tina4ruby 3.13.98 → 3.13.99

data/lib/tina4/field_types.rb

@@ -43,31 +43,45 @@ module Tina4
         end
       end
 
-      def integer_field(name, primary_key: false, auto_increment: false, nullable: true, default: nil)
+      # Feature 19: the constraint options (required:, min:/max: for numbers,
+      # min_length:/max_length:/pattern: for strings) are ENFORCED on save() by
+      # ORM#validate -- bringing Ruby up to the shared cross-framework richness
+      # (Ruby used to be null-only). `length:` stays a DDL VARCHAR sizing hint and
+      # is deliberately never validated (parity with PHP's `length`); use
+      # max_length: for a value cap.
+      def integer_field(name, primary_key: false, auto_increment: false, nullable: true, default: nil,
+                        required: false, min: nil, max: nil)
         register_field(name, :integer, primary_key: primary_key, auto_increment: auto_increment,
-                       nullable: nullable, default: default)
+                       nullable: nullable, default: default, required: required, min: min, max: max)
       end
 
-      def string_field(name, length: 255, primary_key: false, nullable: true, default: nil)
+      def string_field(name, length: 255, primary_key: false, nullable: true, default: nil,
+                       required: false, min_length: nil, max_length: nil, pattern: nil)
         register_field(name, :string, length: length, primary_key: primary_key,
-                       nullable: nullable, default: default)
+                       nullable: nullable, default: default, required: required,
+                       min_length: min_length, max_length: max_length, pattern: pattern)
       end
 
-      def text_field(name, nullable: true, default: nil)
-        register_field(name, :text, nullable: nullable, default: default)
+      def text_field(name, nullable: true, default: nil,
+                     required: false, min_length: nil, max_length: nil, pattern: nil)
+        register_field(name, :text, nullable: nullable, default: default, required: required,
+                       min_length: min_length, max_length: max_length, pattern: pattern)
       end
 
-      def float_field(name, nullable: true, default: nil)
-        register_field(name, :float, nullable: nullable, default: default)
+      def float_field(name, nullable: true, default: nil, required: false, min: nil, max: nil)
+        register_field(name, :float, nullable: nullable, default: default,
+                       required: required, min: min, max: max)
       end
 
-      def decimal_field(name, precision: 10, scale: 2, nullable: true, default: nil)
+      def decimal_field(name, precision: 10, scale: 2, nullable: true, default: nil,
+                        required: false, min: nil, max: nil)
         register_field(name, :decimal, precision: precision, scale: scale,
-                       nullable: nullable, default: default)
+                       nullable: nullable, default: default, required: required, min: min, max: max)
       end
 
-      def numeric_field(name, nullable: true, default: nil)
-        register_field(name, :float, nullable: nullable, default: default)
+      def numeric_field(name, nullable: true, default: nil, required: false, min: nil, max: nil)
+        register_field(name, :float, nullable: nullable, default: default,
+                       required: required, min: min, max: max)
       end
 
       def boolean_field(name, nullable: true, default: nil)
@@ -100,8 +114,11 @@ module Tina4
       #   - Registers an integer field for the column
       #   - Calls belongs_to on this class (strip _id suffix for association name)
       #   - Calls has_many on the referenced class. The accessor name is the
-      #     declaring class name lowercased + "s" (e.g. Post → posts), matching
-      #     Python; override with related_name:. Works whether the referenced
+      #     declaring class name lowercased and SMART-pluralized via
+      #     Tina4.pluralize (e.g. Post → posts, Category → categories -- the same
+      #     inflection the hand-written has_many uses, not a naive + "s" that
+      #     produced "categorys"); override with related_name:. Works whether the
+      #     referenced
       #     class loaded before OR after this one, including the string form
       #     (references: "Author") for forward references — resolution is
       #     deferred via Tina4::ORM.inherited until the target class exists.
@@ -128,7 +145,7 @@ module Tina4
 
         # Wire has_many on referenced class (if already a loaded Class)
         if references.is_a?(Class) && references.respond_to?(:has_many, true)
-          hm_name = (related_name || "#{self.name.split("::").last.downcase}s").to_sym
+          hm_name = (related_name || Tina4.pluralize(self.name.split("::").last.downcase)).to_sym
           references.has_many(hm_name, class_name: self.name.split("::").last, foreign_key: name.to_s)
         end
 
