tina4ruby 3.13.150 → 3.13.151

data/lib/tina4/middleware.rb

@@ -783,6 +783,7 @@ module Tina4
   #   TINA4_CSP                 — Content-Security-Policy (default: "default-src 'self'")
   #   TINA4_REFERRER_POLICY     — Referrer-Policy (default: strict-origin-when-cross-origin)
   #   TINA4_PERMISSIONS_POLICY  — Permissions-Policy (default: camera=(), microphone=(), geolocation=())
+  #   TINA4_COOP                — Cross-Origin-Opener-Policy (default: same-origin-allow-popups)
   class SecurityHeadersMiddleware
     class << self
       # Register this middleware in the default chain (secure-by-default).
@@ -815,7 +816,15 @@ module Tina4
           ["Content-Security-Policy", Tina4::Csp.resolve_csp_header(Tina4::Csp.current_nonce)],
           ["Referrer-Policy", ENV["TINA4_REFERRER_POLICY"] || "strict-origin-when-cross-origin"],
           ["X-XSS-Protection", "0"],
-          ["Permissions-Policy", ENV["TINA4_PERMISSIONS_POLICY"] || "camera=(), microphone=(), geolocation=()"]
+          ["Permissions-Policy", ENV["TINA4_PERMISSIONS_POLICY"] || "camera=(), microphone=(), geolocation=()"],
+          # Cross-Origin-Opener-Policy severs the window-reference link to a
+          # cross-origin opener (closing reverse-tab-nabbing + cross-window
+          # XS-Leaks that X-Frame-Options does not). Default same-origin-allow-popups:
+          # isolates the page from its opener while leaving popups IT opens able to
+          # post back, so OAuth/payment popups keep working. TINA4_COOP=same-origin
+          # for full isolation, unsafe-none to opt out. Secure-context only (https
+          # and http://localhost), inert elsewhere.
+          ["Cross-Origin-Opener-Policy", ENV["TINA4_COOP"] || "same-origin-allow-popups"]
         ]
       end
 

data/lib/tina4/plan.rb

@@ -53,7 +53,7 @@ module Tina4
       end
 
       def slugify(title)
-        slug = title.to_s.strip.downcase.gsub(/[^a-z0-9_\-]+/, "-").gsub(/\A-+|-+\z/, "")
+        slug = title.to_s.strip.downcase.gsub(/[^a-z0-9_\-]+/, "-").gsub(/\A-++|-++\z/, "")
         slug = slug[0, 80]
         slug.empty? ? "plan-#{Time.now.to_i}" : slug
       end
@@ -69,7 +69,7 @@ module Tina4
         section = nil # :steps | :notes | :other | nil
 
         lines.each do |raw|
-          line = raw.sub(/[[:space:]]+\z/, "")
+          line = raw.sub(/[[:space:]]++\z/, "")
           if title.empty? && line.start_with?("# ")
             title = line[2..].to_s.strip
             next

data/lib/tina4/point.rb

@@ -52,7 +52,7 @@ module Tina4
       return from_geojson(value, srid) if value.is_a?(Hash)
       if value.is_a?(String)
         text = value.strip
-        match = text.match(/\A(?:SRID\s*=\s*(\d+)\s*;\s*)?POINT\s*(?:Z|M|ZM)?\s*\(\s*([-+0-9.eE]+)\s+([-+0-9.eE]+)(?:\s+[-+0-9.eE]+)*\s*\)\z/i)
+        match = text.match(/\A(?:SRID\s*=\s*(\d+)\s*;\s*)?POINT\s*(?:Z|M|ZM)?\s*\(\s*([-+0-9.eE]+)\s++([-+0-9.eE]+)(?:\s++[-+0-9.eE]+)*+\s*+\)\z/i)
         return new(match[2], match[3], srid: match[1] ? match[1].to_i : srid) if match
         raw = [text].pack("H*") if text.length >= 42 && text.length.even? && text.match?(/\A[0-9a-f]+\z/i)
         raw ||= value.b if [0, 1].include?(value.getbyte(0))

data/lib/tina4/project_index.rb

@@ -71,7 +71,7 @@ module Tina4
         text.scan(/^\s*def\s+(self\.)?([A-Za-z_][\w!?=]*)/) { |m| out["symbols"] << m[1] }
         text.scan(/^\s*require(?:_relative)?\s+['"]([^'"]+)['"]/) { |m| out["imports"] << m[0] }
         # Tina4.get "/path"  OR  Tina4::Router.get("/path")  OR  get "/path" do
-        route_re = /(?:Tina4(?:::Router)?\.|^\s*)(get|post|put|patch|delete|any|any_method|secure_get|secure_post)\s*\(?\s*['"]([^'"]+)['"]/
+        route_re = /(?:Tina4(?:::Router)?\.|^\s*)(get|post|put|patch|delete|any|any_method|secure_get|secure_post)\s*+\(?\s*+['"]([^'"]+)['"]/
         text.scan(route_re) do |meth, path|
           next unless ROUTE_METHODS.include?(meth)
           out["routes"] << { "method" => meth.upcase, "path" => path, "handler" => "" }

data/lib/tina4/rack_app.rb

@@ -108,6 +108,8 @@ module Tina4
       # value. Cleared in `ensure`, exactly like the request id (an overlapping
       # request on another thread never shares it).
       Tina4::Csp.set_current_nonce(Tina4::Csp.generate_nonce)
+      # form_token() binds each token to this request's session (CSRF).
+      Tina4::Frond.request_env = env
 
       begin
         result = dispatch_pipeline(env)
@@ -121,6 +123,7 @@ module Tina4
         # nonce has the same lifetime.
         Tina4::Log.clear_request_id
         Tina4::Csp.clear_current_nonce
+        Tina4::Frond.request_env = nil
       end
     end
 
@@ -1247,7 +1250,7 @@ module Tina4
       # token in the body, auth token in the session) is still authenticated.
       candidates = []
       auth_header = env["HTTP_AUTHORIZATION"] || ""
-      candidates << [Regexp.last_match(1), :header] if auth_header =~ /\ABearer\s+(.+)\z/i
+      candidates << [Regexp.last_match(1), :header] if auth_header =~ /\ABearer\s++(.+)\z/i
       form_token = _extract_form_token(_read_rack_body(env), env)
       candidates << [form_token, :body] if form_token && !form_token.empty?
 

