tina4-python 3.13.90__tar.gz → 3.13.92__tar.gz

{tina4_python-3.13.90 → tina4_python-3.13.92}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.90
+Version: 3.13.92
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.13.90 → tina4_python-3.13.92}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.90"
+version = "3.13.92"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.90 → tina4_python-3.13.92}/tina4_python/auth/__init__.py

@@ -196,19 +196,51 @@ def _resolve_secret(secret: str = None) -> str:
     return env_secret
 
 
+# Supported JWT algorithms. HMAC only — the whole family is in hashlib, so this
+# stays zero-dependency. The header's "alg" is now always the one we actually sign
+# with (python#105): the digest is looked up here rather than hardcoded.
+_HMAC_ALGORITHMS = {
+    "HS256": hashlib.sha256,
+    "HS384": hashlib.sha384,
+    "HS512": hashlib.sha512,
+}
+
+# Seconds of clock skew tolerated on the "nbf" (not-before) claim. Without this a
+# token minted on one host and validated on another a second behind is rejected
+# for no real reason; RFC 7519 explicitly allows "a small leeway".
+_JWT_LEEWAY_SECONDS = 60
+
+
+def _resolve_algorithm(algorithm: str = None) -> str:
+    """Pick the JWT algorithm: explicit arg, else TINA4_JWT_ALGORITHM, else HS256.
+
+    Raises ValueError naming the supported set when asked for one we cannot sign
+    (python#106 — the env var was registered in the CLI's known_vars and then
+    silently ignored, so a user could set HS512 and still get HS256 tokens).
+    """
+    chosen = (algorithm or os.environ.get("TINA4_JWT_ALGORITHM") or "HS256").strip()
+    if chosen not in _HMAC_ALGORITHMS:
+        raise ValueError(
+            f"Unsupported JWT algorithm {chosen!r}. Tina4 signs with "
+            f"{', '.join(sorted(_HMAC_ALGORITHMS))} (HMAC only, zero-dependency). "
+            f"Set TINA4_JWT_ALGORITHM to one of those."
+        )
+    return chosen
+
+
 class Auth:
     """JWT authentication and password hashing — zero dependencies."""
 
-    def __init__(self, secret: str = None, algorithm: str = "HS256",
+    def __init__(self, secret: str = None, algorithm: str = None,
                  expires_in: int = None):
         """
         Args:
             secret:     Signing secret (falls back to the TINA4_SECRET env var).
-            algorithm:  JWT algorithm (default HS256).
+            algorithm:  JWT algorithm (falls back to TINA4_JWT_ALGORITHM, then HS256).
             expires_in: Token lifetime in seconds (default 3600).
         """
         self.secret = secret if secret is not None else _resolve_secret()
-        self.algorithm = algorithm
+        self.algorithm = _resolve_algorithm(algorithm)
         # JWT expiry env var:
         # - TINA4_TOKEN_EXPIRES_IN (preferred — matches docs and the
         #   form-token expiry env var used by Frond)
@@ -275,13 +307,29 @@ class Auth:
                 return None
 
             h, p, sig = parts
+
+            # Pin the algorithm to OUR configured one instead of trusting the
+            # token's header. A token asking to be verified as anything else --
+            # "none", a weaker HMAC, or an RSA alg we do not implement -- is
+            # rejected before any signature work. Matches the Ruby check.
+            header = json.loads(_b64url_decode(h))
+            if header.get("alg") != self.algorithm:
+                return None
+
             expected = self._sign(f"{h}.{p}")
             if not hmac.compare_digest(sig, expected):
                 return None
 
             payload = json.loads(_b64url_decode(p))
 
-            if "exp" in payload and time.time() > payload["exp"]:
+            now = time.time()
+            if "exp" in payload and now > payload["exp"]:
+                return None
+
+            # "nbf" (not-before): a post-dated token is not valid yet. Was
+            # honoured only by Ruby, so Python/PHP/Node accepted tokens their
+            # issuer had explicitly marked as not-yet-usable (python#107).
+            if "nbf" in payload and now + _JWT_LEEWAY_SECONDS < payload["nbf"]:
                 return None
 
             return payload
@@ -314,8 +362,10 @@ class Auth:
         return self.get_token(payload, expires_in=expires_in)
 
     def _sign(self, message: str) -> str:
+        # Digest comes from the configured algorithm, so the "alg" we advertise in
+        # the header is the one that actually produced this signature.
         sig = hmac.new(
-            self.secret.encode(), message.encode(), hashlib.sha256
+            self.secret.encode(), message.encode(), _HMAC_ALGORITHMS[self.algorithm]
         ).digest()
         return _b64url_encode(sig)
 
