gina 0.7.1 → 0.7.2

package/framework/{v0.7.1 → v0.7.2}/core/connectors/sqlite/lib/session-store.js

@@ -72,16 +72,28 @@ module.exports = function(session, bundle) {
      *
      * @constructor
      * @param {object}  [options]                   - Instance-level overrides.
-     * @param {string}  [options.database]           - Path to the SQLite file, or `':memory:'`
-     *                                                 for a volatile in-process store.
-     *                                                 Defaults to connectors.json `database`, then
-     *                                                 `~/.gina/{version}/sessions-{bundle}.db`.
+     * @param {string}  [options.file]               - Path to the SQLite file, or `':memory:'`
+     *                                                 for a volatile in-process store (#D47).
+     * @param {string}  [options.database]           - The same, read when `options.file` is unset
+     *                                                 (kept so existing code keeps working).
+     *                                                 With neither option, the path is connectors.json
+     *                                                 `file`, then `database`, then
+     *                                                 `<gina home>/sessions-{bundle}.db` (`~/.gina` by default).
+     *                                                 Put a path in connectors.json `file`, not `database`:
+     *                                                 the model layer reads `database` as a NAME, so a
+     *                                                 path there stops the boot.
      * @param {string}  [options.prefix]             - Session key prefix (default: `'sess:'`).
      * @param {number}  [options.ttl]                - Session TTL in seconds (default: connectors.json ttl;
      *                                                 unset → cookie maxAge drives expiry, else 86400).
      *                                                 Must be > 0 when set — non-positive refuses (#B207).
      * @param {number}  [options.cleanupInterval]    - Expired-session purge interval in seconds.
      *                                                 Set to 0 to disable. (default: 900).
+     *
+     * @example
+     * // src/<bundle>/config/connectors.json
+     * // { "session": { "connector": "sqlite", "file": "/var/lib/myapp/sessions.db", "ttl": 86400 } }
+     * var SqliteStore = new lib.SessionStore(session); // resolves the "session" entry
+     * app.use(session({ secret: process.env.SESSION_SECRET, store: new SqliteStore() }));
      */
     function SqliteStore(options) {
         var self = this;
@@ -107,9 +119,15 @@ module.exports = function(session, bundle) {
         this.ttl             = (options.ttl             != null) ? options.ttl             : (connConf.ttl             || null);
         this.cleanupInterval = (options.cleanupInterval != null) ? options.cleanupInterval : (connConf.cleanupInterval || 900);
 
-        // Resolve DB path: option > connectors.json > default per-bundle file
+        // Resolve the DB path (#D47): an instance option, then connectors.json,
+        // then the per-bundle default — `file` before `database` at each level.
+        // The model layer opens a SQLite connector for every connectors.json entry
+        // at boot and reads `database` as a NAME under the gina home, so only
+        // `file` can carry a path both readers accept (the SQLite job and kv
+        // stores read `file` for the same reason).
         var defaultDbPath = _(getPath('gina').home + '/sessions-' + bundle + '.db', true);
-        var dbPath = options.database || connConf.database || defaultDbPath;
+        // was: var dbPath = options.database || connConf.database || defaultDbPath;
+        var dbPath = options.file || options.database || connConf.file || connConf.database || defaultDbPath;
 
         // Resolve the SQLite driver through the shared seam — node:sqlite on
         // Node (built-in since 22.5.0, zero npm deps), bun:sqlite behind an

