tina4-python 3.13.38__tar.gz → 3.13.39__tar.gz

{tina4_python-3.13.38 → tina4_python-3.13.39}/.gitignore

@@ -85,3 +85,8 @@ example/store/src/**/__pycache__/
 /data/store.db
 /example/store/
 /example/uv.lock
+
+# macOS $TMPDIR leak guard: tests that mis-resolve an absolute tmp path
+# relative to cwd would create these under the repo. Never commit them.
+/private/
+/var/folders/

{tina4_python-3.13.38 → tina4_python-3.13.39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.38
+Version: 3.13.39
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT
@@ -72,14 +72,14 @@ tina4 init python ./my-app
 cd my-app && tina4 serve
 ```
 
-Open http://localhost:7146 — your app is running.
+Open http://localhost:7146. Your app is running.
 
-> **Two CLIs:** `tina4` is the cross-language Rust CLI — it scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
+> **Two CLIs:** `tina4` is the cross-language Rust CLI that scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
 
 <details>
 <summary><strong>Without the Tina4 CLI (Docker / CI only)</strong></summary>
 
-The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass — e.g. inside a Docker image where you've already built the assets — set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
+The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass (e.g. inside a Docker image where you've already built the assets), set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
 
 ```bash
 # 1. Create project
@@ -114,12 +114,12 @@ Every feature is built from scratch -- no pip install, no node_modules, no third
 | Category | Features |
 |----------|----------|
 | **Core HTTP** (7) | Router with path params (`{id:int}`, `{p:path}`), Server, Request/Response, Middleware pipeline, Static file serving, CORS |
-| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird — unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
+| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird: unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
 | **ORM** (7) | Active Record with typed fields, relationships (`has_one`/`has_many`/`belongs_to`), soft delete, QueryBuilder + MongoDB support, Auto-CRUD generator, migrations with rollback |
 | **Auth & Security** (5) | JWT (HS256/RS256), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
 | **Templating** (3) | Frond engine (Twig/Jinja2-compatible, pre-compiled 2.8x faster), SCSS auto-compilation, built-in CSS (~24 KB) |
 | **API & Integration** (5) | HTTP client (zero-dep), GraphQL with ORM auto-schema + GraphiQL IDE, WSDL/SOAP with auto WSDL, WebSocket (RFC 6455) + Redis backplane, MCP server (24 dev tools) |
-| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters — service runner — event system (on/emit/once/off) |
+| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters; service runner; event system (on/emit/once/off) |
 | **Data & Storage** (4) | Session (File/Redis/Valkey/MongoDB/DB), response cache (LRU, TTL), seeder + 50+ fake data generators, messenger (SMTP/IMAP) |
 | **Developer Tools** (7) | Dev dashboard (11 tabs), dev toolbar, error overlay (Catppuccin Mocha), dev mailbox, hot reload + CSS hot-reload, code metrics (complexity, coupling, maintainability), AI context installer (7 tools) |
 | **Utilities** (7) | DI container (transient + singleton), HtmlElement builder, inline testing (`@tests` decorator), i18n (6 languages), Swagger/OpenAPI auto-generation, CLI scaffolding (`generate model/route/migration/middleware`), structured logging |
@@ -691,7 +691,7 @@ Frond.clear_cache()
 
 ### Gallery
 
-7 interactive examples with **Try It** deploy — visit the dev admin at `/__dev/` to explore.
+7 interactive examples with **Try It** deploy. Visit the dev admin at `/__dev/` to explore.
 
