tina4ruby 3.13.159 → 3.13.160

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8eaa3629bc154d2dfc5419385857a0f9c3a8ede768af9363664c80448be9e19
-  data.tar.gz: aefe567a6fb3cf128750add20e11dc7683325a14b978708c57010ac5d4062bbe
+  metadata.gz: 04d0f0c9549b131ac6cc66c25af963c658b14a34c5f1690c17c46b2df16b0ab5
+  data.tar.gz: 8ae3b7fb96142e89e7db778c790f45b53b763e1d2531870bbda84a5cf5422c83
 SHA512:
-  metadata.gz: 2041d862f935b2a6611323856b8cfc7ed376009f1a0d7a52583f9ada47eeb4da1298e01c8ef6b48f17bbc71bd2d2c13bf4ae712d1004ba80636c772e18ab358f
-  data.tar.gz: 1d4d7726c126abab28b2f6261b1f5961249e8a2a8ca77e579941379c7943705d91094b0e2caf7701193a1f633ce7ccdd59a5287b1e1bc111ee438c70d3301cda
+  metadata.gz: 5f50bfc2ae1a344b6398760b720caf2fc50cf9b18858ce64c2cd2ea1be4422537952a74028c34aea84244bd84e42e05f387f3c1e7830be48b7eaca7c0d8d58f7
+  data.tar.gz: 3a8666bf0297807ddaee244b20d64e187dd76af5d8004555f10b19c79e6015d5620e42f86fab423b16ba6ac85d7d0347028491659798967cc36626e756e80547

data/CHANGELOG.md

@@ -6,6 +6,24 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.160 - 2026-11-07
+
+### Fixed
+- The secure-by-default auth gate answered a tokenless request to a protected route with
+  a raw `401 {"error": "Unauthorized"}` JSON tuple whatever the client's `Accept`, and a
+  role/permission-guarded (RBAC) route answered a bare `403` the same way — so a browser
+  that posted a form after its session expired saw raw JSON instead of the error page. Both
+  now route through a shared negotiated renderer (`RackApp.negotiated_error_tuple`), the same
+  negotiation every other framework error already used (ERR-DEC-02): a browser gets
+  `errors/401.twig` / `errors/403.twig`, an API client the
+  `{error, code, message, status, request_id}` envelope (#342).
+- `Tina4::Middleware.middleware_500` answered a raw `500 {"error": "Internal Server Error",
+  "status": 500}` body regardless of `Accept` and with no request id. It now negotiates the
+  same way — `errors/500.twig` for a browser, the JSON envelope with the request id for an
+  API client — while keeping the exception out of the body (CWE-209) (#342).
+- `401` gained its `UNAUTHORIZED` entry in the error-code-name map, so the negotiated 401
+  JSON envelope carries a real code rather than `HTTP_401`.
+
 ## 3.13.159 - 2026-11-06
 
 ### Fixed

data/lib/tina4/middleware.rb

@@ -114,7 +114,7 @@ module Tina4
           begin
             result = entry[:handler].call(request, response)
           rescue StandardError, ScriptError => error
-            middleware_500(response, "before handler", error)
+            middleware_500(response, "before handler", error, request)
             return false
           end
           return false if result == false
@@ -126,7 +126,7 @@ module Tina4
             begin
               result = klass.send(method_name, request, response)
             rescue StandardError, ScriptError => error
-              middleware_500(response, "#{class_label(klass)}.#{method_name}", error)
+              middleware_500(response, "#{class_label(klass)}.#{method_name}", error, request)
               return false
             end
 
@@ -174,7 +174,7 @@ module Tina4
           begin
             entry[:handler].call(request, response)
           rescue StandardError, ScriptError => error
-            middleware_500(response, "after handler", error)
+            middleware_500(response, "after handler", error, request)
           end
         end
 