package/framework/{v0.7.1 → v0.7.2}/core/controller/controller.js

@@ -1737,9 +1737,22 @@ function SuperController(options) {
     }
 
     /**
-     * Set resources
+     * Set resources — builds the page's `<link>` / `<script>` tag strings from
+     * the view configuration and stores them as `page.view.stylesheets` /
+     * `page.view.scripts`, the per-request values the layout's placeholders
+     * render.
+     *
+     * #P48 — also decides whether this render emits content-versioned asset
+     * URLs: yes, unless the view configuration sets `assetVersioningEnabled`
+     * to `false`, the render is layoutless (render-swig concatenates those tags
+     * into the template it compiles and caches, where a token could outlive
+     * the file it names), or the bundle runs cacheless (dev, where statics are
+     * served `no-store`).
      *
-     * @param {object} template - template configuration
+     * @inner
+     * @private
+     * @param {object} viewConf - The resolved template configuration (`stylesheets` / `javascripts`)
+     * @returns {void}
      * */
     var setResources = function(viewConf) {
         if (!viewConf) {
@@ -1764,12 +1777,20 @@ function SuperController(options) {
         var cssStr      = ''
             , jsStr     = ''
         ;
+        // #P48 — content-versioned URLs (see the JSDoc); a missing key is ON.
+        // The layoutless test reads local.options, as computeH2PreloadPrefix()
+        // does, so a 103 hint and the tag it announces always agree.
+        var _versioned = (
+            viewConf.assetVersioningEnabled !== false
+            && !( local.options && local.options.isWithoutLayout )
+            && !self.isCacheless()
+        ) ? true : false;
         //Get css
         if( viewConf.stylesheets ) {
             // cssStr  = getNodeRes('css', viewConf.stylesheets, useWebroot, reURL);
             // Fixed on 2025-03-08: ordered by route, making sure that _common could all be loaded first
             var cssColl = new Collection(viewConf.stylesheets).orderBy({route: 'asc'})
-            cssStr   = getNodeRes('css', cssColl, useWebroot, _webroot);
+            cssStr   = getNodeRes('css', cssColl, useWebroot, _webroot, _versioned);
             cssColl = null;
         }
         //Get js
@@ -1777,7 +1798,7 @@ function SuperController(options) {
             // jsStr   = getNodeRes('js', viewConf.javascripts, useWebroot, reURL);
             // Fixed on 2025-03-08: ordered by route, making sure that _common could all be loaded first
             var jsColl = new Collection(viewConf.javascripts).orderBy({route: 'asc'})
-            jsStr   = getNodeRes('js', jsColl, useWebroot, _webroot);
+            jsStr   = getNodeRes('js', jsColl, useWebroot, _webroot, _versioned);
             jsColl = null;
         }
 
@@ -1800,16 +1821,28 @@ function SuperController(options) {
      * suppressed (the hint carries no integrity metadata, so a hinted fetch
      * could not be matched to the integrity-checked consumer).
      *
+     * #P48 — when `isVersioned` (decided by `setResources()`), every same-origin
+     * URL is emitted with `?v=<10 hex of the file's sha384>` (lib/sri, fail-open)
+     * for the tag and its preload hint alike, except a js `isExternalPlugin`
+     * tag, which render-swig splices into the layout it compiles; gina's own
+     * script tag also carries `data-gina-routing-v`, the token of the routing
+     * table variant this request is served.
+     *
      * @param {string} type - `'css'` or `'js'`
      * @param {array} resArr
      * @param {boolean} useWebroot
      * @param {string} webrootStr - Webroot string prefix for startsWith check (#P1)
+     * @param {boolean} [isVersioned=false] - Emit content-versioned URLs (#P48)
      *
      * @returns {string} tag string to inject into the layout
      *
+     * @example
+     * // css, versioning on: '\n\t\t<link href="/css/app.css?v=6a0bf42b46" rel="stylesheet" type="text/css">'
+     * getNodeRes('css', [{ url: '/css/app.css', rel: 'stylesheet', type: 'text/css' }], false, '/', true);
+     *
      * @private
      * */
-    var getNodeRes = function(type, resArr, useWebroot, webrootStr) {
+    var getNodeRes = function(type, resArr, useWebroot, webrootStr, isVersioned) {
 
         var r               = 0
             , rLen          = resArr.length
@@ -1848,6 +1881,22 @@ function SuperController(options) {
         // integrity attribute and loads exactly as before.
         var sriEnabled = (local.options.template.sriEnabled) ? true : false;
 
+        // #P48 — the routing table's token for THIS request's variant (the
+        // host-stripped map when proxied), rendered on gina's own script tag so
+        // the client fetches a year-cacheable URL. Only a 10-hex value is ever
+        // emitted; the handlers compare it with the variant they serve.
+        var routingVersion = null;
+        if (
+            isVersioned
+            && self.serverInstance
+            && self.serverInstance._routingVersion
+        ) {
+            routingVersion = self.serverInstance._routingVersion[ ( isProxyHost === true ) ? 'stripped' : 'full' ];
+            if ( !/^[0-9a-f]{10}$/.test(routingVersion || '') ) {
+                routingVersion = null;
+            }
+        }
+
 
