tina4-python 3.13.3__tar.gz → 3.13.4__tar.gz

{tina4_python-3.13.3 → tina4_python-3.13.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.3
+Version: 3.13.4
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.3 → tina4_python-3.13.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.3"
+version = "3.13.4"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.3 → tina4_python-3.13.4}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.13.3"
+__version__ = "3.13.4"
 
 # ── Route decorators ──
 from tina4_python.core.router import (  # noqa: E402, F401

{tina4_python-3.13.3 → tina4_python-3.13.4}/tina4_python/core/request.py

@@ -15,6 +15,57 @@ class PayloadTooLarge(Exception):
     pass
 
 
+class CaseInsensitiveDict(dict):
+    """Dict subclass for HTTP headers — string keys are case-insensitive.
+
+    HTTP header field-names are case-insensitive per RFC 7230 §3.2.
+    With this class, ``request.headers["Content-Type"]``,
+    ``request.headers.get("content-type")``, and
+    ``request.headers.get("CONTENT-TYPE")`` all return the same value.
+
+    Keys are stored lowercase internally. Cross-framework parity:
+    same behaviour now ships in tina4-php (Tina4\\Request),
+    tina4-ruby (Tina4::Request), tina4-nodejs (Tina4Request) so the
+    chapter 10 documented examples (``headers.get("Content-Type")``)
+    finally do what they read like. tina4-book#141 PY-10-03.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__()
+        if args or kwargs:
+            self.update(dict(*args, **kwargs))
+
+    @staticmethod
+    def _norm(key):
+        return key.lower() if isinstance(key, str) else key
+
+    def __setitem__(self, key, value):
+        super().__setitem__(self._norm(key), value)
+
+    def __getitem__(self, key):
+        return super().__getitem__(self._norm(key))
+
+    def __contains__(self, key):
+        return super().__contains__(self._norm(key))
+
+    def __delitem__(self, key):
+        super().__delitem__(self._norm(key))
+
+    def get(self, key, default=None):
+        return super().get(self._norm(key), default)
+
+    def setdefault(self, key, default=None):
+        return super().setdefault(self._norm(key), default)
+
+    def pop(self, key, *args):
+        return super().pop(self._norm(key), *args)
+
+    def update(self, *args, **kwargs):
+        # Route through __setitem__ so every key gets normalised.
+        for k, v in dict(*args, **kwargs).items():
+            self[k] = v
+
+
 class Request:
     """Parsed HTTP request — everything a route handler needs."""
 
@@ -31,7 +82,7 @@ class Request:
         self.query_string: str = ""
         self.params: dict = {}          # Query string + route params merged
         self.query: dict = {}           # Query string params only (separate from route params)
-        self.headers: dict = {}         # Lowercase header keys
+        self.headers: dict = CaseInsensitiveDict()  # Case-insensitive HTTP headers
         self.body: dict | str | None = None  # Parsed body
         self.raw_body: bytes = b""
         self.cookies: dict = {}

{tina4_python-3.13.3 → tina4_python-3.13.4}/tina4_python/core/router.py

@@ -687,7 +687,14 @@ def secured():
 # ── Middleware Decorator ───────────────────────────────────────
 
 def middleware(*middleware_classes):
-    """Attach middleware classes to a route handler."""
+    """Attach middleware classes or functions to a route handler.
+
+    Middleware is purely additive — it does NOT change the route's auth
+    requirement. POST/PUT/PATCH/DELETE routes stay Bearer-token-gated by
+    default. Use ``@noauth()`` to open a write route, ``@secured()`` to
+    lock a read route. This rule is the same across all four Tina4
+    frameworks (tina4-book#141, PY-10-02).
+    """
     def decorator(fn):
         fn._middleware = list(middleware_classes)
         # If route was already registered (decorator applied after @get/@post),
@@ -695,11 +702,9 @@ def middleware(*middleware_classes):
         if hasattr(fn, "_route_ref"):
             existing = fn._route_ref._route.get("middleware", [])
             fn._route_ref._route["middleware"] = list(middleware_classes) + existing
-            # Custom middleware means developer handles auth — disable built-in
-            # gate unless @secured() was explicitly set.
-            route = fn._route_ref._route
-            if not hasattr(fn, "_secured") and route.get("auth_required"):
-                route["auth_required"] = False
+            # Intentionally does NOT touch route["auth_required"]. Prior
+            # behaviour silently flipped it to False, creating an undocumented
+            # auth bypass for any write route that added custom middleware.
         return fn
     return decorator
 

{tina4_python-3.13.3 → tina4_python-3.13.4}/tina4_python/core/server.py

@@ -1151,10 +1151,40 @@ def _check_auth(request: Request, response: Response, route: dict) -> bool:
     return False
 
 
+def _is_function_middleware(mw) -> bool:
+    """A function-style middleware is a non-class callable that takes 3+ args.
+
+    Class-based middleware uses ``before_*`` / ``after_*`` method-name
+    dispatch. Function-based middleware uses Express/FastAPI-style
+    ``async def mw(request, response, next_handler)`` with a continuation
+    callable that invokes the next layer (or the route handler).
+    Documented in chapter 10 for 8+ examples; before tina4-book#141
+    PY-10-01 the framework silently ignored the function bodies.
+    """
+    import inspect
+    if isinstance(mw, type):
+        return False  # Class — class-based before_*/after_* dispatch
+    if not callable(mw):
+        return False
+    try:
+        sig = inspect.signature(mw)
+        # The third (or later) parameter is the next_handler continuation.
+        return len(sig.parameters) >= 3
+    except (TypeError, ValueError):
+        return False
+
+
 def _run_before_middleware(request: Request, response: Response, route: dict) -> tuple[Request, Response, bool]:
-    """Run before_* middleware methods. Returns (request, response, skip_handler)."""
+    """Run class-based before_* middleware methods. Returns (request, response, skip_handler).
+
+    Function-style ``async def mw(req, resp, next_handler)`` middleware is
+    skipped here — it's handled by ``_invoke_handler_with_middleware``
+    which wraps the route handler with each function's continuation.
+    """
     skip = False
     for _mw_cls in route.get("middleware", []):
+        if _is_function_middleware(_mw_cls):
+            continue  # Handled by the continuation wrapper instead
         _mw_inst = _mw_cls() if isinstance(_mw_cls, type) else _mw_cls
         for _attr_name in dir(_mw_inst):
             if _attr_name.startswith("before_"):
@@ -1172,8 +1202,15 @@ def _run_before_middleware(request: Request, response: Response, route: dict) ->
 
 
 def _run_after_middleware(request: Request, response: Response, route: dict) -> tuple[Request, Response]:
-    """Run after_* middleware methods."""
+    """Run class-based after_* middleware methods.
+
+    Function-style middleware that wraps the handler (with next_handler)
+    handles its own "after" code on the return path — no separate pass
+    needed for it here.
+    """
     for _mw_cls in route.get("middleware", []):
+        if _is_function_middleware(_mw_cls):
+            continue
         _mw_inst = _mw_cls() if isinstance(_mw_cls, type) else _mw_cls
         for _attr_name in dir(_mw_inst):
             if _attr_name.startswith("after_"):
@@ -1185,6 +1222,53 @@ def _run_after_middleware(request: Request, response: Response, route: dict) ->
     return request, response
 
 
+def _make_mw_continuation(mw, inner_next):
+    """Build a `next_handler` continuation for a function-style middleware.
+
+    Captures `mw` and the next layer (`inner_next`) in a closure. When
+    invoked, calls `mw(req, resp, next_handler=inner_next)`. The
+    middleware is responsible for awaiting `inner_next(req, resp)` if it
+    wants the chain to continue — otherwise it short-circuits.
+    """
+    async def wrapper(req, resp):
+        return await mw(req, resp, inner_next)
+    return wrapper
+
+
+async def _invoke_handler_with_middleware(request: Request, response: Response, route: dict, params: dict) -> Response:
+    """Invoke the route handler, wrapping with any function-style middleware.
+
+    Function-style middleware (``async def mw(req, resp, next_handler)``)
+    forms a Russian-doll continuation chain — the first declared
+    middleware is the outermost layer; it calls ``next_handler`` to
+    descend, and the route handler is the innermost. Class-based
+    middleware is dispatched separately by ``_run_before_middleware`` /
+    ``_run_after_middleware`` and does not go through this wrapper.
+    """
+    fn_middlewares = [
+        mw for mw in route.get("middleware", [])
+        if _is_function_middleware(mw)
+    ]
+
+    if not fn_middlewares:
+        return await _invoke_handler(request, response, route, params)
+
+    # Build the chain from the inside out: innermost wraps the handler
+    # first, then each outer layer wraps that. The result is a callable
+    # `next_handler` that, when invoked, runs the whole chain.
+    async def call_route_handler(req, resp):
+        return await _invoke_handler(req, resp, route, params)
+
+    next_handler = call_route_handler
+    for mw in reversed(fn_middlewares):
+        next_handler = _make_mw_continuation(mw, next_handler)
+
+    result = await next_handler(request, response)
+    if isinstance(result, Response):
+        return result
+    return response
+
+
 async def _invoke_handler(request: Request, response: Response, route: dict, params: dict) -> Response:
     """Call the route handler with the correct arguments."""
     import inspect
@@ -1430,7 +1514,7 @@ async def handle(request: Request) -> Response:
             if not skip:
                 request, response, skip = _run_before_middleware(request, response, route)
             if not skip:
-                response = await _invoke_handler(request, response, route, params)
+                response = await _invoke_handler_with_middleware(request, response, route, params)
             request, response = _run_after_middleware(request, response, route)
         except Exception as e:
             response = _handle_route_error(e, request, response, request_id, _is_dev)