tina4-python 3.10.21__tar.gz → 3.10.23__tar.gz

{tina4_python-3.10.21 → tina4_python-3.10.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.10.21
+Version: 3.10.23
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.10.21 → tina4_python-3.10.23}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.10.21"
+version = "3.10.23"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.10.21 → tina4_python-3.10.23}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.10.21"
+__version__ = "3.10.23"
 
 # ── HTTP Constants ──
 from tina4_python.core.constants import (  # noqa: E402, F401

{tina4_python-3.10.21 → tina4_python-3.10.23}/tina4_python/frond/engine.py

@@ -9,6 +9,7 @@ import re
 import html
 import hashlib
 import json
+import secrets
 from functools import lru_cache
 from pathlib import Path
 from datetime import datetime
@@ -940,8 +941,8 @@ def _wordwrap(text: str, width: int) -> str:
 # ── Form Token ─────────────────────────────────────────────────
 
 
-def _form_token(descriptor: str = "", session_id: str = "") -> str:
-    """Generate a JWT form token and return a hidden input element.
+def _generate_form_jwt(descriptor: str = "", session_id: str = "") -> str:
+    """Generate a JWT form token string.
 
     Args:
         descriptor: Optional string to enrich the token payload.
@@ -949,13 +950,11 @@ def _form_token(descriptor: str = "", session_id: str = "") -> str:
             - ``"admin_panel"``: payload is ``{"type": "form", "context": "admin_panel"}``
             - ``"checkout|order_123"``: payload is ``{"type": "form", "context": "checkout", "ref": "order_123"}``
         session_id: Optional session ID to bind the token to a specific session.
-            When provided, the CSRF middleware will verify the token belongs to
-            the same session. If empty, checks ``_form_token_session_id`` global.
 
     Returns:
-        ``<input type="hidden" name="formToken" value="TOKEN">``
+        The raw JWT string.
     """
-    payload = {"type": "form"}
+    payload = {"type": "form", "nonce": secrets.token_hex(8)}
     if descriptor:
         descriptor = str(descriptor)
         if "|" in descriptor:
@@ -973,10 +972,32 @@ def _form_token(descriptor: str = "", session_id: str = "") -> str:
     secret = os.environ.get("SECRET", "tina4-default-secret")
     ttl = int(os.environ.get("TINA4_TOKEN_EXPIRES_IN", "60"))
     auth = _FrondAuth(secret=secret, expires_in=ttl)
-    token = auth.get_token(payload)
+    return auth.get_token(payload)
+
+
+def _form_token(descriptor: str = "", session_id: str = "") -> str:
+    """Generate a JWT form token and return a hidden input element.
+
+    Usage in templates: ``{{ form_token() }}`` or ``{{ "context" | form_token }}``
+
+    Returns:
+        ``<input type="hidden" name="formToken" value="TOKEN">``
+    """
+    token = _generate_form_jwt(descriptor, session_id)
     return SafeString(f'<input type="hidden" name="formToken" value="{token}">')
 
 
+def _form_token_value(descriptor: str = "", session_id: str = "") -> str:
+    """Generate a JWT form token and return just the raw token string.
+
+    Usage in templates: ``{{ formTokenValue("Sleek") }}``
+
+    Returns:
+        The raw JWT string (no HTML wrapper).
+    """
+    return SafeString(_generate_form_jwt(descriptor, session_id))
+
+
 # Module-level session ID holder — set by the server before rendering templates
 # so that form_token() can bind tokens to the current session.
 _form_token_session_id: str = ""
@@ -1015,6 +1036,8 @@ class Frond:
 
         # Built-in global functions
         self._globals["form_token"] = _form_token
+        self._globals["formTokenValue"] = _form_token_value
+        self._globals["form_token_value"] = _form_token_value
 
     def sandbox(self, allowed_filters: list[str] = None,
                 allowed_tags: list[str] = None,