tina4-python 3.8.0__tar.gz → 3.8.2__tar.gz

{tina4_python-3.8.0 → tina4_python-3.8.2}/.gitignore

@@ -58,3 +58,8 @@ __pycache__/
 *.c
 *.so
 build/
+.pytest_cache/
+demo/.env
+example/.env
+demo/data/*.db
+demo/logs/*.log

{tina4_python-3.8.0 → tina4_python-3.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tina4-python
-Version: 3.8.0
+Version: 3.8.2
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT

{tina4_python-3.8.0 → tina4_python-3.8.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.8.0"
+version = "3.8.2"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.8.0 → tina4_python-3.8.2}/tina4_python/__init__.py

@@ -8,7 +8,7 @@ Tina4 Python v3.0 — Zero-dependency, lightweight web framework.
 
 One import, everything works.
 """
-__version__ = "3.8.0"
+__version__ = "3.8.2"
 
 # ── HTTP Constants ──
 from tina4_python.core.constants import (  # noqa: E402, F401

{tina4_python-3.8.0 → tina4_python-3.8.2}/tina4_python/core/middleware.py

@@ -137,3 +137,51 @@ class RateLimiter:
         response.header("x-ratelimit-remaining", str(info["remaining"]))
         response.header("x-ratelimit-reset", str(info["reset"]))
         return response
+
+
+class SecurityHeadersMiddleware:
+    """Injects security headers on every response.
+
+    Configurable via environment variables:
+        TINA4_FRAME_OPTIONS        — X-Frame-Options (default: SAMEORIGIN)
+        TINA4_HSTS                 — Strict-Transport-Security max-age value
+                                     (default: "" = off; set to "31536000" to enable)
+        TINA4_CSP                  — Content-Security-Policy (default: "default-src 'self'")
+        TINA4_REFERRER_POLICY      — Referrer-Policy (default: strict-origin-when-cross-origin)
+        TINA4_PERMISSIONS_POLICY   — Permissions-Policy (default: camera=(), microphone=(), geolocation=())
+    """
+
+    @staticmethod
+    def before_security(request, response):
+        """Set security headers before the route handler runs."""
+        response.header(
+            "x-frame-options",
+            os.environ.get("TINA4_FRAME_OPTIONS", "SAMEORIGIN"),
+        )
+        response.header("x-content-type-options", "nosniff")
+
+        hsts = os.environ.get("TINA4_HSTS", "")
+        if hsts:
+            response.header(
+                "strict-transport-security",
+                f"max-age={hsts}; includeSubDomains",
+            )
+
+        response.header(
+            "content-security-policy",
+            os.environ.get("TINA4_CSP", "default-src 'self'"),
+        )
+        response.header(
+            "referrer-policy",
+            os.environ.get("TINA4_REFERRER_POLICY", "strict-origin-when-cross-origin"),
+        )
+        response.header("x-xss-protection", "0")
+        response.header(
+            "permissions-policy",
+            os.environ.get(
+                "TINA4_PERMISSIONS_POLICY",
+                "camera=(), microphone=(), geolocation=()",
+            ),
+        )
+
+        return request, response

{tina4_python-3.8.0 → tina4_python-3.8.2}/tina4_python/core/request.py

@@ -3,8 +3,17 @@
 Clean request object with parsed body, params, headers, and cookies.
 """
 import json
+import os
 from urllib.parse import parse_qs, unquote
 
+# Maximum upload size in bytes (default 10 MB). Override via TINA4_MAX_UPLOAD_SIZE env var.
+TINA4_MAX_UPLOAD_SIZE = int(os.environ.get("TINA4_MAX_UPLOAD_SIZE", 10_485_760))
+
+
+class PayloadTooLarge(Exception):
+    """Raised when request body exceeds TINA4_MAX_UPLOAD_SIZE."""
+    pass
+
 
 class Request:
     """Parsed HTTP request — everything a route handler needs."""
@@ -46,6 +55,14 @@ class Request:
         req.content_type = req.headers.get("content-type", "")
         req.ip = _extract_ip(scope, req.headers)
 
