gina 0.6.3 → 0.6.4

package/framework/{v0.6.3 → v0.6.4}/core/config.js

@@ -1568,6 +1568,8 @@ function Config(opt, contextResetNeeded) {
                 + ( self.userConf ? 'the file declares no `'+ bundle +'.'+ env +'` block' : 'file NOT FOUND' )
                 + ') — every bundle must be declared there for the env it starts in; refusing to start';
             console.error(_envBlockMsg);
+            // Guarantee the reason survives process.exit() on an async pipe (e.g. bin/gina-container).
+            try { fs.writeSync(2, _envBlockMsg + '\n'); } catch (_e) { /* best-effort */ }
             return callback(new Error(_envBlockMsg));
         }
 
@@ -2953,12 +2955,28 @@ function Config(opt, contextResetNeeded) {
 
         // ${secret:KEY} placeholder substitution. Walks the merged config
         // for this bundle in place, replacing every string value that
-        // matches `^\${secret:KEY\}$` with the value resolved by the env
-        // backend. Runs once per bundle inside the config-load cycle;
-        // downstream reads (getConfig, getInstance) see the resolved
+        // matches `^\${secret:KEY\}$` with the value resolved by the
+        // selected backend. Runs once per bundle inside the config-load
+        // cycle; downstream reads (getConfig, getInstance) see the resolved
         // values. Fail-closed: backend throws on unset/empty values.
+        //
+        // The backend is the env-only default unless the bundle declares
+        // `settings.secrets.file`, in which case files are layered UNDER the
+        // environment (see lib/secrets/backends/file.js for why that way
+        // round). Selection is its own step so that an invalid `secrets`
+        // block reports as a config error rather than as a missing secret.
+        var secretsBackend;
+        try {
+            secretsBackend = secrets.selectBackend(self.envConf[bundle][env]);
+        } catch (backendErr) {
+            console.debug(
+                '[CONFIG][loadBundleConfig] Invalid `settings.secrets` in `'
+                + bundle +'/'+ env +':'+ scope +'`: '+ backendErr.message
+            );
+            return callback(backendErr);
+        }
         try {
-            secrets.resolve(self.envConf[bundle][env]);
+            secrets.resolve(self.envConf[bundle][env], secretsBackend);
         } catch (secretErr) {
             // #B42 — name the failing secret + config path at debug level so
             // operators can locate it. The user-facing message intentionally

package/framework/{v0.6.3 → v0.6.4}/core/controller/controller.js

@@ -21,6 +21,57 @@ const { Resolver } = require('node:dns').promises;
 
 var lib             = require('./../../lib') || require.cache[require.resolve('./../../lib')];
 
+/**
+ * #A11Y3 — BCP-47 language tag for a framework-generated document.
+ *
+ * Mirror of the helper in `core/server.js`; kept local because the fallback error
+ * paths in both engines must stay self-contained. The negotiated culture is stored
+ * underscore-separated (`en_CM`) and a raw `accept-language` value can still carry
+ * its q-value (`fr;q=0.9`) — neither is a valid `lang` attribute, and a tag AT
+ * cannot parse makes it select the wrong voice.
+ *
+ * @param {object} [req] - request whose negotiated `culture` should be used
+ * @returns {string} a BCP-47-shaped language tag, never empty
+ *
+ * @example
+ * a11yLangTag({ culture: 'en_CM' }); // 'en-CM'
+ * a11yLangTag(null);                 // 'en'
+ *
+ * @inner
+ */
+var a11yLangTag = function(req) {
+    var culture = ( req && typeof(req.culture) == 'string' && req.culture )
+        ? req.culture
+        : ( getEnvVar('GINA_CULTURE') || '' );
+    culture = String(culture).split(',')[0].split(';')[0].trim().replace(/_/g, '-');
+    return /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/.test(culture) ? culture : 'en';
+};
+
+/**
+ * #A11Y3 — wraps the inline fallback error body in a conforming HTML document.
+ *
+ * The body was previously sent as a bare `<h1>` + `<pre>` fragment with a
+ * `text/html` content type: no doctype (quirks mode), no `<head>`, no `<title>`
+ * (WCAG 2.4.2), no `lang` (WCAG 3.1.1) and no landmark. The caller's markup is
+ * embedded verbatim, so the status and incident ref that the error-pages guide
+ * promises the fallback shows are preserved unchanged.
+ *
+ * @param {number|string} code - HTTP status code, used for the document title
+ * @param {string} bodyHtml - the already-built `msgString` markup
+ * @param {object} [req] - request, for language negotiation
+ * @returns {string} a complete, conforming HTML document
+ *
+ * @example
+ * a11yErrorDocument(500, '<h1 class="status">Error 500.</h1>', req);
+ *
+ * @inner
+ */
+var a11yErrorDocument = function(code, bodyHtml, req) {
+    return '<!doctype html><html lang="'+ a11yLangTag(req) +'">'
+        + '<head><title>Error '+ code +'</title></head>'
+        + '<body><main>'+ bodyHtml +'</main></body></html>';
+};
+
 // #B3 — persist resolver and cache across dev-mode cache-busts.
 // controller.js is re-required on every request when isCacheless (dev mode), which would
 // create a new Resolver and Cache instance each time, silently abandoning in-flight DNS
@@ -1034,7 +1085,12 @@ function SuperController(options) {
                 now: new Date().format("isoDateTime")
             }
             set('page.view.locale', options.conf.locale);
-            set('page.view.lang', userCulture);
+            // #A11Y3 — `userCulture` is underscore-form (`en_CM`) and, when it came from a
+            // raw `accept-language`, can still carry a q-value (`fr;q=0.9`). Neither is a
+            // valid BCP-47 `lang` attribute. Only the value that reaches the document is
+            // normalised — the locale lookup above deliberately keeps the raw form, whose
+            // resolution behaviour is out of scope here.
+            set('page.view.lang', a11yLangTag({ culture: userCulture }));
         }
 
