tina4ruby 3.13.154 → 3.13.156

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22d42b434e0c3d217a6df121286a6f1097d98ddf891cedc552c39857205fde76
-  data.tar.gz: 6509d126521868fc0a353f8b855d2ff0bdae2bd6d0338a34ac6dfe8cae71316e
+  metadata.gz: 959299a3502a020f30b1f1d0bfd34394cf79180027386888411be340b7b3a9eb
+  data.tar.gz: '0196f348b89c4bca2fc5084ff81dafeb83bab3fb3d409a8b987ce77f1cf6bf5a'
 SHA512:
-  metadata.gz: b548d403d07725623371d20143d92406d7a8de3f8121c238050684e10c0eb7e4e5a8721b7d6f93c53239104e12c1556b12116085eb2da70a30797c218c9c7f7f
-  data.tar.gz: e8f0a0d68a58c3dc030a960f4f488085ce9af6db6b3543142185874869a083a3190ca6e7a88bd3a80e21c8c517c211f1f9cdb74ffbca776c930755999bd59aea
+  metadata.gz: eddbce15e602d9ad4f6d22d30f613b9a1b82813126d751cfe75b0d81ccb4e07582fd388c7d5edebfb0ece7958fa821d0eb4177c9a4f87d25e15dfdf308d3203f
+  data.tar.gz: a0f90bf03d31b7a4745d691d83333357917e144e6e4fdf5643e43f5fd762bfaa00fbc8a0d78a7a3b1a776fe072fe9a1dc0c06e21e030fa19f7e61be2403fd72b

data/CHANGELOG.md

@@ -6,6 +6,31 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.156 - 2026-11-01
+
+### Added
+- Kafka queue: `Queue#push(payload, raw: true)` (and `produce(..., raw: true)`)
+  now produces the value with NO Tina4 envelope (the full Job hash) and no
+  injected `id`, so a non-Tina4 service consuming the topic receives the exact
+  top-level schema it expects (tina4-ruby#264). Kafka-only; the file/rabbitmq/
+  mongodb backends refuse `raw: true` by name (the envelope is internal
+  bookkeeping that pop/retries/dead-lettering depend on). Default unchanged.
+
+### Fixed
+- Kafka queue: the consumer's `auto.offset.reset` was hardcoded to `earliest`,
+  so a new consumer group could not opt into `latest`. It now reads
+  `TINA4_KAFKA_AUTO_OFFSET_RESET` (then the bare `KAFKA_AUTO_OFFSET_RESET`),
+  defaulting to `earliest` so current behaviour is unchanged (tina4-ruby#263).
+  rdkafka honours it directly, so `latest` takes real effect on the consume path.
+  The dead-letter reader still reads from the earliest offset.
+
+## 3.13.155 - 2026-10-29
+
+Version bump for cross-framework parity. No Ruby framework changes this release —
+the 3.13.155 fixes were in tina4-python's scaffolding generator and development
+server (generated sync-ORM handlers, the generated test secret, and a serve test
+port above 65535). Ruby already handled every one of those cases.
+
 ## 3.13.154 - 2026-10-23
 
 ### BREAKING

data/lib/tina4/middleware.rb

@@ -606,18 +606,20 @@ module Tina4
 
   # CsrfMiddleware -- validates form tokens on state-changing requests.
   #
-  # OFF by default: the middleware is NOT attached unless TINA4_CSRF is truthy
-  # (true/1/yes/on -- see .attach_from_env, called once at boot in
+  # NOT attached by default: the middleware is NOT attached unless TINA4_CSRF is
+  # truthy (true/1/yes/on -- see .attach_from_env, called once at boot in
   # Tina4.initialize!) OR it is registered explicitly via
-  # Router.use(CsrfMiddleware). Once attached, TINA4_CSRF=false (or 0/no) is the
-  # kill switch that disables enforcement again.
+  # Router.use(CsrfMiddleware). Once attached it enforces unless the kill switch
+  # TINA4_CSRF=false (or 0/no) is set -- so with it attached but TINA4_CSRF
+  # unset, enforcement is ON (the attach is the opt-in).
   #
   # Behaviour (identical to the Python master's CsrfMiddleware.before_csrf):
   #   - Skips GET, HEAD, OPTIONS (safe methods).
-  #   - Skips a public write route (.no_auth / auth: false -- auth_required
-  #     false). The matched Route is attached to the request before this
-  #     post-match middleware runs, so a genuinely public endpoint (login,
-  #     webhook) is not gated.
+  #   - Skips a route that opts out with .no_csrf (server-to-server webhooks).
+  #     .no_auth does NOT skip CSRF (#265 / CSRF-DEC-03): a public form can be
+  #     open to anonymous visitors AND still protected against cross-site posts.
+  #     The matched Route is attached to the request before this post-match
+  #     middleware runs.
   #   - Fails CLOSED: with TINA4_SECRET unset the signing secret resolves to
   #     blank (there is NO built-in default), and a blank HMAC key is publicly
   #     reproducible -- so no token can be trusted and every write is rejected
@@ -645,15 +647,18 @@ module Tina4
         method = (request.method || "GET").upcase
         return [request, response] if %w[GET HEAD OPTIONS].include?(method)
 
-        # 3. Public write routes (.no_auth / auth: false) skip CSRF -- a
-        #    genuinely public endpoint has no session to protect. The matched
-        #    Route is attached to the request before this post-match middleware
-        #    runs (DispatchPipeline#prepare_route_request); a public write route
-        #    has auth_required == false -- the SAME signal the auth gate reads.
-        #    (Reading request.handler, as this once did, was dead code: the live
-        #    request never carries a handler, so the no_auth skip never fired.)
+        # 3. A route that opts OUT of CSRF with .no_csrf skips the check -- the
+        #    escape hatch for server-to-server endpoints (webhooks, callbacks)
+        #    that carry no browser session and so have no cross-site-forgery
+        #    surface. .no_auth no longer skips CSRF (#265 / CSRF-DEC-03): a PUBLIC
+        #    form must be open to anonymous visitors AND protected against
+        #    cross-site posts, so a form token is still validated on an anonymous
+        #    write route. no_auth controls IDENTITY (who), CSRF controls ORIGIN
+        #    (did our own form send it) -- orthogonal; a webhook opts out of CSRF
+        #    explicitly. The matched Route is attached to the request before this
+        #    post-match middleware runs (DispatchPipeline#prepare_route_request).
         route = request.respond_to?(:route) ? request.route : nil
-        if route.respond_to?(:auth_required) && route.auth_required == false
+        if route.respond_to?(:no_csrf?) && route.no_csrf?
           return [request, response]
         end
 

data/lib/tina4/queue.rb

@@ -113,10 +113,14 @@ module Tina4
     # Push a job onto the queue. Returns the Job.
     # priority: higher-priority messages are dequeued first (default 0).
     # delay_seconds: delay before the message becomes available (default 0).
-    def push(payload, priority: 0, delay_seconds: 0)
+    # raw: Kafka-only (tina4-ruby#264) — produce the value with NO Tina4 envelope
+    #   and no injected id, for a non-Tina4 consumer. The file/rabbitmq/mongodb
+    #   backends refuse raw: true by name (the envelope is internal bookkeeping
+    #   pop/retries/dead-lettering depend on). Default false = unchanged.
+    def push(payload, priority: 0, delay_seconds: 0, raw: false)
       available_at = delay_seconds > 0 ? Time.now + delay_seconds : nil
       message = Job.new(topic: @topic, payload: payload, priority: priority, available_at: available_at, queue: self)
-      @backend.enqueue(message)
+      @backend.enqueue(message, raw: raw)
       message
     end
 
