tina4ruby 3.13.78 → 3.13.79

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3a8f1d39ba3c70f76f17c7bc87f68045864dfc4715307ad0dd6a84575165391
-  data.tar.gz: 8b60f21b3ad7cb1a5a0b04343abb03cc3cd63eb2f7e23fe01f84e75843c1dd40
+  metadata.gz: 6426e235ce3c5433ca29549aa6435f791526c806f37714cdb42db9a9796072f9
+  data.tar.gz: 3fbe6777cb881a67e8a1fbcc65ecd1f3203470b4ecbe89ceec02e26817274487
 SHA512:
-  metadata.gz: eceebf601875d541f521a1ae1793085f9ef5657b8f87d47c1669a29129e6b7593f18d4f3f247114c9c88dc8e74ccd96269e38ba94024bd56511aa85fb8db65ee
-  data.tar.gz: b8af90fd2ea93bc08b9a1770e2b17302c05cdb541bbcbb6e43e5a05f699aee5131546b9b95b6580218efa66285c666ffb347627e4a39b938aa72eec4937fb1e1
+  metadata.gz: 1af6247e51829dfd829d35b28dfc0f04269d394733a44fdf2505e8629fc393128b6ed05e1429a09e3c0222d7bf23589602d89a73bd6e668d1a604dad30ff2412
+  data.tar.gz: fda705c023c9b0196626a957378f55ae9dfbc61cfa65145c1561dae5f70ff6625aa34f109900419aa3fb05843b6aad5af5c87043e4994aafea92d939a8428950

data/lib/tina4/rack_app.rb

@@ -268,10 +268,25 @@ module Tina4
           end
 
           sid = sess.id
-          cookie_val = (env["HTTP_COOKIE"] || "")[/tina4_session=([^;]+)/, 1]
+          # Read the INCOMING session cookie by the SAME configured name the
+          # write side emits — via the one shared resolver (Session.cookie_name),
+          # exact `name=` prefix. A hardcoded "tina4_session=" here never matches
+          # a cookie renamed through TINA4_SESSION_NAME, so the auto-Set-Cookie
+          # would be needlessly re-emitted on every request that already carries
+          # the renamed session cookie. Parity with Python's
+          # core/server._init_session cookie_prefix.
+          cookie_prefix = "#{Tina4::Session.cookie_name}="
+          cookie_val = (env["HTTP_COOKIE"] || "").split(";").map(&:strip)
+                                                 .find { |part| part.start_with?(cookie_prefix) }
+                                                 &.slice(cookie_prefix.length..)
           if sid && sid != cookie_val
-            ttl = Integer(ENV.fetch("TINA4_SESSION_TTL", 3600))
-            headers["set-cookie"] = "tina4_session=#{sid}; Path=/; HttpOnly; SameSite=Lax; Max-Age=#{ttl}"
+            # Route through Session#cookie_header rather than hand-writing the
+            # header, so TINA4_SESSION_SECURE / _SAMESITE / _HTTPONLY / _NAME /
+            # _TTL are all honoured and Secure reflects the request scheme. The
+            # old hand-written literal ignored every attribute except TTL and
+            # hardcoded SameSite=Lax + HttpOnly, making the security env vars
+            # silent no-ops (issue #31).
+            headers["set-cookie"] = sess.cookie_header
           end
           rack_response = [status, headers, body_parts]
         end