@@ -424,16 +474,24 @@ class Auth:
     # ── Request Auth Helper ───────────────────────────────────────
 
     @_DualMethod
-    def authenticate_request(self, headers: dict, secret: str = None, algorithm: str = "HS256") -> dict | None:
+    def authenticate_request(self, headers: dict, secret: str = None, algorithm: str = None) -> dict | None:
         """Extract and validate auth from request headers.
 
         Args:
             secret:    Override signing secret (default: self.secret / TINA4_SECRET env var).
-            algorithm: JWT algorithm override (default: "HS256").
+            algorithm: JWT algorithm override (default: self.algorithm / TINA4_JWT_ALGORITHM).
 
         Checks: Bearer JWT, Bearer API key, Basic auth.
         Returns payload dict on success, None on failure.
         """
+        # Both overrides used to be accepted and then dropped on the floor: the
+        # body called self.valid_token(), so a caller passing secret= or
+        # algorithm= silently got this instance's values instead. Honour them.
+        if secret is not None or algorithm is not None:
+            return Auth(secret=secret if secret is not None else self.secret,
+                        algorithm=algorithm or self.algorithm,
+                        expires_in=self.expires_in).authenticate_request(headers)
+
         auth_header = headers.get("authorization", "")
 
         if auth_header.startswith("Bearer "):
@@ -497,10 +555,10 @@ def refresh_token(token: str, expires_in: int = 60) -> str | None:
     return Auth.refresh_token_static(token, expires_in=expires_in)
 
 
-def authenticate_request(headers: dict, secret: str = None, algorithm: str = "HS256") -> dict | None:
+def authenticate_request(headers: dict, secret: str = None, algorithm: str = None) -> dict | None:
     """Validate auth from request headers — reads TINA4_SECRET from env."""
-    if secret is not None:
-        return Auth(secret=secret).authenticate_request(headers, algorithm=algorithm)
+    if secret is not None or algorithm is not None:
+        return Auth(secret=secret, algorithm=algorithm).authenticate_request(headers)
     return Auth.authenticate_request_static(headers)
 
 

{tina4_python-3.13.90 → tina4_python-3.13.92}/tina4_python/dev_admin/__init__.py

@@ -2041,9 +2041,19 @@ async def _api_metrics(request, response):
 
 
 async def _api_metrics_full(request, response):
-    """Full analysis — AST-based, cached 60s."""
-    from tina4_python.dev_admin.metrics import full_analysis
-    return response(full_analysis())
+    """Full analysis — from the tina4 CLI metrics engine, else the local module.
+
+    The engine (ADR-0002) resolves imports to real file paths, so it is the only
+    source with usable coupling data. It returns None when it is absent or too
+    old to emit a field the dashboard renders, and we fall back rather than
+    serve a payload with holes in it.
+    """
+    from tina4_python.dev_admin.metrics import full_analysis, resolve_scan_target
+    from tina4_python.dev_admin.metrics_engine import engine_analysis
+
+    root, scan_mode = resolve_scan_target()
+    from_engine = engine_analysis(root, scan_mode)
+    return response(from_engine if from_engine is not None else full_analysis())
 
 
 async def _api_metrics_file(request, response):

{tina4_python-3.13.90 → tina4_python-3.13.92}/tina4_python/dev_admin/metrics.py

@@ -23,6 +23,18 @@ _last_scan_root: str = ""
 # ── Quick Metrics ──────────────────────────────────────────────
 
 
+def _is_code_line(line: str) -> bool:
+    """True for a line that counts toward LOC: not blank, not a comment.
+
+    The single definition of the rule. It used to be restated at each file-level
+    call site while function LOC ignored it entirely and returned a raw line
+    span, so `loc` meant two different things in one payload - see
+    _function_loc.
+    """
+    stripped = line.strip()
+    return bool(stripped) and not stripped.startswith("#")
+
+
 def _resolve_root(root: str = "src") -> str:
     """Pick the right directory to scan.
 
