tina4-python 3.13.139__tar.gz → 3.13.140__tar.gz

{tina4_python-3.13.139 → tina4_python-3.13.140}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tina4-python
-Version: 3.13.139
+Version: 3.13.140
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License-Expression: MPL-2.0

{tina4_python-3.13.139 → tina4_python-3.13.140}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.139"
+version = "3.13.140"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.139 → tina4_python-3.13.140}/tina4_python/CLAUDE.md

@@ -1752,25 +1752,39 @@ uv run tina4python start 8080         # Start on custom port
 
 ### CRUD Generator
 
-Generate a complete CRUD interface (list, create, update, delete) for any database table with one call:
+Generate a complete REST CRUD interface (list, get, create, update, delete) for any ORM model.
+Flag the model with `auto_crud = True` and the routes register themselves at import time:
+
+```python
+from tina4_python.orm import ORM, IntegerField, StringField
+
+class User(ORM):
+    auto_crud = True                       # auto-registers CRUD routes for this model
+    id    = IntegerField(primary_key=True, auto_increment=True)
+    name  = StringField()
+    email = StringField()
+```
+
+Or register models explicitly (or discover a whole directory):
 
 ```python
 from tina4_python.crud import AutoCrud
+from src.orm.user import User
 
-@get("/admin/users")
-async def admin_users(request, response):
-    return response(CRUD.to_crud(request, {
-        "sql": "SELECT id, name, email FROM users",
-        "title": "User Management",
-        "primary_key": "id",
-    }))
+AutoCrud.register(User)                    # routes under /api/user
+AutoCrud.register(User, prefix="/api/v2")  # or a custom prefix
+AutoCrud.discover("src/orm", prefix="/api")  # every ORM model in a directory
 ```
 
-This auto-generates:
-- Searchable, paginated HTML table with Tina4 CSS
-- Create / Edit / Delete modals with form tokens
-- 4 RESTful API routes (GET list, POST create, POST update, DELETE)
-- Per-table Twig template in `src/templates/crud/` (customisable after generation)
+This auto-generates per model:
+- `GET /api/{table}` — paginated list (returns the `to_paginate()` envelope)
+- `GET /api/{table}/{id}` — one record by primary key
+- `POST /api/{table}` — create
+- `PUT /api/{table}/{id}` — update
+- `DELETE /api/{table}/{id}` — delete
+
+Write routes are secure by default (they require a valid token); pass `public=True`
+to `register` / `discover` to open them.
 
 ### ORM Table Creation
 
@@ -1799,7 +1813,7 @@ uv run tina4python migrate
 
 | Need | Use |
 |------|-----|
-| Quick admin UI for a table | `CRUD.to_crud()` |
+| Auto REST CRUD for a model | `auto_crud = True` / `AutoCrud.register()` |
 | Schema-first database design | Migration files |
 | Code-first database design | `ORM.create_table()` |
 | New project from scratch | `tina4python init` |

{tina4_python-3.13.139 → tina4_python-3.13.140}/tina4_python/__init__.py

@@ -57,7 +57,7 @@ def _resolve_version() -> str:
     #
     # test_version_constant.py now asserts this literal equals the pyproject
     # version, so the release bump cannot leave it behind again.
-    return "3.13.139"
+    return "3.13.140"
 
 
 __version__ = _resolve_version()

{tina4_python-3.13.139 → tina4_python-3.13.140}/tina4_python/cli/__init__.py

@@ -1970,7 +1970,12 @@ def _gen_crud(name: str, flags: dict):
     """
     fields = _fields_or_default(flags.get("fields", ""))
     table = _resolve_table(name, flags)
-    route_name = table + "s"  # routes are plural
+    # Routes are the SINGLE plural of the singular base — pluralise(snake(name)) —
+    # never `table + "s"`. When the table was pluralised to escape a SQL reserved
+    # word (Order -> table `orders`), `table + "s"` double-pluralised the route,
+    # file and template to `orderss`. Deriving from the singular base keeps one
+    # consistent rule: Order -> orders, Product -> products.
+    route_name = _pluralize_table(_to_snake(name))
 
     print(f"\n  Generating CRUD for {name}...\n")
 
@@ -3244,7 +3249,7 @@ def _gen_form(name: str, flags: dict = None):
     flags = flags or {}
     fields = _fields_or_default(flags.get("fields", ""))
     table = _resolve_table(name, flags)
-    route_name = table + "s"
+    route_name = _pluralize_table(_to_snake(name))  # single plural of the singular base (never table + "s")
 
