gina 0.3.11 → 0.3.12

package/framework/{v0.3.11 → v0.3.12}/core/plugins/lib/validator/src/form-validator.js

@@ -1547,7 +1547,18 @@ function FormValidatorUtil(data, $fields, xhrOptions, fieldsSet) {
                 && typeof(this.target.type) != 'undefined'
                 && this.target.type == 'radio'
             ) {
-                var radios = document.getElementsByName(this.name);
+                // [HTML5 form-reassociation] Scope the radio group by form-owner per
+                // HTML5 spec. `getElementsByName` returns same-name radios across the
+                // whole document regardless of owner — without this filter, the
+                // first-checked pick cross-fires into sibling forms whose radios
+                // happen to share the name (the multi-entry layout where each entry
+                // has its own reassociated form). Mirrors the equivalent filter in
+                // main.js's updateRadio.
+                var $target = this.target;
+                var rawRadios = document.getElementsByName(this.name);
+                var radios = Array.prototype.filter.call(rawRadios, function (_r) {
+                    return _r.form === $target.form;
+                });
                 for (var i = 0, len = radios.length; i < len; ++i) {
                     if (radios[i].checked) {
                         if ( /true|false/.test(radios[i].value) ) {

package/framework/{v0.3.11 → v0.3.12}/core/server.isaac.js

@@ -1263,8 +1263,11 @@ function ServerEngineClass(options) {
                                 var _aLower = a[1] && a[1].toLowerCase();
                                 if ( _aLower === 'false' || _aLower === 'true' || _aLower === 'on' )
                                     a[1] = ( _aLower === 'true' || _aLower === 'on' ) ? true : false;
-                                else if (a[1] && a[1].indexOf('%') > -1)
-                                    a[1] = decodeURIComponent(a[1]);
+                                else if (a[1] && (a[1].indexOf('+') > -1 || a[1].indexOf('%') > -1)) {
+                                    // #B17: '+' → space per WHATWG URL form-urlencoded parser; must run before decodeURIComponent (which does NOT decode '+').
+                                    if (a[1].indexOf('+') > -1) a[1] = a[1].replace(/\+/g, ' ');
+                                    if (a[1].indexOf('%') > -1) a[1] = decodeURIComponent(a[1]);
+                                }
 
                                 if (a[1] && typeof a[1] === 'string' && (a[1].charAt(0) === '{' || a[1].charAt(0) === '[') ) {
                                     try {
@@ -1284,6 +1287,11 @@ function ServerEngineClass(options) {
                             var _aLower2 = a[1] && a[1].toLowerCase();
                             if ( _aLower2 === 'false' || _aLower2 === 'true' || _aLower2 === 'on' )
                                 a[1] = ( _aLower2 === 'true' || _aLower2 === 'on' ) ? true : false;
+                            else if (a[1] && (a[1].indexOf('+') > -1 || a[1].indexOf('%') > -1)) {
+                                // #B17: '+' → space per WHATWG URL form-urlencoded parser; must run before decodeURIComponent (which does NOT decode '+').
+                                if (a[1].indexOf('+') > -1) a[1] = a[1].replace(/\+/g, ' ');
+                                if (a[1].indexOf('%') > -1) a[1] = decodeURIComponent(a[1]);
+                            }
 
                             request.query[ a[0] ] = a[1]
                         } else { // for redirection purposes or when passing `?encodedJsonObject`

package/framework/{v0.3.11 → v0.3.12}/core/server.js

@@ -3161,7 +3161,7 @@ function Server(options) {
                     // get rid of encoding issues
                     try {
                         if ( !/multipart\/form-data;/.test(request.headers['content-type']) ) {
-                            if ( !/application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
+                            if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
                                 request.body = request.body.replace(/\+/g, ' ');
                             }
 
@@ -3313,7 +3313,7 @@ function Server(options) {
                     // get rid of encoding issues
                     try {
                         if ( !/multipart\/form-data;/.test(request.headers['content-type']) ) {
-                            if ( !/application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) ) {
+                            if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) ) {
                                 request.body = request.body.replace(/\+/g, ' ');
                             }
 
@@ -3403,7 +3403,7 @@ function Server(options) {
                 if ( typeof(request.body) == 'string' ) {
                     try {
                         if ( !/multipart\/form-data;/.test(request.headers['content-type']) ) {
-                            if ( !/application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
+                            if ( /application\/x\-www\-form\-urlencoded/.test(request.headers['content-type']) && /\+/.test(request.body) ) {
                                 request.body = request.body.replace(/\+/g, ' ');
                             }
                             if ( request.body.substring(0,1) == '?' )

package/framework/{v0.3.11 → v0.3.12}/package.json

@@ -1,8 +1,8 @@
 {
   "name": "gina-framework",
-  "version": "0.3.11-alpha.2",
+  "version": "0.3.12",
   "dependencies": {
-    "@rhinostone/swig": "^2.0.1",
+    "@rhinostone/swig": "^2.2.0",
     "intl-messageformat": "^11.2.4",
     "psl": "^1.15.0"
   }

package/gna.js

@@ -15,14 +15,14 @@
 'use strict';
 
 // Framework core — the main gna module (lifecycle hooks, lib, etc.)
-var _gna = require('./framework/v0.3.11/core/gna');
+var _gna = require('./framework/v0.3.12/core/gna');
 
 // SuperController and EntitySuper — loaded from their source modules
-var SuperController = require('./framework/v0.3.11/core/controller');
-var EntitySuper     = require('./framework/v0.3.11/core/model/entity');
+var SuperController = require('./framework/v0.3.12/core/controller');
+var EntitySuper     = require('./framework/v0.3.12/core/model/entity');
 
 // uuid — from the lib registry
-var uuid = require('./framework/v0.3.11/lib/uuid');
+var uuid = require('./framework/v0.3.12/lib/uuid');
 
 module.exports = {
 

package/llms.txt

@@ -51,7 +51,7 @@ framework/v${version}/
 
 ### Swig — `@rhinostone/swig` (npm dependency)
 
-Maintained fork of the abandoned swig 1.4.2 template engine. Published to npm as `@rhinostone/swig@2.0.1` (npm org: `rhinostone`, maintainer: `beemaster`). Repo: `https://github.com/gina-io/swig`. Declared in `framework/v*/package.json` — installed via `npm install` inside the framework directory. Requires `npm install` after clone, merge, or worktree switch (the framework `node_modules/` is gitignored).
+Maintained fork of the abandoned swig 1.4.2 template engine. Published to npm as `@rhinostone/swig@2.2.0` (npm org: `rhinostone`, maintainer: `beemaster`). Repo: `https://github.com/gina-io/swig`. Declared in `framework/v*/package.json` — installed via `npm install` inside the framework directory. Requires `npm install` after clone, merge, or worktree switch (the framework `node_modules/` is gitignored).
 
 Previously vendored at `core/deps/swig-1.4.2/` — removed in the migration to the npm dep. CVE-2023-25345 parse-time blocklist (`__proto__`/`constructor`/`prototype`) is patched in the fork's `parser.js` and `tags/set.js`. The path traversal boundary check in `controller.render-swig.js` is Gina's own code and is unaffected by this migration.
 
@@ -824,3 +824,5 @@ Dev-mode query instrumentation captures every database query tied to the current
 
 95. **MongoDB connector — `mongodb` (official driver) wrapper + JSON `pipelines/` files + TTL-index session store** — Document store connector targeting `mongodb >=7.0.0` (current GA). The pre-existing `lib/connector-registry/src/main.js:68` entry pinned an abandoned `>=5.0.0` from the #CN9 placeholder; #CN6 bumped to `>=7.0.0` (latest mongodb is `7.1.1` released March 2026 — three majors past `5.0.0`). Same `npm view <pkg> version` discipline as #CN5's stale-pin trap (#94). **JSON pipeline files at `models/<db>/pipelines/<Entity>/*.json`** describe one Mongo operation each (op + filter / pipeline / doc / etc.) with optional leading JSDoc header carrying `@param {<bson-type>}` and `@return` annotations. Argument placeholders use `{"$arg": N}` (positional, EJSON-like); ObjectId literals use `{"$oid": "<hex>"}`; the literal string `"$scope"` is substituted at load time with the bundle's data isolation scope (`substituteScope` tree-walk in `pipeline-loader.js`). Supported ops: `findOne | find | aggregate | countDocuments | insertOne | insertMany | updateOne | updateMany | replaceOne | deleteOne | deleteMany`. **`castParam`** handles BSON shapes: `objectid` (wraps via `new ObjectId(value)`), `int/int32`, `long/int64` (preserves bigint), `double/number` (parses comma decimal), `boolean` (`/^true$/i`), `string/text`, `date/timestamp`. `Decimal128` and `Binary` deferred to a follow-up. **Session store** auto-creates `createIndex({expiresAt: 1}, {expireAfterSeconds: 0, name: 'sessionsExpiresTTL'})` on first `set()` with `_ttlReady` one-shot guard plus `_ttlPromise` dedupe for concurrent first calls. `IndexOptionsConflict` warn-and-continue (operator intent wins). Document shape `{_id: sid, sess: <JSON string>, expiresAt: Date}`. `get()`, `length()`, and `all()` filter `{expiresAt: {$gt: new Date()}}` to protect against MongoDB's TTL monitor 60-second interval — substantive divergence from ScyllaDB where CQL `USING TTL` reaps server-side and "expired" rows literally don't exist (same intent: return active sessions only, different mechanism). Self-contained — builds its own `MongoClient` (does NOT reuse the `MongodbConnector` entity manager), matching every other gina session store (scylladb / sqlite / redis / couchbase). Promise → callback safety mirrors §13.6 / #CB-BUG-4: every write method calls `fn(null)` explicitly inside `.then()`, never `.then(fn)` directly. Established 2026-05-09 (#CN6).
 
