tina4-python 3.13.92__tar.gz → 3.13.95__tar.gz

{tina4_python-3.13.92 → tina4_python-3.13.95}/.gitignore

@@ -10,6 +10,13 @@
 .env.local
 /public/css/test.css
 /sessions/
+# Runtime session files written by the suite. This was the ONE gap of the four:
+# php ignores /data/, node ignores data/, ruby ignores sessions/ (and defaults to
+# pwd/sessions anyway) - only python left data/sessions/ visible, so a plain test
+# run dirtied the tree and `git add -A` committed session payloads. It did: five
+# of them are tracked on feature/audit-auth. FileSessionHandler already does
+# mkdir(parents=True, exist_ok=True), so a fresh clone needs nothing here.
+/data/sessions/
 /tests/secrets/domain.cert
 /tests/secrets/private.key
 /tests/secrets/public.key
@@ -98,3 +105,8 @@ example/src/**/__pycache__/
 # relative to cwd would create these under the repo. Never commit them.
 /private/
 /var/folders/
+/data/sessions/
+
+# Local file-backend queue store - runtime artefacts, never committed.
+# Four probe .queue-data files were swept in by `git add -A` on 2026-08-03.
+data/queue/

{tina4_python-3.13.92 → tina4_python-3.13.95}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.13.92
+Version: 3.13.95
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT
@@ -14,6 +14,8 @@ Requires-Dist: pymssql>=2.3; extra == 'all-db'
 Requires-Dist: pyodbc>=5.0; extra == 'all-db'
 Provides-Extra: firebird
 Requires-Dist: firebird-driver>=1.10; extra == 'firebird'
+Provides-Extra: kafka
+Requires-Dist: confluent-kafka>=2.0; extra == 'kafka'
 Provides-Extra: memcache
 Requires-Dist: pymemcache>=4.0; extra == 'memcache'
 Provides-Extra: mongo
@@ -26,8 +28,24 @@ Provides-Extra: odbc
 Requires-Dist: pyodbc>=5.0; extra == 'odbc'
 Provides-Extra: postgres
 Requires-Dist: psycopg2-binary>=2.9; extra == 'postgres'
+Provides-Extra: rabbitmq
+Requires-Dist: pika>=1.3; extra == 'rabbitmq'
 Provides-Extra: redis
 Requires-Dist: redis>=5.0; extra == 'redis'
+Provides-Extra: s3
+Requires-Dist: boto3>=1.34; extra == 's3'
+Provides-Extra: test
+Requires-Dist: boto3>=1.34; extra == 'test'
+Requires-Dist: confluent-kafka>=2.0; extra == 'test'
+Requires-Dist: firebird-driver>=1.10; extra == 'test'
+Requires-Dist: mysql-connector-python>=9.0; extra == 'test'
+Requires-Dist: pika>=1.3; extra == 'test'
+Requires-Dist: psycopg2-binary>=2.9; extra == 'test'
+Requires-Dist: pymemcache>=4.0; extra == 'test'
+Requires-Dist: pymongo>=4.0; extra == 'test'
+Requires-Dist: pymssql>=2.3; extra == 'test'
+Requires-Dist: pyodbc>=5.0; extra == 'test'
+Requires-Dist: redis>=5.0; extra == 'test'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -116,7 +134,7 @@ Every feature is built from scratch -- no pip install, no node_modules, no third
 | **Core HTTP** (7) | Router with path params (`{id:int}`, `{p:path}`), Server, Request/Response, Middleware pipeline, Static file serving, CORS |
 | **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird: unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
 | **ORM** (7) | Active Record with typed fields, relationships (`has_one`/`has_many`/`belongs_to`), soft delete, QueryBuilder + MongoDB support, Auto-CRUD generator, migrations with rollback |
-| **Auth & Security** (5) | JWT (HS256/RS256), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
+| **Auth & Security** (5) | JWT (HS256/HS384/HS512, zero-dependency; RS256 opt-in, needs `cryptography`), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
 | **Templating** (3) | Frond engine (Twig/Jinja2-compatible, pre-compiled 2.8x faster), SCSS auto-compilation, built-in CSS (~24 KB) |
 | **API & Integration** (5) | HTTP client (zero-dep), GraphQL with ORM auto-schema + GraphiQL IDE, WSDL/SOAP with auto WSDL, WebSocket (RFC 6455) + Redis backplane, MCP server (24 dev tools) |
 | **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters; service runner; event system (on/emit/once/off) |
@@ -742,7 +760,7 @@ Run benchmarks locally: `python benchmarks/benchmark.py --python`
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages: same architecture, same conventions, same 97 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, same 98 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

{tina4_python-3.13.92 → tina4_python-3.13.95}/README.md

@@ -84,7 +84,7 @@ Every feature is built from scratch -- no pip install, no node_modules, no third
 | **Core HTTP** (7) | Router with path params (`{id:int}`, `{p:path}`), Server, Request/Response, Middleware pipeline, Static file serving, CORS |
 | **Database** (6) | SQLite, PostgreSQL, MySQL, MSSQL, Firebird: unified adapter, connection pooling, query cache, transactions, race-safe ID generation, SQL dialect translation |
 | **ORM** (7) | Active Record with typed fields, relationships (`has_one`/`has_many`/`belongs_to`), soft delete, QueryBuilder + MongoDB support, Auto-CRUD generator, migrations with rollback |
-| **Auth & Security** (5) | JWT (HS256/RS256), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
+| **Auth & Security** (5) | JWT (HS256/HS384/HS512, zero-dependency; RS256 opt-in, needs `cryptography`), password hashing (PBKDF2-SHA256), API key validation, rate limiting, CSRF form tokens |
 | **Templating** (3) | Frond engine (Twig/Jinja2-compatible, pre-compiled 2.8x faster), SCSS auto-compilation, built-in CSS (~24 KB) |
 | **API & Integration** (5) | HTTP client (zero-dep), GraphQL with ORM auto-schema + GraphiQL IDE, WSDL/SOAP with auto WSDL, WebSocket (RFC 6455) + Redis backplane, MCP server (24 dev tools) |
 | **Background** (3) | Job queue (File/RabbitMQ/Kafka/MongoDB) with priority, delay, retry, dead letters; service runner; event system (on/emit/once/off) |
@@ -710,7 +710,7 @@ Run benchmarks locally: `python benchmarks/benchmark.py --python`
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages: same architecture, same conventions, same 97 features:
+Tina4 ships identical features across four languages: same architecture, same conventions, same 98 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|

