tina4-python 3.13.38__tar.gz → 3.13.40__tar.gz

{tina4_python-3.13.38 → tina4_python-3.13.40}/.gitignore

@@ -85,3 +85,8 @@ example/store/src/**/__pycache__/
 /data/store.db
 /example/store/
 /example/uv.lock
+
+# macOS $TMPDIR leak guard: tests that mis-resolve an absolute tmp path
+# relative to cwd would create these under the repo. Never commit them.
+/private/
+/var/folders/

{tina4_python-3.13.38 → tina4_python-3.13.40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.38
+Version: 3.13.40
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT
@@ -72,14 +72,14 @@ tina4 init python ./my-app
 cd my-app && tina4 serve
 ```
 
-Open http://localhost:7146 — your app is running.
+Open http://localhost:7146. Your app is running.
 
-> **Two CLIs:** `tina4` is the cross-language Rust CLI — it scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
+> **Two CLIs:** `tina4` is the cross-language Rust CLI that scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
 
 <details>
 <summary><strong>Without the Tina4 CLI (Docker / CI only)</strong></summary>
 
-The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass — e.g. inside a Docker image where you've already built the assets — set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
+The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass (e.g. inside a Docker image where you've already built the assets), set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
 
 ```bash
 # 1. Create project
@@ -114,12 +114,12 @@ Every feature is built from scratch -- no pip install, no node_modules, no third
 | Category | Features |
 |----------|----------|
 | **Core HTTP** (7) | Router with path params (`{id:int}`, `{p:path}`), Server, Request/Response, Middleware pipeline, Static file serving, CORS |
-| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird — unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
+| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird: unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
 | **ORM** (7) | Active Record with typed fields, relationships (`has_one`/`has_many`/`belongs_to`), soft delete, QueryBuilder + MongoDB support, Auto-CRUD generator, migrations with rollback |
 | **Auth & Security** (5) | JWT (HS256/RS256), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
 | **Templating** (3) | Frond engine (Twig/Jinja2-compatible, pre-compiled 2.8x faster), SCSS auto-compilation, built-in CSS (~24 KB) |
 | **API & Integration** (5) | HTTP client (zero-dep), GraphQL with ORM auto-schema + GraphiQL IDE, WSDL/SOAP with auto WSDL, WebSocket (RFC 6455) + Redis backplane, MCP server (24 dev tools) |
-| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters — service runner — event system (on/emit/once/off) |
+| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters; service runner; event system (on/emit/once/off) |
 | **Data & Storage** (4) | Session (File/Redis/Valkey/MongoDB/DB), response cache (LRU, TTL), seeder + 50+ fake data generators, messenger (SMTP/IMAP) |
 | **Developer Tools** (7) | Dev dashboard (11 tabs), dev toolbar, error overlay (Catppuccin Mocha), dev mailbox, hot reload + CSS hot-reload, code metrics (complexity, coupling, maintainability), AI context installer (7 tools) |
 | **Utilities** (7) | DI container (transient + singleton), HtmlElement builder, inline testing (`@tests` decorator), i18n (6 languages), Swagger/OpenAPI auto-generation, CLI scaffolding (`generate model/route/migration/middleware`), structured logging |
@@ -691,7 +691,7 @@ Frond.clear_cache()
 
 ### Gallery
 
-7 interactive examples with **Try It** deploy — visit the dev admin at `/__dev/` to explore.
+7 interactive examples with **Try It** deploy. Visit the dev admin at `/__dev/` to explore.
 
 ## Environment
 
@@ -716,7 +716,7 @@ Supported: Claude Code, Cursor, GitHub Copilot, Windsurf, Aider, Cline, OpenAI C
 
 ## Performance
 
-Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
+Benchmarked with `wrk`: 5,000 requests, 50 concurrent, median of 3 runs:
 
 | Framework | JSON req/s | Deps | Features |
 |-----------|-----------|------|----------|
@@ -726,7 +726,7 @@ Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
 | Bottle | 4,355 | 0 | ~5 |
 | Django | 4,050 | 20+ | ~22 |
 
-Tina4 Python delivers competitive throughput with **zero dependencies and 55 features** — frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
+Tina4 Python delivers competitive throughput with **zero dependencies and 55 features**. Frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
 
 **Across all 4 Tina4 implementations:**
 
@@ -742,7 +742,7 @@ Run benchmarks locally: `python benchmarks/benchmark.py --python`
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages — same architecture, same conventions, same 55 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, same 55 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

{tina4_python-3.13.38 → tina4_python-3.13.40}/README.md

@@ -40,14 +40,14 @@ tina4 init python ./my-app
 cd my-app && tina4 serve
 ```
 
-Open http://localhost:7146 — your app is running.
+Open http://localhost:7146. Your app is running.
 
-> **Two CLIs:** `tina4` is the cross-language Rust CLI — it scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
+> **Two CLIs:** `tina4` is the cross-language Rust CLI that scaffolds projects, runs the dev server, and watches files. `tina4python` is the Python package's own CLI for project tasks (`migrate`, `seed`, `generate`, `test`). This guide uses `tina4` to scaffold and run, and `tina4python` for those tasks.
 
 <details>
 <summary><strong>Without the Tina4 CLI (Docker / CI only)</strong></summary>
 
-The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass — e.g. inside a Docker image where you've already built the assets — set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
+The framework normally refuses to start without the `tina4` Rust CLI (it owns file watching and SCSS compilation). To bypass (e.g. inside a Docker image where you've already built the assets), set `TINA4_OVERRIDE_CLIENT=true` in `.env`:
 
 ```bash
 # 1. Create project
@@ -82,12 +82,12 @@ Every feature is built from scratch -- no pip install, no node_modules, no third
 | Category | Features |
 |----------|----------|
 | **Core HTTP** (7) | Router with path params (`{id:int}`, `{p:path}`), Server, Request/Response, Middleware pipeline, Static file serving, CORS |
-| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird — unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
+| **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird: unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
 | **ORM** (7) | Active Record with typed fields, relationships (`has_one`/`has_many`/`belongs_to`), soft delete, QueryBuilder + MongoDB support, Auto-CRUD generator, migrations with rollback |
 | **Auth & Security** (5) | JWT (HS256/RS256), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
 | **Templating** (3) | Frond engine (Twig/Jinja2-compatible, pre-compiled 2.8x faster), SCSS auto-compilation, built-in CSS (~24 KB) |
 | **API & Integration** (5) | HTTP client (zero-dep), GraphQL with ORM auto-schema + GraphiQL IDE, WSDL/SOAP with auto WSDL, WebSocket (RFC 6455) + Redis backplane, MCP server (24 dev tools) |
-| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters — service runner — event system (on/emit/once/off) |
+| **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters; service runner; event system (on/emit/once/off) |
 | **Data & Storage** (4) | Session (File/Redis/Valkey/MongoDB/DB), response cache (LRU, TTL), seeder + 50+ fake data generators, messenger (SMTP/IMAP) |
 | **Developer Tools** (7) | Dev dashboard (11 tabs), dev toolbar, error overlay (Catppuccin Mocha), dev mailbox, hot reload + CSS hot-reload, code metrics (complexity, coupling, maintainability), AI context installer (7 tools) |
 | **Utilities** (7) | DI container (transient + singleton), HtmlElement builder, inline testing (`@tests` decorator), i18n (6 languages), Swagger/OpenAPI auto-generation, CLI scaffolding (`generate model/route/migration/middleware`), structured logging |
@@ -659,7 +659,7 @@ Frond.clear_cache()
 
 ### Gallery
 
-7 interactive examples with **Try It** deploy — visit the dev admin at `/__dev/` to explore.
+7 interactive examples with **Try It** deploy. Visit the dev admin at `/__dev/` to explore.
 
 ## Environment
 
@@ -684,7 +684,7 @@ Supported: Claude Code, Cursor, GitHub Copilot, Windsurf, Aider, Cline, OpenAI C
 
 ## Performance
 
-Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
+Benchmarked with `wrk`: 5,000 requests, 50 concurrent, median of 3 runs:
 
 | Framework | JSON req/s | Deps | Features |
 |-----------|-----------|------|----------|
@@ -694,7 +694,7 @@ Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
 | Bottle | 4,355 | 0 | ~5 |
 | Django | 4,050 | 20+ | ~22 |
 
-Tina4 Python delivers competitive throughput with **zero dependencies and 55 features** — frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
+Tina4 Python delivers competitive throughput with **zero dependencies and 55 features**. Frameworks with higher req/s have a fraction of the functionality and require dozens of third-party packages.
 
 **Across all 4 Tina4 implementations:**
 
@@ -710,7 +710,7 @@ Run benchmarks locally: `python benchmarks/benchmark.py --python`
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages — same architecture, same conventions, same 55 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, same 55 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

{tina4_python-3.13.38 → tina4_python-3.13.40}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.38"
+version = "3.13.40"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.38 → tina4_python-3.13.40}/tina4_python/CLAUDE.md

@@ -725,8 +725,14 @@ api.set_basic_auth("client_id", "client_secret")
 
 # Disable SSL verification (dev only)
 api = Api("https://self-signed.local", ignore_ssl=True)
+
+# Opt-in automatic retry with exponential backoff (default off: max_retries=0).
+# Retries a transport error or a retryable status (429/5xx); 4xx is never retried.
+api = Api("https://api.example.com", max_retries=3, retry_backoff=0.5)
 ```
 
+**Redirect safety:** the client follows redirects, but the `Authorization` header is **stripped on a cross-origin hop** (different scheme/host/port) — so a bearer token is never leaked to a host you didn't authenticate against. Same-origin redirects keep the header.
+
 ### Return format
 Every request method (`get()`, `post()`, `put()`, `patch()`, `delete()`, `send()`) returns:
 ```python
@@ -952,11 +958,10 @@ uv run tina4python migrate
 ### How migrations work internally
 
 - SQL files live in `migrations/` folder, named `NNNNNN_description.sql` (6-digit sequence)
-- Files are executed **alphabetically** and split on the `;` delimiter
-- State is tracked in the `tina4_migration` table (auto-created per engine)
-- A migration only runs once — if `passed = 1` in the tracking table, it is skipped
-- Failed migrations (passed = 0) are deleted and retried on the next run
-- On **any** error, the migration rolls back and the process exits with `sys.exit(1)` — fix the error before re-running
+- Files are executed in **numeric-prefix order** (`9_` before `10_`) and split on the `;` delimiter. A file without a numeric/timestamp prefix logs a warning — its order is undefined
+- State is tracked (row-existence) in the `tina4_migration` table (auto-created per engine): a migration runs once — if a row for it exists, it is skipped. (A vestigial `passed` column exists for back-compat; only applied = `passed=1` rows are ever written — failures are never recorded as `passed=0`.)
+- **Each migration FILE is wrapped in its own transaction**: on a failure the file rolls back and `migrate()` **raises** (it does not write `passed=0`, delete anything, or `sys.exit`). Already-applied files stay applied — fix the bad file and re-run. The explicit `tina4 migrate` CLI surfaces the raise as a non-zero exit; startup auto-migration logs it and the service still boots (see TINA4_AUTO_MIGRATE above).
+- **Atomicity caveat:** per-file transactions are truly atomic only on engines with **transactional DDL (PostgreSQL)**. MySQL, Firebird, and SQLite auto-commit DDL, so a multi-statement migration that fails midway on those engines leaves earlier statements applied — keep one logical change per file. CREATE TABLE / ALTER-ADD are made idempotent on Firebird/MSSQL (existence-checked) so a re-run doesn't error.
 
 ### Engine-specific DDL patterns
 
@@ -1617,7 +1622,7 @@ TINA4_DATABASE_PASSWORD=                 # DB password
 
 # Framework
 TINA4_DEBUG=true                  # Enable dev mode (toolbar, live reload, error overlay)
-TINA4_LOG_LEVEL=ERROR             # Log verbosity: ALL, DEBUG, INFO, WARNING, ERROR (default: ERROR)
+TINA4_LOG_LEVEL=INFO              # Log verbosity: ALL, DEBUG, INFO, WARNING, ERROR, CRITICAL (default: INFO)
 TINA4_LOCALE=en                   # Language for framework messages (en, fr, af, zh, ja, es)
 TINA4_DEFAULT_WEBSERVER=FALSE     # Set to TRUE to use Tina4's built-in webserver instead of ASGI
 TINA4_OVERRIDE_CLIENT=false       # Set to true to allow running without tina4 CLI (e.g. Docker)
@@ -1628,20 +1633,30 @@ TINA4_SESSION_BACKEND=SessionFileHandler  # SessionFileHandler, SessionRedisHand
 TINA4_SESSION_SAMESITE=Lax               # SameSite attribute for session cookies (default: Lax)
 
