tina4ruby 3.13.91 → 3.13.93

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3df8f30ccbf4fc6d984ec4af8fa3262045b16ac1f05c7516f6a6818691fad547
-  data.tar.gz: 1236689bdee9821f1994bc27d1a69684fd312cc774f33a2bba6b10fa57bd86d8
+  metadata.gz: f7b916f1f99717b6933e8d4376b760d2c975daefec3b5507d9827480522cfe8f
+  data.tar.gz: e800d0a184690267eb84976193744593eea98b2ec355405f15a32214d12e31a0
 SHA512:
-  metadata.gz: c51b11ed1b2c9361c162ab6d54f999381d13b8b6be74f4cd94ebfa0d72492f0805f9428e9080ee06b2eb6efd52dc5fd72e1a9d073743d5ad03ec9582c3894b8b
-  data.tar.gz: 4f8265ec9da1f6bd427ed844d808e4e2c67ee55ec934a0d24ea37f40b1a88861ce86bc9c09b162cd534f6d879825ed31a05e0baf32e73322ea8584097d9b8346
+  metadata.gz: 6428126904b059c914f08ca0fc446622a07447075c23e4a20ba12b01f93cf6a5c48454cab6cebfdc98da615f9fbb9ba57d4e3021d6b26d688cb92cdf5a553cb3
+  data.tar.gz: 7fb13ab4b8cae5c60ad932ed1a9de7750881381451b294747b6f90441b682dd5658f49394fd29707144fe2e4ae95a5639cb47cc50a6a1a87aae6b4d60eab0e29

data/README.md

@@ -105,7 +105,7 @@ Tina4 Ruby outperforms Sinatra while delivering **98 features vs ~4**, with zero
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages: same architecture, same conventions, same 97 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, same 98 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

data/lib/tina4/auth.rb

@@ -21,6 +21,23 @@ module Tina4
       "run was NOT detected as dev - typically a container or CI without " \
       "TINA4_DEBUG set, or TINA4_ENV=production."
 
+    # Supported JWT algorithms. HMAC only — the whole family ships in OpenSSL, so
+    # this stays zero-gem. The header's "alg" is now always the one we actually
+    # sign with: the digest is looked up here rather than hardcoded to SHA256.
+    # Mirrors the Python master's _HMAC_ALGORITHMS (a name -> digest map); the
+    # value is the digest CLASS and a fresh instance is made per signature, so
+    # nothing about the digest state is shared between calls or threads.
+    HMAC_ALGORITHMS = {
+      "HS256" => OpenSSL::Digest::SHA256,
+      "HS384" => OpenSSL::Digest::SHA384,
+      "HS512" => OpenSSL::Digest::SHA512
+    }.freeze
+
+    # Seconds of clock skew tolerated on the "nbf" (not-before) claim. Without
+    # this a token minted on one host and validated on another a second behind is
+    # rejected for no real reason; RFC 7519 explicitly allows "a small leeway".
+    JWT_LEEWAY_SECONDS = 60
+
     class << self
       def setup(root_dir = Dir.pwd)
         @keys_dir = File.join(root_dir, KEYS_DIR)
@@ -111,62 +128,120 @@ module Tina4
         Base64.urlsafe_decode64(str)
       end
 
