tina4-python 3.10.21__tar.gz → 3.10.24__tar.gz

{tina4_python-3.10.21 → tina4_python-3.10.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.10.21
+Version: 3.10.24
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.10.21 → tina4_python-3.10.24}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.10.21"
+version = "3.10.24"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.10.21 → tina4_python-3.10.24}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.10.21"
+__version__ = "3.10.24"
 
 # ── HTTP Constants ──
 from tina4_python.core.constants import (  # noqa: E402, F401

{tina4_python-3.10.21 → tina4_python-3.10.24}/tina4_python/frond/engine.py

@@ -9,6 +9,7 @@ import re
 import html
 import hashlib
 import json
+import secrets
 from functools import lru_cache
 from pathlib import Path
 from datetime import datetime
@@ -940,8 +941,8 @@ def _wordwrap(text: str, width: int) -> str:
 # ── Form Token ─────────────────────────────────────────────────
 
 
-def _form_token(descriptor: str = "", session_id: str = "") -> str:
-    """Generate a JWT form token and return a hidden input element.
+def _generate_form_jwt(descriptor: str = "", session_id: str = "") -> str:
+    """Generate a JWT form token string.
 
     Args:
         descriptor: Optional string to enrich the token payload.
@@ -949,13 +950,11 @@ def _form_token(descriptor: str = "", session_id: str = "") -> str:
             - ``"admin_panel"``: payload is ``{"type": "form", "context": "admin_panel"}``
             - ``"checkout|order_123"``: payload is ``{"type": "form", "context": "checkout", "ref": "order_123"}``
         session_id: Optional session ID to bind the token to a specific session.
-            When provided, the CSRF middleware will verify the token belongs to
-            the same session. If empty, checks ``_form_token_session_id`` global.
 
     Returns:
-        ``<input type="hidden" name="formToken" value="TOKEN">``
+        The raw JWT string.
     """
-    payload = {"type": "form"}
+    payload = {"type": "form", "nonce": secrets.token_hex(8)}
     if descriptor:
         descriptor = str(descriptor)
         if "|" in descriptor:
@@ -973,10 +972,32 @@ def _form_token(descriptor: str = "", session_id: str = "") -> str:
     secret = os.environ.get("SECRET", "tina4-default-secret")
     ttl = int(os.environ.get("TINA4_TOKEN_EXPIRES_IN", "60"))
     auth = _FrondAuth(secret=secret, expires_in=ttl)
-    token = auth.get_token(payload)
+    return auth.get_token(payload)
+
+
+def _form_token(descriptor: str = "", session_id: str = "") -> str:
+    """Generate a JWT form token and return a hidden input element.
+
+    Usage in templates: ``{{ form_token() }}`` or ``{{ "context" | form_token }}``
+
+    Returns:
+        ``<input type="hidden" name="formToken" value="TOKEN">``
+    """
+    token = _generate_form_jwt(descriptor, session_id)
     return SafeString(f'<input type="hidden" name="formToken" value="{token}">')
 
 
+def _form_token_value(descriptor: str = "", session_id: str = "") -> str:
+    """Generate a JWT form token and return just the raw token string.
+
+    Usage in templates: ``{{ formTokenValue("Sleek") }}``
+
+    Returns:
+        The raw JWT string (no HTML wrapper).
+    """
+    return SafeString(_generate_form_jwt(descriptor, session_id))
+
+
 # Module-level session ID holder — set by the server before rendering templates
 # so that form_token() can bind tokens to the current session.
 _form_token_session_id: str = ""
@@ -1015,6 +1036,8 @@ class Frond:
 
         # Built-in global functions
         self._globals["form_token"] = _form_token
+        self._globals["formTokenValue"] = _form_token_value
+        self._globals["form_token_value"] = _form_token_value
 
     def sandbox(self, allowed_filters: list[str] = None,
                 allowed_tags: list[str] = None,
@@ -1069,23 +1092,20 @@ class Frond:
             raise FileNotFoundError(f"Template not found: {path}")
 
         debug_mode = os.environ.get("TINA4_DEBUG", "").lower() == "true"
-        cached = self._compiled.get(template)
 
-        if cached is not None:
-            if debug_mode:
-                # Dev mode: check if file changed
-                mtime = path.stat().st_mtime
-                if cached[1] == mtime:
-                    return self._execute_cached(cached[0], context, template)
-            else:
-                # Production: skip mtime check, cache is permanent
+        if not debug_mode:
+            # Production: permanent cache, no filesystem checks
+            cached = self._compiled.get(template)
+            if cached is not None:
                 return self._execute_cached(cached[0], context, template)
 
-        # Cache miss — load, tokenize, cache
+        # Dev mode: skip cache entirely — always re-read and re-tokenize.
+        # mtime-based invalidation doesn't catch changes to included/extended
+        # templates (parent or partial changes don't update the caller's mtime).
         source = path.read_text(encoding="utf-8")
-        mtime = path.stat().st_mtime
         tokens = _tokenize(source)
-        self._compiled[template] = (tokens, mtime)
+        if not debug_mode:
+            self._compiled[template] = (tokens, 0)
         return self._execute_with_source(source, tokens, context, template)
 
     def render_string(self, source: str, data: dict = None) -> str: