tina4-python 3.13.87__tar.gz → 3.13.89__tar.gz

{tina4_python-3.13.87 → tina4_python-3.13.89}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.87
+Version: 3.13.89
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.87 → tina4_python-3.13.89}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.87"
+version = "3.13.89"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.87 → tina4_python-3.13.89}/tina4_python/cli/__init__.py

@@ -110,6 +110,21 @@ def _parse_fields(fields_str: str) -> list[tuple[str, str]]:
     return result
 
 
+# Called without --fields, the generators fall back to a single `name` string
+# column. That default MUST be materialised here, in one place, and then flow
+# into the model, the migration, the template and the test alike. It used to
+# live only inside the model template, so `generate model X` / `generate crud X`
+# wrote a model declaring `name` while the migration - built from the parsed
+# field list, which was empty - created only id + created_at. The first write
+# then failed with "table x has no column named name".
+DEFAULT_FIELDS: list[tuple[str, str]] = [("name", "string")]
+
+
+def _fields_or_default(fields_str: str) -> list[tuple[str, str]]:
+    """Parsed --fields, or the default single `name` column when none given."""
+    return _parse_fields(fields_str) or list(DEFAULT_FIELDS)
+
+
 def _parse_flags(args: list[str]) -> tuple[dict, list[str]]:
     """Parse --key value and --flag from args. Returns (flags, positional)."""
     # Boolean-only flags that never take a value argument
@@ -1083,7 +1098,7 @@ def _gen_model(name: str, flags: dict, *, emit_test: bool = True):
     SQLite roundtrip test. Composite generators (crud/auth) pass emit_test=False
     and emit their own broader test instead.
     """
-    fields = _parse_fields(flags.get("fields", ""))
+    fields = _fields_or_default(flags.get("fields", ""))
     table = _to_table(name)
 
     # Determine which ORM field types we need to import
@@ -1091,20 +1106,15 @@ def _gen_model(name: str, flags: dict, *, emit_test: bool = True):
     for _, ftype in fields:
         info = FIELD_TYPE_MAP.get(ftype, FIELD_TYPE_MAP["string"])
         used_types.add(info["orm"])
-    if not fields:
-        used_types.add("StringField")
     used_types.add("DateTimeField")  # for created_at
 
     imports = ", ".join(sorted(used_types))
 
     # Build field lines
     field_lines = [f"    id = IntegerField(primary_key=True, auto_increment=True)"]
-    if fields:
-        for fname, ftype in fields:
-            info = FIELD_TYPE_MAP.get(ftype, FIELD_TYPE_MAP["string"])
-            field_lines.append(f"    {fname} = {info['orm']}()")
-    else:
-        field_lines.append("    name = StringField()")
+    for fname, ftype in fields:
+        info = FIELD_TYPE_MAP.get(ftype, FIELD_TYPE_MAP["string"])
+        field_lines.append(f"    {fname} = {info['orm']}()")
     field_lines.append("    created_at = DateTimeField()")
 
     # Write model file
@@ -1227,6 +1237,8 @@ async def get_{singular}(request, response):
 async def create_{singular}(request, response):
     """Create a new {singular}. {write_doc}"""
 {ext_create}    item = {model}.create(request.body)
+    if item is False:
+        return response({{"error": "Could not create {singular}"}}, 400)
     return response(item.to_dict(), 201)
 
 
@@ -1241,7 +1253,8 @@ async def update_{singular}(request, response):
 {ext_update}    for key, value in request.body.items():
         if hasattr(item, key) and key != "id":
             setattr(item, key, value)
-    item.save()
+    if item.save() is False:
+        return response({{"error": "Could not update {singular}"}}, 400)
     return response(item.to_dict())
 
 
@@ -1359,7 +1372,7 @@ def _gen_crud(name: str, flags: dict):
 
     tina4python generate crud Product --fields "name:string,price:float"
     """
-    fields = _parse_fields(flags.get("fields", ""))
+    fields = _fields_or_default(flags.get("fields", ""))
     table = _to_table(name)
     route_name = table + "s"  # routes are plural
 
@@ -1381,7 +1394,7 @@ def _gen_crud(name: str, flags: dict):
     template_path = template_dir / f"{route_name}.twig"
     if not template_path.exists():
         # Build column headers from fields
-        cols = [f for f, _ in fields] if fields else ["name"]
+        cols = [f for f, _ in fields]
         th = "\n                ".join(f"<th>{c.replace('_', ' ').title()}</th>" for c in cols)
         td = "\n                ".join(f"<td>{{{{ item.{c} }}}}</td>" for c in cols)
 
@@ -2685,14 +2698,14 @@ def _gen_view(name: str, flags: dict = None):
     tina4python generate view Product --fields "name:string,price:float"
     """
     flags = flags or {}
-    fields = _parse_fields(flags.get("fields", ""))
+    fields = _fields_or_default(flags.get("fields", ""))
     table = _to_table(name)
     route_name = table + "s"
 
     target = Path("src/templates/pages")
     target.mkdir(parents=True, exist_ok=True)
 
-    cols = [f for f, _ in fields] if fields else ["name"]
+    cols = [f for f, _ in fields]
 
     # List view
     list_path = target / f"{route_name}.twig"

{tina4_python-3.13.87 → tina4_python-3.13.89}/tina4_python/frond/engine.py

@@ -14,6 +14,7 @@ import re
 import html
 import hashlib
 import json
+import math
 import secrets
 import time
 from functools import lru_cache
@@ -1187,6 +1188,83 @@ def _dict_replace(s: str, mapping: dict) -> str:
 