-      # Build a JWT using HS256 with Ruby's OpenSSL::HMAC (no gem needed)
-      def hmac_encode(claims, secret)
-        header = { "alg" => "HS256", "typ" => "JWT" }
+      # Pick the JWT algorithm: explicit argument, else TINA4_JWT_ALGORITHM, else
+      # HS256. A blank value counts as unset (parity with Python, where an empty
+      # env string is falsy and falls through).
+      #
+      # Raises ArgumentError naming the supported set when asked for one we cannot
+      # sign — Ruby's idiomatic equivalent of the master's ValueError. The env var
+      # was registered in the CLI's known_vars and then silently ignored here, so a
+      # user could set HS512 and still get HS256 tokens.
+      def resolve_algorithm(algorithm = nil)
+        candidate = [algorithm, ENV["TINA4_JWT_ALGORITHM"]]
+                    .find { |value| !value.nil? && !value.to_s.strip.empty? }
+        chosen = (candidate || "HS256").to_s.strip
+        unless HMAC_ALGORITHMS.key?(chosen)
+          raise ArgumentError,
+                "Unsupported JWT algorithm #{chosen.inspect}. Tina4 signs with " \
+                "#{HMAC_ALGORITHMS.keys.sort.join(', ')} (HMAC only, zero-dependency). " \
+                "Set TINA4_JWT_ALGORITHM to one of those."
+        end
+        chosen
+      end
+
+      # HMAC the signing input with the digest the algorithm actually names, so the
+      # header's "alg" can never disagree with the bytes we produced.
+      def hmac_signature(algorithm, secret, signing_input)
+        OpenSSL::HMAC.digest(HMAC_ALGORITHMS.fetch(algorithm).new, secret.to_s, signing_input)
+      end
+
+      # Build a JWT with Ruby's OpenSSL::HMAC (no gem needed). The algorithm is the
+      # explicit argument, else TINA4_JWT_ALGORITHM, else HS256 — and the header
+      # advertises exactly the algorithm that signed.
+      def hmac_encode(claims, secret, algorithm: nil)
+        alg = resolve_algorithm(algorithm)
+        header = { "alg" => alg, "typ" => "JWT" }
         segments = [
           base64url_encode(JSON.generate(header)),
           base64url_encode(JSON.generate(claims))
         ]
         signing_input = segments.join(".")
-        signature = OpenSSL::HMAC.digest("SHA256", secret, signing_input)
-        segments << base64url_encode(signature)
+        segments << base64url_encode(hmac_signature(alg, secret, signing_input))
         segments.join(".")
       end
 
-      # Decode and verify a JWT signed with HS256. Returns the payload hash or nil.
-      def hmac_decode(token, secret)
-        parts = token.split(".")
-        return nil unless parts.length == 3
-
-        header_json = base64url_decode(parts[0])
-        header = JSON.parse(header_json)
-        return nil unless header["alg"] == "HS256"
-
-        # Verify signature
-        signing_input = "#{parts[0]}.#{parts[1]}"
-        expected_sig = OpenSSL::HMAC.digest("SHA256", secret, signing_input)
-        actual_sig = base64url_decode(parts[2])
-
-        # Constant-time comparison to prevent timing attacks
-        return nil unless OpenSSL.fixed_length_secure_compare(expected_sig, actual_sig)
-
-        payload = JSON.parse(base64url_decode(parts[1]))
-
-        # Check expiry
-        now = Time.now.to_i
-        return nil if payload["exp"] && now >= payload["exp"]
-        return nil if payload["nbf"] && now < payload["nbf"]
+      # Decode and verify an HMAC-signed JWT. Returns the payload hash or nil.
+      #
+      # The algorithm is PINNED to our configured one rather than trusted from the
+      # token: a header asking to be verified as anything else — "none", a
+      # different HMAC, or an RSA alg we do not implement here — is rejected before
+      # any signature work.
+      def hmac_decode(token, secret, algorithm: nil)
+        # Resolved OUTSIDE the rescue below: an unsupported algorithm is a
+        # configuration error that must surface, not become a nil "invalid token".
+        alg = resolve_algorithm(algorithm)
 
-        payload
-      rescue ArgumentError, JSON::ParserError, OpenSSL::HMACError
-        nil
+        begin
+          parts = token.split(".")
+          return nil unless parts.length == 3
+
+          header_json = base64url_decode(parts[0])
+          header = JSON.parse(header_json)
+          return nil unless header["alg"] == alg
+
+          # Verify signature
+          signing_input = "#{parts[0]}.#{parts[1]}"
+          expected_sig = hmac_signature(alg, secret, signing_input)
+          actual_sig = base64url_decode(parts[2])
+
+          # Constant-time comparison to prevent timing attacks. Lengths must match
+          # first — fixed_length_secure_compare raises on a length mismatch, which
+          # a forged signature of the wrong digest size would trigger.
+          return nil unless expected_sig.bytesize == actual_sig.bytesize
+          return nil unless OpenSSL.fixed_length_secure_compare(expected_sig, actual_sig)
+
+          payload = JSON.parse(base64url_decode(parts[1]))
+
+          # Check expiry
+          now = Time.now.to_i
+          return nil if payload["exp"] && now >= payload["exp"]
+
+          # "nbf" (not-before): a post-dated token is not valid yet. Tolerate
+          # JWT_LEEWAY_SECONDS of clock skew so a token minted on a host a second
+          # ahead is not rejected for nothing.
+          return nil if payload["nbf"] && now + JWT_LEEWAY_SECONDS < payload["nbf"]
+
+          payload
+        rescue ArgumentError, JSON::ParserError, OpenSSL::HMACError
+          nil
+        end
       end
 