 # Swagger/OpenAPI
-SWAGGER_TITLE=Tina4 API           # API title (default: "Tina4 API")
-SWAGGER_VERSION=1.0.0             # API version
-SWAGGER_DESCRIPTION=              # API description
-SWAGGER_CONTACT_TEAM=             # Contact name
-SWAGGER_CONTACT_URL=              # Contact URL
-SWAGGER_CONTACT_EMAIL=            # Contact email
-SWAGGER_DEV_URL=http://localhost:7145  # Dev server URL for Swagger
-```
+TINA4_SWAGGER_ENABLED=            # on/off for /swagger UI + /swagger/openapi.json. Explicit true/false wins; unset falls back to TINA4_DEBUG. Set false to DISABLE swagger in any environment; true to expose it in production
+TINA4_SWAGGER_TITLE=Tina4 API     # API title (default: "Tina4 API")
+TINA4_SWAGGER_VERSION=1.0.0       # API version
+TINA4_SWAGGER_DESCRIPTION=        # API description
+TINA4_SWAGGER_CONTACT_TEAM=       # Contact name (legacy SWAGGER_CONTACT_TEAM still read as fallback)
+TINA4_SWAGGER_CONTACT_URL=        # Contact URL  (legacy SWAGGER_CONTACT_URL  still read as fallback)
+TINA4_SWAGGER_CONTACT_EMAIL=      # Contact email
+TINA4_SWAGGER_LICENSE=            # SPDX license name (e.g. MIT) for info.license
+TINA4_SWAGGER_SERVERS=            # comma-separated server URLs for the OpenAPI servers[] block; falls back to SWAGGER_DEV_URL
+TINA4_SWAGGER_UI_CDN=             # base URL for the Swagger UI assets (default jsdelivr); point at a self-hosted mirror for air-gapped use
+SWAGGER_DEV_URL=http://localhost:7145  # single dev-server URL (used when TINA4_SWAGGER_SERVERS is unset)
+```
+
+The spec is OpenAPI 3.0.3. ORM models registered via AutoCrud become reusable
+`components.schemas` referenced by `$ref`, and secured routes emit a `bearerAuth`
+security requirement. Set `TINA4_SWAGGER_ENABLED=false` to turn the endpoints off
+anywhere (the production on/off switch, wired for real in 3.13.40).
 
 ### Debug levels
-- `ALL` / `DEBUG` — enables DevReload, hot-patching, verbose logging, error overlay
-- `INFO` — standard logging
-- `WARNING` — warnings and errors only
-- `ERROR` — errors only
+- `ALL` / `DEBUG` — most verbose; every level on the console
+- `INFO` — standard logging (default)
+- `WARNING` — warnings, errors, and critical
+- `ERROR` — errors and critical
+- `CRITICAL` — critical only (highest severity; `Log.critical()` always logs)
 
 ## CORS
 

{tina4_python-3.13.38 → tina4_python-3.13.40}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.13.38"
+__version__ = "3.13.40"
 
 # ── Route decorators ──
 from tina4_python.core.router import (  # noqa: E402, F401

{tina4_python-3.13.38 → tina4_python-3.13.40}/tina4_python/api/__init__.py

@@ -10,12 +10,57 @@ Make HTTP requests without requests/httpx/aiohttp.
 """
 import json
 import ssl
+import time
 import base64
-from urllib.request import Request, urlopen
-from urllib.parse import urlencode
+from urllib.parse import urlencode, urlparse
+from urllib.request import Request, HTTPRedirectHandler, HTTPSHandler, build_opener
 from urllib.error import HTTPError, URLError
 
 
+# Statuses that warrant an automatic retry when ``max_retries`` > 0: rate-limit
+# (429) plus the transient server-side 5xx family. 4xx client errors (401,
+# 404, …) are NOT retried — a repeat won't succeed.
+_RETRY_STATUSES = frozenset({429, 500, 502, 503, 504})
+
+
+def _same_origin(url_a: str, url_b: str) -> bool:
+    """True when two URLs share scheme + host + (effective) port."""
+    a, b = urlparse(url_a), urlparse(url_b)
+    default = {"http": 80, "https": 443}
+    pa = a.port if a.port is not None else default.get(a.scheme)
+    pb = b.port if b.port is not None else default.get(b.scheme)
+    return (a.scheme, a.hostname, pa) == (b.scheme, b.hostname, pb)
+
+
+class _AuthStripRedirectHandler(HTTPRedirectHandler):
+    """Follow redirects, but drop the Authorization header on a cross-origin hop.
+
+    Plain urllib forwards the Authorization header to ANY redirect target,
+    including a different host — so an ``api.get("/login")`` that 302s to
+    ``https://attacker.example/`` would hand the bearer token to the attacker.
+    Stripping it when the target origin (scheme/host/port) differs matches
+    requests/httpx and closes that leak, while same-origin redirects keep auth.
+    """
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        new_req = super().redirect_request(req, fp, code, msg, headers, newurl)
+        if new_req is not None and not _same_origin(req.full_url, newurl):
+            new_req.headers = {
+                k: v for k, v in new_req.headers.items() if k.lower() != "authorization"
+            }
+            new_req.unredirected_hdrs = {
+                k: v for k, v in getattr(new_req, "unredirected_hdrs", {}).items()
+                if k.lower() != "authorization"
+            }
+        return new_req
+
+
+def _open(req, timeout, opener):
+    """The single network-call indirection point (keeps the call site easy to
+    patch in tests). ``req`` stays the first positional arg on purpose."""
+    return opener.open(req, timeout=timeout)
+
+
 class Api:
     """HTTP client using urllib — zero external dependencies."""
 
@@ -25,7 +70,9 @@ class Api:
                  username: str | None = None,
                  password: str | None = None,
                  headers: dict[str, str] | None = None,
-                 verify_ssl: bool | None = None):
+                 verify_ssl: bool | None = None,
+                 max_retries: int = 0,
+                 retry_backoff: float = 0.5):
         """HTTP client.
 
         Constructor accepts ergonomic kwargs the documentation has long
@@ -44,12 +91,21 @@ class Api:
         ``verify_ssl`` is the docs-friendly inverse of ``ignore_ssl`` —
         ``verify_ssl=False`` is equivalent to ``ignore_ssl=True``. If
         both are supplied, ``ignore_ssl`` wins (legacy precedence).
+
+        ``max_retries`` (default 0 = off) enables automatic retry with
+        exponential backoff (``retry_backoff`` seconds base, doubling each
+        attempt) on a transport error or a retryable status (429/5xx). A
+        retried non-idempotent request (POST/…) may be re-sent — retries are
+        opt-in for that reason.
         """
         self.base_url = base_url.rstrip("/")
         self.auth_header = auth_header
         self.timeout = timeout
+        self.max_retries = max(0, int(max_retries))
+        self.retry_backoff = retry_backoff
         self._headers: dict[str, str] = {}
         self._ssl_context = None
+        self._opener_cache = None
 
         # ── kwarg sugar ────────────────────────────────────────────────
         # Bearer token wins over basic auth if both are passed.
@@ -120,9 +176,17 @@ class Api:
             return path
         return f"{self.base_url}/{path.lstrip('/')}" if path else self.base_url
 
-    def _request(self, method: str, url: str, body=None,
-                 content_type: str = "application/json") -> dict:
-        """Execute HTTP request. Returns standardized result dict."""
+    def _opener(self):
+        """Build (once) an opener that follows redirects but strips the
+        Authorization header on a cross-origin hop, honouring the SSL context."""
+        if self._opener_cache is None:
+            handlers = [_AuthStripRedirectHandler()]
+            if self._ssl_context is not None:
+                handlers.append(HTTPSHandler(context=self._ssl_context))
+            self._opener_cache = build_opener(*handlers)
+        return self._opener_cache
+
+    def _build_request(self, method: str, url: str, body, content_type: str) -> Request:
         headers = dict(self._headers)
         if self.auth_header:
             headers["Authorization"] = self.auth_header
@@ -139,10 +203,32 @@ class Api:
                 data = body
                 headers["Content-Type"] = content_type
 
-        req = Request(url, data=data, headers=headers, method=method)
+        return Request(url, data=data, headers=headers, method=method)
+
+    def _request(self, method: str, url: str, body=None,
+                 content_type: str = "application/json") -> dict:
+        """Execute the request with opt-in retry/backoff. Returns a result dict.
+
+        With ``max_retries`` > 0, a transport failure (``http_code`` None) or a
+        retryable status (429/5xx) is retried up to ``max_retries`` times with
+        exponential backoff; any other outcome (2xx, 4xx, 3xx) returns at once.
+        """
+        req = self._build_request(method, url, body, content_type)
+        attempts = self.max_retries + 1
+        result = None
+        for attempt in range(attempts):
+            result = self._attempt(req)
+            code = result.get("http_code")
+            retryable = code is None or code in _RETRY_STATUSES
+            if not retryable or attempt == attempts - 1:
+                return result
+            time.sleep(self.retry_backoff * (2 ** attempt))
+        return result
 
+    def _attempt(self, req: Request) -> dict:
+        """A single HTTP attempt. Returns the standardized result dict."""
         try:
-            resp = urlopen(req, timeout=self.timeout, context=self._ssl_context)
+            resp = _open(req, self.timeout, self._opener())
             raw = resp.read().decode("utf-8", errors="replace")
             resp_headers = dict(resp.headers)
             try:

{tina4_python-3.13.38 → tina4_python-3.13.40}/tina4_python/auth/__init__.py

@@ -78,7 +78,11 @@ def _is_production() -> bool:
 _BLANK_SECRET_WARNING = (
     "Auth: TINA4_SECRET is not set — JWT signing is insecure. "
     "Set TINA4_SECRET to a random value (e.g. `openssl rand -hex 32`) "
-    "in your environment or .env before serving traffic."
+    "in your environment or .env before serving traffic. "
+    "For LOCAL DEV, set TINA4_DEBUG=true and a per-machine secret is generated "
+    "automatically into .env.local (gitignored). Seeing this warning means the "
+    "run was NOT detected as dev — typically a container or CI without "
+    "TINA4_DEBUG set, or TINA4_ENV=production."
 )
 
 

{tina4_python-3.13.38 → tina4_python-3.13.40}/tina4_python/core/middleware.py

@@ -138,7 +138,7 @@ class CorsMiddleware:
         )
         self.max_age = os.environ.get("TINA4_CORS_MAX_AGE", "86400")
         self.credentials = os.environ.get(
-            "TINA4_CORS_CREDENTIALS", "true"
+            "TINA4_CORS_CREDENTIALS", "false"
         ).lower() in ("true", "1", "yes")
 
     def allowed_origin(self, request_origin: str) -> str:

{tina4_python-3.13.38 → tina4_python-3.13.40}/tina4_python/core/request.py

@@ -71,7 +71,7 @@ class Request:
 
     __slots__ = (
         "method", "path", "url", "query_string", "params", "query", "headers",
-        "body", "raw_body", "cookies", "files", "ip",
+        "body", "raw_body", "cookies", "files", "ip", "remote_ip",
         "content_type", "session", "_route_params",
     )
 
@@ -88,6 +88,7 @@ class Request:
         self.cookies: dict = {}
         self.files: dict = {}
         self.ip: str = ""
+        self.remote_ip: str = ""        # Raw socket peer (never X-Forwarded-For) — for trust decisions
         self.content_type: str = ""
         self.session = None             # Set by session middleware
         self._route_params: dict = {}   # Dynamic route params ({id}, etc.)
@@ -107,6 +108,10 @@ class Request:
 
         req.content_type = req.headers.get("content-type", "")
         req.ip = _extract_ip(scope, req.headers)
+        # Raw socket peer address — NEVER honours X-Forwarded-For, so it can
+        # be trusted for loopback/remote authorisation (e.g. the MCP guard).
+        _client = scope.get("client")
+        req.remote_ip = _client[0] if _client else ""
 
         # Reconstruct the full absolute URL — scheme://host[:port]/path[?query].
         # Honours x-forwarded-proto and x-forwarded-host so apps behind a proxy

{tina4_python-3.13.38 → tina4_python-3.13.40}/tina4_python/core/router.py

@@ -178,9 +178,18 @@ class Router:
             "param_names": param_names,
             "param_types": param_types,
             "handler": handler,
+            # A WS route is public by default (like GET). @secured() requires a
+            # valid JWT on the upgrade. Read the flag here AND keep a back-ref so
+            # @secured() applied AFTER @websocket() (the other decorator order)
+            # can still flip it — mirrors the HTTP _route_ref pattern.
+            "auth_required": bool(getattr(handler, "_secured", False)),
         }
         _ws_routes.append(route)
-        Log.debug(f"WebSocket route registered: {path}")
+        try:
+            handler._ws_route_ref = route
+        except (AttributeError, TypeError):
+            pass
+        Log.debug(f"WebSocket route registered: {path} (auth={'required' if route['auth_required'] else 'public'})")
 
     @staticmethod
     def match_ws(path: str) -> tuple[dict | None, dict]:
@@ -735,6 +744,9 @@ def secured():
         # update the route dict directly.
         if hasattr(fn, "_route_ref"):
             fn._route_ref._route["auth_required"] = True
+        # Same for a WebSocket route registered by @websocket() below this one.
+        if hasattr(fn, "_ws_route_ref"):
+            fn._ws_route_ref["auth_required"] = True
         return fn
     return decorator