 
 # Built-in filters
+def _json_safe(value) -> "SafeString":
+    """Serialize to JSON that is valid JSON, valid JavaScript, and safe in HTML.
+
+    THE cross-framework contract for ``json_encode`` / ``to_json`` / ``tojson``.
+    Keep the four implementations byte-identical; ``frond_expression_corpus.txt``
+    locks it.
+
+    Three things this must never do, each of which was a real bug:
+
+    1. **Never emit a non-finite literal.** ``json.dumps`` writes bare
+       ``Infinity``/``NaN`` by default. Neither is JSON -- ``JSON.parse`` throws
+       -- so the payload only survives when inlined straight into a ``<script>``.
+       The JSON spec has no infinity, so a non-finite number serializes as
+       ``null``, which is what ``JSON.stringify`` has always done. Reported as
+       tina4-php#184 by justin-k-bruce, who found it in production: two ``INF``
+       sort keys in a 657-row grid blanked the whole screen.
+    2. **Never emit nothing.** A serializer that fails must not collapse to an
+       empty string (or, worse, to something that still parses and means
+       something else). ``var ROWS = ;`` is at least a loud SyntaxError;
+       ``var ROWS = false;`` is valid JS carrying wrong data. Same fail-loud
+       contract the DB layer got: no swallow-to-empty.
+    3. **Never HTML-escape it.** Entity-encoding JSON produces
+       ``{&quot;a&quot;:1}``, which is a SyntaxError inside ``<script>`` -- it
+       breaks the filter's primary use. Instead escape only the characters that
+       are dangerous in HTML, as JSON ``\\uXXXX`` escapes, which keeps the output
+       valid JSON AND valid JS: ``</script>`` cannot terminate the block, and the
+       result is safe inside a single-quoted attribute. This is exactly what
+       Jinja2's ``tojson`` does, and it is why the result is marked SafeString.
+
+    U+2028 and U+2029 join that escape set. Both are legal inside a JSON string
+    and both were illegal inside a JavaScript string literal before ES2019, so an
+    unescaped one turns a valid payload into a SyntaxError on an older engine.
+
+    ``ensure_ascii=False`` keeps non-ASCII text as itself. PHP, Ruby and Node all
+    emit raw UTF-8; Python was the only one escaping to ``\\uXXXX``, so the four
+    disagreed byte-for-byte on any accented character. Raw wins on ADR-0004 -- it
+    is shorter, readable, and still valid JSON.
+
+    The sanitising walk runs ONLY on the failure path, so a well-formed payload
+    pays nothing beyond the escape pass.
+    """
+    try:
+        # allow_nan=False turns a non-finite into a raised ValueError instead of
+        # a bare Infinity token, so the happy path stays a single dumps() call.
+        text = json.dumps(
+            value, separators=(",", ":"), allow_nan=False, ensure_ascii=False, default=str
+        )
+    except (ValueError, TypeError):
+        text = json.dumps(
+            _json_sanitize(value), separators=(",", ":"), ensure_ascii=False, default=str
+        )
+    return SafeString(
+        text.replace("<", "\\u003c")
+        .replace(">", "\\u003e")
+        .replace("&", "\\u0026")
+        .replace("'", "\\u0027")
+        .replace("\u2028", "\\u2028")
+        .replace("\u2029", "\\u2029")
+    )
+
+
+def _json_sanitize(value):
+    """Replace anything json.dumps refuses with a JSON-representable stand-in.
+
+    Only reached when the happy path raised. Non-finite floats become ``None``
+    (the JSON spec has no Infinity/NaN); anything else unencodable is left for
+    ``default=str`` to stringify.
+    """
+    if isinstance(value, float):
+        return value if math.isfinite(value) else None
+    if isinstance(value, dict):
+        return {k: _json_sanitize(v) for k, v in value.items()}
+    if isinstance(value, (list, tuple)):
+        return [_json_sanitize(v) for v in value]
+    return value
+
+
 _BUILTIN_FILTERS = {
     "upper": lambda v, *a: str(v).upper(),
     "lower": lambda v, *a: str(v).lower(),
@@ -1220,9 +1298,9 @@ _BUILTIN_FILTERS = {
     "int": lambda v, *a: int(v) if v else 0,
     "float": lambda v, *a: float(v) if v else 0.0,
     "string": lambda v, *a: str(v),
-    "json_encode": lambda v, *a: json.dumps(v, separators=(",", ":")),
-    "to_json": lambda v, *a: SafeString(json.dumps(v, default=str, separators=(",", ":")).replace("<", "\\u003c").replace(">", "\\u003e").replace("&", "\\u0026")),
-    "tojson": lambda v, *a: SafeString(json.dumps(v, default=str, separators=(",", ":")).replace("<", "\\u003c").replace(">", "\\u003e").replace("&", "\\u0026")),
+    "json_encode": lambda v, *a: _json_safe(v),
+    "to_json": lambda v, *a: _json_safe(v),
+    "tojson": lambda v, *a: _json_safe(v),
     "js_escape": lambda v, *a: SafeString(str(v).replace("\\", "\\\\").replace("'", "\\'").replace('"', '\\"').replace("\n", "\\n").replace("\r", "\\r")),
     "json_decode": lambda v, *a: json.loads(v) if isinstance(v, str) else v,
     "keys": lambda v, *a: list(v.keys()) if isinstance(v, dict) else [],
@@ -1952,6 +2030,17 @@ class Frond:
             elif kind == "set":
                 self._handle_set(node.content, context)
 
+            elif kind == "set_block":
+                # {% set name %}...{% endset %} -- render the body and bind it,
+                # emitting nothing here. The captured value is a SafeString
+                # because it is template output that has already been escaped
+                # on the way in; re-escaping it at {{ name }} would double-encode
+                # every entity. Twig and Jinja2 both mark the capture safe.
+                if node.name:
+                    context[node.name] = SafeString(
+                        self._render_nodes(node.body, context)
+                    )
+
             elif kind == "include":
                 # Sandbox: check tag
                 if not (self._sandbox and self._allowed_tags is not None