data/lib/tina4/request.rb

@@ -152,11 +152,40 @@ module Tina4
       @body_parsed = nil
     end
 
+    # Is this request HTTPS from the CLIENT's point of view?
+    #
+    # TLS is normally terminated at a proxy (nginx, HAProxy, ALB, Cloudflare,
+    # most container deploys) that then forwards plain HTTP to the app, so
+    # rack.url_scheme is "http" on exactly the deployments that ARE encrypted.
+    # x-forwarded-proto carries the scheme the client actually used, and a
+    # chain of proxies appends each hop ("https, http") — the FIRST is the
+    # client-facing one. Falls back to the native rack scheme, then the CGI
+    # HTTPS var.
+    #
+    # This is the single source of truth for BOTH the URL scheme (#url) and the
+    # session-cookie Secure flag (Session#cookie_header). They used to decide it
+    # independently and could disagree — url() said https while the cookie
+    # concluded plain HTTP and dropped Secure (ruby#31, parity with PHP
+    # Request::isSecureScheme / tina4-php#175).
+    #
+    # @param env [Hash] the Rack environment.
+    # @return [Boolean] true when the client's scheme is https.
+    def self.secure_scheme?(env)
+      forwarded = (env["HTTP_X_FORWARDED_PROTO"] || "").to_s
+      unless forwarded.strip.empty?
+        return forwarded.split(",").first.to_s.strip.casecmp("https").zero?
+      end
+      scheme = (env["rack.url_scheme"] || "").to_s
+      return true if scheme.casecmp("https").zero?
+      https = (env["HTTPS"] || "").to_s
+      !https.empty? && https.casecmp("off") != 0
+    end
+
     # Full absolute URL — scheme://host[:port]/path[?query].
     # Honours X-Forwarded-Proto / X-Forwarded-Host so apps behind a proxy
     # still see the URL the client used. Matches Python/PHP/Node parity.
     def url
-      scheme = env["HTTP_X_FORWARDED_PROTO"] || env["rack.url_scheme"] || "http"
+      scheme = self.class.secure_scheme?(env) ? "https" : "http"
       host = env["HTTP_X_FORWARDED_HOST"] || env["HTTP_HOST"] || env["SERVER_NAME"] || "localhost"
       port = env["SERVER_PORT"]
       url_str = "#{scheme}://#{host}"

data/lib/tina4/session.rb

@@ -5,7 +5,6 @@ require "json"
 module Tina4
   class Session
     DEFAULT_OPTIONS = {
-      cookie_name: "tina4_session",
       secret: nil,
       max_age: 3600,
       handler: :file,
@@ -14,23 +13,59 @@ module Tina4
 