@@ -41,6 +53,23 @@ def _resolve_root(root: str = "src") -> str:
     return framework_dir
 
 
+def resolve_scan_target(root: str = "src") -> tuple[str, str]:
+    """Return (directory to scan, scan_mode) for any metrics producer.
+
+    The CLI engine is language-agnostic and cannot know which directory holds a
+    framework package, so root resolution and the "framework" label stay here -
+    shared by this module and the engine adapter so the two never disagree about
+    what was measured.
+    """
+    resolved = _resolve_root(root)
+    framework_dir = str(Path(__import__("tina4_python").__file__).parent)
+    resolved_path = Path(resolved)
+    scanning_framework = (
+        resolved_path == Path(framework_dir) or str(resolved_path).startswith(framework_dir)
+    )
+    return resolved, "framework" if scanning_framework else "project"
+
+
 def quick_metrics(root: str = "src") -> dict:
     """Scan project files and return instant metrics."""
     root = _resolve_root(root)
@@ -224,7 +253,7 @@ def full_analysis(root: str = "src") -> dict:
         except ValueError:
             rel_path = (str(f.relative_to(root_path.parent)) if root_path.parent != f else f.name).replace("\\", "/")
         lines = source.splitlines()
-        loc = sum(1 for l in lines if l.strip() and not l.strip().startswith("#"))
+        loc = sum(1 for l in lines if _is_code_line(l))
 
         # Extract imports for coupling analysis
         imports = _extract_imports(tree, rel_path)
@@ -491,7 +520,7 @@ def file_detail(file_path: str) -> dict:
 
     functions.sort(key=lambda x: x["complexity"], reverse=True)
 
-    loc = sum(1 for l in lines if l.strip() and not l.strip().startswith("#"))
+    loc = sum(1 for l in lines if _is_code_line(l))
     classes = sum(1 for n in ast.walk(tree) if isinstance(n, ast.ClassDef))
     imports = _extract_imports(tree, file_path)
 
@@ -526,13 +555,37 @@ def file_detail(file_path: str) -> dict:
 # ── AST Helpers ────────────────────────────────────────────────
 
 
+def _own_body_nodes(node: ast.AST):
+    """Yield the nodes belonging to this function's OWN body.
+
+    Nested function and class definitions are skipped: they are reported as
+    functions in their own right, so counting their decision points here too
+    would charge one branch to two different functions. That over-count grew
+    with nesting depth - an IIFE-style wrapper or a registrar that defines
+    twenty inner handlers absorbed the entire file's complexity and sat at the
+    top of the offenders list while the real hot spots hid below it.
+
+    A lambda is NOT skipped. Lambdas are never listed as separate functions, so
+    their decision points would simply vanish; they stay with the function that
+    encloses them.
+    """
+    stack = list(ast.iter_child_nodes(node))
+    while stack:
+        child = stack.pop()
+        if isinstance(child, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)):
+            continue
+        yield child
+        stack.extend(ast.iter_child_nodes(child))
+
+
 def _cyclomatic_complexity(node: ast.AST) -> int:
     """Calculate cyclomatic complexity for a function/method node.
 
     CC = 1 + number of decision points (if/elif/for/while/except/and/or/assert)
+    in the function's own body. Nested functions are measured separately.
     """
     cc = 1
-    for child in ast.walk(node):
+    for child in _own_body_nodes(node):
         if isinstance(child, (ast.If, ast.IfExp)):
             cc += 1
         elif isinstance(child, ast.For):
@@ -553,9 +606,18 @@ def _cyclomatic_complexity(node: ast.AST) -> int:
 
 
 def _function_loc(node: ast.AST, lines: list) -> int:
-    """Count lines of code in a function."""
+    """Count lines of CODE in a function, by the same rule as file-level LOC.
+
+    This returned `end_lineno - lineno + 1` - a raw line span - while the
+    docstring claimed lines of code and every file-level LOC excluded blanks and
+    comments. So a function's LOC and its file's LOC were different units sitting
+    side by side in the dashboard, and the maintainability index (which divides
+    by LOC) penalised a well-commented function for its comments.
+    """
     if hasattr(node, "end_lineno") and node.end_lineno:
-        return node.end_lineno - node.lineno + 1
+        span = lines[node.lineno - 1:node.end_lineno]
+        # Floor of 1: a one-line body must never report 0.
+        return max(1, sum(1 for l in span if _is_code_line(l)))
     # Fallback: count indented lines
     start = node.lineno - 1
     count = 1