@@ -136,7 +153,7 @@ module Tina4
         @@_fk_registry ||= {}
         ref_name = references.is_a?(Class) ? references.name.split("::").last : references.to_s.split("::").last
         @@_fk_registry[ref_name] ||= []
-        hm_key = (related_name || "#{self.name.split("::").last.downcase}s").to_s
+        hm_key = (related_name || Tina4.pluralize(self.name.split("::").last.downcase)).to_s
         @@_fk_registry[ref_name] << {
           declaring_class: self,
           has_many_name: hm_key.to_sym,

data/lib/tina4/frond.rb

@@ -651,11 +651,33 @@ module Tina4
     # Template loading
     # -----------------------------------------------------------------------
 
+    # Load a template's source, CONFINED under the templates directory.
+    #
+    # Every path-taking tag ({% include %}, {% extends %}, {% import %},
+    # {% from ... import %}) funnels through this one loader, so this single guard
+    # confines them all (TAG-DEC-01): a name that is absolute, climbs out with a
+    # +..+ up-level segment, or resolves through a symlink to a location OUTSIDE
+    # the templates root is REFUSED -- the outside file is never read. Template
+    # -side analogue of the static-asset confinement (feature 41 / ADR-0050).
     def load_template(name)
+      # Lexical belt: refuse an absolute path or a `..` up-level segment before
+      # touching the filesystem (defense in depth in front of the realpath check).
+      if name.start_with?("/", "\\") || name =~ %r{\A[A-Za-z]:} ||
+         name.split(%r{[\\/]}).include?("..")
+        raise "Template path escapes the templates directory: #{name}"
+      end
       path = File.join(@template_dir, name)
-      raise "Template not found: #{path}" unless File.exist?(path)
+      raise "Template not found: #{path}" unless File.file?(path)
+
+      # Realpath containment: a symlink INSIDE the templates dir whose target
+      # resolves OUTSIDE it is refused (the lexical belt cannot see a symlink).
+      root = File.realpath(@template_dir)
+      real = File.realpath(path)
+      unless real == root || real.start_with?(root + File::SEPARATOR)
+        raise "Template path escapes the templates directory: #{name}"
+      end
 
-      File.read(path, encoding: "utf-8")
+      File.read(real, encoding: "utf-8")
     end
 
     # -----------------------------------------------------------------------

data/lib/tina4/gallery/auth/src/routes/api/gallery_auth.rb

@@ -108,7 +108,7 @@ Tina4::Router.post("/api/gallery/auth/login") do |request, response|
 end
 
 Tina4::Router.get("/api/gallery/auth/verify") do |request, response|
-  token = request.params["token"].to_s
+  token = request.query["token"].to_s
   result = Tina4::Auth.validate_token(token)
   response.json({ valid: result[:valid] })
 end

data/lib/tina4/gallery/templates/src/templates/gallery_page.twig

@@ -176,7 +176,7 @@
                 </thead>
                 <tbody>
                     <tr><td>1</td><td>tina4-python</td><td>7145</td><td>Python 3.12+</td><td><span class="badge bg-success">Stable</span></td></tr>
-                    <tr><td>2</td><td>tina4-php</td><td>7146</td><td>PHP 8.2+</td><td><span class="badge bg-success">Stable</span></td></tr>
+                    <tr><td>2</td><td>tina4-php</td><td>7145</td><td>PHP 8.2+</td><td><span class="badge bg-success">Stable</span></td></tr>
                     <tr><td>3</td><td>tina4-ruby</td><td>7147</td><td>Ruby 3.1+</td><td><span class="badge bg-success">Stable</span></td></tr>
                     <tr><td>4</td><td>tina4-nodejs</td><td>7148</td><td>Node 20+</td><td><span class="badge bg-success">Stable</span></td></tr>
                 </tbody>

data/lib/tina4/graphql.rb

@@ -1091,9 +1091,9 @@ module Tina4
 
       # Optional: GET for GraphiQL/introspection
       Tina4.get path, auth: false do |request, response|
-        query = request.params["query"]
+        query = request.query["query"]
         if query
-          variables = request.params["variables"]
+          variables = request.query["variables"]
           variables = JSON.parse(variables) if variables.is_a?(String) && !variables.empty?
           result = graphql.execute(query, variables: variables || {}, context: { request: request })
           response.json(result)