         if (
             isProxyHost
@@ -1874,6 +1923,13 @@ function SuperController(options) {
                     if (useWebroot && !obj.url.startsWith(webrootStr) ) {
                         obj.url = local.options.conf.server.webroot + obj.url.substring(1);
                     }
+                    // #P48 — from here on the tag, its preload hint and its SRI
+                    // lookup (which ignores the query) use the versioned URL.
+                    // `obj` is a copy (the Collection setResources builds clones
+                    // its input), never the template conf.
+                    if ( isVersioned ) {
+                        obj.url = lib.sri.getVersionedUrl(obj.url, local.options.conf, local.options.conf.server.webroot);
+                    }
                     // #OW3 — SRI attribute pair for same-origin disk-resolvable
                     // assets when the bundle opted in; '' otherwise (fail-open).
                     var sriAttributes = (sriEnabled) ? lib.sri.getIntegrityAttributes(obj.url, local.options.conf, local.options.conf.server.webroot) : '';
@@ -1911,6 +1967,15 @@ function SuperController(options) {
                     if (useWebroot && !obj.url.startsWith(webrootStr) ) {
                         obj.url = local.options.conf.server.webroot + obj.url.substring(1);
                     }
+                    // #P48 — as in the css case, except an `isExternalPlugin`
+                    // tag: render-swig splices those into the layout it compiles
+                    // (and persists with the render cache on), so a token there
+                    // could outlive the file it names. `_plainUrl` keeps the
+                    // unversioned URL for the checks below.
+                    var _plainUrl = obj.url;
+                    if ( isVersioned && !obj.isExternalPlugin ) {
+                        obj.url = lib.sri.getVersionedUrl(obj.url, local.options.conf, local.options.conf.server.webroot);
+                    }
                     // #OW3 — SRI attribute pair for same-origin disk-resolvable
                     // assets when the bundle opted in; '' otherwise (fail-open).
                     var sriAttributes = (sriEnabled) ? lib.sri.getIntegrityAttributes(obj.url, local.options.conf, local.options.conf.server.webroot) : '';
@@ -1933,7 +1998,7 @@ function SuperController(options) {
                     // }
 
 
-                    if ( /\/jquery\.(.*)\.(min\.js|js)$/i.test(obj.url) ) {
+                    if ( /\/jquery\.(.*)\.(min\.js|js)$/i.test(_plainUrl) ) {
                         console.warn('jQuery Plugin found in templates.json !\nIf you want to load it before [gina.min.js], you should declare it at the top of your handler using requireJS or add property "isExternalPlugin: true" in your templates.json, under: '+ (obj.route || local.req.routing.rule) +' .');
                     }
                     // Allow jQuery & other external plugins to be loaded in the HEAD section before gina
@@ -1943,8 +2008,9 @@ function SuperController(options) {
                         local.options.template.externalPlugins.splice(1, 0, '\n\t\t<script'+ deferMode +' type="'+ obj.type +'" src="'+ obj.url +'"'+ sriAttributes +'></script>');
                     }
                     else {
-                        // normal case
-                        str += '\n\t\t<script'+ deferMode +' type="'+ obj.type +'" src="'+ obj.url +'"'+ sriAttributes +'></script>';
+                        // normal case — gina's own tag also carries the routing
+                        // table's token for this request (#P48, read by core.js)
+                        str += '\n\t\t<script'+ deferMode +' type="'+ obj.type +'" src="'+ obj.url +'"'+ ( ( routingVersion && obj.name == 'gina' ) ? ' data-gina-routing-v="'+ routingVersion +'"' : '' ) + sriAttributes +'></script>';
                     }
                 }
                 break;
@@ -1978,7 +2044,9 @@ function SuperController(options) {
      *
      * Mirrors `getNodeRes()`: same `Collection.orderBy({route:'asc'})` ordering,
      * same webroot rewrite, same #OW3 rule that an SRI'd asset gets no preload
-     * hint (the hint carries no integrity metadata).
+     * hint (the hint carries no integrity metadata), and the same #P48 versioned
+     * URL under the same rule as `setResources()` — a hint must name the exact
+     * URL its tag fetches, or the browser fetches the asset twice.
      *
      * @param {object} viewConf - The resolved template config (`stylesheets` / `javascripts`)
      * @returns {string} `'<url>; as=style; rel=preload,'`-joined prefix, `''` when nothing qualifies
@@ -1997,6 +2065,14 @@ function SuperController(options) {
         var _webroot    = local.options.conf.server.webroot;
         var useWebroot  = ( _webroot !== '/' && _webroot.length > 0 ) ? true : false;
         var sriEnabled  = ( local.options.template && local.options.template.sriEnabled ) ? true : false;
+        // #P48 — setResources()' rule, read off the same objects, so each hint
+        // names the exact URL its tag will fetch
+        var isVersioned = (
+            local.options.template
+            && local.options.template.assetVersioningEnabled !== false
+            && !local.options.isWithoutLayout
+            && !self.isCacheless()
+        ) ? true : false;
         var links       = '';
 
         var appendAll = function(as, resArr) {
@@ -2016,6 +2092,11 @@ function SuperController(options) {
                 if ( sriEnabled && lib.sri.getIntegrityAttributes(url, local.options.conf, _webroot) ) {
                     continue;
                 }
+                // #P48 — the versioned URL, except for a js external plugin,
+                // whose tag stays unversioned (see getNodeRes)
+                if ( isVersioned && !( as == 'script' && obj.isExternalPlugin ) ) {
+                    url = lib.sri.getVersionedUrl(url, local.options.conf, _webroot);
+                }
                 links += '<'+ url +'>; as='+ as +'; rel=preload,';
             }
             coll = null;

package/framework/{v0.7.1 → v0.7.2}/core/controller/controller.render-nunjucks.js