{tina4_python-3.13.87 → tina4_python-3.13.89}/tina4_python/frond/parser.py

@@ -223,6 +223,21 @@ class SetNode:
     strip_before: bool = False
 
 
+@dataclass(slots=True)
+class SetBlockNode:
+    """{% set name %}...{% endset %} — capture the rendered body into ``name``.
+
+    Core syntax in BOTH reference engines (Twig and Jinja2) and broken in all
+    four Tina4 frameworks until 3.13.89: the body rendered inline where it stood
+    and the variable was never assigned, so ``{% set g %}hi{% endset %}[{{ g }}]``
+    printed ``hi[]`` instead of ``[hi]``.
+    """
+    kind = "set_block"
+    name: str = ""
+    body: list = field(default_factory=list)
+    strip_before: bool = False
+
+
 @dataclass(slots=True)
 class IncludeNode:
     """{% include "file" [with {...}] [ignore missing] %}."""
@@ -462,6 +477,28 @@ def _needs_live_strip(tokens: list, index: int, strip_before: bool) -> bool:
     return strip_before and index > 0 and tokens[index - 1][0] != TEXT
 
 
+# Every tag that OPENS a construct. An unknown tag is a typo, and 3.13.89 makes
+# it raise rather than render its body: a mistyped guard -- {% iff is_admin %}
+# instead of {% if is_admin %} -- used to render the gated content
+# UNCONDITIONALLY, so a reviewer saw a guard that was not there. Twig and Jinja2
+# both raise on an unknown tag; Frond now does too. There is no user-extension
+# point for tags in any of the four frameworks, so an unknown name is always a
+# mistake, never a plugin.
+_KNOWN_TAGS = frozenset({
+    "autoescape", "block", "cache", "extends", "for", "from", "if", "import",
+    "include", "live", "macro", "raw", "set", "spaceless",
+})
+
+# Terminators and branch keywords. These reach _parse_block only when stray
+# (their own collector consumes them in the normal case), and a stray one keeps
+# the old render-nothing behaviour -- see the comment at the raise.
+_TERMINATORS = frozenset({
+    "elif", "else", "elseif", "endautoescape", "endblock", "endcache",
+    "endfor", "endif", "endlive", "endmacro", "endraw", "endset",
+    "endspaceless",
+})
+
+
 def _parse_block(content: str, strip_before: bool, strip_after: bool,
                  tokens: list, i: int):
     """Build the node for the BLOCK token at ``i``. Returns (node, next_index);
@@ -477,6 +514,16 @@ def _parse_block(content: str, strip_before: bool, strip_after: bool,
         return _parse_for(content, strip_before, strip_after, tokens, i)
 
     if tag == "set":
+        # An assignment has an ``=``; without one this is the BLOCK form,
+        # {% set name %}...{% endset %}, which captures its rendered body.
+        # A bare ``in`` test is exact here, not a shortcut: the block form's tag
+        # content is only ever ``set <name>``, so an ``=`` anywhere -- even
+        # inside a quoted value like {% set msg = "a = b" %} -- means assignment.
+        if "=" not in content:
+            body, end = _collect_body(tokens, i, "set", "endset")
+            _bake_strip_after_end(tokens, strip_after, end)
+            name = parts[1] if len(parts) > 1 else ""
+            return SetBlockNode(name, _parse_nodes(body), strip_before), end
         return SetNode(content, strip_before), i + 1
 
     if tag == "include":
@@ -525,8 +572,18 @@ def _parse_block(content: str, strip_before: bool, strip_after: bool,
     if tag in ("block", "endblock"):
         return BlockMarkerNode(parts[1] if len(parts) > 1 else "", strip_before), i + 1
 
-    # A stray terminator or an unknown tag: no output, advance one token.
-    return SkipNode(strip_before), i + 1
+    if tag == "" or tag in _TERMINATORS:
+        # An empty tag ({%  %}, or a bare whitespace-control {%- -%}) and a
+        # stray terminator (an {% endif %} with no {% if %}): no output,
+        # advance one token. Malformed, but it has always rendered nothing, and
+        # nothing is the safe answer -- unlike an unknown tag it cannot expose
+        # content that was meant to be gated.
+        return SkipNode(strip_before), i + 1
+
+    raise ValueError(
+        f'Frond: unknown tag "{tag}" -- known tags are: '
+        + ", ".join(sorted(_KNOWN_TAGS))
+    )
 
 
 def _parse_if(content: str, strip_before: bool, strip_after: bool,