tina4-python 3.13.136__tar.gz → 3.13.137__tar.gz

{tina4_python-3.13.136 → tina4_python-3.13.137}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tina4-python
-Version: 3.13.136
+Version: 3.13.137
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.136 → tina4_python-3.13.137}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.136"
+version = "3.13.137"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}
@@ -41,9 +41,12 @@ s3 = ["boto3>=1.34"]
 kafka = ["confluent-kafka>=2.0"]
 rabbitmq = ["pika>=1.3"]
 
-# Web Push is zero-dependency until selected. The standard library has no
-# P-256 ECDH or ES256 primitives, so the native cryptography capability is
-# installed explicitly when a project enables Web Push.
+# Web Push is zero-dependency on the server: the crypto runs through the OS
+# OpenSSL (libcrypto) by ctypes, so a Linux host needs nothing installed. This
+# extra is the DEV FALLBACK - on a stock Mac or a Windows workstation ctypes
+# cannot reach a safe OpenSSL, so the cryptography package runs instead. Install
+# it there (or pin it with TINA4_PUSH_BACKEND=cryptography); the wire output is
+# identical either way. See tina4_python/push/_libcrypto.py.
 push = ["cryptography>=42.0"]
 
 # All database drivers

{tina4_python-3.13.136 → tina4_python-3.13.137}/tina4_python/__init__.py

@@ -51,7 +51,7 @@ def _resolve_version() -> str:
     #
     # test_version_constant.py now asserts this literal equals the pyproject
     # version, so the release bump cannot leave it behind again.
-    return "3.13.136"
+    return "3.13.137"
 
 
 __version__ = _resolve_version()

{tina4_python-3.13.136 → tina4_python-3.13.137}/tina4_python/ai/client.py

@@ -98,7 +98,7 @@ class Ai:
     Explicit call options beat environment values, which beat defaults.
     """
 
-    _PROVIDERS = {"local", "openai", "anthropic"}
+    _PROVIDERS = {"local", "openai", "anthropic", "gemini"}
 
     @staticmethod
     def chat(
@@ -369,15 +369,19 @@ class Ai:
     def _config(capability: str, *, model: str | None, timeout: float | None, provider: str | None) -> _Config:
         selected = (provider or os.environ.get("TINA4_AI_PROVIDER") or "local").strip().lower()
         if selected not in Ai._PROVIDERS:
-            raise AiConfigError("TINA4_AI_PROVIDER must be local, openai, or anthropic")
+            raise AiConfigError("TINA4_AI_PROVIDER must be local, openai, anthropic, or gemini")
         key = os.environ.get("TINA4_AI_KEY") or None
-        if selected in {"openai", "anthropic"} and not key:
+        if selected in {"openai", "anthropic", "gemini"} and not key:
             raise AiConfigError(f"TINA4_AI_KEY is required for the {selected} provider")
 
         defaults = {
             "local": ("http://localhost:11437", "llama3.2"),
             "openai": ("https://api.openai.com/v1", "gpt-4o-mini"),
             "anthropic": ("https://api.anthropic.com/v1", "claude-3-5-haiku-latest"),
+            # Gemini speaks the OpenAI wire format at its OpenAI-compatible base, so it
+            # rides the openai body/parse/stream path - only the base URL, the endpoint
+            # suffix append, and the Bearer key differ.
+            "gemini": ("https://generativelanguage.googleapis.com/v1beta/openai", "gemini-2.5-flash"),
         }
         base, default_model = defaults[selected]
         if capability == "embed" and os.environ.get("TINA4_EMBED_URL"):
@@ -408,8 +412,12 @@ class Ai:
             suffix = "/embeddings"
         else:
             suffix = "/chat/completions"
-        if path in {"", "/v1", "/api"}:
-            prefix = path or ("/v1" if provider in {"local", "openai"} else "/v1")
+        # "/v1beta/openai" is Gemini's OpenAI-compatible base; append the suffix onto
+        # it exactly as onto a bare host or "/v1", so the default gemini base resolves
+        # to .../v1beta/openai/chat/completions (or /embeddings). A full endpoint URL
+        # the caller supplies verbatim still passes through untouched.
+        if path in {"", "/v1", "/api", "/v1beta/openai"}:
+            prefix = path or "/v1"
             path = prefix + suffix
             parsed = parsed._replace(path=path)
             return parsed.geturl()
@@ -418,7 +426,7 @@ class Ai:
     @staticmethod
     def _headers(config: _Config) -> dict[str, str]:
         headers = {"content-type": "application/json", "accept": "application/json"}
-        if config.provider == "openai" and config.key:
+        if config.provider in {"openai", "gemini"} and config.key:
             headers["authorization"] = f"Bearer {config.key}"
         elif config.provider == "anthropic" and config.key:
             headers["x-api-key"] = config.key

{tina4_python-3.13.136 → tina4_python-3.13.137}/tina4_python/core/server.py

@@ -2588,7 +2588,11 @@ def _stage_dev_toolbar_inject(ctx: DispatchContext) -> None:
     Best-effort: a toolbar that fails to render must never break the response
     it was decorating, so the whole thing is guarded.
     """
-    if not ctx.is_dev or not ctx.response.content_type:
+    if (
+        not ctx.is_dev 
+        or not ctx.response.content_type 
+        or ctx.response.status_code == 204
+    ):
         return None
     if "text/html" not in ctx.response.content_type:
         return None

{tina4_python-3.13.136 → tina4_python-3.13.137}/tina4_python/migration/runner.py

@@ -156,7 +156,13 @@ def _build_stem_map(migration_folder: str | None) -> list[str]:
 def _resolve_migration_name(description: str, stems: list[str]) -> str:
     """Find the file stem that corresponds to a v2 description, or fall back.
 
-    Match strategy, in order:
+    Python v2 recorded `description` straight from os.listdir, so the value
+    normally carries the file extension (".sql"/".py") while a stem never does.
+    Match on the extension-stripped form as well, or a whole v2 history looks
+    unapplied and replays — see tests/test_issue_115_v2_upgrade.py.
+
+    Match strategy, in order (each tried against the description and against
+    its extension-stripped form):
       1. Exact stem match.
       2. A stem ending in "_" + description (e.g. "000001_create_users"
          resolves a v2 description of "create_users").
@@ -165,14 +171,22 @@ def _resolve_migration_name(description: str, stems: list[str]) -> str:
          getAppliedMigrations() but migrate() may re-run if a real file
          exists with a different name.
     """
-    if description in stems:
-        return description
-    for stem in stems:
-        if stem.endswith("_" + description):
-            return stem
-    for stem in stems:
-        if description in stem:
-            return stem
+    candidates = [description]
+    bare = re.sub(r"\.(sql|py)$", "", description, flags=re.IGNORECASE)
+    if bare != description:
+        candidates.append(bare)
+
+    for candidate in candidates:
+        if candidate in stems:
+            return candidate
+    for candidate in candidates:
+        for stem in stems:
+            if stem.endswith("_" + candidate):
+                return stem
+    for candidate in candidates:
+        for stem in stems:
+            if candidate in stem:
+                return stem
     return description
 
 

{tina4_python-3.13.136 → tina4_python-3.13.137}/tina4_python/push/__init__.py

@@ -1,8 +1,13 @@
 """Provider-neutral Web Push delivery (RFC 8291 / RFC 8292).
 
-The framework remains zero-dependency. Install the optional capability with
-``pip install tina4-python[push]``; ``cryptography`` is imported only when a
-push sender is constructed or used.
+The framework stays zero-dependency on the server. The crypto runs through the OS
+OpenSSL (``libcrypto``) by ctypes - the same "use the platform crypto" model the
+PHP, Ruby and Node frameworks get from their stdlib - so a Linux host sends push
+with nothing installed. Where ctypes cannot reach a safe OpenSSL (a stock Mac, a
+Windows workstation), it falls back to the optional ``cryptography`` package
+(``pip install tina4-python[push]``). Both backends emit identical bytes, so the
+wire output is the same whichever runs. Set ``TINA4_PUSH_BACKEND`` to ``libcrypto``
+or ``cryptography`` to pin one; ``auto`` (default) prefers libcrypto.
 """
 from __future__ import annotations
 
@@ -19,6 +24,8 @@ import urllib.request
 from dataclasses import dataclass
 from typing import Any
 
+from ._base import BackendUnavailable
+
 RECORD_SIZE = 4096
 MAX_PAYLOAD = RECORD_SIZE - 17
 