data/lib/tina4/realtime/s3_client.rb

@@ -0,0 +1,240 @@
+# frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+require "net/http"
+require "uri"
+require "openssl"
+require "digest"
+require "time"
+
+module Tina4
+  module Realtime
+    # An S3 request returned a non-2xx status; +status+ holds the HTTP code.
+    class S3Error < StandardError
+      attr_reader :status
+      attr_accessor :retry_after
+
+      def initialize(status, message)
+        super(message)
+        @status = status
+        @retry_after = nil
+      end
+    end
+
+    # The client cannot sign a request: no access key or secret was given.
+    class S3ConfigError < StandardError; end
+
+    # Zero-dependency S3 client (AWS Signature Version 4) on the Ruby standard
+    # library. Covers exactly what the realtime {S3Storage} backend needs — PUT,
+    # GET, DELETE, HEAD, and a presigned GET URL — so the +s3+ backend no longer
+    # needs the aws-sdk-s3 gem.
+    #
+    # Path-style addressing (<endpoint>/<bucket>/<key>), which S3-compatible
+    # servers (MinIO, Garage) require and AWS accepts; with no endpoint it
+    # targets https://s3.<region>.amazonaws.com. SigV4 is HMAC-SHA256 canonical
+    # signing — the same primitive Tina4's JWT already uses (stdlib OpenSSL);
+    # nothing here is reinvented crypto. Mirrors the Python master, proven
+    # against AWS's published SigV4 test vector.
+    class S3Client
+      ALGORITHM = "AWS4-HMAC-SHA256"
+      SERVICE = "s3"
+      # Retry policy, as for the AI client (ADR-0053): HTTP 429, any 5xx (S3's
+      # SlowDown is a 503) and a dropped connection are sent again, a bounded
+      # number of times, honouring Retry-After. Every operation here is idempotent.
+      MAX_RETRIES = 2
+      BACKOFF_BASE = 0.5   # seconds; retry n waits up to base * 2**n, jittered
+      BACKOFF_CAP = 20.0
+      # A connection refused, reset, dropped or timed out: nothing was answered.
+      RETRYABLE_NETWORK = [
+        Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EPIPE, EOFError,
+        SocketError, IOError, Net::OpenTimeout, Net::ReadTimeout, Timeout::Error
+      ].freeze
+
+      def initialize(endpoint: nil, access_key: "", secret_key: "", region: "us-east-1", timeout: 30)
+        @region = region && !region.empty? ? region : "us-east-1"
+        @access_key = access_key || ""
+        @secret_key = secret_key || ""
+        @timeout = timeout
+        base = endpoint && !endpoint.empty? ? endpoint : "https://s3.#{@region}.amazonaws.com"
+        base = base.delete_suffix("/") while base.end_with?("/") # strip trailing slashes without a regex
+        @scheme = base[%r{\A([a-z][a-z0-9+.\-]*)://}i, 1] || "https"
+        authority = base.sub(%r{\A[a-z][a-z0-9+.\-]*://}i, "")
+        # Split authority (host[:port], the Host header + signed `host:`) from a
+        # path an endpoint carries (https://host/s3 -> "/s3"), which is kept in
+        # front of every request path and in what is signed.
+        slash = authority.index("/")
+        @host = slash ? authority[0...slash] : authority
+        @prefix = slash ? authority[slash..].delete_suffix("/") : ""
+        @prefix = @prefix.delete_suffix("/") while @prefix.end_with?("/")
+      end
+
+      # -- public API (the subset S3Storage uses) ------------------------------
+
+      def put_object(bucket, key, data, content_type = "application/octet-stream")
+        request("PUT", canonical_uri(bucket, key), data, { "content-type" => content_type })
+      end
+
+      def get_object(bucket, key)
+        request("GET", canonical_uri(bucket, key), "")[1]
+      end
+
+      def delete_object(bucket, key)
+        request("DELETE", canonical_uri(bucket, key), "")
+        nil
+      end
+
+      def head_object(bucket, key)
+        request("HEAD", canonical_uri(bucket, key), "")
+        nil
+      end
+
+      # Create the bucket (path-style PUT /<bucket>); an already-owned bucket (409) is success.
+      def create_bucket(bucket)
+        request("PUT", "#{@prefix}/#{self.class.uri_encode(bucket, true)}", "")
+        nil
+      rescue S3Error => e
+        raise unless e.status == 409
+      end
+
+      # A URL that fetches the object directly, signed via SigV4 query params.
+      def presigned_get_url(bucket, key, expires: 3600)
+        require_credentials
+        now = Time.now.utc
+        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        datestamp = now.strftime("%Y%m%d")
+        uri = canonical_uri(bucket, key)
+        scope = "#{datestamp}/#{@region}/#{SERVICE}/aws4_request"
+        query = {
+          "X-Amz-Algorithm" => ALGORITHM,
+          "X-Amz-Credential" => "#{@access_key}/#{scope}",
+          "X-Amz-Date" => amz_date,
+          "X-Amz-Expires" => expires.to_s,
+          "X-Amz-SignedHeaders" => "host"
+        }
+        canonical_qs = canonical_query(query)
+        canonical_request = ["GET", uri, canonical_qs, "host:#{@host}\n", "host", "UNSIGNED-PAYLOAD"].join("\n")
+        signature = sign(canonical_request, amz_date, datestamp, scope)
+        "#{@scheme}://#{@host}#{uri}?#{canonical_qs}&X-Amz-Signature=#{signature}"
+      end
+
+      # SigV4 canonical encoding: keep the RFC 3986 unreserved set literal; keep
+      # "/" in a path, percent-encode it in a query; space -> %20.
+      def self.uri_encode(value, is_path)
+        value.to_s.b.each_byte.map do |byte|
+          ch = byte.chr
+          if ch.match?(/[A-Za-z0-9\-_.~]/) || (is_path && ch == "/")
+            ch
+          else
+            format("%%%02X", byte)
+          end
+        end.join
+      end
+
+      private
+
+      # Signing with an empty key only earns a 403 from the server, which says
+      # nothing about the cause. Name the settings instead, before sending.
+      def require_credentials
+        return unless @access_key.empty? || @secret_key.empty?
+
+        raise S3ConfigError, "S3 credentials are not set: set TINA4_STORAGE_KEY and TINA4_STORAGE_SECRET"
+      end
+
+      # Seconds from a Retry-After header in its delta-seconds form, else nil.
+      def retry_after_seconds(raw)
+        return nil if raw.nil?
+
+        value = Float(raw)
+        value.negative? ? 0.0 : value
+      rescue ArgumentError, TypeError
+        nil
+      end
+
+      def canonical_uri(bucket, key)
+        "#{@prefix}/#{self.class.uri_encode(bucket, true)}/#{self.class.uri_encode(key, true)}"
+      end
+
+      def canonical_query(query)
+        query.sort.map { |k, v| "#{self.class.uri_encode(k, false)}=#{self.class.uri_encode(v, false)}" }.join("&")
+      end
+
+      def signing_key(datestamp)
+        k_date = OpenSSL::HMAC.digest("SHA256", "AWS4#{@secret_key}", datestamp)
+        k_region = OpenSSL::HMAC.digest("SHA256", k_date, @region)
+        k_service = OpenSSL::HMAC.digest("SHA256", k_region, SERVICE)
+        OpenSSL::HMAC.digest("SHA256", k_service, "aws4_request")
+      end
+
+      def sign(canonical_request, amz_date, datestamp, scope)
+        string_to_sign = [ALGORITHM, amz_date, scope, Digest::SHA256.hexdigest(canonical_request)].join("\n")
+        OpenSSL::HMAC.hexdigest("SHA256", signing_key(datestamp), string_to_sign)
+      end
+
+      def request(method, canonical_uri, body, extra_headers = {})
+        require_credentials
+        attempt = 0
+        loop do
+          last = attempt == MAX_RETRIES
+          delay = nil
+          begin
+            # Signed afresh each attempt: x-amz-date moves on.
+            return send_once(method, canonical_uri, body, extra_headers)
+          rescue S3Error => e
+            raise if last || !(e.status == 429 || e.status >= 500)
+
+            delay = e.retry_after
+          rescue *RETRYABLE_NETWORK
+            raise if last
+          end
+          delay ||= rand * (BACKOFF_BASE * (2**attempt))
+          sleep([delay, BACKOFF_CAP].min)
+          attempt += 1
+        end
+      end
+
+      def send_once(method, canonical_uri, body, extra_headers = {})
+        now = Time.now.utc
+        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        datestamp = now.strftime("%Y%m%d")
+        payload_hash = Digest::SHA256.hexdigest(body || "")
+
+        signed = { "host" => @host, "x-amz-content-sha256" => payload_hash, "x-amz-date" => amz_date }
+        canonical_headers = signed.sort.map { |k, v| "#{k}:#{v}\n" }.join
+        signed_headers = signed.keys.sort.join(";")
+        canonical_request = [method, canonical_uri, "", canonical_headers, signed_headers, payload_hash].join("\n")
+        scope = "#{datestamp}/#{@region}/#{SERVICE}/aws4_request"
+        signature = sign(canonical_request, amz_date, datestamp, scope)
+        authorization = "#{ALGORITHM} Credential=#{@access_key}/#{scope}, " \
+                        "SignedHeaders=#{signed_headers}, Signature=#{signature}"
+
+        uri = URI("#{@scheme}://#{@host}#{canonical_uri}")
+        klass = { "PUT" => Net::HTTP::Put, "GET" => Net::HTTP::Get,
+                  "DELETE" => Net::HTTP::Delete, "HEAD" => Net::HTTP::Head }.fetch(method)
+        req = klass.new(uri)
+        req["Authorization"] = authorization
+        req["x-amz-content-sha256"] = payload_hash
+        req["x-amz-date"] = amz_date
+        extra_headers.each { |name, value| req[name] = value }
+        req.body = body if %w[PUT POST].include?(method)
+
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+        http.open_timeout = @timeout
+        http.read_timeout = @timeout
+        response = http.request(req)
+        status = response.code.to_i
+        if status < 200 || status >= 300
+          error = S3Error.new(status, "#{method} #{canonical_uri}: HTTP #{status}")
+          error.retry_after = retry_after_seconds(response["retry-after"])
+          raise error
+        end
+
+        [status, response.body || ""]
+      end
+    end
+  end
+end

data/lib/tina4/realtime/s3_storage.rb

@@ -8,55 +8,42 @@
 
 module Tina4
   module Realtime
-    # S3-compatible store (AWS S3, MinIO, ...). Opt-in; needs the aws-sdk-s3 gem.
+    # S3-compatible store (AWS S3, MinIO, Garage, ...). Opt-in, zero dependencies.
     #
-    # Presigned GET URLs let clients fetch large blobs straight from object
-    # storage instead of streaming through the app.
+    # Talks to S3 through Tina4's own stdlib SigV4 client ({S3Client}) — no
+    # aws-sdk-s3 gem. Presigned GET URLs let clients fetch large blobs straight
+    # from object storage instead of streaming through the app.
     class S3Storage < StorageBackend
       def initialize(endpoint: nil, key: nil, secret: nil, bucket: nil, region: nil)
         super()
-        begin
-          require "aws-sdk-s3" # optional dependency, loaded lazily
-        rescue LoadError
-          # Storage.select rescues this and falls back to local; its warning
-          # carries this message, so the remedy reaches the operator.
-          raise LoadError,
-                "The 'aws-sdk-s3' gem is required for S3Storage. Install it with: " \
-                "bundle add aws-sdk-s3 (or add gem \"aws-sdk-s3\" to your Gemfile)"
-        end
-
         @bucket = bucket || ENV["TINA4_STORAGE_BUCKET"]
         raise ArgumentError, "S3Storage requires TINA4_STORAGE_BUCKET" if @bucket.nil? || @bucket.empty?
 
-        opts = {
-          access_key_id: key || ENV["TINA4_STORAGE_KEY"],
-          secret_access_key: secret || ENV["TINA4_STORAGE_SECRET"],
-          region: region || ENV["TINA4_STORAGE_REGION"] || "us-east-1",
-          force_path_style: true
-        }
-        ep = endpoint || ENV["TINA4_STORAGE_URL"]
-        opts[:endpoint] = ep if ep && !ep.empty?
-        @client = Aws::S3::Client.new(**opts)
+        @client = S3Client.new(
+          endpoint: endpoint || ENV["TINA4_STORAGE_URL"],
+          access_key: key || ENV["TINA4_STORAGE_KEY"] || "",
+          secret_key: secret || ENV["TINA4_STORAGE_SECRET"] || "",
+          region: region || ENV["TINA4_STORAGE_REGION"] || "us-east-1"
+        )
       end
 
       def put(key, data, mime = "application/octet-stream")
-        @client.put_object(bucket: @bucket, key: key, body: data, content_type: mime)
+        @client.put_object(@bucket, key, data, mime)
         nil
       end
 
       def get(key)
-        @client.get_object(bucket: @bucket, key: key).body.read
+        @client.get_object(@bucket, key)
       rescue StandardError
         nil
       end
 
       def url(key, ttl = 3600)
-        Aws::S3::Presigner.new(client: @client)
-                          .presigned_url(:get_object, bucket: @bucket, key: key, expires_in: ttl)
+        @client.presigned_get_url(@bucket, key, expires: ttl)
       end
 
       def delete(key)
-        @client.delete_object(bucket: @bucket, key: key)
+        @client.delete_object(@bucket, key)
         nil
       rescue StandardError => e
         Tina4::Log.error("S3Storage delete failed for #{key}: #{e.message}")
@@ -64,7 +51,7 @@ module Tina4
       end
 
       def exists?(key)
-        @client.head_object(bucket: @bucket, key: key)
+        @client.head_object(@bucket, key)
         true
       rescue StandardError
         false

data/lib/tina4/realtime/storage.rb

@@ -39,11 +39,10 @@ module Tina4
         if name == "s3"
           begin
             return S3Storage.new
-          # LoadError (missing aws-sdk-s3 gem) is a ScriptError, NOT a
-          # StandardError, so it must be rescued explicitly or the "graceful
-          # fallback when the driver is absent" contract breaks (the whole mount
-          # would crash instead of degrading to local).
-          rescue StandardError, LoadError => e
+          # S3Storage is zero-dependency now (Tina4's own SigV4 client, no gem),
+          # so the only construction failure is an incomplete config, e.g. a
+          # missing bucket (ArgumentError) — degrade to local rather than crash.
+          rescue StandardError => e
             Tina4::Log.warning(
               "realtime files: S3 storage unavailable (#{e.message}); " \
               "falling back to local filesystem storage."

data/lib/tina4/realtime.rb

@@ -18,6 +18,7 @@ require_relative "realtime/message"
 require_relative "realtime/attachment"
 require_relative "realtime/storage_backend"
 require_relative "realtime/local_storage"
+require_relative "realtime/s3_client"
 require_relative "realtime/s3_storage"
 require_relative "realtime/storage"
 require_relative "parse_json"
@@ -80,7 +81,7 @@ module Tina4
     # @param features  [Array<String>] any of "calls", "chat", "files"
     def mount(prefix: "", authorize: nil, storage: nil, features: nil)
       features = features || ["calls"]
-      p = prefix.to_s.gsub(%r{\A/+|/+\z}, "")
+      p = prefix.to_s.gsub(%r{\A/++|/++\z}, "")
       p = p.empty? ? "" : "/#{p}"
       @authorize = authorize
       @storage = storage

data/lib/tina4/request.rb

@@ -205,7 +205,7 @@ module Tina4
       FileUtils.mkdir_p(target_dir)
       dest = File.join(target_dir, base)
       # Defence in depth: the resolved parent of the destination must be exactly
-      # the resolved target dir (guards a pre-existing symlink at target/base).
+      # the resolved target dir.
       real_dir = File.realpath(target_dir)
       real_parent = File.realpath(File.dirname(dest))
       unless real_parent == real_dir
@@ -213,10 +213,35 @@ module Tina4
       end
 
       content = file["content"] || file[:content] || ""
-      File.binwrite(dest, content)
+      write_upload(dest, content)
       dest
     end
 
+    # Never write THROUGH a link already at target/base: a symlink (even a
+    # dangling one) leads out of target_dir, and a hard link shares its bytes
+    # with a file elsewhere. Such an entry is removed so the upload gets a file
+    # of its own; a plain file is rewritten in place and keeps its mode.
+    def self.write_upload(dest, content)
+      File.unlink(dest) if File.symlink?(dest)
+      flags = File::WRONLY | File::CREAT | File::BINARY | (defined?(File::NOFOLLOW) ? File::NOFOLLOW : 0)
+      # 0o600: a newly created upload is owner-only, never group/other readable
+      # or writable (CWE-732). The mode applies only when CREAT makes the file;
+      # a plain file rewritten in place keeps its own mode, per the note above.
+      io = File.open(dest, flags, 0o600)
+      if io.stat.nlink > 1
+        io.close
+        File.unlink(dest)
+        io = File.open(dest, flags | File::EXCL, 0o600)
+      end
+      begin
+        io.truncate(0)
+        io.write(content)
+      ensure
+        io.close
+      end
+    end
+    private_class_method :write_upload
+
     def initialize(env, path_params = {})
       @env = env
       @method = env["REQUEST_METHOD"]
@@ -563,7 +588,7 @@ module Tina4
           body_raw
         end
       elsif @content_type.include?("application/x-www-form-urlencoded")
-        parse_query_to_hash(body_raw)
+        parse_form_body(body_raw)
       elsif @content_type.include?("multipart/form-data")
         # Form fields from the parsed multipart body (Tina4::FormParser).
         # Files are handled separately by extract_files.
@@ -594,6 +619,19 @@ module Tina4
       result
     end
 
+    # An urlencoded body, nested the way a multipart form is
+    # (`tags[]=a&tags[]=b` -> {"tags" => ["a", "b"]}), so a form arrives in one
+    # shape however it was encoded. A field whose name conflicts with an earlier
+    # one (`a=1&a[b]=2`) keeps its flat key. The query string stays flat:
+    # AutoCrud reads `filter[...]` keys from it.
+    def parse_form_body(body)
+      pairs = body.split("&").map do |pair|
+        key, value = pair.split("=", 2)
+        [URI.decode_www_form_component(key.to_s), URI.decode_www_form_component(value.to_s)]
+      end
+      Tina4::FormParser.nest(pairs, lenient: true)
+    end
+
     def extract_files
       result = {}
       return result unless @content_type.include?("multipart/form-data")

data/lib/tina4/response_cache.rb

@@ -502,7 +502,8 @@ module Tina4
     #     Authorization, and Tina4's own session mechanism IS a cookie. Because
     #     the key is method + URL, storing such a response replays one signed-in
     #     user's page to whoever asks for that URL next; a response that installs
-    #     a session (Set-Cookie) is per-user by construction for the same reason.
+    #     a session (Set-Cookie, or a session about to add one) is per-user by
+    #     construction for the same reason.
     #
     # Both cookie cases stay cacheable when the response opts in explicitly with
     # a shared-cache directive, which is how a genuinely public page served to
@@ -517,6 +518,13 @@ module Tina4
       return shared_cache_allowed?(response) unless header_value(request, "Authorization").nil?
       return shared_cache_allowed?(response) unless header_value(request, "Cookie").nil?
       return shared_cache_allowed?(response) unless header_value(response, "Set-Cookie").nil?
+      # The session cookie is added after this check, so a response that is
+      # about to install one carries no Set-Cookie yet: a request that came
+      # without a cookie and leaves its session holding data (a form token
+      # bound to it marks it) is that case. Read the session only if the
+      # request already opened one; asking for it would open one.
+      session = request.instance_variable_get(:@session) if request.instance_variable_defined?(:@session)
+      return shared_cache_allowed?(response) if session.respond_to?(:fresh?) && !session.fresh?
 
       true
     end

data/lib/tina4/router.rb

@@ -724,7 +724,7 @@ module Tina4
       # trailing slash on a prefix could leave "/api//users").
       def join_group_path(prefix, path)
         full = "#{prefix}/#{path.sub(%r{\A/+}, '')}"
-        full = "/#{full.gsub(%r{\A/+|/+\z}, '')}"
+        full = "/#{full.gsub(%r{\A/++|/++\z}, '')}"
         full.gsub(%r{/+}, "/")
       end
 

data/lib/tina4/sql_translator.rb

@@ -316,11 +316,11 @@ module Tina4
           sql
             .gsub(/\bBIGINT\s+PRIMARY\s+KEY\s+AUTOINCREMENT\b/i, "BIGSERIAL PRIMARY KEY")
             .gsub(/\bINTEGER\s+PRIMARY\s+KEY\s+AUTOINCREMENT\b/i, "SERIAL PRIMARY KEY")
-            .gsub(/\s*\bAUTOINCREMENT\b/i, "")
+            .gsub(/\s*+\bAUTOINCREMENT\b/i, "")
         when "mssql"
           sql.gsub(/AUTOINCREMENT/i, "IDENTITY(1,1)")
         when "firebird"
-          sql.gsub(/\s*AUTOINCREMENT\b/i, "")
+          sql.gsub(/\s*+AUTOINCREMENT\b/i, "")
         else
           sql
         end
@@ -490,7 +490,9 @@ module Tina4
       "mariadb" => "mysql"
     }.freeze
 
-    INSERT_VALUES = /\A\s*INSERT\s+INTO\s+.+?\s+VALUES\s*\(([^()]*)\)\s*\z/im
+    # ReDoS-safe: the table ref is bounded by non-space at both ends (\S(?:.*?\S)?)
+    # so the `\s+` before VALUES can't overlap it the way `.+?\s+` did.
+    INSERT_VALUES = /\A\s*INSERT\s+INTO\s+\S(?:.*?\S)?\s+VALUES\s*\(([^()]*)\)\s*\z/im
 
     # Engines whose last_insert_id reports the FIRST generated id of a multi-row
     # INSERT rather than the last. Verified live against MySQL.