@@ -184,7 +184,7 @@ module Tina4
             begin
               result = klass.send(method_name, request, response)
             rescue StandardError, ScriptError => error
-              middleware_500(response, "#{class_label(klass)}.#{method_name}", error)
+              middleware_500(response, "#{class_label(klass)}.#{method_name}", error, request)
               next
             end
             if result.is_a?(Tina4::Response)
@@ -203,7 +203,7 @@ module Tina4
       # (NEVER silent) then sets the response to the canonical error shape —
       # byte-identical to the Python master ({"error":"Internal Server Error",
       # "status":500} + status 500). Returns the response for chaining.
-      def middleware_500(response, label, error)
+      def middleware_500(response, label, error, request = nil)
         begin
           Tina4::Log.error(
             "Middleware #{label} raised #{error.class.name}: #{error.message}"
@@ -216,7 +216,30 @@ module Tina4
             # never let logging break the worker
           end
         end
-        response.json({ error: "Internal Server Error", status: 500 }, 500)
+        # ERR-DEC-02 (#342): answer through the SAME negotiation every other
+        # framework error uses — errors/500.twig for a browser, the JSON envelope
+        # {error, code, message, status, request_id} for an API client. The real
+        # exception stays in the log, never in the body (CWE-209). It used to
+        # return an unconditional {"error":"Internal Server Error","status":500}.
+        # `request` is optional only for backward compatibility; the dispatcher
+        # always passes it, and without it the JSON envelope is used.
+        request_id = Tina4::Log.get_request_id || ""
+        json_body = { error: true, code: "INTERNAL_SERVER_ERROR", message: "Internal Server Error", status: 500, request_id: request_id }
+        accept = request.respond_to?(:headers) ? (request.headers["accept"] || "") : ""
+        return response.json(json_body, 500) if Tina4::Template.wants_json?(accept)
+
+        path = request.respond_to?(:path) ? request.path.to_s : ""
+        html = begin
+          Tina4::Template.render_error(500, { "path" => CGI.escapeHTML(path), "request_id" => request_id, "error_message" => "" })
+        rescue StandardError
+          nil
+        end
+        if html && response.respond_to?(:html)
+          response.html(html, 500)
+        else
+          response.json(json_body, 500)
+        end
+        response
       end
 
       # The `false` row of the return-value table, on its own.

data/lib/tina4/rack_app.rb

@@ -422,7 +422,9 @@ module Tina4
     # (error: true, code, message, status) already shared by app-level
     # response.error() calls, plus request_id for correlation (feature 43,
     # ERR-404-REQUESTID) - the SAME shape Python/PHP/Node build.
-    ERROR_CODE_NAMES = { 403 => "FORBIDDEN", 404 => "NOT_FOUND", 500 => "INTERNAL_SERVER_ERROR" }.freeze
+    ERROR_CODE_NAMES = {
+      401 => "UNAUTHORIZED", 403 => "FORBIDDEN", 404 => "NOT_FOUND", 500 => "INTERNAL_SERVER_ERROR"
+    }.freeze
 
     def error_json_body(status, message, request_id)
       Tina4::Response.error_response(
@@ -1236,10 +1238,34 @@ module Tina4
     # in-process TestClient call it, so the test surface enforces the identical
     # gate as production (Python #PY2 parity). Instantiating a RackApp just to
     # reach the check would run full boot/route-discovery — this needs none of it.
+    # Build a negotiated error Rack tuple (ERR-DEC-02, #342): a browser gets
+    # errors/{code}.twig, an API client the JSON envelope, both carrying
+    # request_id. A CLASS method so the class-method auth / RBAC gates
+    # (enforce_route_auth, rbac_forbidden) answer like every other framework
+    # error; the instance handle_403/handle_404/handle_500 paths keep their own
+    # copies (they carry extra template-serving / debug-overlay logic).
+    def self.negotiated_error_tuple(code, message, path = "", accept = "")
+      request_id = Tina4::Log.get_request_id || "-"
+      if Tina4::Template.wants_json?(accept)
+        body = Tina4::Response.error_response(ERROR_CODE_NAMES[code] || "HTTP_#{code}", message, code)
+                              .merge(request_id: request_id)
+        return [code, { "content-type" => "application/json" }, [JSON.generate(body)]]
+      end
+      html = begin
+        Tina4::Template.render_error(code, { "path" => CGI.escapeHTML(path.to_s), "request_id" => request_id, "error_message" => "" })
+      rescue StandardError
+        "#{code} #{message}"
+      end
+      [code, { "content-type" => "text/html" }, [html]]
+    end
+
     def self.enforce_route_auth(env, route)
       return nil unless route.auth_required
 
