tina4-python 3.13.6__tar.gz → 3.13.7__tar.gz

{tina4_python-3.13.6 → tina4_python-3.13.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.6
+Version: 3.13.7
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.6 → tina4_python-3.13.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.6"
+version = "3.13.7"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.6 → tina4_python-3.13.7}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.13.6"
+__version__ = "3.13.7"
 
 # ── Route decorators ──
 from tina4_python.core.router import (  # noqa: E402, F401

{tina4_python-3.13.6 → tina4_python-3.13.7}/tina4_python/core/server.py

@@ -1307,9 +1307,38 @@ def _handle_route_error(
     error: Exception, request: Request, response: Response,
     request_id: str, is_dev: bool,
 ) -> Response:
-    """Format an error response for a failed route handler."""
+    """Format an error response for a failed route handler.
+
+    Two contracts (v3.13.7):
+
+    1. Fire ``tina4.request.error`` before rendering, so observers
+       (centralised logging, APM, Sentry) see the failure even though
+       the framework caught it. Payload is a single dict ``{exception,
+       request}`` — the canonical shape mirrored by PHP/Ruby/Node.
+       Listener exceptions are swallowed so a broken listener can't
+       break the 500 page.
+
+    2. In non-debug mode, never put the stack trace in the response
+       body (CWE-209). The trace is still available via ``Log.error``
+       above and the dev-admin ``BrokenTracker`` in dev mode. The
+       framework's own 500.twig now guards the trace block with
+       ``{% if error_message %}``.
+    """
     Log.error(f"Route error: {error}", path=request.path)
     _write_broken(request, error)
+
+    try:
+        from tina4_python.core.events import emit as _emit
+        _emit("tina4.request.error", {"exception": error, "request": request})
+    except Exception as listener_err:
+        try:
+            Log.warning(
+                f"Listener for tina4.request.error raised: "
+                f"{type(listener_err).__name__}: {listener_err}"
+            )
+        except Exception:
+            pass
+
     if is_dev:
         try:
             import traceback as _tb
@@ -1324,9 +1353,9 @@ def _handle_route_error(
         overlay_html = render_error_overlay(error, request)
         response.status(500).html(overlay_html)
     else:
-        import traceback
-        tb = traceback.format_exc()
-        html = _render_error_page(500, request.path, request_id, tb)
+        # Production: NO traceback in the body. The trace is logged via
+        # Log.error above; clients only see the generic page + request_id.
+        html = _render_error_page(500, request.path, request_id, "")
         if html:
             response.status(500).html(html)
         else:

{tina4_python-3.13.6 → tina4_python-3.13.7}/tina4_python/templates/errors/500.twig

@@ -27,7 +27,7 @@ body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; c
         <div class="error-title">Server Error</div>
     </div>
     <div class="error-msg">Something went wrong while processing your request.</div>
-    <pre class="error-trace">{{ error_message }}</pre>
+    {% if error_message %}<pre class="error-trace">{{ error_message }}</pre>{% endif %}
     <div class="error-footer">
         <span class="error-hint">Fix the error and save to auto-reload</span>
         <span class="error-id">{{ request_id }}</span>