       # ── Token API (auto-selects HS256 or RS256) ─────────────────
 
-      def get_token(payload, expires_in: 60, secret: nil)
+      # Mint a signed JWT.
+      #
+      # `algorithm:` selects the HMAC algorithm (else TINA4_JWT_ALGORITHM, else
+      # HS256); an unsupported one raises ArgumentError rather than quietly
+      # downgrading. It applies to the HMAC path only — the legacy RS256 path
+      # (RSA keys present in .keys/) is unaffected.
+      #
+      # BREAKING (deliberate): no "nbf" claim is stamped. It duplicated "iat",
+      # added no security, and created clock-skew rejections; RFC 7519 nbf is for
+      # deliberately post-dated tokens, which stays fully supported when the caller
+      # passes its own "nbf" in the payload. Python/PHP/Node never auto-stamped it,
+      # so Ruby doing so was the parity break.
+      def get_token(payload, expires_in: 60, secret: nil, algorithm: nil)
         now = Time.now.to_i
         claims = payload.merge(
           "iat" => now,
-          "exp" => now + (expires_in * 60).to_i,
-          "nbf" => now
+          "exp" => now + (expires_in * 60).to_i
         )
 
         if secret
-          hmac_encode(claims, secret)
+          hmac_encode(claims, secret, algorithm: algorithm)
         elsif use_hmac?
-          hmac_encode(claims, hmac_secret)
+          hmac_encode(claims, hmac_secret, algorithm: algorithm)
         else
           ensure_keys
           require "jwt"
@@ -247,16 +322,28 @@ module Tina4
         nil
       end
 
+      # Validate and re-issue a token with the same claims.
+      #
+      # Only "iat"/"exp" are dropped (they are re-stamped). A caller-supplied "nbf"
+      # is PRESERVED — matching the Python master, and keeping the promise made
+      # when auto-nbf was removed: a deliberately post-dated claim is the issuer's,
+      # and a refresh must not quietly erase it.
       def refresh_token(token, expires_in: 60)
         return nil unless valid_token(token)
 
         payload = get_payload(token)
         return nil unless payload
-        payload = payload.reject { |k, _| %w[iat exp nbf].include?(k) }
+        payload = payload.reject { |k, _| %w[iat exp].include?(k) }
         get_token(payload, expires_in: expires_in)
       end
 
-      def authenticate_request(headers, secret: nil, algorithm: "HS256")
+      # Extract and validate auth from request headers.
+      #
+      # `secret:` and `algorithm:` are real overrides. `algorithm:` used to be
+      # accepted with a hardcoded "HS256" default and then dropped on the floor, so
+      # an explicit argument silently lost to TINA4_JWT_ALGORITHM — the precedence
+      # is now honoured here too (explicit > env > HS256).
+      def authenticate_request(headers, secret: nil, algorithm: nil)
         auth_header = headers["HTTP_AUTHORIZATION"] || headers["Authorization"] || ""
         return nil unless auth_header =~ /\ABearer\s+(.+)\z/i
 
@@ -271,9 +358,10 @@ module Tina4
           return { "api_key" => true }
         end
 
-        # If a custom secret is provided, validate against it directly
-        if secret
-          payload = hmac_decode(token, secret)
+        # If a custom secret and/or algorithm is provided, validate against those
+        # directly rather than this process's env-resolved defaults.
+        if secret || algorithm
+          payload = hmac_decode(token, secret || hmac_secret, algorithm: algorithm)
           return payload ? payload : nil
         end
 

data/lib/tina4/cli.rb

@@ -467,12 +467,21 @@ module Tina4
     # ── start ─────────────────────────────────────────────────────────────
 