-      unauthorized = [401, { "content-type" => "application/json" }, [JSON.generate({ error: "Unauthorized" })]]
+      # ERR-DEC-02 (#342): a browser gets errors/401.twig, an API client the JSON
+      # envelope — the same negotiation every other framework error uses. Was an
+      # unconditional JSON tuple.
+      unauthorized = negotiated_error_tuple(401, "Unauthorized", env["PATH_INFO"] || "", env["HTTP_ACCEPT"] || "")
 
       # Token slots in priority order: Authorization Bearer header, then the
       # body formToken (frond.js puts the auth token it received as a
@@ -1283,7 +1309,7 @@ module Tina4
       # ── RBAC guards (Feature 138): authorization AFTER authentication ──
       # Auth has passed (401 ruled out above). If the route carries role/
       # permission guards, the verified payload must satisfy them, else 403.
-      deny = rbac_forbidden(route, env["tina4.auth_payload"])
+      deny = rbac_forbidden(route, env["tina4.auth_payload"], env)
       return deny if deny
 
       nil
@@ -1317,7 +1343,7 @@ module Tina4
     # verified payload, else nil. AND across guard groups, OR within a group.
     # Roles read the `roles` claim (legacy singular `role` coerced); permissions
     # read `permissions` with granted-side wildcards. Feature 138 / ADR-0058.
-    def self.rbac_forbidden(route, payload)
+    def self.rbac_forbidden(route, payload, env = nil)
       required_roles = route.respond_to?(:roles) ? Array(route.roles) : []
       required_perms = route.respond_to?(:perms) ? Array(route.perms) : []
       return nil if required_roles.empty? && required_perms.empty?
@@ -1325,17 +1351,19 @@ module Tina4
       subject = payload.is_a?(Hash) ? payload : {}
       roles = _rbac_claim_list(subject, "roles", "role")
       required_roles.each do |group|
-        return _rbac_forbidden_tuple unless group.any? { |r| roles.include?(r) }
+        return _rbac_forbidden_tuple(env) unless group.any? { |r| roles.include?(r) }
       end
       perms = _rbac_claim_list(subject, "permissions", nil)
       required_perms.each do |group|
-        return _rbac_forbidden_tuple unless group.any? { |req| _rbac_perm_granted(perms, req) }
+        return _rbac_forbidden_tuple(env) unless group.any? { |req| _rbac_perm_granted(perms, req) }
       end
       nil
     end
 
-    def self._rbac_forbidden_tuple
-      [403, { "content-type" => "application/json" }, [JSON.generate({ error: "Forbidden" })]]
+    # ERR-DEC-02 negotiation (#342): HTML page for a browser, JSON envelope for
+    # an API client, both with request_id — instead of the old unconditional JSON.
+    def self._rbac_forbidden_tuple(env = nil)
+      negotiated_error_tuple(403, "Forbidden", env && env["PATH_INFO"] || "", env && env["HTTP_ACCEPT"] || "")
     end
 
     # Read a claim as a list of strings; coerce a legacy singular string.

data/lib/tina4/version.rb

@@ -7,5 +7,5 @@
 
 
 module Tina4
-  VERSION = "3.13.159"
+  VERSION = "3.13.160"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.159
+  version: 3.13.160
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-11-06 00:00:00.000000000 Z
+date: 2026-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sqlite3