tina4-python 3.13.85__tar.gz → 3.13.86__tar.gz

{tina4_python-3.13.85 → tina4_python-3.13.86}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.85
+Version: 3.13.86
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.85 → tina4_python-3.13.86}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.85"
+version = "3.13.86"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

tina4_python-3.13.86/tina4_python/__init__.py

@@ -0,0 +1,190 @@
+# Tina4 Python v3.0 — The Intelligent Native Application 4ramework.
+# Copyright 2007 - present Tina4
+# License: MIT https://opensource.org/licenses/MIT
+"""
+Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
+
+    from tina4_python import get, post, ORM, Database, Frond, Auth, Queue
+
+One import, everything works.
+"""
+def _resolve_version() -> str:
+    """Resolve the package version from a single source of truth.
+
+    Derive it rather than hardcode it, so a release only has to bump
+    ``pyproject.toml`` and can never leave this constant stale (which used to
+    make the dev toolbar and ``docs._detect_version`` under-report). Mirrors how
+    Node reads package.json and PHP resolves ``App::$VERSION`` at runtime.
+
+    Order:
+      1. The repo's own ``pyproject.toml`` (a source checkout is authoritative
+         and current; installed metadata can lag an un-synced checkout). Guarded
+         by the project name so a copy vendored under another app's pyproject
+         can't hijack the version.
+      2. Installed distribution metadata (the shipped wheel has no pyproject).
+      3. A floor literal (last resort only).
+    """
+    try:
+        import pathlib
+        import tomllib
+        pyproject = pathlib.Path(__file__).resolve().parent.parent / "pyproject.toml"
+        if pyproject.exists():
+            with pyproject.open("rb") as fh:
+                project = tomllib.load(fh).get("project", {})
+            if project.get("name") == "tina4-python" and project.get("version"):
+                return project["version"]
+    except Exception:
+        pass
+    try:
+        from importlib.metadata import PackageNotFoundError, version
+        try:
+            return version("tina4-python")
+        except PackageNotFoundError:
+            pass
+    except Exception:
+        pass
+    return "3.13.56"
+
+
+__version__ = _resolve_version()
+
+# ══════════════════════════════════════════════════════════════════════════
+# LAZY FEATURE LOADING (PEP 562 module __getattr__)
+# ══════════════════════════════════════════════════════════════════════════
+# A batteries-included framework should not pay to import all ~98 features on
+# every boot. Only the CORE surface below is imported eagerly; every optional
+# subsystem is registered in _LAZY and imported on FIRST reference via
+# ``__getattr__``. An app that never touches GraphQL/WSDL/MQTT/Messenger never
+# loads those modules — so a production runtime's footprint matches the app.
+# ``from tina4_python import GraphQL`` still works: the miss routes through
+# ``__getattr__``, which imports the module, caches the name in globals(), and
+# returns it (so later access skips the hook). See plan/v3/feature-preload-manifest.md.
+
+# ── CORE (always eager) — every app needs these to boot + serve ──
+from tina4_python.core.router import (  # noqa: E402, F401
+    get, post, put, patch, delete, any_method,
+    noauth, secured, cached, middleware, template,
+    Router, RouteGroup,
+)
+from tina4_python.core.constants import (  # noqa: E402, F401
+    HTTP_OK, HTTP_CREATED, HTTP_ACCEPTED, HTTP_NO_CONTENT,
+    HTTP_MOVED, HTTP_REDIRECT, HTTP_NOT_MODIFIED,
+    HTTP_BAD_REQUEST, HTTP_UNAUTHORIZED, HTTP_FORBIDDEN,
+    HTTP_NOT_FOUND, HTTP_METHOD_NOT_ALLOWED, HTTP_CONFLICT,
+    HTTP_GONE, HTTP_UNPROCESSABLE, HTTP_TOO_MANY,
+    HTTP_SERVER_ERROR, HTTP_BAD_GATEWAY, HTTP_UNAVAILABLE,
+    APPLICATION_JSON, APPLICATION_XML, APPLICATION_FORM,
+    APPLICATION_OCTET, TEXT_HTML, TEXT_PLAIN, TEXT_CSV, TEXT_XML,
+)
+from tina4_python.core.server import (  # noqa: E402, F401
+    run, background, background_task_count, stop_all_background_tasks,
+)
+from tina4_python.core.events import on, emit, once, off  # noqa: E402, F401
+from tina4_python.env import Env  # noqa: E402, F401
+
+# ── OPTIONAL (lazy) — public name -> (submodule, attribute) ──
+_LAZY: dict[str, tuple[str, str]] = {
+    # Database + ORM
+    "Database": ("tina4_python.database", "Database"),
+    "ORM": ("tina4_python.orm", "ORM"),
+    "bind_database": ("tina4_python.orm", "bind_database"),
+    "Field": ("tina4_python.orm", "Field"),
+    "IntegerField": ("tina4_python.orm", "IntegerField"),
+    "StringField": ("tina4_python.orm", "StringField"),
+    "BooleanField": ("tina4_python.orm", "BooleanField"),
+    "FloatField": ("tina4_python.orm", "FloatField"),
+    "DateTimeField": ("tina4_python.orm", "DateTimeField"),
+    "TextField": ("tina4_python.orm", "TextField"),
+    "BlobField": ("tina4_python.orm", "BlobField"),
+    "NumericField": ("tina4_python.orm", "NumericField"),
+    "JSONField": ("tina4_python.orm", "JSONField"),
+    "ForeignKeyField": ("tina4_python.orm", "ForeignKeyField"),
+    "IntField": ("tina4_python.orm", "IntField"),
+    "StrField": ("tina4_python.orm", "StrField"),
+    "BoolField": ("tina4_python.orm", "BoolField"),
+    "has_many": ("tina4_python.orm", "has_many"),
+    "has_one": ("tina4_python.orm", "has_one"),
+    "belongs_to": ("tina4_python.orm", "belongs_to"),
+    # Auth
+    "Auth": ("tina4_python.auth", "Auth"),
+    # Queue
+    "Queue": ("tina4_python.queue", "Queue"),
+    # MQTT
+    "Mqtt": ("tina4_python.mqtt", "Mqtt"),
+    "MqttMessage": ("tina4_python.mqtt", "MqttMessage"),
+    "MqttError": ("tina4_python.mqtt", "MqttError"),
+    # Template engine
+    "Frond": ("tina4_python.frond", "Frond"),
+    # Response cache
+    "ResponseCache": ("tina4_python.cache", "ResponseCache"),
+    "cache_stats": ("tina4_python.cache", "cache_stats"),
+    "clear_cache": ("tina4_python.cache", "clear_cache"),
+    # DI container
+    "Container": ("tina4_python.container", "Container"),
+    # HTTP client
+    "Api": ("tina4_python.api", "Api"),
+    # SOAP / WSDL
+    "WSDL": ("tina4_python.wsdl", "WSDL"),
+    "wsdl_operation": ("tina4_python.wsdl", "wsdl_operation"),
+    # GraphQL
+    "GraphQL": ("tina4_python.graphql", "GraphQL"),
+    # Auto-CRUD
+    "AutoCrud": ("tina4_python.crud", "AutoCrud"),
+    # Email
+    "Messenger": ("tina4_python.messenger", "Messenger"),
+    # Realtime / WebRTC
+    "realtime": ("tina4_python.realtime", "realtime"),
+    "RtcMediaBackend": ("tina4_python.realtime", "RtcMediaBackend"),
+    "MeshBackend": ("tina4_python.realtime", "MeshBackend"),
+    "StorageBackend": ("tina4_python.realtime.storage", "StorageBackend"),
+    "LocalStorage": ("tina4_python.realtime.storage", "LocalStorage"),
+    "S3Storage": ("tina4_python.realtime.storage", "S3Storage"),
+    # Inline testing
+    "tests": ("tina4_python.Testing", "tests"),
+    "assert_equal_inline": ("tina4_python.Testing", "assert_equal"),
+}
+
+
+def __getattr__(name: str):  # noqa: N807  (PEP 562 module-level hook)
+    """Import an optional subsystem on first reference, then cache it."""
+    spec = _LAZY.get(name)
+    if spec is None:
+        raise AttributeError(f"module 'tina4_python' has no attribute {name!r}")
+    import importlib
+    module_path, attr = spec
+    value = getattr(importlib.import_module(module_path), attr)
+    globals()[name] = value  # cache — subsequent access skips this hook
+    return value
+
+
+def __dir__() -> list[str]:
+    return sorted(set(globals()) | set(_LAZY))
+
+
+def _preload_from_manifest() -> None:
+    """Eager-warm the subsystems an app actually uses, from a generated
+    ``.tina4/preload.json`` (see plan/v3/feature-preload-manifest.md). No manifest,
+    or dev mode, means everything stays lazy — this is pure pre-warm, never a gate.
+    The lazy ``__getattr__`` above is what guarantees unused features never load.
+    """
+    import os
+    if os.environ.get("TINA4_DEBUG", "").lower() in ("true", "1", "yes", "on"):
+        return  # dev: leave everything lazy on-demand
+    try:
+        import json
+        import pathlib
+        manifest = pathlib.Path.cwd() / ".tina4" / "preload.json"
+        if not manifest.exists():
+            return
+        data = json.loads(manifest.read_text())
+        import importlib
+        for feature in data.get("features", []):
+            try:
+                importlib.import_module(f"tina4_python.{feature}")
+            except Exception:  # noqa: BLE001 — a bad manifest entry must not break boot
+                pass
+    except Exception:  # noqa: BLE001
+        pass
+
+
+_preload_from_manifest()

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/cli/__init__.py

@@ -54,9 +54,45 @@ def _to_snake(name: str) -> str:
     return re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", s1).lower()
 
 
+# Table names that collide with SQL reserved words. `CREATE TABLE order (...)`
+# is a syntax error on every engine, and the ORM interpolates table names into
+# SQL unquoted (and hands the raw name to driver insert/update/delete), so the
+# safe fix is to never GENERATE one. The plural form is not reserved and reads
+# naturally as a table name.
+SQL_RESERVED_TABLE_NAMES = {
+    "order", "group", "user", "table", "select", "from", "where", "index",
+    "key", "values", "column", "constraint", "check", "default", "primary",
+    "foreign", "references", "unique", "join", "union", "having", "limit",
+    "offset", "desc", "asc", "case", "when", "then", "else", "end", "and",
+    "or", "not", "null", "insert", "update", "delete", "create", "drop",
+    "alter", "grant", "revoke", "commit", "rollback", "view", "trigger",
+    "procedure", "function", "database", "schema", "session", "set", "into",
+    "as", "on", "by", "inner", "outer", "left", "right", "full", "natural",
+    "using", "with", "distinct", "between", "exists", "like", "in", "is",
+    "all", "any", "cross", "add", "row", "rows", "range", "current", "to",
+}
+
+
+def _pluralize_table(name: str) -> str:
+    """Simple English plural, used to escape a reserved table name."""
+    if name.endswith("y") and not name.endswith(("ay", "ey", "iy", "oy", "uy")):
+        return name[:-1] + "ies"
+    if name.endswith(("s", "x", "z", "ch", "sh")):
+        return name + "es"
+    return name + "s"
+
+
 def _to_table(name: str) -> str:
-    """Class name → singular table name: Product → product."""
-    return _to_snake(name)
+    """Class name → singular table name: Product → product.
+
+    A name colliding with a SQL reserved word is pluralised instead
+    (Order → orders). Every generator routes through here, so the model's
+    ``table_name``, the migration DDL, the routes and the tests all agree.
+    """
+    table = _to_snake(name)
+    if table in SQL_RESERVED_TABLE_NAMES:
+        return _pluralize_table(table)
+    return table
 
 
 def _parse_fields(fields_str: str) -> list[tuple[str, str]]:

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/core/router.py

@@ -341,6 +341,11 @@ class Router:
             "param_names": param_names,
             "param_types": param_types,
             "handler": handler,
+            # Which module registered this route. Lets dev hot-reload purge a
+            # changed module's OLD routes before re-importing it — otherwise a
+            # renamed or deleted endpoint keeps serving its stale handler,
+            # because replace-semantics only match an identical (method, path).
+            "module": getattr(handler, "__module__", ""),
             "middleware": effective_middleware,
             "auth_required": auth_required,
             "cached": options.get("cached", False),
@@ -452,6 +457,25 @@ class Router:
         """Return all registered routes (debug-friendly)."""
         return _routes
 
+    @staticmethod
+    def remove_routes_for_module(module_name: str) -> int:
+        """Drop every route registered by ``module_name``. Returns the count.
+
+        Used by dev hot-reload BEFORE re-importing a changed module: its
+        decorators then re-register whatever the file currently declares. Without
+        this, replace-semantics only overwrite an identical (method, path), so a
+        renamed or deleted endpoint would keep serving its stale handler until a
+        full restart — you "remove" a route and it still answers.
+        """
+        if not module_name:
+            return 0
+        removed = 0
+        for registry in (_routes, _ws_routes):
+            keep = [r for r in registry if r.get("module") != module_name]
+            removed += len(registry) - len(keep)
+            registry[:] = keep
+        return removed
+
     @staticmethod
     def clear():
         """Clear all routes (for testing)."""

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/core/server.py

@@ -301,10 +301,20 @@ def _auto_discover(root_dir: str = "src"):
                 # tina4_python.* / third-party module would break shared
                 # singletons and class identity — never do that here.
                 if module_name == root_pkg or module_name.startswith(root_pkg + "."):
+                    # Purge this module's OLD routes first. Re-importing only
+                    # OVERWRITES an identical (method, path), so a renamed or
+                    # deleted endpoint would otherwise keep serving its stale
+                    # handler until a full restart. The decorators below
+                    # re-register whatever the file declares NOW.
+                    from tina4_python.core.router import Router
+                    dropped = Router.remove_routes_for_module(module_name)
                     del sys.modules[module_name]
                     importlib.import_module(module_name)
                     _discovered_mtimes[module_name] = current_mtime
-                    Log.info(f"Reloaded changed module: {module_name}")
+                    Log.info(
+                        f"Reloaded changed module: {module_name}"
+                        + (f" (dropped {dropped} stale route(s))" if dropped else "")
+                    )
                 else:
                     # Out-of-scope module changed — record mtime so we don't
                     # keep re-evaluating it, but do not re-import it.

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/database/adapter.py

@@ -479,6 +479,35 @@ class DatabaseAdapter:
         """Execute a read query and return a single row or None."""
         raise NotImplementedError
 
+    #: Identifier quoting for this dialect. ANSI double quotes work on SQLite,
+    #: PostgreSQL and Firebird; MySQL and SQL Server override this.
+    IDENTIFIER_QUOTE = ('"', '"')
+
+    def quote_identifier(self, name: str) -> str:
+        """Quote a table/column name so a SQL reserved word can be used.
+
+        ``CREATE TABLE order (...)`` / ``SELECT * FROM order`` are syntax errors
+        on every engine; quoting makes ``order``, ``group``, ``user`` etc. usable
+        as names. Idempotent (an already-quoted name is returned unchanged) and
+        dot-aware (``schema.table`` quotes each part).
+
+        A raw expression is never quoted — ``*``, ``COUNT(*)`` and anything that
+        isn't a plain identifier are passed through untouched, so existing
+        hand-written SQL keeps working.
+        """
+        if not name:
+            return name
+        open_q, close_q = self.IDENTIFIER_QUOTE
+        name = name.strip()
+        if name.startswith(open_q) and name.endswith(close_q):
+            return name
+        if "." in name:
+            return ".".join(self.quote_identifier(p) for p in name.split("."))
+        # Only quote a plain identifier — leave expressions/wildcards alone.
+        if not name.replace("_", "").replace("$", "").isalnum():
+            return name
+        return f"{open_q}{name.replace(close_q, close_q * 2)}{close_q}"
+
     def insert(self, table: str, data: dict | list) -> DatabaseResult:
         """Insert one or more rows.
 
@@ -492,9 +521,9 @@ class DatabaseAdapter:
                 return DatabaseResult()
             # All dicts must have the same keys
             keys = list(data[0].keys())
-            columns = ", ".join(keys)
+            columns = ", ".join(self.quote_identifier(k) for k in keys)
             placeholders = ", ".join(["?"] * len(keys))
-            sql = f"INSERT INTO {table} ({columns}) VALUES ({placeholders})"
+            sql = f"INSERT INTO {self.quote_identifier(table)} ({columns}) VALUES ({placeholders})"
             params_list = [list(row[k] for k in keys) for row in data]
             return self.execute_many(sql, params_list)
         raise NotImplementedError
@@ -526,7 +555,7 @@ class DatabaseAdapter:
 
         if isinstance(filter_sql, dict):
             # Build WHERE from dict
-            where_parts = [f"{k} = ?" for k in filter_sql.keys()]
+            where_parts = [f"{self.quote_identifier(k)} = ?" for k in filter_sql.keys()]
             where_sql = " AND ".join(where_parts)
             return self.delete(table, where_sql, list(filter_sql.values()))
 

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/database/connection.py

@@ -664,6 +664,14 @@ class Database:
             return result
         return self._fetch_one_direct(sql, params)
 
+    def quote_identifier(self, name: str) -> str:
+        """Quote a table/column name for THIS connection's dialect.
+
+        Exposed so the ORM can build SQL that survives a reserved-word name
+        (``table_name = "order"``) without knowing which driver is bound.
+        """
+        return self._get_adapter().quote_identifier(name)
+
     def insert(self, table: str, data: dict | list) -> DatabaseResult:
         if self._cache_enabled:
             self._cache_invalidate()

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/database/firebird.py

@@ -375,15 +375,15 @@ class FirebirdAdapter(DatabaseAdapter):
         return row
 
     def insert(self, table: str, data: dict) -> DatabaseResult:
-        columns = ", ".join(data.keys())
+        columns = ", ".join(self.quote_identifier(c) for c in data.keys())
         placeholders = ", ".join(["?"] * len(data))
-        sql = f"INSERT INTO {table} ({columns}) VALUES ({placeholders})"
+        sql = f"INSERT INTO {self.quote_identifier(table)} ({columns}) VALUES ({placeholders})"
         return self.execute(sql, list(data.values()))
 
     def update(self, table: str, data: dict,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
-        set_clause = ", ".join(f"{k} = ?" for k in data.keys())
-        sql = f"UPDATE {table} SET {set_clause}"
+        set_clause = ", ".join(f"{self.quote_identifier(k)} = ?" for k in data.keys())
+        sql = f"UPDATE {self.quote_identifier(table)} SET {set_clause}"
         all_params = list(data.values())
 
         if filter_sql:
@@ -394,7 +394,7 @@ class FirebirdAdapter(DatabaseAdapter):
 
     def delete(self, table: str,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
-        sql = f"DELETE FROM {table}"
+        sql = f"DELETE FROM {self.quote_identifier(table)}"
         if filter_sql:
             sql += f" WHERE {filter_sql}"
         return self.execute(sql, params or [])

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/database/mssql.py

@@ -12,6 +12,9 @@ from tina4_python.database.adapter import DatabaseAdapter, DatabaseResult, SQLTr
 
 
 class MSSQLAdapter(DatabaseAdapter):
+    #: SQL Server uses bracketed identifiers.
+    IDENTIFIER_QUOTE = ("[", "]")
+
     """Microsoft SQL Server database driver using pymssql."""
 
     def __init__(self):
@@ -173,15 +176,15 @@ class MSSQLAdapter(DatabaseAdapter):
         # 'keys'`` because this override only handled the single-dict case.)
         if isinstance(data, list):
             return super().insert(table, data)
-        columns = ", ".join(data.keys())
+        columns = ", ".join(self.quote_identifier(c) for c in data.keys())
         placeholders = ", ".join(["%s"] * len(data))
-        sql = f"INSERT INTO {table} ({columns}) VALUES ({placeholders})"
+        sql = f"INSERT INTO {self.quote_identifier(table)} ({columns}) VALUES ({placeholders})"
         return self.execute(sql, list(data.values()))
 
     def update(self, table: str, data: dict,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
         set_clause = ", ".join(f"{k} = %s" for k in data.keys())
-        sql = f"UPDATE {table} SET {set_clause}"
+        sql = f"UPDATE {self.quote_identifier(table)} SET {set_clause}"
         all_params = list(data.values())
 
         if filter_sql:
@@ -193,7 +196,7 @@ class MSSQLAdapter(DatabaseAdapter):
 
     def delete(self, table: str,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
-        sql = f"DELETE FROM {table}"
+        sql = f"DELETE FROM {self.quote_identifier(table)}"
         if filter_sql:
             translated_filter = SQLTranslator.placeholder_style(filter_sql, "%s")
             sql += f" WHERE {translated_filter}"

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/database/mysql.py

@@ -12,6 +12,9 @@ from tina4_python.database.adapter import DatabaseAdapter, DatabaseResult, SQLTr
 
 
 class MySQLAdapter(DatabaseAdapter):
+    #: MySQL quotes identifiers with backticks (ANSI_QUOTES is not the default).
+    IDENTIFIER_QUOTE = ("`", "`")
+
     """MySQL/MariaDB database driver using mysql-connector-python."""
 
     def __init__(self):
@@ -148,15 +151,15 @@ class MySQLAdapter(DatabaseAdapter):
         # 'keys'`` because this override only handled the single-dict case.)
         if isinstance(data, list):
             return super().insert(table, data)
-        columns = ", ".join(data.keys())
+        columns = ", ".join(self.quote_identifier(c) for c in data.keys())
         placeholders = ", ".join(["%s"] * len(data))
-        sql = f"INSERT INTO {table} ({columns}) VALUES ({placeholders})"
+        sql = f"INSERT INTO {self.quote_identifier(table)} ({columns}) VALUES ({placeholders})"
         return self.execute(sql, list(data.values()))
 
     def update(self, table: str, data: dict,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
         set_clause = ", ".join(f"{k} = %s" for k in data.keys())
-        sql = f"UPDATE {table} SET {set_clause}"
+        sql = f"UPDATE {self.quote_identifier(table)} SET {set_clause}"
         all_params = list(data.values())
 
         if filter_sql:
@@ -168,7 +171,7 @@ class MySQLAdapter(DatabaseAdapter):
 
     def delete(self, table: str,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
-        sql = f"DELETE FROM {table}"
+        sql = f"DELETE FROM {self.quote_identifier(table)}"
         if filter_sql:
             translated_filter = SQLTranslator.placeholder_style(filter_sql, "%s")
             sql += f" WHERE {translated_filter}"

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/database/odbc.py

@@ -114,15 +114,15 @@ class ODBCAdapter(DatabaseAdapter):
         return dict(zip(columns, row))
 
     def insert(self, table: str, data: dict) -> DatabaseResult:
-        columns = ", ".join(data.keys())
+        columns = ", ".join(self.quote_identifier(c) for c in data.keys())
         placeholders = ", ".join(["?"] * len(data))
-        sql = f"INSERT INTO {table} ({columns}) VALUES ({placeholders})"
+        sql = f"INSERT INTO {self.quote_identifier(table)} ({columns}) VALUES ({placeholders})"
         return self.execute(sql, list(data.values()))
 
     def update(self, table: str, data: dict,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
-        set_clause = ", ".join(f"{k} = ?" for k in data.keys())
-        sql = f"UPDATE {table} SET {set_clause}"
+        set_clause = ", ".join(f"{self.quote_identifier(k)} = ?" for k in data.keys())
+        sql = f"UPDATE {self.quote_identifier(table)} SET {set_clause}"
         all_params = list(data.values())
         if filter_sql:
             sql += f" WHERE {filter_sql}"
@@ -131,7 +131,7 @@ class ODBCAdapter(DatabaseAdapter):
 
     def delete(self, table: str,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
-        sql = f"DELETE FROM {table}"
+        sql = f"DELETE FROM {self.quote_identifier(table)}"
         if filter_sql:
             sql += f" WHERE {filter_sql}"
         return self.execute(sql, params or [])

{tina4_python-3.13.85 → tina4_python-3.13.86}/tina4_python/database/postgres.py

@@ -342,8 +342,6 @@ class PostgreSQLAdapter(DatabaseAdapter):
 
     def fetch(self, sql: str, params: list = None,
               limit: int = 100, offset: int = 0) -> DatabaseResult:
-        import psycopg2.extras
-
         # v3.13.12: strip trailing `;` before the framework wraps with
         # COUNT(*) and appends LIMIT/OFFSET — otherwise a user-supplied
         # `"SELECT * FROM users;"` produces invalid wrapped SQL.
@@ -356,13 +354,22 @@ class PostgreSQLAdapter(DatabaseAdapter):
         # _exec_with_handling's heal step.
         self._heal_aborted_txn()
 
-        cursor = self._conn.cursor(cursor_factory=psycopg2.extras.RealDictCursor)
-
-        # Count total rows
+        # A PLAIN cursor (tuples), not RealDictCursor. RealDictCursor builds a
+        # RealDictRow per row (an OrderedDict subclass -- a full dict allocation
+        # with per-row column-name binding) which the old code then COPIED again
+        # via dict(row): two dict allocations per row. Reading tuples and building
+        # each dict once from the cached column names avoids both. Measured on
+        # real PostgreSQL 16.14, a 5,000-row x 6-col fetch: 14.27ms -> 6.27ms
+        # (2.28x), byte-identical output incl. native types (int/bool/Decimal/None)
+        # -- cursor_factory only chooses the row CONTAINER, never value coercion,
+        # so psycopg2's type adaptation is unchanged.
+        cursor = self._conn.cursor()
+
+        # Count total rows (plain cursor -> read the scalar positionally, not ["cnt"])
         count_sql = f"SELECT COUNT(*) AS cnt FROM ({sql}) AS _count_subquery"
         try:
             self._safe_execute(cursor, count_sql, params)
-            total = cursor.fetchone()["cnt"]
+            total = cursor.fetchone()[0]
         except Exception as e:
             total = 0
             # v3.13.11 (issue #49 Gap 1): log the probe failure as a
@@ -393,7 +400,12 @@ class PostgreSQLAdapter(DatabaseAdapter):
             paginated_sql = f"{sql} LIMIT %s OFFSET %s"
             paginated_params = (params or []) + [limit, offset]
         self._exec_with_handling(cursor, paginated_sql, paginated_params)
-        rows = [self._decode_blobs(dict(row)) for row in cursor.fetchall()]
+        columns = [d[0] for d in cursor.description] if cursor.description else []
+        indexes = range(len(columns))
+        rows = [
+            self._decode_blobs({columns[i]: row[i] for i in indexes})
+            for row in cursor.fetchall()
+        ]
 
         # v3.13.15 (#51): rows are materialised above — close the implicit
         # read transaction so the connection doesn't sit idle-in-transaction.
@@ -434,15 +446,15 @@ class PostgreSQLAdapter(DatabaseAdapter):
         # 'keys'`` because this override only handled the single-dict case.)
         if isinstance(data, list):
             return super().insert(table, data)
-        columns = ", ".join(data.keys())
+        columns = ", ".join(self.quote_identifier(c) for c in data.keys())
         placeholders = ", ".join(["%s"] * len(data))
-        sql = f"INSERT INTO {table} ({columns}) VALUES ({placeholders}) RETURNING *"
+        sql = f"INSERT INTO {self.quote_identifier(table)} ({columns}) VALUES ({placeholders}) RETURNING *"
         return self.execute(sql, list(data.values()))
 
     def update(self, table: str, data: dict,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
         set_clause = ", ".join(f"{k} = %s" for k in data.keys())
-        sql = f"UPDATE {table} SET {set_clause}"
+        sql = f"UPDATE {self.quote_identifier(table)} SET {set_clause}"
         all_params = list(data.values())
 
         if filter_sql:
@@ -454,7 +466,7 @@ class PostgreSQLAdapter(DatabaseAdapter):
 
     def delete(self, table: str,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
-        sql = f"DELETE FROM {table}"
+        sql = f"DELETE FROM {self.quote_identifier(table)}"
         if filter_sql:
             translated_filter = SQLTranslator.placeholder_style(filter_sql, "%s")
             sql += f" WHERE {translated_filter}"