tina4ruby 3.13.82 → 3.13.83

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c8f9a8a50b4bb94a8b19b81774ce30e7a9d64fca932c2eb6a49016dc0352171
-  data.tar.gz: 90066d82b0085d019c3118fe57d225eb78206fe44f55c235dd3e7d67d8451382
+  metadata.gz: 047daf112e32975b3a932f37b8cc266495c67744228dad532831ecfc918d76d1
+  data.tar.gz: 06a13610c6f4dca323533afda0170fe9ab8b80c8181bd21ee3cc9743314704c3
 SHA512:
-  metadata.gz: 042b4dbfa4faf371dde9eb25e3e4406170c46086c29f1ff67afecad0fb61c482605f4f912469251b8640545142eeb295dd7eb1797081137575d941ebccf3f9be
-  data.tar.gz: e5e303934c51d2fc83692817eef9f26382d5bbd5c1b735f6a0b3bcd65a13a7a902574b070cd86a1b60cf0e17a34788444507c5b8cd62c9d8a60aea626abff80f
+  metadata.gz: 9836d9caa0a14bcdebaca2effb98265c76a326c21e4d67a50daa6a22f2eef134fce9cf31ab068a60da688b2daa6fc0717a0244d58b1f17116a501a2f8ab91685
+  data.tar.gz: d6fae651771e754bf8a3bb5fd9a73aee386765bf0574abb285a1eccea1fefe294e96d1e15913b3b413f380d2c239881b2cb70431956a67bb3282d132068c97f2

data/CHANGELOG.md

@@ -28,6 +28,29 @@ UNRELEASED work. When a version ships, its notes go to the release notes above.
   filename alignment, not an API change. Only code that bypassed the gem's own entry point with
   a direct `require "tina4/sql_translation"` needs to update the path.
 
+### Fixed
+
+- **Security: the bundled Swagger UI static assets now honour the swagger gate.** `/swagger`,
+  `/swagger/`, `/swagger/index.html` and `/swagger/oauth2-redirect.html` were served from the
+  framework's own public directory BEFORE route matching (with directory-index resolution turning
+  `/swagger` into `swagger/index.html`), so a production server with `TINA4_SWAGGER_ENABLED=false`
+  still served the whole UI while `/swagger/openapi.json` correctly 404'd. Static serving now checks
+  the gate before it resolves an index. Bite-verified lock-in test. (python#97)
+- **The startup banner advertises only a surface that answers.** The `Swagger:` and `Dashboard:`
+  rows printed unconditionally, so a production log claimed a dev surface was exposed and a
+  developer following the link hit a 404. Each row is now built by one pure helper of
+  (port, swagger_enabled, dev_admin_enabled), unit tested rather than inferred from stdout.
+  (python#99)
+- **MQTT TLS tests verify the CA before trusting it.** A stale CA file in the shared temp directory
+  made six TLS tests FAIL instead of skip, in all four frameworks, pointing at correct TLS code.
+  The suites now confirm the CA actually validates the broker certificate before treating the TLS
+  environment as present. (python#98)
+- **The gemspec declares `logger` and `base64`.** Ruby 4 dropped both from the default gems.
+  `tina4ruby` requires `logger` and nothing in its transitive closure provided it, so a fresh
+  install on Ruby 4 could fail at require time. `base64` is satisfied through `jwt` today and is
+  declared directly so a change there cannot break us.
+
+
 ## Earlier history (pre-3.x)
 
 Kept for reference only. The versions below are from the 0.x line, long before the unified

data/lib/tina4/rack_app.rb

@@ -418,6 +418,19 @@ module Tina4
     def try_static(path, env = nil)
       return nil if path.include?("..")
 
+      # The framework ships the Swagger UI as STATIC assets under
+      # lib/tina4/public/swagger/. Static serving is independent of the gated
+      # /swagger handler, so without this check the UI stays reachable in
+      # production via '/swagger/index.html' or '/swagger/oauth2-redirect.html'
+      # even when swagger is disabled -- silently bypassing
+      # TINA4_SWAGGER_ENABLED / TINA4_DEBUG. (A bare '/swagger' and '/swagger/'
+      # are already intercepted by the gated handler, which is why this leak hid.)
+      normalised_path = path.start_with?("/") ? path : "/#{path}"
+      if (normalised_path == "/swagger" || normalised_path.start_with?("/swagger/")) &&
+         !Tina4::Swagger.enabled?
+        return nil
+      end
+
       @static_roots.each do |root|
         full_path = File.join(root, path)
         if File.file?(full_path)

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.82"
+  VERSION = "3.13.83"
 end

data/lib/tina4.rb

@@ -156,6 +156,25 @@ module Tina4
     # models with a Symbol/String `self.db` resolve against it.
     def databases = (@databases ||= {})
 
+    # Build the startup banner's optional surface lines (issue #99).
+    #
+    # Only advertise a surface that is actually REACHABLE. In production, or with
+    # TINA4_DEBUG off, /swagger and /__dev return 404 -- printing them anyway
+    # both misleads an operator into believing a dev surface is exposed and sends
+    # a developer to a dead link.
+    #
+    # Kept as a pure function of (port, two booleans) so the contract is unit
+    # testable without booting a server and grepping stdout. Parity: Python
+    # banner_surface_lines, PHP App::bannerSurfaceLines, Node bannerSurfaceLines.
+    #
+    # @return [Array<String>] zero, one or two ready-to-puts banner rows.
+    def banner_surface_lines(port, swagger_enabled:, dev_admin_enabled:)
+      lines = []
+      lines << "  Swagger:   http://localhost:#{port}/swagger" if swagger_enabled
+      lines << "  Dashboard: http://localhost:#{port}/__dev" if dev_admin_enabled
+      lines
+    end
+
     def print_banner(host: "0.0.0.0", port: 7147, server_name: nil)
       # TINA4_SUPPRESS — short-circuit ALL banner output for headless / CI runs.
       return if Tina4::Env.is_truthy(ENV["TINA4_SUPPRESS"])
@@ -187,8 +206,12 @@ module Tina4
       puts "  Simple. Fast. Human. | Built for AI. Built for you."
       puts ""
       puts "  Server:    http://#{display}:#{port} (#{server_name})"
-      puts "  Swagger:   http://localhost:#{port}/swagger"
-      puts "  Dashboard: http://localhost:#{port}/__dev"
+      # Only advertise a surface that is actually reachable (issue #99).
+      banner_surface_lines(
+        port,
+        swagger_enabled: Tina4::Swagger.enabled?,
+        dev_admin_enabled: is_debug
+      ).each { |line| puts line }
       puts "  Debug:     #{is_debug ? 'ON' : 'OFF'} (Log level: #{log_level})"
       puts ""
     rescue

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.82
+  version: 3.13.83
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-23 00:00:00.000000000 Z
+date: 2026-07-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -136,6 +136,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.8'
+- !ruby/object:Gem::Dependency
+  name: logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.6'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement