pending migrations")
+        return []
+      end
+
+      batch = next_batch_number
+      results = []
+      pending.each do |file|
+        result = run_migration(file, batch)
+        results << result
+        # Stop on failure
+        break if result[:status] == "failed"
+      end
+      results
+    end
+
+    # A stable signed-64-bit key for PostgreSQL's pg_advisory_lock, derived from
+    # the lock name so it cannot collide with an application's own advisory-lock
+    # keys. It is a constant (not user input), so inlining it in the SQL is
+    # injection-safe.
+    def pg_advisory_key
+      Digest::SHA256.digest(LOCK_NAME)[0, 8].unpack1("q")
+    end
+
+    # Take the run-wide migration lock, blocking until it is held.
+    #
+    # PostgreSQL/MySQL/MSSQL use a native session-scoped advisory lock; SQLite,
+    # Firebird and anything else fall back to an OS advisory file lock on a
+    # sidecar in the migrations folder. A backend that cannot lock degrades to the
+    # file lock, and finally to running unlocked (the pre-#277 behaviour) rather
+    # than blocking boot. Returns [kind, resource] for release_migration_lock.
+    def acquire_migration_lock
+      engine = (@db.respond_to?(:get_database_type) ? @db.get_database_type : "").to_s.downcase
+
+      begin
+        if engine.start_with?("postgres")
+          @db.fetch("SELECT pg_advisory_lock(#{pg_advisory_key}) AS locked")
+          return [:postgres, nil]
+        elsif engine.start_with?("mysql")
+          # -1 = wait indefinitely; GET_LOCK is connection-scoped.
+          @db.fetch("SELECT GET_LOCK('#{LOCK_NAME}', -1) AS locked")
+          return [:mysql, nil]
+        elsif engine == "mssql" || engine == "sqlserver"
+          @db.execute(
+            "DECLARE @res INT; EXEC @res = sp_getapplock @Resource = '#{LOCK_NAME}', " \
+            "@LockMode = 'Exclusive', @LockOwner = 'Session', @LockTimeout = -1"
+          )
+          return [:mssql, nil]
+        end
+      rescue => e
+        Tina4::Log.debug("DB migration lock unavailable (#{engine}): #{e.message}; using a file lock")
+      end
+
+      acquire_file_lock
+    end
+
+    # OS advisory file lock on a sidecar — the portable fallback (crash-safe: the
+    # kernel drops it when the process exits).
+    def acquire_file_lock
+      handle = File.open(file_lock_path, File::RDWR | File::CREAT, 0o644)
+      handle.flock(File::LOCK_EX)
+      [:file, handle]
+    rescue => e
+      Tina4::Log.debug("file migration lock unavailable: #{e.message}; running unlocked")
+      [:none, nil]
+    end
+
+    # Where the advisory lock file lives: the system temp directory, NOT the
+    # migrations folder. The lock is a runtime artifact, not a migration — a
+    # dotfile left in the tracked migrations/ directory gets committed by accident
+    # and blocks a plain rmdir of the folder. The name is derived from the ABSOLUTE
+    # migrations directory, so every worker of the SAME app lands on the SAME file
+    # and flock() serializes them, while two different apps get two different locks.
+    # This keeps the lock scope identical to before; only the file's location
+    # changed. Mirrors the PHP reference's fileLockPath() (issue #277).
+    def file_lock_path
+      key = begin
+        File.realpath(@migrations_dir)
+      rescue StandardError
+        @migrations_dir
+      end
+      File.join(Dir.tmpdir, "tina4-migration-#{Digest::SHA256.hexdigest(key)}.lock")
+    end
+
+    def release_migration_lock(handle)
+      kind, resource = handle
+      case kind
+      when :postgres
+        @db.fetch("SELECT pg_advisory_unlock(#{pg_advisory_key}) AS released")
+      when :mysql
+        @db.fetch("SELECT RELEASE_LOCK('#{LOCK_NAME}') AS released")
+      when :mssql
+        @db.execute("EXEC sp_releaseapplock @Resource = '#{LOCK_NAME}', @LockOwner = 'Session'")
+      when :file
+        if resource
+          resource.flock(File::LOCK_UN)
+          resource.close
+        end
+      end
+    rescue => e
+      Tina4::Log.debug("migration lock release failed (#{handle&.first}): #{e.message}")
+    end
+
     # Resolve migrations directory: prefer src/migrations, fall back to migrations/
     def resolve_migrations_dir
       # Canonical location is migrations/ (project root) — matches the Python reference, the CLI,