@@ -50,15 +57,45 @@ def _unb64(value: str, name: str) -> bytes:
     return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))
 
 
-def _crypto() -> tuple[Any, ...]:
-    try:
-        from cryptography.hazmat.primitives import hashes, serialization
-        from cryptography.hazmat.primitives.asymmetric import ec
-        from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-        from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
-    except ImportError as exc:
-        raise PushError("Web Push requires the optional crypto capability; install tina4-python[push]") from exc
-    return hashes, serialization, ec, Cipher, algorithms, modes, decode_dss_signature
+_BACKEND = None
+
+
+def _select_backend():
+    """Pick the crypto backend: OS libcrypto first, cryptography as fallback.
+
+    ``TINA4_PUSH_BACKEND`` forces ``auto`` (default), ``libcrypto`` or
+    ``cryptography``. The choice is cached for the process; ``_reset_backend``
+    drops the cache so a later call re-selects after the environment changes.
+    """
+    global _BACKEND
+    if _BACKEND is not None:
+        return _BACKEND
+    choice = os.getenv("TINA4_PUSH_BACKEND", "auto").strip().lower() or "auto"
+    order = {"auto": ("libcrypto", "cryptography"),
+             "libcrypto": ("libcrypto",),
+             "cryptography": ("cryptography",)}.get(choice)
+    if order is None:
+        raise PushError("TINA4_PUSH_BACKEND must be auto, libcrypto or cryptography")
+    reasons = []
+    for name in order:
+        if name == "libcrypto":
+            from . import _libcrypto as backend_module
+        else:
+            from . import _cryptography as backend_module
+        try:
+            _BACKEND = backend_module.load()
+            return _BACKEND
+        except BackendUnavailable as exc:
+            reasons.append(f"{name} ({exc})")
+    raise PushError(
+        "Web Push needs the OS OpenSSL (Linux/Unix) or the cryptography package "
+        "(install tina4-python[push]); unavailable here: " + ", ".join(reasons))
+
+
+def _reset_backend() -> None:
+    """Drop the cached backend so the next call re-selects."""
+    global _BACKEND
+    _BACKEND = None
 
 
 def _hmac(key: bytes, value: bytes) -> bytes:
@@ -78,15 +115,8 @@ def _hkdf(prk: bytes, info: bytes, length: int) -> bytes:
     return b"".join(chunks)[:length]
 
 
-def _public_bytes(public_key: Any, serialization: Any) -> bytes:
-    return public_key.public_bytes(serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint)
-
-
 def generate_vapid_keys() -> dict[str, str]:
-    _hashes, serialization, ec, *_ = _crypto()
-    private = ec.generate_private_key(ec.SECP256R1())
-    public = _public_bytes(private.public_key(), serialization)
-    raw_private = private.private_numbers().private_value.to_bytes(32, "big")
+    raw_private, public = _select_backend().generate_keypair()
     return {"publicKey": _b64(public), "privateKey": _b64(raw_private)}
 
 
@@ -104,7 +134,7 @@ def _payload_bytes(payload: Any) -> bytes:
 def _encrypt(payload: bytes, subscription: dict[str, Any]) -> bytes:
     if len(payload) > MAX_PAYLOAD:
         raise PushError(f"Push payload is too large; maximum is {MAX_PAYLOAD} bytes")
-    _hashes, serialization, ec, Cipher, algorithms, modes, _decode = _crypto()
+    backend = _select_backend()
     try:
         client_public_bytes = _unb64(subscription["keys"]["p256dh"], "subscription.keys.p256dh")
         auth_secret = _unb64(subscription["keys"]["auth"], "subscription.keys.auth")
@@ -115,32 +145,27 @@ def _encrypt(payload: bytes, subscription: dict[str, Any]) -> bytes:
     if len(auth_secret) != 16:
         raise PushError("subscription.keys.auth must be a 16-byte authentication secret")
 
-    client_public = ec.EllipticCurvePublicKey.from_encoded_point(ec.SECP256R1(), client_public_bytes)
-    ephemeral = ec.generate_private_key(ec.SECP256R1())
-    server_public_bytes = _public_bytes(ephemeral.public_key(), serialization)
-    shared = ephemeral.exchange(ec.ECDH(), client_public)
+    try:
+        server_public_bytes, shared = backend.encrypt_ecdh(client_public_bytes)
+    except ValueError as exc:
+        raise PushError("subscription.keys.p256dh is not a valid P-256 public key") from exc
     key_info = b"WebPush: info\0" + client_public_bytes + server_public_bytes
     ikm = _hkdf(_hmac(auth_secret, shared), key_info, 32)
     salt = os.urandom(16)
     prk = _hmac(salt, ikm)
     cek = _hkdf(prk, b"Content-Encoding: aes128gcm\0", 16)
     nonce = _hkdf(prk, b"Content-Encoding: nonce\0", 12)
-    encryptor = Cipher(algorithms.AES(cek), modes.GCM(nonce)).encryptor()
-    ciphertext = encryptor.update(payload + b"\x02") + encryptor.finalize() + encryptor.tag
+    ciphertext = backend.aes128gcm_encrypt(cek, nonce, payload + b"\x02")
     return salt + RECORD_SIZE.to_bytes(4, "big") + bytes([len(server_public_bytes)]) + server_public_bytes + ciphertext
 
 
 def _vapid_token(endpoint: str, subject: str, raw_private: bytes, raw_public: bytes) -> str:
-    _hashes, serialization, ec, _Cipher, _algorithms, _modes, decode_dss_signature = _crypto()
     audience = urllib.parse.urlparse(endpoint)
     aud = f"{audience.scheme}://{audience.netloc}"
     header = _b64(json.dumps({"typ": "JWT", "alg": "ES256"}, separators=(",", ":")).encode())
     claims = _b64(json.dumps({"aud": aud, "exp": int(time.time()) + 12 * 60 * 60, "sub": subject}, separators=(",", ":")).encode())
     signing_input = f"{header}.{claims}".encode("ascii")
-    private = ec.derive_private_key(int.from_bytes(raw_private, "big"), ec.SECP256R1())
-    der = private.sign(signing_input, ec.ECDSA(_hashes.SHA256()))
-    r, s = decode_dss_signature(der)
-    signature = r.to_bytes(32, "big") + s.to_bytes(32, "big")
+    signature = _select_backend().sign_es256(raw_private, signing_input)
     return signing_input.decode("ascii") + "." + _b64(signature)
 
 
@@ -196,12 +221,11 @@ class Push:
             raise PushError("TINA4_VAPID_PUBLIC must be a 65-byte P-256 public key")
         if len(raw_private) != 32:
             raise PushError("TINA4_VAPID_PRIVATE must be a 32-byte P-256 private key")
-        _hashes, serialization, ec, *_ = _crypto()
         try:
-            derived = ec.derive_private_key(int.from_bytes(raw_private, "big"), ec.SECP256R1())
+            derived_public = _select_backend().public_from_private(raw_private)
         except ValueError as exc:
             raise PushError("TINA4_VAPID_PRIVATE is not a valid P-256 private key") from exc
-        if _public_bytes(derived.public_key(), serialization) != raw_public:
+        if derived_public != raw_public:
             raise PushError("TINA4_VAPID_PUBLIC does not match TINA4_VAPID_PRIVATE")
         return raw_public, raw_private
 

tina4_python-3.13.137/tina4_python/push/_base.py

@@ -0,0 +1,38 @@
+"""The Web Push crypto backend contract.
+
+A backend supplies the five primitives RFC 8291 / RFC 8292 need that CPython's
+stdlib cannot: P-256 keygen, ECDH, AES-128-GCM, the public point of a stored
+scalar, and an ES256 signature. Everything else (HKDF, HMAC, the record framing,
+the JWT assembly) is pure stdlib and lives in ``__init__``, written once and
+shared by both backends.
+
+Two backends implement this contract: ``_libcrypto`` (ctypes -> the OS OpenSSL,
+zero packages, the server path) and ``_cryptography`` (the pyca package, the
+Mac/Windows dev fallback). Both return the SAME bytes, so the wire output stays
+identical to the PHP, Ruby and Node frameworks whichever one runs.
+
+Each method raises ``ValueError`` on malformed key material. A backend that
+cannot run on this host raises ``BackendUnavailable`` from its ``load()`` so the
+selector can fall through to the next one.
+
+Contract (all keys are raw bytes, points are 65-byte uncompressed ``0x04`` form):
+
+    generate_keypair() -> (raw_private32, public65)
+        A fresh random P-256 keypair.
+    public_from_private(raw_private32) -> public65
+        The public point for a stored scalar (used to validate a VAPID pair).
+    encrypt_ecdh(peer_public65) -> (server_public65, shared32)
+        Generate an ephemeral keypair, ECDH against the subscriber's key, and
+        hand back both the ephemeral public point and the shared secret. The
+        ephemeral private key never leaves the backend.
+    aes128gcm_encrypt(key16, iv12, plaintext) -> ciphertext_with_tag
+        AES-128-GCM; the 16-byte tag is appended to the ciphertext.
+    sign_es256(raw_private32, message) -> signature64
+        ECDSA P-256 / SHA-256 over ``message``, as raw r||s (each left-padded
+        to 32 bytes).
+"""
+from __future__ import annotations
+
+
+class BackendUnavailable(RuntimeError):
+    """Raised by a backend's ``load()`` when it cannot run on this host."""

