tina4ruby 3.13.133 → 3.13.134

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83f372e751a027c81f97a04d5002b5dd756f16d9f94bc9a9b771c820f0878619
-  data.tar.gz: 6436d18bc08e5dd6f5b6232feb90a7e2650a728064420f12e505eb279e3b941c
+  metadata.gz: 1d0d4c7801e0766f00041e3d004a0318d7bd4e22d9b4a4d102d05516b89ebba1
+  data.tar.gz: 837234011a9a76e4d0733d8a05936bdb08a5bcb8681638679064b51d84dc2392
 SHA512:
-  metadata.gz: 8c214ae801254e82779984e62aabf4c07895c45109e25a75a28ea48aecb41aef707edfdbaed6a86db94e458b3bfdf06df783fc1e398bd7e77a1bc7796cc967b8
-  data.tar.gz: e98653bdc54a68d5c9c205645651b0b682ce1d23912d5dc437d774161636d09abfe1225fc01366ddcc2f0ad38f69fe2bd9984dc77579541f5876bae41e973c4b
+  metadata.gz: bfd2d4b058f1366920dd46b66f1d59f504f1b30cc649b71ecc7f5d8f8d15a385eaa19b5de9078768c0f935aba9a3115e8e10efe72806cfa53be5aca73f5c2caf
+  data.tar.gz: 178596fd8db63262bc35aeb25ae13e11c609b3f50a85bc06d91ce12063b9739973f80ce5783ec5a330d115b3b07e9389718f2316d8c53590b47867ad777b193d

data/CHANGELOG.md

@@ -6,6 +6,13 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.134
+
+Feature 140 Web Push is now available with provider-neutral subscription delivery,
+native result envelopes, fail-closed configuration, and the documented runtime
+configuration. Developer skills now include the Web Push API and configuration
+reference for all supported language stacks.
+
 ## 3.13.133
 
 Maintainability pass, no behavior changes. Swagger.generate decomposed into cohesive

data/README.md

@@ -102,7 +102,7 @@ Benchmarked with `wrk`: 5,000 requests, 50 concurrent, median of 3 runs:
 | **Tina4 Ruby** | **10,243** | 0 | 55 |
 | Sinatra | 9,548 | 5+ | ~4 |
 
-Tina4 Ruby outperforms Sinatra while delivering **98 features vs ~4**, with zero runtime dependencies.
+Tina4 Ruby outperforms Sinatra while delivering **140 cataloged features vs ~4**, with zero runtime dependencies.
 
 **Across all 4 Tina4 implementations:**
 
@@ -116,7 +116,7 @@ Tina4 Ruby outperforms Sinatra while delivering **98 features vs ~4**, with zero
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages: same architecture, same conventions, same 98 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, the same 140 cataloged features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

data/lib/tina4/push.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "base64"
+require "json"
+require "net/http"
+require "uri"
+
+module Tina4
+  class PushError < StandardError; end
+
+  # Provider-neutral Web Push sender using Ruby's stdlib OpenSSL and Net::HTTP.
+  # Web Push remains optional at use time; a Ruby build without OpenSSL fails
+  # loudly when the feature is selected rather than silently sending plaintext.
+  class Push
+    RECORD_SIZE = 4096
+    MAX_PAYLOAD = RECORD_SIZE - 17
+
+    def self.generate_vapid_keys
+      require_openssl
+      key = OpenSSL::PKey::EC.generate("prime256v1")
+      {
+        "publicKey" => b64(key.public_key.to_bn.to_s(2)),
+        "privateKey" => b64(key.private_key.to_s(2))
+      }
+    end
+
+    def initialize(subject: nil, public_key: nil, private_key: nil, ttl: 60, urgency: nil)
+      @subject = (subject || ENV.fetch("TINA4_VAPID_SUBJECT", "")).strip
+      @public_key = (public_key || ENV.fetch("TINA4_VAPID_PUBLIC", "")).strip
+      @private_key = (private_key || ENV.fetch("TINA4_VAPID_PRIVATE", "")).strip
+      @ttl = ttl
+      @urgency = urgency
+      if %w[0 false off no].include?(ENV.fetch("TINA4_WEB_PUSH", "").strip.downcase)
+        raise PushError, "Web Push is disabled by TINA4_WEB_PUSH"
+      end
+      configuration if [@subject, @public_key, @private_key].any? { |value| !value.empty? }
+    end
+
+    def send(subscription, payload)
+      endpoint, uri = endpoint_for(subscription)
+      subject, public_key, private_key = configuration
+      public, private = vapid_keys(public_key, private_key)
+      deliver(endpoint, uri, subject, public_key, private, public, encrypt(payload_bytes(payload), subscription))
+    rescue URI::InvalidURIError => e
+      raise PushError, "Push subscription endpoint must be a valid URL: #{e.message}"
+    rescue Net::HTTPError, SocketError, SystemCallError => e
+      raise PushError, "Web Push request failed: #{e.message}"
+    end
+
+    private
+
+    def endpoint_for(subscription)
+      endpoint = subscription.is_a?(Hash) ? (subscription["endpoint"] || subscription[:endpoint]) : nil
+      raise PushError, "A Web Push subscription with an endpoint is required" unless endpoint.is_a?(String) && !endpoint.empty?
+      uri = URI.parse(endpoint)
+      raise PushError, "Push subscription endpoint must use HTTP or HTTPS" unless %w[http https].include?(uri.scheme) && uri.host
+      [endpoint, uri]
+    end
+
+    def vapid_keys(public_key, private_key)
+      public = decode(public_key, "TINA4_VAPID_PUBLIC")
+      private = decode(private_key, "TINA4_VAPID_PRIVATE")
+      raise PushError, "TINA4_VAPID_PUBLIC must be a 65-byte P-256 public key" unless public.bytesize == 65 && public.getbyte(0) == 4
+      raise PushError, "TINA4_VAPID_PRIVATE must be a 32-byte P-256 private key" unless private.bytesize == 32
+      begin
+        derived = private_key_from_raw(private, public).public_key.to_bn.to_s(2)
+      rescue OpenSSL::PKey::PKeyError => e
+        raise PushError, "TINA4_VAPID_PRIVATE is not a valid P-256 private key: #{e.message}"
+      end
+      raise PushError, "TINA4_VAPID_PUBLIC does not match TINA4_VAPID_PRIVATE" unless derived == public
+      [public, private]
+    end
+
+    def deliver(endpoint, uri, subject, public_key, private, public, body)
+      request = Net::HTTP::Post.new(uri)
+      request["Authorization"] = "vapid t=#{vapid_token(uri, subject, private, public)}, k=#{public_key}"
+      request["Content-Encoding"] = "aes128gcm"
+      request["Content-Type"] = "application/octet-stream"
+      request["TTL"] = @ttl.to_i.to_s
+      request["Urgency"] = @urgency if @urgency && !@urgency.empty?
+      request.body = body
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      response = http.start { |client| client.request(request) }
+      status = response.code.to_i
+      { "ok" => status < 400, "status" => status, "dead" => [404, 410].include?(status), "retryable" => [408, 429].include?(status) || status >= 500, "endpoint" => endpoint, "response" => response.body.to_s }
+    end
+
+    def configuration
+      missing = []
+      missing << "TINA4_VAPID_SUBJECT" if @subject.empty?
+      missing << "TINA4_VAPID_PUBLIC" if @public_key.empty?
+      missing << "TINA4_VAPID_PRIVATE" if @private_key.empty?
+      raise PushError, "Web Push is configured but missing: #{missing.join(', ')}" unless missing.empty?
+      self.class.send(:require_openssl)
+      [@subject, @public_key, @private_key]
+    end
+
+    def self.require_openssl
+      return if defined?(OpenSSL::PKey::EC)
+
+      raise PushError, "Web Push requires Ruby's OpenSSL stdlib capability; rebuild Ruby with OpenSSL support"
+    end
+
+    def self.b64(value)
+      Base64.urlsafe_encode64(value, padding: false)
+    end
+
+    def decode(value, name)
+      raise PushError, "#{name} must be a non-empty base64url string" unless value.is_a?(String) && value.match?(/\A[A-Za-z0-9_-]+\z/)
+