     attr_reader :id, :data
 
+    # The session cookie name — the SINGLE source of truth shared by the WRITE
+    # side (#cookie_header) and the READ side (#extract_session_id AND RackApp's
+    # incoming-cookie parse), so a cookie written under a renamed name is read
+    # back on the next request. Keeping the default literal in ONE place means it
+    # can never drift between the emit and parse paths. Parity with Python's
+    # module-level session_cookie_name() (tina4_python/session/__init__.py).
+    #
+    #   TINA4_SESSION_NAME   Cookie name (default: tina4_session)
+    def self.cookie_name
+      name = ENV["TINA4_SESSION_NAME"]
+      name.nil? || name.empty? ? "tina4_session" : name
+    end
+
     def initialize(env, options = {})
       @options = DEFAULT_OPTIONS.merge(options)
-      # TINA4_SESSION_NAME — overrides cookie_name unless caller explicitly passed one.
-      env_name = ENV["TINA4_SESSION_NAME"]
-      if !options.key?(:cookie_name) && env_name && !env_name.empty?
-        @options[:cookie_name] = env_name
-      end
+      # TINA4_SESSION_NAME — resolved by the ONE shared resolver (Session.cookie_name)
+      # that BOTH the write path (#cookie_header) and the read paths
+      # (#extract_session_id + RackApp incoming-cookie parse) go through, so a
+      # renamed cookie is emitted and read back under the same name. An explicit
+      # :cookie_name option still wins (same precedence as :handler below).
+      @options[:cookie_name] = self.class.cookie_name unless options.key?(:cookie_name)
       # No guessable built-in secret. The session never signs with this value
       # (IDs are SecureRandom.hex(32)), so we resolve it from TINA4_SECRET only
       # — nil when unset. This honours the framework's blank-secret discipline
       # (Auth.ensure_dev_secret never uses a guessable default); Python/Node
       # sessions carry no secret field at all.
       @options[:secret] ||= ENV["TINA4_SECRET"]
+      # TINA4_SESSION_TTL — cookie Max-Age (parity with Python's Session._ttl,
+      # which reads the same var). Only consulted when the caller did NOT pass
+      # an explicit :max_age (an explicit option always wins). Keeps the cookie
+      # honouring TINA4_SESSION_TTL now that rack_app routes the Set-Cookie
+      # through #cookie_header instead of hand-writing it (issue #31).
+      unless options.key?(:max_age)
+        ttl_env = ENV["TINA4_SESSION_TTL"]
+        @options[:max_age] = Integer(ttl_env) if ttl_env && !ttl_env.strip.empty?
+      end
+      # TINA4_SESSION_BACKEND — selects the storage handler unless the caller
+      # explicitly passed :handler (same precedence as :cookie_name above; an
+      # explicit option always wins over the environment). Without this the
+      # shipped redis/valkey/mongo/database handlers are unreachable by config.
+      # Parity with Python's Session._resolve_handler.
+      @options[:handler] = env_session_backend || @options[:handler] unless options.key?(:handler)
       # Backend-failure policy strict flag (parity with Python's
       # TINA4_SESSION_STRICT). When truthy, read/write/destroy/gc failures
       # RE-RAISE instead of logging + degrading.
       @strict = Tina4::Env.is_truthy(ENV["TINA4_SESSION_STRICT"])
+      # Whether THIS request reached us over https, decided PROXY-AWARE from the
+      # Rack env at construction (x-forwarded-proto first hop, else rack scheme /
+      # HTTPS). #cookie_header ORs this into the Secure flag so a cookie set on an
+      # https request is Secure even when TINA4_SESSION_SECURE is unset — a
+      # session cookie for an encrypted request must never be sent in the clear.
+      # Uses the SAME detector as Request#url so the two never disagree (issue #31).
+      @request_secure = Tina4::Request.secure_scheme?(env || {})
       @handler = create_handler
       @id = extract_session_id(env) || SecureRandom.hex(32)
       @data = load_session
@@ -184,8 +219,14 @@ module Tina4
       samesite = ENV["TINA4_SESSION_SAMESITE"] || "Lax"
       # HttpOnly defaults to true (existing behaviour); flip off only when explicitly false.
       httponly = !%w[false 0 no off].include?((ENV["TINA4_SESSION_HTTPONLY"] || "true").to_s.strip.downcase)
-      # Secure defaults to false; flip on with truthy env var.
-      secure = %w[true 1 yes on].include?((ENV["TINA4_SESSION_SECURE"] || "false").to_s.strip.downcase)
+      # Secure is set when ANY of the unified-contract conditions hold (parity
+      # with tina4-php#175/#179): TINA4_SESSION_SECURE is truthy, OR SameSite is
+      # None (browsers reject a None cookie without Secure per RFC 6265bis), OR
+      # the request itself is https (proxy-aware, from @request_secure). A plain
+      # HTTP request with the flag unset and SameSite != None stays non-Secure.
+      secure = %w[true 1 yes on].include?((ENV["TINA4_SESSION_SECURE"] || "false").to_s.strip.downcase) ||
+               samesite.to_s.strip.casecmp("none").zero? ||
+               @request_secure == true
 
       parts = ["#{name}=#{@id}", "Path=/"]
       parts << "HttpOnly" if httponly
@@ -262,9 +303,24 @@ module Tina4
       warn("Session #{operation} failed: #{error.message}")
     end
 
+    # The configured TINA4_SESSION_BACKEND name, or nil when unset/blank (so the
+    # caller keeps the DEFAULT_OPTIONS handler). The value is normalised at
+    # dispatch in #create_handler, not here.
+    def env_session_backend
+      value = ENV["TINA4_SESSION_BACKEND"]
+      value && !value.strip.empty? ? value : nil
+    end
+
+    # Build the storage handler for the resolved backend name.
+    #
+    # The accepted names — and the aliases — mirror Python's
+    # Session._resolve_handler exactly: file|filesystem, redis, valkey,
+    # mongodb|mongo, database|db. The name is normalised (downcase + strip) so
+    # "Redis" / " mongodb " from a .env line resolve, and an UNKNOWN value falls
+    # back to the file handler SILENTLY (never raises) — same as Python.
     def create_handler
-      case @options[:handler].to_sym
-      when :file
+      case @options[:handler].to_s.downcase.strip.to_sym
+      when :file, :filesystem
         Tina4::SessionHandlers::FileHandler.new(@options[:handler_options])
       when :redis
         Tina4::SessionHandlers::RedisHandler.new(@options[:handler_options])
@@ -273,7 +329,15 @@ module Tina4
       when :valkey
         Tina4::SessionHandlers::ValkeyHandler.new(@options[:handler_options])
       when :database, :db
-        Tina4::SessionHandlers::DatabaseHandler.new(@options[:handler_options])
+        # Parity with Python: the database backend "uses whatever DB is
+        # connected", so reuse the single ORM resolver (named binding → global
+        # Tina4.bind_database → TINA4_DATABASE_URL auto-discovery) rather than
+        # opening a second, divergent connection. An explicit
+        # handler_options[:db] still wins; a nil here leaves the handler's own
+        # env-derived default untouched.
+        Tina4::SessionHandlers::DatabaseHandler.new(
+          { db: Tina4::ORM.db }.merge(@options[:handler_options] || {})
+        )
       else
         Tina4::SessionHandlers::FileHandler.new(@options[:handler_options])
       end