+        # Check upload size limit
+        content_length = int(req.headers.get("content-length", 0) or 0)
+        if content_length > TINA4_MAX_UPLOAD_SIZE or len(body) > TINA4_MAX_UPLOAD_SIZE:
+            raise PayloadTooLarge(
+                f"Request body ({max(content_length, len(body))} bytes) exceeds "
+                f"TINA4_MAX_UPLOAD_SIZE ({TINA4_MAX_UPLOAD_SIZE} bytes)"
+            )
+
         # Parse query params
         if req.query_string:
             parsed = parse_qs(req.query_string, keep_blank_values=True)

{tina4_python-3.8.0 → tina4_python-3.8.2}/tina4_python/core/response.py

@@ -132,6 +132,14 @@ class Response:
         self.content = content.encode() if isinstance(content, str) else content
         return self
 
+    def error(self, code: str, message: str, status_code: int = 400) -> "Response":
+        """Standard error response envelope.
+
+        Usage:
+            return response.error("VALIDATION_FAILED", "Email is required", 400)
+        """
+        return self.json(error_response(code, message, status_code), status_code)
+
     def xml(self, content: str, status_code: int = None) -> "Response":
         """XML response."""
         if status_code:
@@ -229,6 +237,20 @@ class Response:
         return headers
 
 
+def error_response(code: str, message: str, status: int = 400) -> dict:
+    """Build a standard error response envelope.
+
+    Usage:
+        return response(error_response("VALIDATION_FAILED", "Email is required", 400), 400)
+    """
+    return {
+        "error": True,
+        "code": code,
+        "message": message,
+        "status": status,
+    }
+
+
 def _is_compressible(content_type: str) -> bool:
     """Check if content type benefits from compression."""
     compressible = (

{tina4_python-3.8.0 → tina4_python-3.8.2}/tina4_python/database/connection.py

@@ -5,6 +5,9 @@ The Database class parses a connection URL and creates the right adapter.
     db = Database("sqlite:///data/app.db")
     db = Database("postgresql://user:pass@host:5432/dbname")
     db = Database()  # Reads DATABASE_URL from environment
+
+Connection pooling:
+    db = Database("sqlite:///data/app.db", pool=4)  # 4 connections, round-robin
 """
 import hashlib
 import os
@@ -14,6 +17,73 @@ from urllib.parse import urlparse
 from tina4_python.database.adapter import DatabaseAdapter, DatabaseResult
 
 
+class ConnectionPool:
+    """Thread-safe connection pool using round-robin rotation.
+
+    When pool_size > 0, maintains multiple adapter instances and rotates
+    through them for each operation. Connections are created lazily on
+    first use.
+
+    Usage:
+        pool = ConnectionPool(pool_size=4, factory=create_adapter,
+                              connect_args=("path", {"username": "u", "password": "p"}))
+        adapter = pool.checkout()
+        try:
+            result = adapter.fetch(sql, params, limit, offset)
+        finally:
+            pool.checkin(adapter)
+        pool.close_all()
+    """
+
+    def __init__(self, pool_size: int, factory: callable, connect_path: str,
+                 username: str = "", password: str = ""):
+        self._pool_size = pool_size
+        self._factory = factory
+        self._connect_path = connect_path
+        self._username = username
+        self._password = password
+        self._adapters: list[DatabaseAdapter | None] = [None] * pool_size
+        self._index = 0
+        self._lock = threading.Lock()
+
+    def _ensure_adapter(self, idx: int) -> DatabaseAdapter:
+        """Lazily create an adapter at the given index."""
+        if self._adapters[idx] is None:
+            adapter = self._factory()
+            adapter.connect(self._connect_path, username=self._username, password=self._password)
+            self._adapters[idx] = adapter
+        return self._adapters[idx]
+
+    def checkout(self) -> DatabaseAdapter:
+        """Get the next adapter via round-robin. Thread-safe."""
+        with self._lock:
+            idx = self._index
+            self._index = (self._index + 1) % self._pool_size
+            return self._ensure_adapter(idx)
+
+    def checkin(self, adapter: DatabaseAdapter) -> None:
+        """Return an adapter to the pool. Currently a no-op for round-robin."""
+        pass
+
+    def close_all(self) -> None:
+        """Close all active connections in the pool."""
+        with self._lock:
+            for i, adapter in enumerate(self._adapters):
+                if adapter is not None:
+                    adapter.close()
+                    self._adapters[i] = None
+
+    @property
+    def size(self) -> int:
+        return self._pool_size
+
+    @property
+    def active_count(self) -> int:
+        """Number of connections that have been created."""
+        with self._lock:
+            return sum(1 for a in self._adapters if a is not None)
+
+
 # Driver registry — maps URL scheme to adapter class
 _DRIVERS: dict[str, type] = {}
 