tina4_python-3.13.92/tina4_python/dev_admin/metrics_engine.py

@@ -0,0 +1,108 @@
+"""Code metrics from the tina4 CLI engine (ADR-0002).
+
+The metrics engine now lives in the Rust CLI: one tree-sitter implementation
+covering every language, instead of a hand-rolled AST walker per framework. This
+adapter shells out to it and reshapes the payload into the dashboard's contract.
+
+It returns None whenever the CLI cannot supply a COMPLETE payload - no binary on
+PATH, a non-zero exit, unparseable JSON, or an older CLI whose engine predates a
+field the dashboard renders. The caller then falls back to the in-framework
+module, so a stale CLI degrades quietly instead of blanking the chart.
+"""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+from pathlib import Path
+
+# The dashboard reads these at the top level; the CLI nests them under "summary"
+# because its own text report and the --fail-on gate group them there.
+_SUMMARY_KEYS = (
+    "files_analyzed",
+    "total_functions",
+    "avg_complexity",
+    "avg_maintainability",
+)
+
+# Fields the dashboard renders that a pre-3.8.59 engine does not emit. Checking
+# for the DATA is honest where checking a version string is not: a user may run
+# any CLI build, and the payload tells us what it can actually do.
+_REQUIRED_FILE_KEYS = ("path", "loc", "avg_complexity", "maintainability", "has_tests")
+_REQUIRED_FUNCTION_KEYS = ("name", "file", "line", "complexity", "loc")
+
+_TIMEOUT_SECONDS = 60
+
+
+def engine_path() -> str | None:
+    """Absolute path to the tina4 CLI binary, or None when it is not installed."""
+    return shutil.which("tina4")
+
+
+def engine_analysis(root: str, scan_mode: str = "project") -> dict | None:
+    """Run `tina4 metrics --json` over root and adapt it to the dashboard shape.
+
+    The framework passes --path and owns scan_mode: it knows where its own
+    package lives, and the engine is deliberately language-agnostic, so root
+    resolution stays on this side of the boundary.
+    """
+    binary = engine_path()
+    if binary is None:
+        return None
+
+    try:
+        proc = subprocess.run(
+            [binary, "metrics", "--path", str(root), "--json"],
+            capture_output=True,
+            text=True,
+            timeout=_TIMEOUT_SECONDS,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+
+    if proc.returncode != 0 or not proc.stdout.strip():
+        return None
+
+    try:
+        payload = json.loads(proc.stdout)
+    except (json.JSONDecodeError, ValueError):
+        return None
+
+    return adapt_payload(payload, root, scan_mode)
+
+
+def adapt_payload(payload: dict, root: str, scan_mode: str = "project") -> dict | None:
+    """Flatten the engine payload into the dashboard contract, or None if short.
+
+    Split out from engine_analysis so the reshaping is testable without a
+    subprocess - the shaping is where the contract actually lives.
+    """
+    if not isinstance(payload, dict):
+        return None
+
+    summary = payload.get("summary")
+    file_metrics = payload.get("file_metrics")
+    functions = payload.get("most_complex_functions")
+    if not isinstance(summary, dict) or not isinstance(file_metrics, list):
+        return None
+    if not isinstance(functions, list):
+        return None
+
+    if any(key not in summary for key in _SUMMARY_KEYS):
+        return None
+    if file_metrics and any(key not in file_metrics[0] for key in _REQUIRED_FILE_KEYS):
+        return None
+    if functions and any(key not in functions[0] for key in _REQUIRED_FUNCTION_KEYS):
+        return None
+
+    result = {key: summary[key] for key in _SUMMARY_KEYS}
+    result["file_metrics"] = file_metrics
+    result["most_complex_functions"] = functions[:15]
+    result["dependency_graph"] = payload.get("dependency_graph") or {}
+    # The framework decides these two - the engine always reports "project"
+    # because it cannot know which directory is a framework package.
+    result["scan_mode"] = scan_mode
+    result["scan_root"] = str(Path(root).resolve())
+    result["engine"] = "tina4-cli"
+    return result