tina4-python 3.13.2__tar.gz → 3.13.4__tar.gz

{tina4_python-3.13.2 → tina4_python-3.13.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.2
+Version: 3.13.4
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.2 → tina4_python-3.13.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.2"
+version = "3.13.4"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.2 → tina4_python-3.13.4}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.13.2"
+__version__ = "3.13.4"
 
 # ── Route decorators ──
 from tina4_python.core.router import (  # noqa: E402, F401
@@ -42,6 +42,9 @@ from tina4_python.orm import (  # noqa: E402, F401
     has_many, has_one, belongs_to,  # relationship descriptors
 )
 
+# ── Env (typed env-var helpers) ──
+from tina4_python.env import Env  # noqa: E402, F401
+
 # ── Auth ──
 from tina4_python.auth import Auth  # noqa: E402, F401
 

{tina4_python-3.13.2 → tina4_python-3.13.4}/tina4_python/core/request.py

@@ -15,6 +15,57 @@ class PayloadTooLarge(Exception):
     pass
 
 
+class CaseInsensitiveDict(dict):
+    """Dict subclass for HTTP headers — string keys are case-insensitive.
+
+    HTTP header field-names are case-insensitive per RFC 7230 §3.2.
+    With this class, ``request.headers["Content-Type"]``,
+    ``request.headers.get("content-type")``, and
+    ``request.headers.get("CONTENT-TYPE")`` all return the same value.
+
+    Keys are stored lowercase internally. Cross-framework parity:
+    same behaviour now ships in tina4-php (Tina4\\Request),
+    tina4-ruby (Tina4::Request), tina4-nodejs (Tina4Request) so the
+    chapter 10 documented examples (``headers.get("Content-Type")``)
+    finally do what they read like. tina4-book#141 PY-10-03.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__()
+        if args or kwargs:
+            self.update(dict(*args, **kwargs))
+
+    @staticmethod
+    def _norm(key):
+        return key.lower() if isinstance(key, str) else key
+
+    def __setitem__(self, key, value):
+        super().__setitem__(self._norm(key), value)
+
+    def __getitem__(self, key):
+        return super().__getitem__(self._norm(key))
+
+    def __contains__(self, key):
+        return super().__contains__(self._norm(key))
+
+    def __delitem__(self, key):
+        super().__delitem__(self._norm(key))
+
+    def get(self, key, default=None):
+        return super().get(self._norm(key), default)
+
+    def setdefault(self, key, default=None):
+        return super().setdefault(self._norm(key), default)
+
+    def pop(self, key, *args):
+        return super().pop(self._norm(key), *args)
+
+    def update(self, *args, **kwargs):
+        # Route through __setitem__ so every key gets normalised.
+        for k, v in dict(*args, **kwargs).items():
+            self[k] = v
+
+
 class Request:
     """Parsed HTTP request — everything a route handler needs."""
 
@@ -31,7 +82,7 @@ class Request:
         self.query_string: str = ""
         self.params: dict = {}          # Query string + route params merged
         self.query: dict = {}           # Query string params only (separate from route params)
-        self.headers: dict = {}         # Lowercase header keys
+        self.headers: dict = CaseInsensitiveDict()  # Case-insensitive HTTP headers
         self.body: dict | str | None = None  # Parsed body
         self.raw_body: bytes = b""
         self.cookies: dict = {}

{tina4_python-3.13.2 → tina4_python-3.13.4}/tina4_python/core/router.py

@@ -687,7 +687,14 @@ def secured():
 # ── Middleware Decorator ───────────────────────────────────────
 
 def middleware(*middleware_classes):
-    """Attach middleware classes to a route handler."""
+    """Attach middleware classes or functions to a route handler.
+
+    Middleware is purely additive — it does NOT change the route's auth
+    requirement. POST/PUT/PATCH/DELETE routes stay Bearer-token-gated by
+    default. Use ``@noauth()`` to open a write route, ``@secured()`` to
+    lock a read route. This rule is the same across all four Tina4
+    frameworks (tina4-book#141, PY-10-02).
+    """
     def decorator(fn):
         fn._middleware = list(middleware_classes)
         # If route was already registered (decorator applied after @get/@post),
@@ -695,11 +702,9 @@ def middleware(*middleware_classes):
         if hasattr(fn, "_route_ref"):
             existing = fn._route_ref._route.get("middleware", [])
             fn._route_ref._route["middleware"] = list(middleware_classes) + existing
-            # Custom middleware means developer handles auth — disable built-in
-            # gate unless @secured() was explicitly set.
-            route = fn._route_ref._route
-            if not hasattr(fn, "_secured") and route.get("auth_required"):
-                route["auth_required"] = False
+            # Intentionally does NOT touch route["auth_required"]. Prior
+            # behaviour silently flipped it to False, creating an undocumented
+            # auth bypass for any write route that added custom middleware.
         return fn
     return decorator
 

{tina4_python-3.13.2 → tina4_python-3.13.4}/tina4_python/core/server.py

@@ -1151,10 +1151,40 @@ def _check_auth(request: Request, response: Response, route: dict) -> bool:
     return False
 
 
+def _is_function_middleware(mw) -> bool:
+    """A function-style middleware is a non-class callable that takes 3+ args.
+
+    Class-based middleware uses ``before_*`` / ``after_*`` method-name
+    dispatch. Function-based middleware uses Express/FastAPI-style
+    ``async def mw(request, response, next_handler)`` with a continuation
+    callable that invokes the next layer (or the route handler).
+    Documented in chapter 10 for 8+ examples; before tina4-book#141
+    PY-10-01 the framework silently ignored the function bodies.
+    """
+    import inspect
+    if isinstance(mw, type):
+        return False  # Class — class-based before_*/after_* dispatch
+    if not callable(mw):
+        return False
+    try:
+        sig = inspect.signature(mw)
+        # The third (or later) parameter is the next_handler continuation.
+        return len(sig.parameters) >= 3
+    except (TypeError, ValueError):
+        return False
+
+
 def _run_before_middleware(request: Request, response: Response, route: dict) -> tuple[Request, Response, bool]:
-    """Run before_* middleware methods. Returns (request, response, skip_handler)."""
+    """Run class-based before_* middleware methods. Returns (request, response, skip_handler).
+
+    Function-style ``async def mw(req, resp, next_handler)`` middleware is
+    skipped here — it's handled by ``_invoke_handler_with_middleware``
+    which wraps the route handler with each function's continuation.
+    """
     skip = False
     for _mw_cls in route.get("middleware", []):
+        if _is_function_middleware(_mw_cls):
+            continue  # Handled by the continuation wrapper instead
         _mw_inst = _mw_cls() if isinstance(_mw_cls, type) else _mw_cls
         for _attr_name in dir(_mw_inst):
             if _attr_name.startswith("before_"):
@@ -1172,8 +1202,15 @@ def _run_before_middleware(request: Request, response: Response, route: dict) ->
 
 
 def _run_after_middleware(request: Request, response: Response, route: dict) -> tuple[Request, Response]:
-    """Run after_* middleware methods."""
+    """Run class-based after_* middleware methods.
+
+    Function-style middleware that wraps the handler (with next_handler)
+    handles its own "after" code on the return path — no separate pass
+    needed for it here.
+    """
     for _mw_cls in route.get("middleware", []):
+        if _is_function_middleware(_mw_cls):
+            continue
         _mw_inst = _mw_cls() if isinstance(_mw_cls, type) else _mw_cls
         for _attr_name in dir(_mw_inst):
             if _attr_name.startswith("after_"):
@@ -1185,6 +1222,53 @@ def _run_after_middleware(request: Request, response: Response, route: dict) ->
     return request, response
 