data/lib/tina4/templates/crud/form.twig

@@ -0,0 +1,26 @@
+{#
+  crud/form.twig — the create/edit field inputs (and the public generate_form).
+
+  Override: drop your own templates/crud/form.twig to change how inputs render.
+
+  fields - one per input: { id, name, label, value, placeholder, required_attr,
+           and exactly ONE control flag: input (with type) | textarea | checkbox
+           (checked_attr) | select (options_html) }.
+  wrap        - render the <form> wrapper; form_id_attr/action/form_method set it
+  edit        - add the hidden primary-key input (edit modal)
+  modal_footer- render the Cancel/Save modal buttons; submit_button - a plain Submit
+
+  No inline styles or on*= handlers: the modal buttons carry data-crud-action and
+  are wired by the page script's delegated listener (ADR-0088).
+#}
+{% if wrap %}<form{{ form_id_attr|raw }} action="{{ action }}" method="{{ form_method }}" class="needs-validation" data-crud-form="1">{% endif %}
+{% if method_override %}<input type="hidden" name="_method" value="{{ method_override }}">{% endif %}
+{% if edit %}<input type="hidden" id="{{ mode }}-pk-value" name="{{ pk }}">{% endif %}
+{% if modal_footer %}<div class="crud-errors" data-crud-errors hidden></div>{% endif %}
+{% for field in fields %}<div class="mb-3">
+<label for="{{ field.id }}" class="form-label">{{ field.label }}</label>
+{% if field.textarea %}<textarea class="form-control" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.value }}</textarea>{% endif %}{% if field.checkbox %}<div class="form-check"><input class="form-check-input" type="checkbox" id="{{ field.id }}" name="{{ field.name }}"{{ field.checked_attr|raw }}></div>{% endif %}{% if field.select %}<select class="form-select" id="{{ field.id }}" name="{{ field.name }}"{{ field.required_attr|raw }}>{{ field.options_html|raw }}</select>{% endif %}{% if field.input %}<input type="{{ field.type }}" class="form-control" id="{{ field.id }}" name="{{ field.name }}" value="{{ field.value }}" placeholder="{{ field.placeholder }}"{{ field.required_attr|raw }}>{% endif %}
+</div>
+{% endfor %}
+{% if modal_footer %}<div class="modal-footer"><button type="button" class="btn btn-secondary" data-crud-action="close" data-crud-modal="{{ mode }}">Cancel</button><button type="button" class="btn btn-primary" data-crud-action="save" data-crud-mode="{{ mode }}">Save</button></div>{% endif %}{% if submit_button %}<button type="submit" class="btn btn-primary">Submit</button>{% endif %}
+{% if wrap %}</form>{% endif %}

data/lib/tina4/templates/crud/modals.twig

@@ -0,0 +1,31 @@
+{#
+  crud/modals.twig — the create, edit and delete-confirm dialogs.
+
+  Override: drop your own templates/crud/modals.twig to restyle the dialogs.
+  create_form / edit_form are the crud/form.twig renders injected here. Buttons
+  carry data-crud-action (close / confirm-delete) and are wired by the page
+  script — no inline on*= handlers (ADR-0088).
+#}
+<div class="modal-overlay" id="modal-create">
+  <div class="modal-box">
+    <h3>Create New Record</h3>
+    {{ create_form|raw }}
+  </div>
+</div>
+<div class="modal-overlay" id="modal-edit">
+  <div class="modal-box">
+    <h3>Edit Record</h3>
+    {{ edit_form|raw }}
+  </div>
+</div>
+<div class="modal-overlay" id="modal-delete">
+  <div class="modal-box">
+    <h3>Confirm Delete</h3>
+    <p>Are you sure you want to delete this record? This action cannot be undone.</p>
+    <input type="hidden" id="delete-pk-value">
+    <div class="modal-footer">
+      <button class="btn btn-secondary" data-crud-action="close" data-crud-modal="delete">Cancel</button>
+      <button class="btn btn-danger" data-crud-action="confirm-delete">Delete</button>
+    </div>
+  </div>
+</div>