tina4-python 3.13.78__tar.gz → 3.13.79__tar.gz

{tina4_python-3.13.78 → tina4_python-3.13.79}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.78
+Version: 3.13.79
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.78 → tina4_python-3.13.79}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.78"
+version = "3.13.79"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.78 → tina4_python-3.13.79}/tina4_python/core/request.py

@@ -70,8 +70,8 @@ class Request:
     """Parsed HTTP request — everything a route handler needs."""
 
     __slots__ = (
-        "method", "path", "url", "query_string", "params", "query", "headers",
-        "body", "raw_body", "cookies", "files", "ip", "remote_ip",
+        "method", "path", "url", "scheme", "query_string", "params", "query",
+        "headers", "body", "raw_body", "cookies", "files", "ip", "remote_ip",
         "content_type", "session", "_route_params", "_handler",
     )
 
@@ -79,6 +79,7 @@ class Request:
         self.method: str = "GET"
         self.path: str = "/"
         self.url: str = "/"
+        self.scheme: str = "http"       # Native connection scheme (see is_secure_scheme)
         self.query_string: str = ""
         self.params: dict = {}          # Query string + route params merged
         self.query: dict = {}           # Query string params only (separate from route params)
@@ -97,6 +98,27 @@ class Request:
                                         # middleware (e.g. CsrfMiddleware) can read
                                         # handler metadata like _noauth.
 
+    def is_secure_scheme(self) -> bool:
+        """True when the client's request scheme is https.
+
+        Proxy-aware: TLS is normally terminated at a proxy (nginx, HAProxy,
+        ALB, Cloudflare, most container deploys) which then forwards plain
+        HTTP, so the native ASGI scheme reads ``http`` on exactly the deploys
+        that ARE encrypted. ``x-forwarded-proto`` carries the scheme the
+        client actually used; the FIRST hop of a comma-separated chain
+        (``"https, http"``) is the client-facing one. Falls back to the
+        native connection scheme when no forwarded header is present.
+
+        This is the single source of truth for the URL scheme AND for the
+        Secure flag on the session cookie, so both agree instead of one
+        concluding ``https://`` while the other drops Secure (#95; mirrors
+        tina4-php ``Request::isSecureScheme()``, php#175).
+        """
+        forwarded = self.headers.get("x-forwarded-proto", "")
+        if forwarded:
+            return forwarded.split(",")[0].strip().lower() == "https"
+        return (self.scheme or "").lower() == "https"
+
     @classmethod
     def from_scope(cls, scope: dict, body: bytes = b"") -> "Request":
         """Build a Request from an ASGI scope + body."""
@@ -117,14 +139,16 @@ class Request:
         _client = scope.get("client")
         req.remote_ip = _client[0] if _client else ""
 
+        # Native connection scheme (ASGI: "http"/"https"; TLS terminated at a
+        # proxy shows "http" here — x-forwarded-proto carries the real one).
+        req.scheme = scope.get("scheme") or "http"
+
         # Reconstruct the full absolute URL — scheme://host[:port]/path[?query].
-        # Honours x-forwarded-proto and x-forwarded-host so apps behind a proxy
-        # still see the URL the client used. Matches PHP/Ruby/Node parity.
-        scheme = (
-            req.headers.get("x-forwarded-proto")
-            or scope.get("scheme")
-            or "http"
-        )
+        # is_secure_scheme() is the single source of truth for the scheme (and
+        # for the session cookie's Secure flag): it honours x-forwarded-proto
+        # (first hop of a comma chain wins) then the native scheme, so an app
+        # behind a TLS-terminating proxy still sees https. PHP/Ruby/Node parity.
+        scheme = "https" if req.is_secure_scheme() else "http"
         host = (
             req.headers.get("x-forwarded-host")
             or req.headers.get("host")

{tina4_python-3.13.78 → tina4_python-3.13.79}/tina4_python/core/server.py

@@ -1108,8 +1108,13 @@ def _init_session(request: Request) -> None:
     Session creation is skipped for WebSocket upgrade requests — they don't send
     cookies and would create orphaned session files that are never cleaned up.
     A session is only created when:
-      - A tina4_session cookie is already present (resume existing session), OR
+      - A session cookie is already present (resume existing session), OR
       - The request is a normal HTTP request (not a WebSocket upgrade)
+
+    The incoming cookie is read by the SAME configured name the write side emits
+    (``TINA4_SESSION_NAME``, default ``tina4_session``) via
+    ``session.session_cookie_name()`` — otherwise a renamed cookie would be
+    written but never read back and the session would silently never resume.
     """
     if request.session is not None:
         return
@@ -1122,12 +1127,13 @@ def _init_session(request: Request) -> None:
         return
 
     try:
-        from tina4_python.session import Session
+        from tina4_python.session import Session, session_cookie_name
         cookie_header = request.headers.get("cookie", "")
         sid_match = None
+        cookie_prefix = session_cookie_name() + "="
         for part in cookie_header.split(";"):
             part = part.strip()
-            if part.startswith("tina4_session="):
+            if part.startswith(cookie_prefix):
                 sid_match = part.split("=", 1)[1]
                 break
 
@@ -1770,9 +1776,15 @@ def _finalize_response(
                 request.session.save()
                 sid = request.session.session_id if hasattr(request.session, 'session_id') else getattr(request.session, 'id', None)
                 if sid:
-                    ttl = int(os.environ.get("TINA4_SESSION_TTL", "3600"))
-                    samesite = os.environ.get("TINA4_SESSION_SAMESITE", "Lax")
-                    response.header("set-cookie", f"tina4_session={sid}; Path=/; HttpOnly; SameSite={samesite}; Max-Age={ttl}")
+                    # Route through the single cookie-builder so every
+                    # TINA4_SESSION_* knob (Secure/HttpOnly/SameSite) and the
+                    # proxy-aware Secure detection actually take effect. Do NOT
+                    # hand-write a second Set-Cookie here — that bypass is what
+                    # made TINA4_SESSION_SECURE a silent no-op (#95).
+                    response.header(
+                        "set-cookie",
+                        request.session.cookie_header(request=request),
+                    )
             import random
             if random.randint(1, 100) == 1:
                 request.session.gc()

{tina4_python-3.13.78 → tina4_python-3.13.79}/tina4_python/session/__init__.py

@@ -18,6 +18,21 @@ import secrets
 from pathlib import Path
 
 
+def session_cookie_name() -> str:
+    """Resolve the session cookie name — the single source of truth shared by
+    the WRITE side (``Session.cookie_header``) and the READ side
+    (``core/server._init_session``), so a cookie written under a renamed name is
+    read back on the next request.
+
+        TINA4_SESSION_NAME   Cookie name (default: ``tina4_session``)
+
+    Keeping this in one place means the default can never drift between the two
+    sides: an operator who sets ``TINA4_SESSION_NAME`` renames the cookie on both
+    the emit and the parse paths at once.
+    """
+    return os.environ.get("TINA4_SESSION_NAME", "tina4_session")
+
+
 class SessionHandler:
     """Base class for session storage backends."""
 
@@ -379,7 +394,7 @@ class Session:
         result = self.flash(key)
         return result if result is not None else default
 
-    def cookie_header(self, cookie_name: str = None) -> str:
+    def cookie_header(self, cookie_name: str = None, request=None) -> str:
         """Return a Set-Cookie header value for this session.
 
         Cookie attributes are env-driven so deployments can flip security
@@ -387,17 +402,37 @@ class Session:
 
             TINA4_SESSION_NAME      Cookie name (default: tina4_session)
             TINA4_SESSION_HTTPONLY  HttpOnly flag (default: true)
-            TINA4_SESSION_SECURE    Secure flag (default: false). Set to
-                                    true only when serving over HTTPS.
+            TINA4_SESSION_SECURE    Secure flag (default: false). Forces
+                                    Secure on regardless of request scheme.
             TINA4_SESSION_SAMESITE  SameSite attribute (default: Lax)
+
+        The Secure attribute is set when ANY of the following holds:
+
+          1. TINA4_SESSION_SECURE is truthy (explicit opt-in), OR
+          2. SameSite is ``None`` — browsers reject SameSite=None without
+             Secure, OR
+          3. the request is really on https — detected proxy-aware via
+             ``request.is_secure_scheme()`` (honours x-forwarded-proto, first
+             hop of a comma chain), so a session behind a TLS-terminating
+             proxy still ships Secure (#95).
+
+        Plain HTTP with no proxy signal and no TLS stays non-Secure: a Secure
+        cookie over plain http is undeliverable and would silently break the
+        session. Pass ``request`` so the scheme can be detected; omit it and
+        only the env/SameSite signals apply.
         """
         if cookie_name is None:
-            cookie_name = os.environ.get("TINA4_SESSION_NAME", "tina4_session")
+            cookie_name = session_cookie_name()
         samesite = os.environ.get("TINA4_SESSION_SAMESITE", "Lax")
         # Default true for HttpOnly (matches v2 behaviour) — only drop the
         # flag when the operator explicitly opts out.
         httponly = str(os.environ.get("TINA4_SESSION_HTTPONLY", "true")).strip().lower() in ("true", "1", "yes", "on")
         secure = str(os.environ.get("TINA4_SESSION_SECURE", "false")).strip().lower() in ("true", "1", "yes", "on")
+        secure = (
+            secure
+            or samesite.strip().lower() == "none"
+            or (request is not None and request.is_secure_scheme())
+        )
 
         parts = [f"{cookie_name}={self._session_id}", "Path=/"]
         if httponly:
@@ -421,4 +456,5 @@ class Session:
 __all__ = [
     "Session", "SessionHandler",
     "FileSessionHandler", "DatabaseSessionHandler",
+    "session_cookie_name",
 ]