 
+def _make_mw_continuation(mw, inner_next):
+    """Build a `next_handler` continuation for a function-style middleware.
+
+    Captures `mw` and the next layer (`inner_next`) in a closure. When
+    invoked, calls `mw(req, resp, next_handler=inner_next)`. The
+    middleware is responsible for awaiting `inner_next(req, resp)` if it
+    wants the chain to continue — otherwise it short-circuits.
+    """
+    async def wrapper(req, resp):
+        return await mw(req, resp, inner_next)
+    return wrapper
+
+
+async def _invoke_handler_with_middleware(request: Request, response: Response, route: dict, params: dict) -> Response:
+    """Invoke the route handler, wrapping with any function-style middleware.
+
+    Function-style middleware (``async def mw(req, resp, next_handler)``)
+    forms a Russian-doll continuation chain — the first declared
+    middleware is the outermost layer; it calls ``next_handler`` to
+    descend, and the route handler is the innermost. Class-based
+    middleware is dispatched separately by ``_run_before_middleware`` /
+    ``_run_after_middleware`` and does not go through this wrapper.
+    """
+    fn_middlewares = [
+        mw for mw in route.get("middleware", [])
+        if _is_function_middleware(mw)
+    ]
+
+    if not fn_middlewares:
+        return await _invoke_handler(request, response, route, params)
+
+    # Build the chain from the inside out: innermost wraps the handler
+    # first, then each outer layer wraps that. The result is a callable
+    # `next_handler` that, when invoked, runs the whole chain.
+    async def call_route_handler(req, resp):
+        return await _invoke_handler(req, resp, route, params)
+
+    next_handler = call_route_handler
+    for mw in reversed(fn_middlewares):
+        next_handler = _make_mw_continuation(mw, next_handler)
+
+    result = await next_handler(request, response)
+    if isinstance(result, Response):
+        return result
+    return response
+
+
 async def _invoke_handler(request: Request, response: Response, route: dict, params: dict) -> Response:
     """Call the route handler with the correct arguments."""
     import inspect
@@ -1430,7 +1514,7 @@ async def handle(request: Request) -> Response:
             if not skip:
                 request, response, skip = _run_before_middleware(request, response, route)
             if not skip:
-                response = await _invoke_handler(request, response, route, params)
+                response = await _invoke_handler_with_middleware(request, response, route, params)
             request, response = _run_after_middleware(request, response, route)
         except Exception as e:
             response = _handle_route_error(e, request, response, request_id, _is_dev)

{tina4_python-3.13.2 → tina4_python-3.13.4}/tina4_python/debug/__init__.py

@@ -320,10 +320,57 @@ class Log:
         now = datetime.now(timezone.utc)
         return now.strftime("%Y-%m-%dT%H:%M:%S.") + f"{now.microsecond // 1000:03d}Z"
 
+    # Frame names that belong to Log itself — walk past them when looking
+    # for the real caller. Kept as a class attribute so subclasses can
+    # extend if they layer extra wrappers (and so tests can introspect).
+    _OWN_FRAMES = frozenset({
+        "_caller_name", "_format_line", "_format", "_log",
+        "debug", "info", "warning", "error", "critical",
+    })
+
+    @classmethod
+    def _caller_name(cls) -> str | None:
+        """Return the function name that called Log.{debug,info,warning,error}.
+
+        Active only when ``TINA4_LOG_FUNC=true`` — the lookup uses
+        ``inspect.currentframe()`` which is ~5% overhead per log call.
+        Walks past Log's own frames (``_OWN_FRAMES``) to land on the
+        real caller, so the count is robust whether the test calls
+        ``_format_line`` directly or goes through ``Log.info`` →
+        ``_log`` → ``_format_line``. Returns ``None`` if the stack is
+        too shallow (e.g. log called from module import) or if anything
+        goes wrong — never raises. Parity feature #41 across all four
+        Tina4 frameworks.
+        """
+        import os
+        if os.environ.get("TINA4_LOG_FUNC", "").strip().lower() not in (
+            "1", "true", "on", "yes", "y", "t"
+        ):
+            return None
+        try:
+            import inspect
+            frame = inspect.currentframe()
+            # Walk past Log's own frames. Cap the walk at 16 to defend
+            # against any pathological recursion / wrapper stack.
+            for _ in range(16):
+                if frame is None:
+                    return None
+                name = frame.f_code.co_name
+                if name not in cls._OWN_FRAMES:
+                    # Filter out anonymous / module-level callers — they're noise.
+                    if name in ("<module>", "<lambda>", "<genexpr>", "<listcomp>", "<setcomp>", "<dictcomp>"):
+                        return None
+                    return name
+                frame = frame.f_back
+            return None
+        except Exception:
+            return None
+
     @classmethod
     def _format_line(cls, level: str, message: str, **kwargs) -> str:
         timestamp = cls._timestamp()
         request_id = get_request_id()
+        caller = cls._caller_name()
 