@@ -560,9 +560,11 @@ function injectInspectorScripts(html, data, self, local, displayInspector) {
  * render callback completed, in which case `stream.respond()` throws
  * `ERR_HTTP2_INVALID_STREAM`.
  *
- * `res.headersSent = true` is set after a successful `stream.respond()`
- * to signal to the HTTP/1.1 compat layer that the response was sent
- * directly, matching render-swig's §7b pattern.
+ * No `headersSent` flag is set after the raw send (#B750): on the HTTP/2
+ * compat response `headersSent` is a getter-only accessor that reads the
+ * stream's state, so it already reports the send, and assigning it threw a
+ * TypeError in this strict-mode file. (render-swig's §7b assignment is a
+ * silent no-op only because that file is not in strict mode.)
  *
  * @inner
  * @param {object} local  - Per-request closure
@@ -613,7 +615,11 @@ function sendHtmlResponse(local, html, req, res) {
             } else {
                 __ginaSend1();
             }
-            res.headersSent = true;
+            // #B750 — `headersSent` is a getter-only accessor on the HTTP/2 compat
+            // response and already reports the raw send. Assigning it threw a TypeError
+            // in this strict-mode file, logged as an unhandled promise rejection on
+            // every nunjucks render over HTTP/2.
+            // was: res.headersSent = true;
         } else {
             // Case 2: HEAD + HTTP/1.1
             res.setHeader('content-length', byteLength);
@@ -660,7 +666,8 @@ function sendHtmlResponse(local, html, req, res) {
         } else {
             __ginaSend2(html);
         }
-        res.headersSent = true;
+        // #B750 — as in the HEAD branch above.
+        // was: res.headersSent = true;
         return;
     }
 

package/framework/{v0.7.1 → v0.7.2}/core/controller/controller.render-xml.js

@@ -207,7 +207,11 @@ module.exports = function renderXML(xmlContent, contentType, deps) {
             } else {
                 __ginaSend2(data);
             }
-            response.headersSent = true;
+            // #B750 — `headersSent` is a getter-only accessor on the HTTP/2 compat
+            // response and already reports the raw send. Assigning it threw a TypeError
+            // in this strict-mode file, which the catch at the end of this function
+            // handed to throwError on a response already sent, skipping the cleanup below.
+            // was: response.headersSent = true;
             local.req = null;
             local.res = null;
             local.next = null;
@@ -219,7 +223,11 @@ module.exports = function renderXML(xmlContent, contentType, deps) {
             try {
                 response.setHeader('content-type', _contentType);
                 response.end(data);
-                response.headersSent = true;
+                // #B750 — the response's own `headersSent` getter already reports the
+                // send. Assigning it threw a TypeError in this strict-mode file; the
+                // catch below swallowed it, skipping this branch's return, so the code
+                // after the if could call next() on a response that had already ended.
+                // was: response.headersSent = true;
                 // Release per-request refs — response is a local copy, so the
                 // .end() above is unaffected.
                 local.req = null;

package/framework/{v0.7.1 → v0.7.2}/core/gna.js

@@ -1053,7 +1053,7 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
                         // #M6 — register core controller files and the bundle controllers
                         // directory. The router checks __hotReload dirty flags instead of
                         // evicting require.cache on every request.
-                        var _hotDirty = { core: false, action: false };
+                        var _hotDirty = { core: false, action: false, lane: false };
                         setContext('__hotReload', _hotDirty);
 
                         var _corePath = getPath('gina').core;
@@ -1065,6 +1065,20 @@ isBundleMounted(projects, bundlesPath, getContext('bundle'), function onBundleMo
 
                         _watcher.register('__hot_controllers__', conf.bundlePath + '/controllers');
                         _watcher.on('__hot_controllers__', function() { _hotDirty.action = true; });
+
+                        // #P49 — the fast lane's handler modules: lib/lane reloads them on
+                        // the next lane request once this flag is set. One watch per
+                        // directory holding a registered module (a directory watch does not
+                        // descend), none for a bundle without lane routes. Each directory is
+                        // also watched for `rename`, the event an editor's atomic save
+                        // delivers (#B642).
+                        var _laneDirs = lib.lane.watchDirs(conf.bundlePath + '/lanes');
+                        for (var _ld = 0; _ld < _laneDirs.length; ++_ld) {
+                            _watcher.register('__hot_lanes_'+ _ld +'__', _laneDirs[_ld]);
+                            _watcher.on('__hot_lanes_'+ _ld +'__', function() { _hotDirty.lane = true; });
+                            _watcher.register('__hot_lanes_'+ _ld +'_rename__', _laneDirs[_ld], { event: 'rename' });
+                            _watcher.on('__hot_lanes_'+ _ld +'_rename__', function() { _hotDirty.lane = true; });
+                        }
                     }
 
                     if (_hasUserWatchers) {