tina4_python-3.13.95/pyproject.toml

@@ -0,0 +1,121 @@
+[project]
+name = "tina4-python"
+version = "3.13.95"
+description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
+authors = [
+    {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}
+]
+readme = "README.md"
+requires-python = ">=3.12"
+license = {text = "MIT"}
+
+# ZERO core dependencies — this is v3's defining feature
+dependencies = []
+
+[project.optional-dependencies]
+# Database drivers — install what you need
+postgres = ["psycopg2-binary>=2.9"]
+mysql = ["mysql-connector-python>=9.0"]
+mssql = ["pymssql>=2.3"]
+firebird = ["firebird-driver>=1.10"]
+mongo = ["pymongo>=4.0"]
+odbc = ["pyodbc>=5.0"]
+
+# Session backends — install what you need
+redis = ["redis>=5.0"]
+memcache = ["pymemcache>=4.0"]
+
+# File-storage backends — install what you need.
+# The `local` filesystem backend is the zero-dependency default; S3Storage
+# (TINA4_STORAGE_BACKEND=s3) is opt-in and imports boto3 lazily.
+s3 = ["boto3>=1.34"]
+
+# Queue backends — install what you need
+kafka = ["confluent-kafka>=2.0"]
+rabbitmq = ["pika>=1.3"]
+
+# All database drivers
+all-db = [
+    "psycopg2-binary>=2.9",
+    "mysql-connector-python>=9.0",
+    "pymssql>=2.3",
+    "firebird-driver>=1.10",
+    "pymongo>=4.0",
+    "pyodbc>=5.0",
+]
+
+# Every client the TEST SUITE needs against live services.
+#
+# These were installed ad hoc by CI (`uv pip install pymongo confluent-kafka
+# pika ...`) and declared nowhere, so a fresh host had no way to know what the
+# suite requires. confluent-kafka and pika in particular were in NO extra: the
+# lab host's first full-suite run failed with three "confluent-kafka not
+# installed" errors, correctly raised by the TINA4_REQUIRE_SERVICES gate, and
+# `uv sync --all-extras` could not have fixed it because the dependency was not
+# expressed anywhere. One declared extra means `uv sync --extra test` is
+# reproducible on any machine.
+#
+# Includes firebird-driver even though the Firebird CI job installs it on its
+# own: `uv sync --extra X` PRUNES anything outside the named extras, so a test
+# extra that omitted it would silently uninstall it on a host that had it.
+#
+# boto3 is here for exactly that reason, MEASURED on the lab 2026-08-06
+# (Ubuntu 24.04.4 LTS x86_64, Python 3.13.3): it was declared in NO extra, but
+# happened to be installed ad hoc, so the two REAL-MinIO tests in
+# tests/test_realtime_files.py were passing. Running `uv sync --extra test`
+# pruned boto3 (plus s3transfer and jmespath) and those tests went straight from
+# "2 passed" to "2 skipped" -- with the suite still GREEN under
+# TINA4_REQUIRE_SERVICES=1, because the skip reason matched neither a service
+# keyword nor an unavailable hint in the conftest gate. Live S3 coverage
+# evaporated silently. Declaring it here is the fix; tests/conftest.py now also
+# recognises a missing boto3 so the gate can never miss it again.
+test = [
+    "psycopg2-binary>=2.9",
+    "mysql-connector-python>=9.0",
+    "pymssql>=2.3",
+    "firebird-driver>=1.10",
+    "pymongo>=4.0",
+    "pyodbc>=5.0",
+    "redis>=5.0",
+    "pymemcache>=4.0",
+    "confluent-kafka>=2.0",
+    "pika>=1.3",
+    "boto3>=1.34",
+]
+
+[dependency-groups]
+dev = [
+    "bottle>=0.13.4",
+    "cython>=3.2.4",
+    "django>=6.0.3",
+    "fastapi>=0.135.1",
+    "flask>=3.1.3",
+    "pytest>=8.0",
+    "pytest-asyncio>=0.23",
+    "pytest-cov>=5.0",
+    "reportlab>=4.4.10",
+    "ruff>=0.4",
+    "setuptools>=82.0.1",
+    "uvicorn>=0.42.0",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build]
+include = ["tina4_python/**/*"]
+
+[project.scripts]
+tina4python = "tina4_python.cli:main"
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]
+markers = [
+    "slow: a test that needs real wall-clock time to reproduce a timing bug (deselect with -m 'not slow')",
+]
+
+[tool.ruff]
+target-version = "py312"
+line-length = 120

{tina4_python-3.13.92 → tina4_python-3.13.95}/tina4_python/CLAUDE.md

@@ -514,8 +514,11 @@ TINA4_TOKEN_LIMIT is used to set the session time, default 60 minutes
 
 Set `TINA4_SESSION_BACKEND` to choose a backend:
 
-The value is the backend NAME, not a class name. An unknown value falls back to
-the file backend without raising.
+The value is the backend NAME, not a class name, and it is normalised (trimmed and
+lowercased), so " Redis " resolves. An UNRECOGNISED value raises `ValueError` at
+startup, naming the bad value and the valid ones -- it used to fall back to the
+file backend silently, which turned a typo into sessions quietly written to local
+disk. Unset or blank still means file.
 
 | Value | Backend | Required package |
 |---------|---------|-----------------|
@@ -794,11 +797,18 @@ db.insert("users", {"name": "Alice", "email": "alice@example.com"})
 # Insert multiple
 db.insert("users", [{"name": "Bob"}, {"name": "Eve"}])
 
-# Update (by primary key — default "id")
+# Update (the primary key in the data IS the filter — introspected, not assumed)
 db.update("users", {"id": 1, "name": "Alice Updated"})
 
-# Delete
+# Update many rows — the filter must be explicit
+db.update("users", {"active": 0}, "last_login < ?", ["2025-01-01"])
+
+# Delete (dict filter or string + params, both accepted)
 db.delete("users", {"id": 1})
+db.delete("users", "age < ?", [18])
+
+# Empty a table — explicit, never accidental
+db.truncate("users")
 