     # Input type mapping
     input_types = {
@@ -3328,7 +3333,7 @@ def _gen_view(name: str, flags: dict = None):
     flags = flags or {}
     fields = _fields_or_default(flags.get("fields", ""))
     table = _resolve_table(name, flags)
-    route_name = table + "s"
+    route_name = _pluralize_table(_to_snake(name))  # single plural of the singular base (never table + "s")
 
     target = Path("src/templates/pages")
     target.mkdir(parents=True, exist_ok=True)

{tina4_python-3.13.139 → tina4_python-3.13.140}/tina4_python/database/connection.py

@@ -66,17 +66,36 @@ current_route: contextvars.ContextVar = contextvars.ContextVar("tina4_current_ro
 _warned_routes: set = set()
 
 
+def _running_event_loop():
+    """The event loop running on this thread, or ``None`` when there is none.
+
+    A supported replacement for the private ``asyncio._get_running_loop()``:
+    ``asyncio.get_running_loop()`` answers on a running loop and raises
+    ``RuntimeError`` off one (ADR-0074). It runs only after the TINA4_DEBUG
+    gate below, so its off-loop ``RuntimeError`` never fires on the hot sync
+    path in production.
+    """
+    try:
+        return asyncio.get_running_loop()
+    except RuntimeError:
+        return None
+
+
 def _warn_if_blocking_the_event_loop(operation: str) -> None:
     """Debug-mode warning: a sync DB call on a thread that is running an event
     loop freezes every other request on that loop until the statement returns.
 
-    Called only once a running loop is detected, so the check costs one C call
-    on every other thread (sync routes run in worker threads, and the async API
-    runs its statements on the pool's own workers - neither has a loop).
+    Gated on TINA4_DEBUG first, so production pays nothing; only then does it
+    look for a running loop. Callers invoke it unconditionally - the loop check
+    lives here, not at every call site, so the supported (raising)
+    ``asyncio.get_running_loop()`` never touches the hot sync path outside
+    debug mode (ADR-0074).
     """
     from tina4_python.dotenv import is_truthy
     if not is_truthy(os.environ.get("TINA4_DEBUG", "")):
         return
+    if _running_event_loop() is None:
+        return
     route = current_route.get() or "(no route - a coroutine outside a request)"
     if route in _warned_routes:
         return
@@ -430,11 +449,13 @@ class Database(DatabaseAsyncMixin):
             sqlite:////absolute/path.db    → /absolute/path.db  (absolute)
             sqlite:///C:/Users/app.db      → C:/Users/app.db  (Windows absolute)
 
-        Directories are auto-created ONLY when the resolved path is
-        inside the current working directory (the project root). We
-        never try to ``os.makedirs`` at root (``/data``, ``C:\\data``)
-        — that's both hostile on read-only filesystems and not what
-        any project actually wants.
+        Directories are auto-created (mode ``0775``, masked by the umask)
+        ONLY when the resolved parent stays inside the current working
+        directory (the project root). An absolute path is trusted and
+        never auto-created. A RELATIVE path whose parent resolves OUTSIDE
+        cwd (``../../etc/foo.db``) is REFUSED with a ``ValueError`` — Tina4
+        never ``os.makedirs`` outside the project, which is both hostile on
+        read-only filesystems and a latent footgun (ADR-0086).
         """
         parsed = urlparse(self.url)
 
@@ -500,10 +521,25 @@ class Database(DatabaseAsyncMixin):
             # Relative — resolve under the project root (cwd).
             cwd = os.getcwd()
             path = os.path.join(cwd, stripped)
-            # Only auto-create subdirectories *inside* cwd.
+            # Create the parent, but ONLY when it stays inside cwd (ADR-0086).
+            # A relative path whose parent resolves OUTSIDE cwd (e.g.
+            # "../../etc/foo.db") is REFUSED loudly here — never a silent mkdir
+            # outside the project (the PHP/Ruby footgun) and never a path that
+            # only fails cryptically when the driver opens it (the old Python
+            # silent-skip). Absolute paths are trusted and never reach this
+            # branch. The created directory is mode 0775 (masked by the umask),
+            # matching every framework.
             directory = os.path.dirname(path)
-            if directory and os.path.commonpath([os.path.abspath(directory), cwd]) == cwd:
-                os.makedirs(directory, exist_ok=True)
+            if directory:
+                if os.path.commonpath([os.path.abspath(directory), cwd]) != cwd:
+                    raise ValueError(
+                        f"SQLite path {self.url!r} resolves outside the project "
+                        f"directory: {os.path.abspath(directory)!r} is not within "
+                        f"{cwd!r}. Tina4 refuses to create directories outside the "
+                        f"project (ADR-0086). Use an absolute path for a database "
+                        f"that lives outside the project."
+                    )
+                os.makedirs(directory, mode=0o775, exist_ok=True)
 