@@ -65,9 +135,23 @@ class Database:
         # Priority: constructor params > env vars > empty
         self.username = username or os.environ.get("DATABASE_USERNAME", "")
         self.password = password or os.environ.get("DATABASE_PASSWORD", "")
-        self.pool_size = pool  # Reserved for future connection pooling (0 = single connection)
-        self._adapter: DatabaseAdapter = self._create_adapter()
-        self._adapter.connect(self._connection_path(), username=self.username, password=self.password)
+        self.pool_size = pool  # 0 = single connection, N>0 = N pooled connections
+
+        if self.pool_size > 0:
+            # Pooled mode — create a ConnectionPool with lazy adapter creation
+            self._pool = ConnectionPool(
+                pool_size=self.pool_size,
+                factory=self._create_adapter,
+                connect_path=self._connection_path(),
+                username=self.username,
+                password=self.password,
+            )
+            self._adapter: DatabaseAdapter | None = None
+        else:
+            # Single-connection mode — current behavior
+            self._pool: ConnectionPool | None = None
+            self._adapter: DatabaseAdapter = self._create_adapter()
+            self._adapter.connect(self._connection_path(), username=self.username, password=self.password)
 
         # Query cache — off by default, opt-in via TINA4_DB_CACHE=true
         from tina4_python.dotenv import is_truthy
@@ -166,20 +250,34 @@ class Database:
             self._cache_hits = 0
             self._cache_misses = 0
 
+    # ── Pool-aware adapter access ─────────────────────────────
+
+    def _get_adapter(self) -> DatabaseAdapter:
+        """Get an adapter — from pool (round-robin) or single connection."""
+        if self._pool is not None:
+            return self._pool.checkout()
+        return self._adapter
+
     # ── Delegate to adapter — with cache integration ─────────
 
     def close(self):
-        self._adapter.close()
+        """Close all connections (pool or single)."""
+        if self._pool is not None:
+            self._pool.close_all()
+        elif self._adapter is not None:
+            self._adapter.close()
 
     def execute(self, sql: str, params: list = None) -> DatabaseResult:
         if self._cache_enabled:
             self._cache_invalidate()
-        return self._adapter.execute(sql, params)
+        adapter = self._get_adapter()
+        return adapter.execute(sql, params)
 
     def execute_many(self, sql: str, params_list: list[list] = None) -> DatabaseResult:
         if self._cache_enabled:
             self._cache_invalidate()
-        return self._adapter.execute_many(sql, params_list)
+        adapter = self._get_adapter()
+        return adapter.execute_many(sql, params_list)
 
     def fetch(self, sql: str, params: list = None,
               limit: int = 20, offset: int = 0) -> DatabaseResult:
@@ -191,12 +289,14 @@ class Database:
                 with self._cache_lock:
                     self._cache_hits += 1
                 return cached
-            result = self._adapter.fetch(sql, params, limit, offset)
+            adapter = self._get_adapter()
+            result = adapter.fetch(sql, params, limit, offset)
             self._cache_set(key, result)
             with self._cache_lock:
                 self._cache_misses += 1
             return result
-        return self._adapter.fetch(sql, params, limit, offset)
+        adapter = self._get_adapter()
+        return adapter.fetch(sql, params, limit, offset)
 
     def fetch_one(self, sql: str, params: list = None) -> dict | None:
         if self._cache_enabled:
@@ -206,59 +306,79 @@ class Database:
                 with self._cache_lock:
                     self._cache_hits += 1
                 return cached
-            result = self._adapter.fetch_one(sql, params)
+            adapter = self._get_adapter()
+            result = adapter.fetch_one(sql, params)
             self._cache_set(key, result)
             with self._cache_lock:
                 self._cache_misses += 1
             return result
-        return self._adapter.fetch_one(sql, params)
+        adapter = self._get_adapter()
+        return adapter.fetch_one(sql, params)
 