+      Base64.urlsafe_decode64(value)
+    rescue ArgumentError => e
+      raise PushError, "#{name} must be base64url encoded: #{e.message}"
+    end
+
+    def payload_bytes(payload)
+      return payload.b if payload.is_a?(String)
+      JSON.generate(payload)
+    rescue JSON::GeneratorError => e
+      raise PushError, "Push payload is not JSON serializable: #{e.message}"
+    end
+
+    def private_key_from_raw(private, public)
+      body = OpenSSL::ASN1::Sequence.new([
+        OpenSSL::ASN1::Integer.new(1),
+        OpenSSL::ASN1::OctetString.new(private),
+        OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::ObjectId.new("prime256v1")], 0, :CONTEXT_SPECIFIC),
+        OpenSSL::ASN1::ASN1Data.new([OpenSSL::ASN1::BitString.new(public)], 1, :CONTEXT_SPECIFIC)
+      ])
+      OpenSSL::PKey.read(body.to_der)
+    end
+
+    def public_key_from_raw(public)
+      algorithm = OpenSSL::ASN1::Sequence.new([OpenSSL::ASN1::ObjectId.new("id-ecPublicKey"), OpenSSL::ASN1::ObjectId.new("prime256v1")])
+      OpenSSL::PKey.read(OpenSSL::ASN1::Sequence.new([algorithm, OpenSSL::ASN1::BitString.new(public)]).to_der)
+    end
+
+    def encrypt(payload, subscription)
+      raise PushError, "Push payload is too large; maximum is #{MAX_PAYLOAD} bytes" if payload.bytesize > MAX_PAYLOAD
+      keys = subscription.is_a?(Hash) ? (subscription["keys"] || subscription[:keys] || {}) : {}
+      p256dh = keys["p256dh"] || keys[:p256dh]
+      auth = keys["auth"] || keys[:auth]
+      client = decode(p256dh.to_s, "subscription.keys.p256dh")
+      auth_secret = decode(auth.to_s, "subscription.keys.auth")
+      raise PushError, "subscription.keys.p256dh must be a 65-byte P-256 public key" unless client.bytesize == 65 && client.getbyte(0) == 4
+      raise PushError, "subscription.keys.auth must be a 16-byte authentication secret" unless auth_secret.bytesize == 16
+
+      ephemeral = OpenSSL::PKey::EC.generate("prime256v1")
+      server = ephemeral.public_key.to_bn.to_s(2)
+      shared = ephemeral.derive(public_key_from_raw(client))
+      ikm = hkdf(hmac(auth_secret, shared), "WebPush: info\0" + client + server, 32)
+      salt = OpenSSL::Random.random_bytes(16)
+      prk = hmac(salt, ikm)
+      cek = hkdf(prk, "Content-Encoding: aes128gcm\0", 16)
+      nonce = hkdf(prk, "Content-Encoding: nonce\0", 12)
+      cipher = OpenSSL::Cipher.new("aes-128-gcm")
+      cipher.encrypt
+      cipher.key = cek
+      cipher.iv = nonce
+      ciphertext = cipher.update(payload + "\x02") + cipher.final
+      tag = cipher.auth_tag
+      salt + [RECORD_SIZE].pack("N") + [server.bytesize].pack("C") + server + ciphertext + tag
+    end
+
+    def hmac(key, value)
+      OpenSSL::HMAC.digest(OpenSSL::Digest::SHA256.new, key, value)
+    end
+
+    def hkdf(prk, info, length)
+      output = +""
+      previous = +""
+      counter = 1
+      while output.bytesize < length
+        previous = hmac(prk, previous + info + [counter].pack("C"))
+        output << previous
+        counter += 1
+        raise PushError, "HKDF output is too large" if counter > 255
+      end
+      output.byteslice(0, length)
+    end
+
+    def vapid_token(uri, subject, private, public)
+      aud = "#{uri.scheme}://#{uri.host}#{uri.port && ![80, 443].include?(uri.port) ? ":#{uri.port}" : ""}"
+      header = self.class.send(:b64, JSON.generate({ typ: "JWT", alg: "ES256" }))
+      claims = self.class.send(:b64, JSON.generate({ aud: aud, exp: Time.now.to_i + 43_200, sub: subject }))
+      input = "#{header}.#{claims}"
+      signature = private_key_from_raw(private, public).sign(OpenSSL::Digest::SHA256.new, input)
+      asn = OpenSSL::ASN1.decode(signature)
+      raw = [asn.value[0].value.to_s(2), asn.value[1].value.to_s(2)].map { |value| value.rjust(32, "\0") }.join
+      "#{input}.#{self.class.send(:b64, raw)}"
+    end
+  end
+end

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.133"
+  VERSION = "3.13.134"
 end

data/lib/tina4.rb

@@ -169,6 +169,8 @@ module Tina4
   autoload :MqttError,           File.expand_path("tina4/mqtt", __dir__)
   autoload :MqttTimeoutError,    File.expand_path("tina4/mqtt", __dir__)
   autoload :MqttMessage,         File.expand_path("tina4/mqtt_message", __dir__)
+  autoload :Push,                File.expand_path("tina4/push", __dir__)
+  autoload :PushError,           File.expand_path("tina4/push", __dir__)
   autoload :Testing,             File.expand_path("tina4/testing", __dir__)
   # Queue / Messenger / DocStore were the last three optional subsystems still
   # loaded eagerly, so every `require "tina4"` paid for a queue backend, an

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.133
+  version: 3.13.134
 platform: ruby
 authors:
 - Tina4 Team
@@ -405,6 +405,7 @@ files:
 - lib/tina4/public/js/tina4js.min.js
 - lib/tina4/public/swagger/index.html
 - lib/tina4/public/swagger/oauth2-redirect.html
+- lib/tina4/push.rb
 - lib/tina4/query_builder.rb
 - lib/tina4/queue.rb
 - lib/tina4/queue_backends/kafka_backend.rb