 # Raw query
 result = db.fetch("SELECT * FROM users WHERE age > ?", [18])
@@ -1634,17 +1644,23 @@ TINA4_TOKEN_LIMIT=60              # Token lifetime in minutes (default: 60)
 TINA4_DATABASE_URL=sqlite:///app.db     # Connection URL (driver://host:port/database)
 TINA4_DATABASE_USERNAME=                 # DB username (for PostgreSQL, MySQL, etc.)
 TINA4_DATABASE_PASSWORD=                 # DB password
+TINA4_DATABASE_CONNECT_TIMEOUT=10        # Seconds a database connect may block (default 10). Set <= 0 to wait
+                                         # indefinitely (the old behaviour); a non-numeric value warns and uses 10.
+                                         # On expiry the error names the host, port, elapsed seconds and this variable.
+                                         # Applies to postgres/mysql/mssql/odbc/firebird, and to mongodb's deferred
+                                         # connect. SQLite is exempt: it opens a local file, there is no peer to hang on
 
 # Framework
 TINA4_DEBUG=true                  # Enable dev mode (toolbar, live reload, error overlay)
 TINA4_LOG_LEVEL=INFO              # Log verbosity: ALL, DEBUG, INFO, WARNING, ERROR, CRITICAL (default: INFO)
 TINA4_LOCALE=en                   # Language for framework messages (en, fr, af, zh, ja, es)
-TINA4_DEFAULT_WEBSERVER=FALSE     # Set to TRUE to use Tina4's built-in webserver instead of ASGI
+TINA4_DEFAULT_WEBSERVER=FALSE     # TRUE pins Tina4's built-in asyncio webserver even when a production ASGI server (uvicorn/hypercorn/granian) is installed. Unset/FALSE: a production server is used when one is importable and TINA4_DEBUG is off
+TINA4_SHUTDOWN_TIMEOUT=30         # Seconds to drain in-flight requests on SIGTERM/SIGINT (default 30). Honoured on the built-in server, and mapped onto uvicorn's timeout_graceful_shutdown / hypercorn's graceful_timeout. granian has no drain deadline, so it is not honoured there (logged at startup). A non-positive or unparseable value warns and uses 30
 TINA4_OVERRIDE_CLIENT=false       # Set to true to allow running without tina4 CLI (e.g. Docker)
 HOST_NAME=localhost:7145
 
 # Sessions
-TINA4_SESSION_BACKEND=file                # file, redis, valkey, mongodb, database (unknown value falls back to file)
+TINA4_SESSION_BACKEND=file                # file, redis, valkey, mongodb, memcached, database (an unknown value RAISES; unset/blank = file)
 TINA4_SESSION_SAMESITE=Lax               # SameSite attribute for session cookies (default: Lax)
 
 # Swagger/OpenAPI
@@ -1706,7 +1722,7 @@ anywhere (the production on/off switch, wired for real in 3.13.40).
 
 ## CORS
 
-Built-in — all origins allowed by default. CORS headers and OPTIONS pre-flight are handled automatically.
+Built-in, and it DENIES by default (ADR-0018). Set `TINA4_CORS_ORIGINS` to the origins you want to allow (comma-separated), or `*` for any. With it unset no `Access-Control-Allow-Origin` is sent and the browser blocks the cross-origin request. `TINA4_CORS_CREDENTIALS=true` is never sent alongside a `*` origin (the Fetch Standard forbids the pair). OPTIONS pre-flight is handled automatically.
 
 ## SCSS Workflow
 

{tina4_python-3.13.92 → tina4_python-3.13.95}/tina4_python/__init__.py

@@ -43,7 +43,15 @@ def _resolve_version() -> str:
             pass
     except Exception:
         pass
-    return "3.13.56"
+    # Floor literal, reached only when BOTH lookups above miss. That is not
+    # theoretical: the Docker build used to prune dist-info from the installed
+    # package, so path 2 raised PackageNotFoundError and the published
+    # tina4-python:3.13.94 image served this literal on /health -- then reading
+    # "3.13.56", 36 releases stale, because nothing kept it current.
+    #
+    # test_version_constant.py now asserts this literal equals the pyproject
+    # version, so the release bump cannot leave it behind again.
+    return "3.13.95"
 
 
 __version__ = _resolve_version()