     def insert(self, table: str, data: dict | list) -> DatabaseResult:
         if self._cache_enabled:
             self._cache_invalidate()
-        return self._adapter.insert(table, data)
+        adapter = self._get_adapter()
+        return adapter.insert(table, data)
 
     def update(self, table: str, data: dict,
                filter_sql: str = "", params: list = None) -> DatabaseResult:
         if self._cache_enabled:
             self._cache_invalidate()
-        return self._adapter.update(table, data, filter_sql, params)
+        adapter = self._get_adapter()
+        return adapter.update(table, data, filter_sql, params)
 
     def delete(self, table: str,
                filter_sql: str | dict | list = "", params: list = None) -> DatabaseResult:
         if self._cache_enabled:
             self._cache_invalidate()
-        return self._adapter.delete(table, filter_sql, params)
+        adapter = self._get_adapter()
+        return adapter.delete(table, filter_sql, params)
 
     def start_transaction(self):
-        self._adapter.start_transaction()
+        adapter = self._get_adapter()
+        adapter.start_transaction()
 
     def commit(self):
-        self._adapter.commit()
+        adapter = self._get_adapter()
+        adapter.commit()
 
     def rollback(self):
-        self._adapter.rollback()
+        adapter = self._get_adapter()
+        adapter.rollback()
 
     def table_exists(self, name: str) -> bool:
-        return self._adapter.table_exists(name)
+        adapter = self._get_adapter()
+        return adapter.table_exists(name)
 
     def get_tables(self) -> list[str]:
-        return self._adapter.get_tables()
+        adapter = self._get_adapter()
+        return adapter.get_tables()
 
     def get_columns(self, table: str) -> list[dict]:
-        return self._adapter.get_columns(table)
+        adapter = self._get_adapter()
+        return adapter.get_columns(table)
 
     def get_database_type(self) -> str:
-        return self._adapter.get_database_type()
+        adapter = self._get_adapter()
+        return adapter.get_database_type()
 
     @property
     def autocommit(self) -> bool:
         """Whether writes auto-commit. Off by default, set TINA4_AUTOCOMMIT=true to enable."""
-        return self._adapter.autocommit
+        adapter = self._get_adapter()
+        return adapter.autocommit
 
     @autocommit.setter
     def autocommit(self, value: bool):
-        self._adapter.autocommit = value
+        if self._pool is not None:
+            # Set autocommit on all active pool connections
+            with self._pool._lock:
+                for a in self._pool._adapters:
+                    if a is not None:
+                        a.autocommit = value
+        elif self._adapter is not None:
+            self._adapter.autocommit = value
 
     def register_function(self, name: str, num_params: int, func: callable, deterministic: bool = True):
         """Register a custom SQL function (SQLite only).
@@ -267,14 +387,23 @@ class Database:
             db.register_function("double", 1, lambda x: x * 2)
             db.fetch_one("SELECT double(5) as result")  # {"result": 10}
         """
-        if hasattr(self._adapter, "register_function"):
-            self._adapter.register_function(name, num_params, func, deterministic)
+        adapter = self._get_adapter()
+        if hasattr(adapter, "register_function"):
+            adapter.register_function(name, num_params, func, deterministic)
         else:
             raise NotImplementedError(
-                f"{self._adapter.get_database_type()} does not support custom function registration"
+                f"{adapter.get_database_type()} does not support custom function registration"
             )
 