 
@@ -7026,7 +7082,11 @@ if ( /^local$/i.test(process.env.NODE_SCOPE) ) {
                 //     res.end(msgString);
                 // } else {
                 //if ( isHtmlContent && !hasCustomErrorFile ) {
-                    res.end(msgString);
+                    // #A11Y3 — wrap the fragment in a conforming document. The wrap is
+                    // deliberately here, after the msgString construction block above, so
+                    // the body markup (status + incident ref + the local-scope-gated stack)
+                    // is unchanged and its characterization tests keep mirroring it.
+                    res.end(a11yErrorDocument(code, msgString, req));
                 //}
                 // Release per-request refs — HTML error path (no custom error file). (#M1)
                 local.req  = null;

package/framework/{v0.6.3 → v0.6.4}/core/controller/controller.render-nunjucks.js

@@ -1232,9 +1232,17 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
         // reads the file directly at line 347 and compiles its contents.
         var _absErrTemplate = localOptions.file;
         var _errStatusCode  = (data && data.page && data.page.data && data.page.data.status) || 500;
+        // #A11Y3 — the three fallbacks below already carry a doctype and a title but no
+        // `lang` (WCAG 3.1.1). Reuse the negotiated, already-normalised value the render
+        // data carries, and fall back to `en` rather than emit an unparseable tag.
+        var _errLang = ( data && data.page && data.page.view
+                         && typeof(data.page.view.lang) == 'string'
+                         && /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/.test(data.page.view.lang) )
+            ? data.page.view.lang
+            : 'en';
 
         if (!_absErrTemplate || !fs.existsSync(_absErrTemplate)) {
-            html = '<!doctype html><html><head><title>Error ' + _errStatusCode + '</title></head>'
+            html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _errStatusCode + '</title></head>'
                  + '<body><pre>[render-nunjucks] error template not found: '
                  + (_absErrTemplate || '(unset)') + '</pre></body></html>';
         } else {
@@ -1242,7 +1250,7 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
             try {
                 _errSource = fs.readFileSync(_absErrTemplate, 'utf8');
             } catch (readErr) {
-                html = '<!doctype html><html><head><title>Error ' + _errStatusCode + '</title></head>'
+                html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _errStatusCode + '</title></head>'
                      + '<body><pre>[render-nunjucks] failed to read error template: '
                      + (readErr.message || readErr) + '</pre></body></html>';
             }
@@ -1250,7 +1258,7 @@ module.exports = async function renderNunjucks(userData, displayInspector, errOp
                 try {
                     html = env.renderString(_errSource, data);
                 } catch (renderErr) {
-                    html = '<!doctype html><html><head><title>Error ' + _errStatusCode + '</title></head>'
+                    html = '<!doctype html><html lang="' + _errLang + '"><head><title>Error ' + _errStatusCode + '</title></head>'
                          + '<body><pre>[render-nunjucks] error template render failed: '
                          + (renderErr.message || renderErr) + '</pre></body></html>';
                 }

package/framework/{v0.6.3 → v0.6.4}/core/controller/controller.render-swig.js

@@ -1266,7 +1266,21 @@ module.exports = async function render(userData, displayInspector, errOptions, d
 