         # JSON format wins whenever the explicit env opt-in is set,
         # regardless of production flag (so dev devs can ship JSON to
@@ -336,6 +383,8 @@ class Log:
             }
             if request_id:
                 entry["request_id"] = request_id
+            if caller:
+                entry["function"] = caller
             if kwargs:
                 entry["context"] = {k: v for k, v in kwargs.items()}
             return json.dumps(entry, default=str)
@@ -345,6 +394,8 @@ class Log:
         parts = [timestamp, f"[{level_str}]"]
         if request_id:
             parts.append(f"[{request_id}]")
+        if caller:
+            parts.append(f"[{caller}]")
         parts.append(message)
         if kwargs:
             parts.append(json.dumps(kwargs, default=str))

tina4_python-3.13.4/tina4_python/env.py

@@ -0,0 +1,111 @@
+# Tina4 Env — Typed environment-variable helpers.
+# Copyright 2007 - present Tina4
+# License: MIT
+"""Typed environment-variable helpers — zero-deps.
+
+Reading env vars by hand gets old fast: every boolean flag becomes a
+``os.getenv("TINA4_DEBUG", "false").lower() in ("1", "true", "on", "yes")``
+incantation. Every numeric tuning knob needs a try/except around int().
+Env centralises that. Same API across all four Tina4 frameworks
+(``Tina4\\Env`` in PHP, ``Tina4::Env`` in Ruby, ``Env`` in Node.js).
+
+    from tina4_python import Env
+
+    debug   = Env.bool("TINA4_DEBUG", default=False)
+    workers = Env.int("WORKERS", default=4)
+    rate    = Env.float("RATE_LIMIT", default=10.0)
+    region  = Env.str("AWS_REGION", default="us-east-1")
+
+Values are accepted case-insensitively after ``strip()``. Truthy:
+``1 / true / on / yes / y / t``. Falsy: ``0 / false / off / no / n / f``.
+Any other value triggers the ``default``. Unparseable ints and floats
+log a warning via ``Log`` and fall back to ``default`` — never raise.
+"""
+from __future__ import annotations
+
+import os
+
+# Lazy import so ``import tina4_python.env`` doesn't drag the whole Log
+# chain in for callers who don't want it (CLI scaffolding, etc).
+_TRUTHY = frozenset({"1", "true", "on", "yes", "y", "t"})
+_FALSY = frozenset({"0", "false", "off", "no", "n", "f", ""})
+
+
+def _log_warning(message: str) -> None:
+    """Emit a warning via Log without creating a circular import at module load."""
+    try:
+        from tina4_python.debug import Log
+        Log.warning(message)
+    except Exception:
+        # Log not yet wired (e.g. very early bootstrap) — silently skip.
+        pass
+
+
+class Env:
+    """Typed environment-variable helpers.
+
+    All methods are classmethods so callers can write ``Env.bool(...)``
+    without instantiating anything — matching the PHP/Ruby/Node ports.
+    """
+
+    @classmethod
+    def bool(cls, name: str, default: bool = False) -> bool:
+        """Read ``name`` and coerce to bool.
+
+        Truthy values (case-insensitive after strip): ``1``, ``true``,
+        ``on``, ``yes``, ``y``, ``t``. Falsy: ``0``, ``false``, ``off``,
+        ``no``, ``n``, ``f``, empty string. Anything else returns the
+        ``default`` — never raises.
+        """
+        raw = os.environ.get(name)
+        if raw is None:
+            return default
+        token = raw.strip().lower()
+        if token in _TRUTHY:
+            return True
+        if token in _FALSY:
+            return False
+        return default
+
+    @classmethod
+    def int(cls, name: str, default: int = 0) -> int:
+        """Read ``name`` and coerce to int. Returns ``default`` on parse failure."""
+        raw = os.environ.get(name)
+        if raw is None:
+            return default
+        try:
+            return int(raw.strip())
+        except (ValueError, TypeError):
+            _log_warning(
+                f"Env.int({name!r}): could not parse {raw!r} as int — "
+                f"using default {default!r}"
+            )
+            return default
+
+    @classmethod
+    def float(cls, name: str, default: float = 0.0) -> float:
+        """Read ``name`` and coerce to float. Returns ``default`` on parse failure."""
+        raw = os.environ.get(name)
+        if raw is None:
+            return default
+        try:
+            return float(raw.strip())
+        except (ValueError, TypeError):
+            _log_warning(
+                f"Env.float({name!r}): could not parse {raw!r} as float — "
+                f"using default {default!r}"
+            )
+            return default
+
+    @classmethod
+    def str(cls, name: str, default: str = "") -> str:
+        """Read ``name`` as a string. Returns ``default`` if unset.
+
+        Whitespace is preserved — this is a pass-through for the raw env
+        value. ``Env.str("PATH")`` is exactly ``os.environ.get("PATH", "")``
+        with a more discoverable name.
+        """
+        raw = os.environ.get(name)
+        if raw is None:
+            return default
+        return raw