tina4_python-3.13.137/tina4_python/push/_cryptography.py

@@ -0,0 +1,66 @@
+"""Web Push crypto through the pyca ``cryptography`` package.
+
+The dev fallback. When ctypes cannot reach a safe OS OpenSSL - a stock Mac, a
+Windows workstation, a musl image without OpenSSL - this backend runs instead,
+provided the optional package is installed (``pip install tina4-python[push]``).
+It produces the same bytes as the libcrypto backend, so the wire output does not
+change with the host.
+
+``load()`` raises ``BackendUnavailable`` when the package is absent, so the
+selector can report both misses in one clear error.
+"""
+from __future__ import annotations
+
+from ._base import BackendUnavailable
+
+
+class CryptographyBackend:
+    """RFC 8291 / RFC 8292 primitives over the pyca cryptography package."""
+
+    name = "cryptography"
+
+    def __init__(self, module_bundle):
+        (self._ec, self._AESGCM, self._Encoding, self._PublicFormat,
+         self._hashes, self._decode_dss) = module_bundle
+
+    def _public_bytes(self, public_key) -> bytes:
+        return public_key.public_bytes(self._Encoding.X962, self._PublicFormat.UncompressedPoint)
+
+    def generate_keypair(self):
+        priv = self._ec.generate_private_key(self._ec.SECP256R1())
+        pub = self._public_bytes(priv.public_key())
+        raw = priv.private_numbers().private_value.to_bytes(32, "big")
+        return raw, pub
+
+    def public_from_private(self, raw_private: bytes) -> bytes:
+        priv = self._ec.derive_private_key(int.from_bytes(raw_private, "big"), self._ec.SECP256R1())
+        return self._public_bytes(priv.public_key())
+
+    def encrypt_ecdh(self, peer_public: bytes):
+        peer = self._ec.EllipticCurvePublicKey.from_encoded_point(self._ec.SECP256R1(), peer_public)
+        ephemeral = self._ec.generate_private_key(self._ec.SECP256R1())
+        server_pub = self._public_bytes(ephemeral.public_key())
+        shared = ephemeral.exchange(self._ec.ECDH(), peer)
+        return server_pub, shared
+
+    def aes128gcm_encrypt(self, key: bytes, iv: bytes, plaintext: bytes) -> bytes:
+        return self._AESGCM(key).encrypt(iv, plaintext, None)
+
+    def sign_es256(self, raw_private: bytes, message: bytes) -> bytes:
+        priv = self._ec.derive_private_key(int.from_bytes(raw_private, "big"), self._ec.SECP256R1())
+        der = priv.sign(message, self._ec.ECDSA(self._hashes.SHA256()))
+        r, s = self._decode_dss(der)
+        return r.to_bytes(32, "big") + s.to_bytes(32, "big")
+
+
+def load() -> CryptographyBackend:
+    """Return the cryptography backend, or raise BackendUnavailable if absent."""
+    try:
+        from cryptography.hazmat.primitives import hashes
+        from cryptography.hazmat.primitives.asymmetric import ec
+        from cryptography.hazmat.primitives.asymmetric.utils import decode_dss_signature
+        from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+        from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+    except ImportError as exc:
+        raise BackendUnavailable("the cryptography package is not installed") from exc
+    return CryptographyBackend((ec, AESGCM, Encoding, PublicFormat, hashes, decode_dss_signature))