 ## Environment
 
@@ -716,7 +716,7 @@ Supported: Claude Code, Cursor, GitHub Copilot, Windsurf, Aider, Cline, OpenAI C
 
 ## Performance
 
-Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
+Benchmarked with `wrk`: 5,000 requests, 50 concurrent, median of 3 runs:
 
 | Framework | JSON req/s | Deps | Features |
 |-----------|-----------|------|----------|
@@ -726,7 +726,7 @@ Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
 | Bottle | 4,355 | 0 | ~5 |
 | Django | 4,050 | 20+ | ~22 |
 
-Tina4 Python delivers competitive throughput with **zero dependencies and 55 features** — frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
+Tina4 Python delivers competitive throughput with **zero dependencies and 55 features**. Frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
 
 **Across all 4 Tina4 implementations:**
 
@@ -742,7 +742,7 @@ Run benchmarks locally: `python benchmarks/benchmark.py --python`
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages — same architecture, same conventions, same 55 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, same 55 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

{tina4_python-3.13.38 → tina4_python-3.13.39}/README.md

@@ -40,14 +40,14 @@ tina4 init python ./my-app
 cd my-app && tina4 serve
 ```
 
-Open http://localhost:7146 — your app is running.
+Open http://localhost:7146. Your app is running.
 
-> **Two CLIs:** `tina4` is the cross-language Rust CLI — it scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
+> **Two CLIs:** `tina4` is the cross-language Rust CLI that scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
 
 <details>
 <summary><strong>Without the Tina4 CLI (Docker / CI only)</strong></summary>
 
-The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass — e.g. inside a Docker image where you've already built the assets — set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
+The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass (e.g. inside a Docker image where you've already built the assets), set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
 
 ```bash
 # 1. Create project
@@ -82,12 +82,12 @@ Every feature is built from scratch -- no pip install, no node_modules, no third
 | Category | Features |
 |----------|----------|
 | **Core HTTP** (7) | Router with path params (`{id:int}`, `{p:path}`), Server, Request/Response, Middleware pipeline, Static file serving, CORS |
-| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird — unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
+| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird: unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
 | **ORM** (7) | Active Record with typed fields, relationships (`has_one`/`has_many`/`belongs_to`), soft delete, QueryBuilder + MongoDB support, Auto-CRUD generator, migrations with rollback |
 | **Auth & Security** (5) | JWT (HS256/RS256), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
 | **Templating** (3) | Frond engine (Twig/Jinja2-compatible, pre-compiled 2.8x faster), SCSS auto-compilation, built-in CSS (~24 KB) |
 | **API & Integration** (5) | HTTP client (zero-dep), GraphQL with ORM auto-schema + GraphiQL IDE, WSDL/SOAP with auto WSDL, WebSocket (RFC 6455) + Redis backplane, MCP server (24 dev tools) |
-| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters — service runner — event system (on/emit/once/off) |
+| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters; service runner; event system (on/emit/once/off) |
 | **Data & Storage** (4) | Session (File/Redis/Valkey/MongoDB/DB), response cache (LRU, TTL), seeder + 50+ fake data generators, messenger (SMTP/IMAP) |
 | **Developer Tools** (7) | Dev dashboard (11 tabs), dev toolbar, error overlay (Catppuccin Mocha), dev mailbox, hot reload + CSS hot-reload, code metrics (complexity, coupling, maintainability), AI context installer (7 tools) |
 | **Utilities** (7) | DI container (transient + singleton), HtmlElement builder, inline testing (`@tests` decorator), i18n (6 languages), Swagger/OpenAPI auto-generation, CLI scaffolding (`generate model/route/migration/middleware`), structured logging |
@@ -659,7 +659,7 @@ Frond.clear_cache()
 
 ### Gallery
 
-7 interactive examples with **Try It** deploy — visit the dev admin at `/__dev/` to explore.
+7 interactive examples with **Try It** deploy. Visit the dev admin at `/__dev/` to explore.
 
 ## Environment
 
@@ -684,7 +684,7 @@ Supported: Claude Code, Cursor, GitHub Copilot, Windsurf, Aider, Cline, OpenAI C
 
 ## Performance
 
-Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
+Benchmarked with `wrk`: 5,000 requests, 50 concurrent, median of 3 runs:
 
 | Framework | JSON req/s | Deps | Features |
 |-----------|-----------|------|----------|
@@ -694,7 +694,7 @@ Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
 | Bottle | 4,355 | 0 | ~5 |
 | Django | 4,050 | 20+ | ~22 |
 
-Tina4 Python delivers competitive throughput with **zero dependencies and 55 features** — frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
+Tina4 Python delivers competitive throughput with **zero dependencies and 55 features**. Frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
 
 **Across all 4 Tina4 implementations:**
 
@@ -710,7 +710,7 @@ Run benchmarks locally: `python benchmarks/benchmark.py --python`
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages — same architecture, same conventions, same 55 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, same 55 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

{tina4_python-3.13.38 → tina4_python-3.13.39}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.38"
+version = "3.13.39"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.38 → tina4_python-3.13.39}/tina4_python/CLAUDE.md

@@ -725,8 +725,14 @@ api.set_basic_auth("client_id", "client_secret")
 
 # Disable SSL verification (dev only)
 api = Api("https://self-signed.local", ignore_ssl=True)
+
+# Opt-in automatic retry with exponential backoff (default off: max_retries=0).
+# Retries a transport error or a retryable status (429/5xx); 4xx is never retried.
+api = Api("https://api.example.com", max_retries=3, retry_backoff=0.5)
 ```
 
+**Redirect safety:** the client follows redirects, but the `Authorization` header is **stripped on a cross-origin hop** (different scheme/host/port) — so a bearer token is never leaked to a host you didn't authenticate against. Same-origin redirects keep the header.
+
 ### Return format
 Every request method (`get()`, `post()`, `put()`, `patch()`, `delete()`, `send()`) returns:
 ```python
@@ -952,11 +958,10 @@ uv run tina4python migrate
 ### How migrations work internally
 
 - SQL files live in `migrations/` folder, named `NNNNNN_description.sql` (6-digit sequence)
-- Files are executed **alphabetically** and split on the `;` delimiter
-- State is tracked in the `tina4_migration` table (auto-created per engine)
-- A migration only runs once — if `passed = 1` in the tracking table, it is skipped
-- Failed migrations (passed = 0) are deleted and retried on the next run
-- On **any** error, the migration rolls back and the process exits with `sys.exit(1)` — fix the error before re-running
+- Files are executed in **numeric-prefix order** (`9_` before `10_`) and split on the `;` delimiter. A file without a numeric/timestamp prefix logs a warning — its order is undefined
+- State is tracked (row-existence) in the `tina4_migration` table (auto-created per engine): a migration runs once — if a row for it exists, it is skipped. (A vestigial `passed` column exists for back-compat; only applied = `passed=1` rows are ever written — failures are never recorded as `passed=0`.)
+- **Each migration FILE is wrapped in its own transaction**: on a failure the file rolls back and `migrate()` **raises** (it does not write `passed=0`, delete anything, or `sys.exit`). Already-applied files stay applied — fix the bad file and re-run. The explicit `tina4 migrate` CLI surfaces the raise as a non-zero exit; startup auto-migration logs it and the service still boots (see TINA4_AUTO_MIGRATE above).
+- **Atomicity caveat:** per-file transactions are truly atomic only on engines with **transactional DDL (PostgreSQL)**. MySQL, Firebird, and SQLite auto-commit DDL, so a multi-statement migration that fails midway on those engines leaves earlier statements applied — keep one logical change per file. CREATE TABLE / ALTER-ADD are made idempotent on Firebird/MSSQL (existence-checked) so a re-run doesn't error.
 
 ### Engine-specific DDL patterns
 
@@ -1617,7 +1622,7 @@ TINA4_DATABASE_PASSWORD=                 # DB password
 
 # Framework
 TINA4_DEBUG=true                  # Enable dev mode (toolbar, live reload, error overlay)
-TINA4_LOG_LEVEL=ERROR             # Log verbosity: ALL, DEBUG, INFO, WARNING, ERROR (default: ERROR)
+TINA4_LOG_LEVEL=INFO              # Log verbosity: ALL, DEBUG, INFO, WARNING, ERROR, CRITICAL (default: INFO)
 TINA4_LOCALE=en                   # Language for framework messages (en, fr, af, zh, ja, es)
 TINA4_DEFAULT_WEBSERVER=FALSE     # Set to TRUE to use Tina4's built-in webserver instead of ASGI
 TINA4_OVERRIDE_CLIENT=false       # Set to true to allow running without tina4 CLI (e.g. Docker)
@@ -1638,10 +1643,11 @@ SWAGGER_DEV_URL=http://localhost:7145  # Dev server URL for Swagger
 ```
 
 ### Debug levels
-- `ALL` / `DEBUG` — enables DevReload, hot-patching, verbose logging, error overlay
-- `INFO` — standard logging
-- `WARNING` — warnings and errors only
-- `ERROR` — errors only
+- `ALL` / `DEBUG` — most verbose; every level on the console
+- `INFO` — standard logging (default)
+- `WARNING` — warnings, errors, and critical
+- `ERROR` — errors and critical
+- `CRITICAL` — critical only (highest severity; `Log.critical()` always logs)
 
 ## CORS
 

{tina4_python-3.13.38 → tina4_python-3.13.39}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.13.38"
+__version__ = "3.13.39"
 
 # ── Route decorators ──
 from tina4_python.core.router import (  # noqa: E402, F401

{tina4_python-3.13.38 → tina4_python-3.13.39}/tina4_python/api/__init__.py

@@ -10,12 +10,57 @@ Make HTTP requests without requests/httpx/aiohttp.
 """
 import json
 import ssl
+import time
 import base64
-from urllib.request import Request, urlopen
-from urllib.parse import urlencode
+from urllib.parse import urlencode, urlparse
+from urllib.request import Request, HTTPRedirectHandler, HTTPSHandler, build_opener
 from urllib.error import HTTPError, URLError
 
 
+# Statuses that warrant an automatic retry when ``max_retries`` > 0: rate-limit
+# (429) plus the transient server-side 5xx family. 4xx client errors (401,
+# 404, …) are NOT retried — a repeat won't succeed.
+_RETRY_STATUSES = frozenset({429, 500, 502, 503, 504})
+
+
+def _same_origin(url_a: str, url_b: str) -> bool:
+    """True when two URLs share scheme + host + (effective) port."""
+    a, b = urlparse(url_a), urlparse(url_b)
+    default = {"http": 80, "https": 443}
+    pa = a.port if a.port is not None else default.get(a.scheme)
+    pb = b.port if b.port is not None else default.get(b.scheme)
+    return (a.scheme, a.hostname, pa) == (b.scheme, b.hostname, pb)
+
+
+class _AuthStripRedirectHandler(HTTPRedirectHandler):
+    """Follow redirects, but drop the Authorization header on a cross-origin hop.
+
+    Plain urllib forwards the Authorization header to ANY redirect target,
+    including a different host — so an ``api.get("/login")`` that 302s to
+    ``https://attacker.example/`` would hand the bearer token to the attacker.
+    Stripping it when the target origin (scheme/host/port) differs matches
+    requests/httpx and closes that leak, while same-origin redirects keep auth.
+    """
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        new_req = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if new_req is not None and not _same_origin(req.full_url, newurl):
+            new_req.headers = {
+                k: v for k, v in new_req.headers.items() if k.lower() != "authorization"
+            }
+            new_req.unredirected_hdrs = {
+                k: v for k, v in getattr(new_req, "unredirected_hdrs", {}).items()
+                if k.lower() != "authorization"
+            }
+        return new_req
+
+
+def _open(req, timeout, opener):
+    """The single network-call indirection point (keeps the call site easy to
+    patch in tests). ``req`` stays the first positional arg on purpose."""
+    return opener.open(req, timeout=timeout)
+
+
 class Api:
     """HTTP client using urllib — zero external dependencies."""
 
@@ -25,7 +70,9 @@ class Api:
                  username: str | None = None,
                  password: str | None = None,
                  headers: dict[str, str] | None = None,
-                 verify_ssl: bool | None = None):
+                 verify_ssl: bool | None = None,
+                 max_retries: int = 0,
+                 retry_backoff: float = 0.5):
         """HTTP client.
 
         Constructor accepts ergonomic kwargs the documentation has long
@@ -44,12 +91,21 @@ class Api:
         ``verify_ssl`` is the docs-friendly inverse of ``ignore_ssl`` —
         ``verify_ssl=False`` is equivalent to ``ignore_ssl=True``. If
         both are supplied, ``ignore_ssl`` wins (legacy precedence).
+
+        ``max_retries`` (default 0 = off) enables automatic retry with
+        exponential backoff (``retry_backoff`` seconds base, doubling each
+        attempt) on a transport error or a retryable status (429/5xx). A
+        retried non-idempotent request (POST/…) may be re-sent — retries are
+        opt-in for that reason.
         """
         self.base_url = base_url.rstrip("/")
         self.auth_header = auth_header
         self.timeout = timeout
+        self.max_retries = max(0, int(max_retries))
+        self.retry_backoff = retry_backoff
         self._headers: dict[str, str] = {}
         self._ssl_context = None
+        self._opener_cache = None
 
         # ── kwarg sugar ────────────────────────────────────────────────
         # Bearer token wins over basic auth if both are passed.
@@ -120,9 +176,17 @@ class Api:
             return path
         return f"{self.base_url}/{path.lstrip('/')}" if path else self.base_url
 
-    def _request(self, method: str, url: str, body=None,
-                 content_type: str = "application/json") -> dict:
-        """Execute HTTP request. Returns standardized result dict."""
+    def _opener(self):
+        """Build (once) an opener that follows redirects but strips the
+        Authorization header on a cross-origin hop, honouring the SSL context."""
+        if self._opener_cache is None:
+            handlers = [_AuthStripRedirectHandler()]
+            if self._ssl_context is not None:
+                handlers.append(HTTPSHandler(context=self._ssl_context))
+            self._opener_cache = build_opener(*handlers)
+        return self._opener_cache
+
+    def _build_request(self, method: str, url: str, body, content_type: str) -> Request:
         headers = dict(self._headers)
         if self.auth_header:
             headers["Authorization"] = self.auth_header
@@ -139,10 +203,32 @@ class Api:
                 data = body
                 headers["Content-Type"] = content_type
 
-        req = Request(url, data=data, headers=headers, method=method)
+        return Request(url, data=data, headers=headers, method=method)
+
+    def _request(self, method: str, url: str, body=None,
+                 content_type: str = "application/json") -> dict:
+        """Execute the request with opt-in retry/backoff. Returns a result dict.
+
+        With ``max_retries`` > 0, a transport failure (``http_code`` None) or a
+        retryable status (429/5xx) is retried up to ``max_retries`` times with
+        exponential backoff; any other outcome (2xx, 4xx, 3xx) returns at once.
+        """
+        req = self._build_request(method, url, body, content_type)
+        attempts = self.max_retries + 1
+        result = None
+        for attempt in range(attempts):
+            result = self._attempt(req)
+            code = result.get("http_code")
+            retryable = code is None or code in _RETRY_STATUSES
+            if not retryable or attempt == attempts - 1:
+                return result
+            time.sleep(self.retry_backoff * (2 ** attempt))
+        return result
 
+    def _attempt(self, req: Request) -> dict:
+        """A single HTTP attempt. Returns the standardized result dict."""
         try:
-            resp = urlopen(req, timeout=self.timeout, context=self._ssl_context)