data/lib/tina4/session_handlers/mongo_handler.rb

@@ -4,14 +4,20 @@ require "json"
 module Tina4
   module SessionHandlers
     class MongoHandler
+      # Connection is configured from TINA4_SESSION_MONGO_* env vars (parity with
+      # Python's MongoDBSessionHandler) so TINA4_SESSION_BACKEND=mongodb can be
+      # pointed at a server by env. TINA4_SESSION_MONGO_URI is canonical;
+      # TINA4_SESSION_MONGO_URL is a legacy alias. The database default is
+      # "tina4" (Python's default — Ruby previously drifted to "tina4_sessions").
+      # An explicit constructor option always wins over the environment.
       def initialize(options = {})
         require "mongo"
         @ttl = options[:ttl] || 86400
-        client = Mongo::Client.new(
-          options[:uri] || "mongodb://localhost:27017",
-          database: options[:database] || "tina4_sessions"
-        )
-        @collection = client[options[:collection] || "sessions"]
+        @uri = options[:uri] || ENV["TINA4_SESSION_MONGO_URI"] || ENV["TINA4_SESSION_MONGO_URL"] || "mongodb://localhost:27017"
+        @database = options[:database] || ENV["TINA4_SESSION_MONGO_DB"] || "tina4"
+        @collection_name = options[:collection] || ENV["TINA4_SESSION_MONGO_COLLECTION"] || "sessions"
+        client = Mongo::Client.new(@uri, database: @database)
+        @collection = client[@collection_name]
         ensure_ttl_index
       rescue LoadError
         raise "MongoDB session handler requires the 'mongo' gem. Install with: gem install mongo"

data/lib/tina4/session_handlers/redis_handler.rb

@@ -9,13 +9,17 @@ module Tina4
     # speaks raw RESP over a TCP socket via RespClient — zero dependencies, so a
     # Tina4 app stores sessions in Redis with no extra gem.
     class RedisHandler
+      # Connection is configured from TINA4_SESSION_REDIS_* env vars (parity with
+      # Python's RedisSessionHandler and the Ruby ValkeyHandler shape) so
+      # TINA4_SESSION_BACKEND=redis can actually be pointed at a server by env.
+      # An explicit constructor option always wins over the environment.
       def initialize(options = {})
         @prefix = options[:prefix] || "tina4:session:"
         @ttl = options[:ttl] || 86400
-        @host = options[:host] || "localhost"
-        @port = options[:port] || 6379
-        @db = options[:db] || 0
-        @password = options[:password]
+        @host = options[:host] || ENV["TINA4_SESSION_REDIS_HOST"] || "localhost"
+        @port = options[:port] || (ENV["TINA4_SESSION_REDIS_PORT"] ? ENV["TINA4_SESSION_REDIS_PORT"].to_i : 6379)
+        @db = options[:db] || (ENV["TINA4_SESSION_REDIS_DB"] ? ENV["TINA4_SESSION_REDIS_DB"].to_i : 0)
+        @password = options[:password] || ENV["TINA4_SESSION_REDIS_PASSWORD"]
         @redis = build_gem_client
         @resp = @redis ? nil : RespClient.new(host: @host, port: @port, password: @password, db: @db)
       end

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.78"
+  VERSION = "3.13.79"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.78
+  version: 3.13.79
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-17 00:00:00.000000000 Z
+date: 2026-07-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack