tina4ruby 3.13.153 → 3.13.154

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff2b6722d0fadf4d3045e879eed65c3d0a67836ee35ed2d95d95441958e6ac8f
-  data.tar.gz: f46b4617edc7d85b40612640020e4a7c40c17f1ade00d2ea68090b07a44a7049
+  metadata.gz: 22d42b434e0c3d217a6df121286a6f1097d98ddf891cedc552c39857205fde76
+  data.tar.gz: 6509d126521868fc0a353f8b855d2ff0bdae2bd6d0338a34ac6dfe8cae71316e
 SHA512:
-  metadata.gz: 0c9c47a5e35589686cc8535d010a3116249bb49e8864dec07499308d3ee222a8408a00ad258b7db93df5ac0daf0d3fa30b3871ea91cf23b138c06f9bb602e6e2
-  data.tar.gz: 5feef0d7194c6c98d2a0d1a17721838628897acd56966915d51cc7c812c89ba147b605be227126f7f1066a595d0b33947ffb108429eb53ffdb4e92b46c093fe5
+  metadata.gz: b548d403d07725623371d20143d92406d7a8de3f8121c238050684e10c0eb7e4e5a8721b7d6f93c53239104e12c1556b12116085eb2da70a30797c218c9c7f7f
+  data.tar.gz: e8f0a0d68a58c3dc030a960f4f488085ce9af6db6b3543142185874869a083a3190ca6e7a88bd3a80e21c8c517c211f1f9cdb74ffbca776c930755999bd59aea

data/CHANGELOG.md

@@ -6,6 +6,33 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.154 - 2026-10-23
+
+### BREAKING
+- Realtime (WebRTC): `GET /api/rtc/config` (which mints ephemeral TURN
+  credentials) and the `/ws/rtc/{room}` signalling socket now require a valid
+  token by default (ADR-0101, tina4-python#252). They were public, with no way
+  for an app to close them, so the TURN relay was an open resource. Opt out with
+  `TINA4_RTC_REQUIRE_AUTH=false` (or `0`/`no`/`off`) for anonymous calling; any
+  other value keeps them secured. If your app relied on the open routes, set
+  that env var.
+
+### Fixed
+- Frond: a bare reference to a zero-argument callable global (a zero-arity Proc,
+  lambda or Method) is now invoked and its return value used for both `{{ g }}`
+  output and `{% if g %}` truthiness, matching Node (ADR-0085,
+  tina4-documentation#90). `g()` still calls exactly once; a non-callable global
+  and a callable that declares parameters are unchanged.
+- CSP: the per-response nonce is no longer injected into a `script-src` /
+  `style-src` directive that already carries `'unsafe-inline'` (ADR-0100,
+  tina4-php#330). A browser ignores `'unsafe-inline'` once a nonce joins the same
+  directive, so inline content an app deliberately allowed through `TINA4_CSP`
+  was silently blocked from 3.13.143 on. The app's explicit choice now wins; the
+  strict default policy is still nonced.
+
+### Changed
+- Skills: the maintainer skill gains an off-skill self-audit reflex.
+
 ## 3.13.153 - 2026-10-21
 
 ### Fixed

data/lib/tina4/csp.rb

@@ -95,9 +95,20 @@ module Tina4
       %w[style-src script-src].each do |directive|
         existing = directives.find { |name, _| name == directive }
         if existing
+          # ADR-0100: the app opted this directive into inline via
+          # 'unsafe-inline'. A browser ignores 'unsafe-inline' the moment a
+          # nonce joins the same directive (CSP Level 2+), so adding the nonce
+          # would silently block the inline the app asked for. The app wins.
+          next if existing[1].split(/\s+/).include?("'unsafe-inline'")
+
           existing[1] = "#{existing[1]} #{token}".strip unless existing[1].split(/\s+/).include?(token)
         else
           base = default_value.empty? ? "'self'" : default_value
+          # ADR-0100: a directive derived from an 'unsafe-inline' default-src
+          # must not be spawned with a nonce - it would cancel the inline the
+          # app allowed through default-src.
+          next if base.split(/\s+/).include?("'unsafe-inline'")
+
           directives << [directive, "#{base} #{token}".strip]
         end
       end

data/lib/tina4/frond.rb

@@ -441,7 +441,35 @@ module Tina4
     # Same dual-callable semantics as ``add_filter`` — see that method for
     # the static-facade pattern.
     def self.add_global(name, value)
-      @@class_globals[name.to_s] = value
+      @@class_globals[name.to_s] = wrap_global(value) # ADR-0085
+    end
+
+    # Wrap a bare zero-argument Proc/lambda/Method so a bare reference to it
+    # auto-calls (ADR-0085). Node auto-calls any function reached by a bare
+    # reference and uses the return value; Ruby stored the proc instead, so
+    # `{% if admin_only %}` with `add_global("admin_only", -> { ... })` was
+    # always truthy. A callable that declares parameters is left unwrapped and
+    # behaves exactly as before; anything that is not a Proc/Method is untouched
+    # (matching Node, which only auto-calls plain functions).
+    def self.wrap_global(value)
+      if (value.is_a?(Proc) || value.is_a?(Method)) && value.arity.zero?
+        AutoGlobal.new(value)
+      else
+        value
+      end
+    end
+
+    # Marker for a zero-argument callable global (see wrap_global). `resolve`
+    # invokes it once for a bare reference; `admin_only()` still calls it via
+    # the ordinary function-call path (`call` forwards).
+    class AutoGlobal
+      def initialize(fn)
+        @fn = fn
+      end
+
+      def call(*args)
+        @fn.call(*args)
+      end
     end
 
     # Register a custom filter.
@@ -465,7 +493,7 @@ module Tina4
     #
     # Updates this instance's live globals map only.
     def add_global(name, value)
-      @globals[name.to_s] = value
+      @globals[name.to_s] = self.class.wrap_global(value) # ADR-0085
       self
     end
 
@@ -2311,7 +2339,10 @@ module Tina4
         return nil if value.nil?
       end
 
-      value
+      # ADR-0085: a bare reference to a zero-argument callable global uses its
+      # return value. `g()` never reaches here as a marker -- the function-call
+      # path invokes it directly -- so each global is called at most once.
+      value.is_a?(AutoGlobal) ? value.call : value
     end
 
     # -----------------------------------------------------------------------

data/lib/tina4/realtime.rb

@@ -114,8 +114,17 @@ module Tina4
 
     # ----- route registration -------------------------------------------------
 
+    # ADR-0101: the config route mints TURN credentials and the signalling socket
+    # relays calls, so both require a valid token UNLESS the app opts out with
+    # TINA4_RTC_REQUIRE_AUTH=false (anonymous calling). Secure-by-default: only an
+    # explicit false/0/no/off opens them.
+    def rtc_require_auth?
+      raw = (ENV["TINA4_RTC_REQUIRE_AUTH"] || "true").strip.downcase
+      !%w[false 0 no off].include?(raw)
+    end
+
     def register_config(paths, features)
-      Tina4::Router.get(paths["config"]) do |_request, response|
+      route = Tina4::Router.get(paths["config"]) do |_request, response|
         body = { "backend" => "mesh" }
         if features.include?("calls")
           body["iceServers"] = Tina4::Realtime.ice_servers
@@ -128,12 +137,14 @@ module Tina4
         body["files"] = paths["files"] if features.include?("files")
         response.json(body, Tina4::HTTP_OK)
       end
+      route.secure if rtc_require_auth? # ADR-0101
     end
 
     def register_calls(paths)
       # WebRTC signalling relay (mesh). Tina4 never parses the SDP; peers filter
-      # by `to`. The signalling room is public - the media is E2E between peers.
-      Tina4::Router.websocket("#{paths['signalling']}/{room}") do |connection, event, data|
+      # by `to`. The media is E2E between peers; the signalling room requires auth
+      # by default (ADR-0101) unless TINA4_RTC_REQUIRE_AUTH=false.
+      route = Tina4::Router.websocket("#{paths['signalling']}/{room}") do |connection, event, data|
         room = connection.params[:room].to_s
         next if room.empty?
 
@@ -145,6 +156,7 @@ module Tina4
           connection.broadcast_to_room(key, data, exclude_self: true)
         end
       end
+      route.secure if rtc_require_auth? # ADR-0101
     end
 
     def register_chat(paths)

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.153"
+  VERSION = "3.13.154"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.153
+  version: 3.13.154
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-21 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3