         // iframe case - without HTML TAG
         if (!self.isXMLRequest() && _layoutLower.indexOf('<html') < 0 ) {
-            layout = '<html>\n\t<head></head>\n\t<body class="gina-iframe-body">\n\t\t'+ layout +'\n\t</body>\n</html>';
+            // #A11Y3 — the synthesised wrapper carried no doctype (so the document rendered
+            // in quirks mode) and no `lang` (WCAG 3.1.1). Deliberately NOT added here:
+            //   - `<title>`: no title value is in scope at this point, and inventing one is
+            //     worse than omitting it;
+            //   - a landmark: this wraps arbitrary partial content that may already carry
+            //     its own `<main>`, and two landmarks are worse than none.
+            // The `</body>` below is load-bearing beyond markup validity — release-banner's
+            // maybeInject() splices the dev banner on /<\/body>/i, so dropping it would
+            // silently stop the banner injecting with no test to catch it.
+            var _iframeLang = ( data && data.page && data.page.view
+                                && typeof(data.page.view.lang) == 'string'
+                                && /^[A-Za-z]{2,3}(-[A-Za-z0-9]{2,8})*$/.test(data.page.view.lang) )
+                ? data.page.view.lang
+                : 'en';
+            layout = '<!doctype html>\n<html lang="'+ _iframeLang +'">\n\t<head></head>\n\t<body class="gina-iframe-body">\n\t\t'+ layout +'\n\t</body>\n</html>';
         }
 
         // adding stylesheets

package/framework/{v0.6.3 → v0.6.4}/core/gna.js

@@ -304,7 +304,39 @@ try {
 
 // Ensure gina.home is always registered (SQLite connector, session store)
 if ( !getPath('gina').home && typeof(getEnvVar) != 'undefined' ) {
-    setPath('gina.home', getEnvVar('GINA_HOMEDIR'));
+    // #B277 — `getEnvVar` reads `process.gina`, which the CLI populates when it
+    // starts a bundle; it deliberately does NOT consult `process.env`. Outside a
+    // bundle it therefore yields nothing, and `setPath` then failed with the path
+    // registry's generic empty-value error — a message naming an internal call
+    // rather than the boundary that was hit. That old text is deliberately NOT
+    // reproduced verbatim here: a consumer grepping to confirm it is gone would
+    // otherwise match this comment and conclude the fix had not landed. It is
+    // quoted where quoting it helps a reader recognise the symptom instead — the
+    // changelog entry and the llms.txt record.
+    //
+    // Failing HERE is correct and is not what changed: this is the first point at
+    // which a boot without bundle context is detectable. `GINA_HOMEDIR` is read a
+    // few lines below as a bare global, so letting an empty value through only
+    // defers the failure into a `ReferenceError: GINA_HOMEDIR is not defined`,
+    // which is strictly less legible. This is also the sole registration site for
+    // `gina.home` (the SQLite connector and the session store both read it), so
+    // skipping the call would leave it unregistered. Message only — the boot still
+    // throws at exactly the same point, for exactly the same reason.
+    var _ginaHome = getEnvVar('GINA_HOMEDIR');
+    if ( !_ginaHome ) {
+        throw new Error(
+            'gina must be required from within a bundle context. The framework '
+            + 'bootstrap could not resolve GINA_HOMEDIR, which the CLI sets on '
+            + '`process.gina` when it starts a bundle (`process.env` is not '
+            + 'consulted). Requiring gina from a plain node process — a test '
+            + 'runner, a one-off script, a codegen pass — is not supported. To '
+            + 'exercise controller code without booting a bundle, use '
+            + 'SuperController.createTestInstance() from '
+            + '`gina/framework/<version>/core/controller`; see the Testing guide '
+            + 'at https://gina.io/docs/guides/testing.'
+        );
+    }
+    setPath('gina.home', _ginaHome);
 }
 
 if ( typeof(getEnvVar) == 'undefined') {