         return path
 
@@ -663,8 +699,7 @@ class Database(DatabaseAsyncMixin):
         in this context, so nested facade calls land on the same connection;
         ``_release`` returns it.
         """
-        if asyncio._get_running_loop() is not None:
-            _warn_if_blocking_the_event_loop(operation)
+        _warn_if_blocking_the_event_loop(operation)
         borrow = self._borrowed.get()
         if borrow is not None:
             return borrow.adapter, None
@@ -675,8 +710,7 @@ class Database(DatabaseAsyncMixin):
         """``_acquire`` for a single adapter call that never calls back into this
         facade (fetch, fetch_one, execute, insert, delete): nothing nested can
         need the pin, so skip recording it. ``token`` is the adapter to return."""
-        if asyncio._get_running_loop() is not None:
-            _warn_if_blocking_the_event_loop(operation)
+        _warn_if_blocking_the_event_loop(operation)
         borrow = self._borrowed.get()
         if borrow is not None:
             return borrow.adapter, None
@@ -705,8 +739,7 @@ class Database(DatabaseAsyncMixin):
         commit()/rollback() - the write is uncommitted, so the connection that
         holds it must be the one the commit lands on."""
         if self._manual_commit and self._borrowed.get() is None:
-            if asyncio._get_running_loop() is not None:
-                _warn_if_blocking_the_event_loop(operation)
+            _warn_if_blocking_the_event_loop(operation)
             adapter = self._pool.checkout()
             self._borrowed.set(_Borrow(adapter, sticky=True, pool=self._pool))
             return adapter, None
@@ -1172,8 +1205,7 @@ class Database(DatabaseAsyncMixin):
             borrow.depth += 1
             return
         if borrow is None:
-            if asyncio._get_running_loop() is not None:
-                _warn_if_blocking_the_event_loop("start_transaction")
+            _warn_if_blocking_the_event_loop("start_transaction")
             self._begin_on(self._pool.checkout())
             return
         # Inside an operation's (or a manual-commit write's) borrow: open the
@@ -1223,8 +1255,7 @@ class Database(DatabaseAsyncMixin):
             # Inner commit of an ignored nested begin — just unwind the depth.
             borrow.depth -= 1
             return
-        if asyncio._get_running_loop() is not None:
-            _warn_if_blocking_the_event_loop("commit")
+        _warn_if_blocking_the_event_loop("commit")
         try:
             borrow.adapter.commit()
             self.last_error = None
@@ -1250,8 +1281,7 @@ class Database(DatabaseAsyncMixin):
                 adapter.rollback()
             self.last_error = None
             return
-        if asyncio._get_running_loop() is not None:
-            _warn_if_blocking_the_event_loop("rollback")
+        _warn_if_blocking_the_event_loop("rollback")
         try:
             borrow.adapter.rollback()
             self.last_error = None

{tina4_python-3.13.139 → tina4_python-3.13.140}/tina4_python/database/pool.py

@@ -43,6 +43,14 @@ def resolve_pool_size(pool: int | None) -> int:
 
     ``0`` keeps its documented meaning, "a single connection" - it is now LENT
     exclusively like any other pool, so it serialises instead of being shared.
+
+    Backward-compatibility note (ADR-0074): an UNSET ``pool=`` used to mean one
+    shared connection; it now means TINA4_DB_POOL, else DEFAULT_POOL_SIZE (10).
+    This is a deliberate behavioural fix - the old shared connection let two
+    concurrent requests read and commit inside each other's transaction. Sync
+    callers keep working unchanged; the only visible difference is that an app
+    that never set ``pool=`` now opens up to ten connections instead of one. Pin
+    the old single-connection behaviour with ``pool=0`` or ``TINA4_DB_POOL=0``.
     """
     if pool is None:
         raw = os.environ.get("TINA4_DB_POOL", "").strip()