@@ -247,10 +251,11 @@ module Tina4
     end
 
     # Produce a message onto a topic. Convenience wrapper around push().
-    def produce(topic, payload, priority: 0, delay_seconds: 0)
+    # raw: Kafka-only, un-enveloped produce — see push() (tina4-ruby#264).
+    def produce(topic, payload, priority: 0, delay_seconds: 0, raw: false)
       available_at = delay_seconds > 0 ? Time.now + delay_seconds : nil
       message = Job.new(topic: topic, payload: payload, priority: priority, available_at: available_at, queue: self)
-      @backend.enqueue(message)
+      @backend.enqueue(message, raw: raw)
       message
     end
 

data/lib/tina4/queue_backends/kafka_backend.rb

@@ -6,6 +6,7 @@
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 
+require "json"
 require_relative "../parse_json"
 require_relative "republish_retry_policy"
 
@@ -36,7 +37,7 @@ module Tina4
         consumer_config = {
           "bootstrap.servers" => @brokers,
           "group.id" => @group_id,
-          "auto.offset.reset" => "earliest",
+          "auto.offset.reset" => self.class.offset_reset,
           "enable.auto.commit" => "false"
         }.merge(security)
         @consumer = Rdkafka::Config.new(consumer_config).consumer
@@ -73,6 +74,23 @@ module Tina4
         config
       end
 
+      # Resolve the consumer's auto.offset.reset policy from the environment.
+      #
+      # Where a NEW consumer group (one with no committed offset) starts reading:
+      # "earliest" (the default, unchanged) replays the retained backlog;
+      # "latest" skips it. Read from the Tina4-namespaced env var first
+      # (TINA4_KAFKA_AUTO_OFFSET_RESET), then the bare librdkafka-convention name
+      # (KAFKA_AUTO_OFFSET_RESET) — the same precedence the TLS/SASL keys use. A
+      # blank value falls through to the default (tina4-ruby#263). rdkafka honours
+      # it directly, so "latest" takes real effect on the consume path.
+      #
+      # Mirrors tina4_python/queue_backends/kafka_backend.py::_offset_reset.
+      def self.offset_reset
+        env_value("TINA4_KAFKA_AUTO_OFFSET_RESET") ||
+          env_value("KAFKA_AUTO_OFFSET_RESET") ||
+          "earliest"
+      end
+
       # Read an env var, treating empty/blank values as unset (parity with
       # Python's `os.environ.get(...) or ...` truthiness).
       def self.env_value(name)
@@ -83,7 +101,7 @@ module Tina4
       end
       private_class_method :env_value
 
-      def enqueue(message)
+      def enqueue(message, raw: false)
         if message.priority.to_i > 0
           raise NotImplementedError,
                 "The kafka queue backend cannot honour push(priority): Kafka has no " \
@@ -100,9 +118,14 @@ module Tina4
                 "the push itself."
         end
 
+        # raw (tina4-ruby#264): produce the bare payload with NO Tina4 envelope
+        # (the full Job hash) so a non-Tina4 consumer reads the schema it expects.
+        # The id rides as the record KEY only (for partitioning), never in the value.
+        payload = raw ? JSON.generate(message.payload) : message.to_json
+
         @producer.produce(
           topic: message.topic,
-          payload: message.to_json,
+          payload: payload,
           key: message.id
         ).wait
       end

data/lib/tina4/queue_backends/lite_backend.rb

@@ -68,7 +68,17 @@ module Tina4
       # configuration onto a backend instance passed directly (legacy path).
       attr_accessor :visibility_timeout
 