     def cmd_start(argv)
-      options = { port: nil, host: nil, dev: false, no_browser: false, no_reload: false, production: false }
+      options = { port: nil, host: nil, dev: false, no_browser: false, no_reload: false, production: false,
+                  managed: false }
       parser = OptionParser.new do |opts|
         opts.banner = "Usage: tina4ruby start [options]"
         opts.on("-p", "--port PORT", Integer, "Port (default: 7147)") { |v| options[:port] = v }
         opts.on("-h", "--host HOST", "Host (default: 0.0.0.0)") { |v| options[:host] = v }
         opts.on("-d", "--dev", "Enable dev mode with auto-reload") { options[:dev] = true }
+        # --managed says the Rust CLI owns this process (it supervises, watches
+        # files, and compiles SCSS, so the framework must not duplicate any of
+        # it). "managed" was already declared in boolean_flags above, but this
+        # parser never accepted it, so `tina4ruby serve --managed` died with
+        # OptionParser::InvalidOption -- which is precisely how the Rust CLI
+        # invokes PHP. That mismatch is why Ruby could not be launched through
+        # the shared launcher the other frameworks use.
+        opts.on("--managed", "Running under the tina4 CLI supervisor") { options[:managed] = true }
         opts.on("--production", "Use production server (Puma)") { options[:production] = true }
         opts.on("--no-browser", "Do not open browser on start") { options[:no_browser] = true }
         opts.on("--no-reload", "Disable file watcher / live-reload") { options[:no_reload] = true }
@@ -502,12 +511,10 @@ module Tina4
       root_dir = Dir.pwd
       Tina4.initialize!(root_dir)
 
-      # Register health check endpoint
-      Tina4::Health.register!
-
-      # Register the always-on Frond {% live %} refresh endpoint
-      # (GET /__frond/live/{name}) so server-rendered live blocks can poll/SSE.
-      Tina4::Frond.register_live_endpoint!
+      # Built-in routes (health, Frond live). Shared with Tina4.run! so the two
+      # entry points cannot drift again -- they did, and app.rb served 404 on
+      # /health for it. register! is idempotent, so calling it here is safe.
+      Tina4.register_builtin_routes!
 
       # Load route files
       load_routes(root_dir)

data/lib/tina4/health.rb

@@ -16,12 +16,22 @@ module Tina4
       end
 
       def register!
+        # Idempotent by ASKING THE ROUTER, not by remembering. run! and the CLI
+        # both call this, and it can run more than once per process. A boolean
+        # flag looked equivalent and was not: Router.clear! (every spec, and
+        # any re-init) wipes the routes while the flag stays true, so /health
+        # silently vanishes for the rest of the run. Querying the router is
+        # self-healing -- cleared routes re-register, present ones don't
+        # duplicate.
+        return if Tina4::Router.find_route("/health", "GET")
+
         # Register at the configured path. The legacy "/health" path stays
         # registered for backward-compat.
         Tina4::Router.add("GET", path, method(:handle))
         Tina4::Router.add("GET", "/health", method(:handle)) unless path == "/health"
       end
 
+
       def handle(_request, response)
         now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         uptime = (now - START_TIME).round(2)

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.91"
+  VERSION = "3.13.93"
 end

data/lib/tina4.rb

@@ -309,6 +309,14 @@ module Tina4
       end
     end
 
+    # The framework's own routes, in ONE place. Both entry points call this:
+    # Tina4.run! (app.rb) and the CLI's cmd_start. Anything added here is
+    # available however the app was launched -- which is the whole point.
+    def register_builtin_routes!
+      Tina4::Health.register!
+      Tina4::Frond.register_live_endpoint!
+    end
+
     def run!(root_dir = nil, port: nil, host: nil, debug: nil)
       # Handle legacy call: run!(port: 7147) where root_dir receives the hash
       if root_dir.is_a?(Hash)
@@ -325,6 +333,14 @@ module Tina4
 
       initialize!(root_dir) unless @root_dir
 
+      # Built-in routes. These used to be registered ONLY by the CLI's
+      # cmd_start, so an app booted the documented way -- `Tina4.run!` from
+      # app.rb, which is exactly what `tina4 init ruby` scaffolds -- served 404
+      # on /health while the identical code under `tina4ruby serve` served 200.
+      # A container health check pointed at /health therefore failed against a
+      # perfectly healthy app.
+      register_builtin_routes!
+
       host = ENV.fetch("HOST", ENV.fetch("TINA4_HOST", "0.0.0.0"))
       port = ENV.fetch("PORT", ENV.fetch("TINA4_PORT", "7147")).to_i
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.91
+  version: 3.13.93
 platform: ruby
 authors:
 - Tina4 Team