+            resp = _open(req, self.timeout, self._opener())
             raw = resp.read().decode("utf-8", errors="replace")
             resp_headers = dict(resp.headers)
             try:

{tina4_python-3.13.38 → tina4_python-3.13.39}/tina4_python/core/middleware.py

@@ -138,7 +138,7 @@ class CorsMiddleware:
         )
         self.max_age = os.environ.get("TINA4_CORS_MAX_AGE", "86400")
         self.credentials = os.environ.get(
-            "TINA4_CORS_CREDENTIALS", "true"
+            "TINA4_CORS_CREDENTIALS", "false"
         ).lower() in ("true", "1", "yes")
 
     def allowed_origin(self, request_origin: str) -> str:

{tina4_python-3.13.38 → tina4_python-3.13.39}/tina4_python/core/router.py

@@ -178,9 +178,18 @@ class Router:
             "param_names": param_names,
             "param_types": param_types,
             "handler": handler,
+            # A WS route is public by default (like GET). @secured() requires a
+            # valid JWT on the upgrade. Read the flag here AND keep a back-ref so
+            # @secured() applied AFTER @websocket() (the other decorator order)
+            # can still flip it — mirrors the HTTP _route_ref pattern.
+            "auth_required": bool(getattr(handler, "_secured", False)),
         }
         _ws_routes.append(route)
-        Log.debug(f"WebSocket route registered: {path}")
+        try:
+            handler._ws_route_ref = route
+        except (AttributeError, TypeError):
+            pass
+        Log.debug(f"WebSocket route registered: {path} (auth={'required' if route['auth_required'] else 'public'})")
 
     @staticmethod
     def match_ws(path: str) -> tuple[dict | None, dict]:
@@ -735,6 +744,9 @@ def secured():
         # update the route dict directly.
         if hasattr(fn, "_route_ref"):
             fn._route_ref._route["auth_required"] = True
+        # Same for a WebSocket route registered by @websocket() below this one.
+        if hasattr(fn, "_ws_route_ref"):
+            fn._ws_route_ref["auth_required"] = True
         return fn
     return decorator
 

{tina4_python-3.13.38 → tina4_python-3.13.39}/tina4_python/core/server.py

@@ -720,23 +720,36 @@ async def _handle_asgi_websocket(scope: dict, receive, send):
     # Origin allow-list (opt-in via TINA4_WS_ALLOWED_ORIGINS). Unset = allow all
     # so existing deployments are unaffected. Shared with the standalone server
     # via websocket.origin_allowed().
-    from tina4_python.websocket import origin_allowed
+    from tina4_python.websocket import origin_allowed, ws_authorized
     _ws_headers = {k.decode().lower(): v.decode() for k, v in scope.get("headers", [])}
     if not origin_allowed(_ws_headers):
         # 1008 = policy violation (per ASGI/RFC 6455 close codes)
         await send({"type": "websocket.close", "code": 1008})
         return
 
-    # Accept the connection
+    # Per-route auth: a @secured() WS route requires a valid JWT on the upgrade
+    # (Authorization header, "bearer" subprotocol, or ?token=). Public by default.
+    _ws_subproto = _ws_headers.get("sec-websocket-protocol", "")
+    _ws_payload, _ws_ok = ws_authorized(
+        route, _ws_headers, scope.get("query_string", b"").decode(), _ws_subproto)
+    if not _ws_ok:
+        await send({"type": "websocket.close", "code": 1008})
+        return
+
+    # Accept the connection (echo the bearer subprotocol if the client offered it)
     msg = await receive()
     if msg["type"] != "websocket.connect":
         return
-    await send({"type": "websocket.accept"})
+    _accept = {"type": "websocket.accept"}
+    if any(p.strip().lower() == "bearer" for p in _ws_subproto.split(",")):
+        _accept["subprotocol"] = "bearer"
+    await send(_accept)
 
     handler = route["handler"]
 
     # Create a lightweight connection wrapper for ASGI WebSocket
     conn = _AsgiWebSocketConnection(scope, receive, send, path, params, _ws_manager)
+    conn.auth = _ws_payload
     _ws_manager.add(conn)
 
     # Fire "open" event — this may set conn._on_message / conn._on_close
@@ -794,6 +807,7 @@ class _AsgiWebSocketConnection:
         self.id = str(uuid.uuid4())[:8]
         self.path = path
         self.params = params
+        self.auth = None   # verified JWT payload on a @secured WS route, else None
         self.headers = {
             k.decode(): v.decode()
             for k, v in scope.get("headers", [])
@@ -899,7 +913,7 @@ async def _handle_dev_websocket(reader, writer, headers, path):
         writer.close()
         return
 
-    from tina4_python.websocket import compute_accept_key, origin_allowed
+    from tina4_python.websocket import compute_accept_key, origin_allowed, ws_authorized
 
     ws_key = headers.get("sec-websocket-key")
     if not ws_key:
@@ -2221,6 +2235,53 @@ def _check_legacy_env_vars() -> None:
     sys.exit(2)
 
 
+def _auto_migrate_on_startup(migration_folder: str = "migrations") -> None:
+    """Apply pending DB migrations on startup — NON-BREAKING.
+
+    When a ``migrations/`` folder exists (with at least one ``.sql`` file) and
+    ``TINA4_AUTO_MIGRATE`` is not disabled, pending migrations are applied during
+    boot so the schema is current with no manual ``tina4 migrate`` step. A
+    failure here is logged LOUD and the service STILL starts — a bad migration
+    must never take the backend down. (The explicit ``tina4 migrate`` CLI stays
+    fail-fast so CI still gets a non-zero exit.)
+
+    Disable with ``TINA4_AUTO_MIGRATE=false`` — e.g. multi-instance production
+    that migrates as a separate deploy step (concurrent first-apply can race).
+    """
+    from pathlib import Path
+    from tina4_python.dotenv import is_truthy
+
+    folder = Path(migration_folder)
+    if not folder.is_dir() or not any(folder.glob("*.sql")):
+        return  # no migrations → nothing to do (silent)
+    if not is_truthy(os.environ.get("TINA4_AUTO_MIGRATE", "true")):
+        Log.debug("TINA4_AUTO_MIGRATE is off — skipping startup migrations")
+        return
+
+    try:
+        from tina4_python.database import Database
+        db = Database()  # resolves TINA4_DATABASE_URL (framework default if unset)
+    except Exception as exc:
+        Log.debug(f"Startup migrations skipped (no database configured): {exc}")
+        return
+
+    try:
+        from tina4_python.migration import migrate
+        applied = migrate(db)
+        if applied:
+            Log.info(f"Applied {len(applied)} pending migration(s) on startup")
+    except Exception as exc:
+        Log.error(
+            f"Startup auto-migration failed: {exc} — the service is starting "
+            "anyway. Run `tina4 migrate` to retry."
+        )
+    finally:
+        try:
+            db.close()  # transient migration connection — don't leak it at boot
+        except Exception:
+            pass
+
+
 def run(host: str | None = None, port: int | None = None, no_browser: bool = False, no_reload: bool = False):
     """Start the Tina4 dev server.
 
@@ -2353,6 +2414,9 @@ def run(host: str | None = None, port: int | None = None, no_browser: bool = Fal
     route_count = len(Router.get_routes())
     Log.info(f"Discovered {route_count} routes")
 
+    # Apply pending DB migrations on startup (non-breaking — see helper).
+    _auto_migrate_on_startup()
+
     # Resolve host/port (CLI arg > ENV > default)
     host, port = resolve_config(cli_host=host, cli_port=port)
 

{tina4_python-3.13.38 → tina4_python-3.13.39}/tina4_python/debug/__init__.py

@@ -19,8 +19,6 @@ Environment variables (all optional — defaults match v2 behaviour):
     TINA4_LOG_ROTATE_SIZE   Bytes per file before rotation. Default 10 MB.
                             Set to 0 to disable rotation.
     TINA4_LOG_ROTATE_KEEP   Number of rotated files to keep (default: 5).
-    TINA4_LOG_CRITICAL      When truthy, Log.critical(...) is accepted and
-                            mapped to error level. Default: false.
     TINA4_LOG_MAX_SIZE      [legacy] Megabytes per file. Used only when