+96. **Layout cache concurrent-render ENOENT race — atomic temp+rename closes the gap window between `rmSync` and the post-priming read.** `controller.render-swig.js` primes a per-template layout cache file at `<cachePath>/<bundle>/swig/<subFolder>/layout.html` from the `{% extends "..." %}` directive, then reads it back ~340 sync-code lines below to inline assets. In dev mode (`_cacheIsEnabled !== 'true'`) the priming block USED to delete-then-rewrite (`fs.rmSync(newLayoutFilename)` followed by `await fs.promises.writeFile(newLayoutFilename, buffer)`), which opened a gap window: a concurrent render of the same URL could `rmSync` the file AFTER the first render's `writeFile` completed but BEFORE its later `readFile` syscall opened the file, leaving the first render with `Error: ENOENT: no such file or directory, open '<cache>/<bundle>/swig/.../layout.html'`. Symptom shape: intermittent 500s on parallel POST/GET bursts to the same URL in dev mode (production unaffected — cached mode skips the rmSync entirely). **Fix** — collapse `rmSync + writeFile(target)` into `writeFile(temp) + rename(temp → target)` at BOTH cache-write sites (the priming block AT THE TOP and the post-asset-injection rewrite ~640 lines below). POSIX `rename(2)` is atomic on the same filesystem, so concurrent readers always observe either the prior content or the new content, never an absent file. Per-process unique temp names (`<target>.tmp.<pid>.<Date.now()>.<random>`) avoid TOCTOU on the temp itself. The CVE-2023-25345 `{% extends %}` path-traversal boundary check at the priming block is preserved verbatim. **Reproduction** — a tight in-process Promise.all(50) misses the race because all attempts march in lockstep through awaits; the natural staggering needed for the race to fire comes from the pre-block request-lifecycle awaits in a real HTTP server (routing/middleware/controller setup). A unit-level harness can amplify the race by adding `for (k=0; k<5; k++) await Promise.resolve()` BEFORE the racy block plus a ~10ms sync CPU sink between writeFile and readFile and 0-50ms setTimeout stagger across attempts — that recipe surfaced 205/1000 ENOENT failures pre-fix, 0/1000 post-fix. **Test surface** — `test/core/render-swig.test.js` § 11: four source pins (rmSync removed, writeFile+rename pair at both cache-write sites, temp name embeds pid/time/random) + CVE-2023-25345 preservation pin + a behavior test that exercises 200 concurrent atomic writes and asserts 0 ENOENT. Generalises to any "delete then rewrite a shared file under concurrent renders" pattern — atomic temp+rename is the canonical resolution wherever the read window can outlive the rewrite cycle. Established 2026-05-11.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gina",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "Node.js MVC framework with built-in HTTP/2, multi-bundle architecture, and scope-based data isolation — no Express dependency",
   "keywords": [
     "nodejs",
@@ -56,7 +56,7 @@
     "gina-container": "bin/gina-container",
     "gina-init": "bin/gina-init"
   },
-  "main": "./framework/v0.3.11/core/gna",
+  "main": "./framework/v0.3.12/core/gna",
   "types": "./types/index.d.ts",
   "typesVersions": {
     "*": {

package/framework/v0.3.11/VERSION

@@ -1 +0,0 @@
-0.3.11