-      def enqueue(message)
+      def enqueue(message, raw: false)
+        if raw
+          raise NotImplementedError,
+                "The file queue backend cannot honour push(raw: true): raw emits " \
+                "the message with no Tina4 envelope, which only a message bus " \
+                "consumed by non-Tina4 systems (Kafka) needs. This backend stores " \
+                "an internal envelope (id/status/attempts/available_at) that pop, " \
+                "the retry lifecycle and dead-lettering depend on, so there is " \
+                "nothing to omit. Use the kafka backend for raw external messages."
+        end
+
         @mutex.synchronize do
           topic_dir = topic_path(message.topic)
           FileUtils.mkdir_p(topic_dir)

data/lib/tina4/queue_backends/mongo_backend.rb

@@ -63,7 +63,17 @@ module Tina4
         300.0
       end
 
-      def enqueue(message)
+      def enqueue(message, raw: false)
+        if raw
+          raise NotImplementedError,
+                "The mongodb queue backend cannot honour push(raw: true): raw emits " \
+                "the message with no Tina4 envelope, which only a message bus " \
+                "consumed by non-Tina4 systems (Kafka) needs. This backend stores " \
+                "an internal envelope (payload/priority/attempts) that pop, the " \
+                "retry lifecycle and dead-lettering depend on, so there is nothing " \
+                "to omit. Use the kafka backend for raw external messages."
+        end
+
         # Queue#push already resolved delay_seconds into an available_at (nil when
         # undelayed). Persisting it is what makes a delayed job invisible until
         # its time: dequeue filters on it below. Before 3.13.95 this field was

data/lib/tina4/queue_backends/rabbitmq_backend.rb

@@ -37,7 +37,17 @@ module Tina4
       # Queue propagates its own configuration onto the backend after construction.
       attr_accessor :max_retries
 
-      def enqueue(message)
+      def enqueue(message, raw: false)
+        if raw
+          raise NotImplementedError,
+                "The rabbitmq queue backend cannot honour push(raw: true): raw emits " \
+                "the message with no Tina4 envelope, which only a message bus " \
+                "consumed by non-Tina4 systems (Kafka) needs. This backend stores " \
+                "an internal envelope (payload/priority/attempts) that pop, the " \
+                "retry lifecycle and dead-lettering depend on, so there is nothing " \
+                "to omit. Use the kafka backend for raw external messages."
+        end
+
         if message.priority.to_i > 0
           raise NotImplementedError,
                 "The rabbitmq queue backend cannot honour push(priority): RabbitMQ " \

data/lib/tina4/router.rb

@@ -32,6 +32,10 @@ module Tina4
       # PY-10-02. Call .no_auth on the route to opt out explicitly.
       @auth_required = %w[POST PUT PATCH DELETE].include?(@method)
       @cached = false
+      # CSRF is enforced on a write route even when it is public (#265): a form
+      # token proves ORIGIN, not identity. Call .no_csrf to opt a server-to-
+      # server endpoint (webhook, callback) out of the CSRF form-token check.
+      @no_csrf = false
       @roles = []
       @perms = []
       @param_names = []
@@ -53,6 +57,23 @@ module Tina4
       self
     end
 
+    # Opt a route OUT of CSRF form-token validation (webhooks / server-to-server
+    # callbacks that carry no browser session). .no_auth no longer skips CSRF
+    # (#265): a public form stays CSRF-protected. CSRF (origin) and auth
+    # (identity) are orthogonal — pair .no_csrf with .no_auth for a public webhook.
+    # Returns self for chaining: Router.post("/webhook") { ... }.no_auth.no_csrf
+    def no_csrf
+      @no_csrf = true
+      self
+    end
+
+    # True when this route opts out of CSRF (set by .no_csrf). Predicate reader,
+    # kept distinct from the chainable .no_csrf setter (same pattern as
+    # auth_required vs .secure/.no_auth) so neither shadows the other.
+    def no_csrf?
+      @no_csrf == true
+    end
+
     # RBAC: require ONE of the named roles (OR). Reads the verified JWT `roles`
     # claim. Stack .role/.can for AND. Implies auth. Feature 138 / ADR-0058.
     # Returns self for chaining: Router.get("/admin") { ... }.role("admin")

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.154"
+  VERSION = "3.13.156"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.154
+  version: 3.13.156
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-23 00:00:00.000000000 Z
+date: 2026-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3