                             TINA4_LOG_ROTATE_SIZE is unset (back-compat).
     TINA4_LOG_KEEP          [legacy] Alias for TINA4_LOG_ROTATE_KEEP.
@@ -201,10 +199,7 @@ class Log:
     # _format_mode so it doesn't clash with the legacy _format() method
     # name kept below for backward compatibility.
     _format_mode: str = "text"
-    # Whether Log.critical() is accepted (TINA4_LOG_CRITICAL).
-    _critical_enabled: bool = False
-
-    LEVELS = {"debug": 0, "info": 1, "warning": 2, "error": 3}
+    LEVELS = {"debug": 0, "info": 1, "warning": 2, "error": 3, "critical": 4}
 
     @classmethod
     def configure(cls, log_dir: str = "logs", level: str = "info",
@@ -229,22 +224,19 @@ class Log:
             cls._stdout_enabled = True
             cls._file_enabled = True
         else:
-            # "stdout" (default) — but we still keep file output on for
-            # parity with v2 behaviour where logs/tina4.log is always
-            # written. Operators who want stdout-only can flip the new
-            # explicit "stdout-only" by setting TINA4_LOG_FILE="" AND
-            # TINA4_LOG_OUTPUT=stdout — handled below where the file
-            # path resolves to empty.
+            # "stdout" (default): stdout is ALWAYS on. The log FILE is written
+            # only in development (TINA4_DEBUG truthy). In production /
+            # containers a logs/tina4.log + error.log just bloat the writable
+            # layer and disk, and 12-factor wants logs on stdout for the
+            # platform to capture. Explicit TINA4_LOG_OUTPUT=file/both (or an
+            # explicit TINA4_LOG_FILE path) overrides this and writes a file.
             cls._stdout_enabled = True
-            cls._file_enabled = True
+            cls._file_enabled = _is_truthy(os.environ.get("TINA4_DEBUG"))
 
         # ── Format ───────────────────────────────────────────────
         fmt = os.environ.get("TINA4_LOG_FORMAT", "text").lower().strip()
         cls._format_mode = "json" if fmt == "json" else "text"
 
-        # ── Critical level toggle ────────────────────────────────
-        cls._critical_enabled = _is_truthy(os.environ.get("TINA4_LOG_CRITICAL"))
-
         # ── Rotation config ──────────────────────────────────────
         # New-style: TINA4_LOG_ROTATE_SIZE in BYTES (0 = disabled).
         # Legacy: TINA4_LOG_MAX_SIZE in MEGABYTES.
@@ -311,6 +303,7 @@ class Log:
         "info": "\033[32m",      # Green
         "warning": "\033[33m",   # Yellow
         "error": "\033[31m",     # Red
+        "critical": "\033[35m",  # Magenta
     }
     RESET = "\033[0m"
 
@@ -454,12 +447,26 @@ class Log:
 
     @classmethod
     def critical(cls, message: str, **kwargs):
-        """Critical-level log — accepted only when TINA4_LOG_CRITICAL=true.
+        """Critical-level log — the highest severity (above error).
+
+        Always emitted (like every other level) and written to error.log.
+        Use it for unrecoverable, alert-worthy failures.
+        """
+        cls._log("critical", message, **kwargs)
+
+    @classmethod
+    def is_enabled(cls, level: str) -> bool:
+        """Return True if a message at ``level`` would pass the configured
+        minimum console level.
+
+        This reflects console (stdout) visibility — the log file always
+        records every level regardless of this threshold. Use it to skip
+        building an expensive log payload that would not be shown::
+
+            if Log.is_enabled("debug"):
+                Log.debug("state", snapshot=expensive_dump())
 
-        Maps to error so existing log consumers (alerting, error.log)
-        keep working. When the toggle is off the call is a no-op so
-        deployments that have standardised on debug/info/warning/error
-        don't get surprise log lines.
+        ``level`` is case-insensitive (``debug`` / ``info`` / ``warning`` /
+        ``error`` / ``critical``).
         """
-        if cls._critical_enabled:
-            cls._log("error", message, **kwargs)
+        return cls._should_log((level or "").lower())