tina4ruby 3.13.62 → 3.13.63

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2654a6c8f7c322aeb7b6719ff4e908840e4dec23afa49dc02e165a0b0c74b0c7
-  data.tar.gz: a5b0f4e3813c0597f7d6734ba5472a4641f70af228c8ad9513166519743f0e0b
+  metadata.gz: 51cd83415eaad0fc64019fcbab89e92fb0cfb90cd9a3e1a3db6122499c14c83f
+  data.tar.gz: 9f1283a11d1f433d3ca39ae961db99bc73aa0e1f462336508c696ebbceaf9642
 SHA512:
-  metadata.gz: 5fc83c37a2afdb997a9faf495d1fb6547b287b968ae40a93c94c404142f4e783e2cb569796ee2072a09e11d356ec53336b1d5858ed8d2e029a7562a8d8fec255
-  data.tar.gz: bd2a127e45f88513764af879ad80a5abe166001661cb0809b9af5d00e9ce9d950513a8afaef85ddf562d2d0a48945e068e4f236ac3a494893ab4cdedbc705c0c
+  metadata.gz: 59ceaebe4dea54ec1b9e4894efee36cb1d98af2e9bdfc919033a055f5824d12f37f523177003b4a0f2497d0ca0f0a4c3086628f8ae1e29e8035beda64a7ea4b5
+  data.tar.gz: 6aa2471f6a38fe85d13e8832f68c23fd093ec0bbf9837f6ff6da220880428af9851c044cbf4d89f9cbd4ae64c1cc1c4f73e9373d3037902731018227fb6d0bbb

data/lib/tina4/auto_crud.rb

@@ -9,15 +9,32 @@ module Tina4
         @models ||= []
       end
 
-      # Register a model for auto-CRUD
-      def register(model_class)
+      # Per-model public-writes flag (model_class => Boolean).
+      # Default secure; only set true when a model is registered `public: true`.
+      # Mirrors tina4-php's `$this->public` map. Write routes stay gated unless
+      # a model is explicitly opted out.
+      def public_flags
+        @public_flags ||= {}
+      end
+
+      # Register a model for auto-CRUD.
+      #
+      # @param model_class [Class] the ORM subclass to expose
+      # @param public [Boolean] when true, the generated write routes
+      #   (POST/PUT/DELETE) opt OUT of the framework's secure-by-default write
+      #   gate — they are marked `.no_auth`. Default false keeps writes gated
+      #   (a valid bearer token is required), matching the router's rule that
+      #   POST/PUT/PATCH/DELETE require auth unless explicitly opened. Parity
+      #   with tina4-python / tina4-php.
+      def register(model_class, public: false)
         models << model_class unless models.include?(model_class)
+        public_flags[model_class] = public
       end
 
       # Generate REST endpoints for all registered models
       def generate_routes(prefix: "/api")
         models.each do |model_class|
-          generate_routes_for(model_class, prefix: prefix)
+          generate_routes_for(model_class, prefix: prefix, public: public_flags[model_class])
         end
       end
 
@@ -45,13 +62,25 @@ module Tina4
         example
       end
 
-      # Generate REST endpoints for a single model class
-      def generate_routes_for(model_class, prefix: "/api")
+      # Generate REST endpoints for a single model class.
+      #
+      # @param model_class [Class] the ORM subclass to expose
+      # @param prefix [String] URL prefix for the generated routes
+      # @param public [Boolean, nil] when true, the write routes
+      #   (POST/PUT/DELETE) opt out of the secure-by-default gate via
+      #   `.no_auth`. When nil (the default), the flag stored at register()
+      #   time is used, falling back to false (secure). The read routes (GET)
+      #   are never gated regardless.
+      def generate_routes_for(model_class, prefix: "/api", public: nil)
         table = model_class.table_name
         pk = model_class.primary_key_field || :id
         pretty_name = table.to_s.split("_").map(&:capitalize).join(" ")
         example_body = build_example(model_class)
 
+        # Explicit arg wins; otherwise fall back to the flag recorded by
+        # register(), otherwise secure-by-default.
+        is_public = public.nil? ? (public_flags[model_class] || false) : public
+
         # GET /api/{table} -- list all with pagination, filtering, sorting
         Tina4::Router.add("GET", "#{prefix}/#{table}", proc { |req, res|
           begin
@@ -109,7 +138,7 @@ module Tina4
         }, swagger_meta: { summary: "Get #{pretty_name} by ID", tags: [table.to_s] })
 
         # POST /api/{table} -- create record
-        Tina4::Router.add("POST", "#{prefix}/#{table}", proc { |req, res|
+        post_route = Tina4::Router.add("POST", "#{prefix}/#{table}", proc { |req, res|
           begin
             attributes = req.body_parsed
             record = model_class.create(attributes)
@@ -136,8 +165,11 @@ module Tina4
           }
         })
 
+        # Secure-by-default: only opt out of the write gate when public: true.
+        post_route.no_auth if is_public
+
         # PUT /api/{table}/{id} -- update record
-        Tina4::Router.add("PUT", "#{prefix}/#{table}/{id}", proc { |req, res|
+        put_route = Tina4::Router.add("PUT", "#{prefix}/#{table}/{id}", proc { |req, res|
           begin
             id = req.params["id"]
             record = model_class.find_by_id(id.to_i)
@@ -174,8 +206,11 @@ module Tina4
           }
         })
 
+        # Secure-by-default: only opt out of the write gate when public: true.
+        put_route.no_auth if is_public
+
         # DELETE /api/{table}/{id} -- delete record
-        Tina4::Router.add("DELETE", "#{prefix}/#{table}/{id}", proc { |req, res|
+        delete_route = Tina4::Router.add("DELETE", "#{prefix}/#{table}/{id}", proc { |req, res|
           begin
             id = req.params["id"]
             record = model_class.find_by_id(id.to_i)
@@ -192,14 +227,20 @@ module Tina4
             res.json({ error: e.message }, status: 500)
           end
         }, swagger_meta: { summary: "Delete #{pretty_name}", tags: [table.to_s] })
+
+        # Secure-by-default: only opt out of the write gate when public: true.
+        delete_route.no_auth if is_public
       end
 
       # Discover ORM model classes from a directory and register them.
       #
       # @param models_dir [String] directory to scan (default "src/orm")
       # @param prefix [String] URL prefix for generated routes (default "/api")
+      # @param public [Boolean] when true, opt discovered models' write routes
+      #   out of the secure-by-default gate (see .register). Default false keeps
+      #   writes gated. Parity with tina4-python / tina4-php.
       # @return [Array<String>] list of discovered model class names
-      def discover(models_dir = "src/orm", prefix: "/api")
+      def discover(models_dir = "src/orm", prefix: "/api", public: false)
         discovered = []
         return discovered unless Dir.exist?(models_dir)
 
@@ -210,7 +251,7 @@ module Tina4
         # Find all ORM subclasses that have a table_name
         ObjectSpace.each_object(Class).select { |c| c < Tina4::ORM rescue false }.each do |klass|
           next unless klass.respond_to?(:table_name) && klass.table_name
-          register(klass)
+          register(klass, public: public)
           discovered << klass.name
         end
 
@@ -220,6 +261,7 @@ module Tina4
 
       def clear!
         @models = []
+        @public_flags = {}
       end
 
       # Alias for parity with other frameworks

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.62"
+  VERSION = "3.13.63"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.62
+  version: 3.13.63
 platform: ruby
 authors:
 - Tina4 Team