     @property
     def adapter(self) -> DatabaseAdapter:
-        """Access the underlying adapter directly (for driver-specific ops)."""
-        return self._adapter
+        """Access the underlying adapter directly (for driver-specific ops).
+
+        With pooling enabled, returns the next adapter from the pool via round-robin.
+        """
+        return self._get_adapter()
+
+    @property
+    def pool(self) -> ConnectionPool | None:
+        """Access the connection pool (None if pooling is disabled)."""
+        return self._pool

tina4_python-3.8.2/tina4_python/test_client/__init__.py

@@ -0,0 +1,177 @@
+# Tina4 Test Client — Test routes without starting a server.
+"""
+Simple test client that creates mock requests, matches routes,
+executes handlers, and returns a TestResponse.
+
+Usage::
+
+    from tina4_python.test_client import TestClient
+
+    client = TestClient()
+
+    response = client.get("/api/users")
+    assert response.status == 200
+    assert response.json()["users"] is not None
+
+    response = client.post("/api/users", json={"name": "Alice"})
+    assert response.status == 201
+
+    response = client.get("/api/users/1", headers={"Authorization": "Bearer token123"})
+"""
+import json as _json
+import asyncio
+from tina4_python.core.request import Request
+from tina4_python.core.response import Response
+from tina4_python.core.router import Router
+
+
+class TestResponse:
+    """Wraps a Response object with a clean test-friendly API."""
+
+    __slots__ = ("status", "body", "headers", "content_type")
+
+    def __init__(self, response: Response):
+        self.status: int = response.status_code
+        self.body: bytes = response.content
+        self.content_type: str = response.content_type
+        self.headers: dict = {}
+        for name, value in response._headers:
+            self.headers[name.lower()] = value
+
+    def json(self) -> dict | list | None:
+        """Parse body as JSON."""
+        if not self.body:
+            return None
+        return _json.loads(self.body.decode())
+
+    def text(self) -> str:
+        """Return body as a string."""
+        return self.body.decode(errors="replace")
+
+    def __repr__(self) -> str:
+        return f"<TestResponse status={self.status} content_type={self.content_type!r}>"
+
+
+class TestClient:
+    """Test routes directly without starting a server.
+
+    Creates a mock Request, finds the matching route via Router.match(),
+    executes the handler, and returns a TestResponse.
+    """
+
+    def get(self, path: str, *, headers: dict | None = None) -> TestResponse:
+        """Send a GET request to the given path."""
+        return self._request("GET", path, headers=headers)
+
+    def post(self, path: str, *, json: dict | list | None = None,
+             body: str | bytes | None = None, headers: dict | None = None) -> TestResponse:
+        """Send a POST request to the given path."""
+        return self._request("POST", path, json=json, body=body, headers=headers)
+
+    def put(self, path: str, *, json: dict | list | None = None,
+            body: str | bytes | None = None, headers: dict | None = None) -> TestResponse:
+        """Send a PUT request to the given path."""
+        return self._request("PUT", path, json=json, body=body, headers=headers)
+
+    def patch(self, path: str, *, json: dict | list | None = None,
+              body: str | bytes | None = None, headers: dict | None = None) -> TestResponse:
+        """Send a PATCH request to the given path."""
+        return self._request("PATCH", path, json=json, body=body, headers=headers)
+
+    def delete(self, path: str, *, headers: dict | None = None) -> TestResponse:
+        """Send a DELETE request to the given path."""
+        return self._request("DELETE", path, headers=headers)
+
+    def _request(self, method: str, path: str, *,
+                 json: dict | list | None = None,
+                 body: str | bytes | None = None,
+                 headers: dict | None = None) -> TestResponse:
+        """Build a mock request, match the route, execute the handler."""
+
+        # Build raw body bytes
+        raw_body = b""
+        content_type = ""
+
+        if json is not None:
+            raw_body = _json.dumps(json).encode()
+            content_type = "application/json"
+        elif body is not None:
+            if isinstance(body, str):
+                raw_body = body.encode()
+            else:
+                raw_body = body
+
+        # Build ASGI-style headers
+        header_list: list[tuple[bytes, bytes]] = []
+        if headers:
+            for k, v in headers.items():
+                header_list.append((k.lower().encode(), v.encode()))
+
+        if content_type and not any(h[0] == b"content-type" for h in header_list):
+            header_list.append((b"content-type", content_type.encode()))
+
+        if raw_body and not any(h[0] == b"content-length" for h in header_list):
+            header_list.append((b"content-length", str(len(raw_body)).encode()))
+
+        # Split path and query string
+        query_string = ""
+        clean_path = path
+        if "?" in path:
+            clean_path, query_string = path.split("?", 1)
+
+        # Build ASGI scope
+        scope = {
+            "type": "http",
+            "method": method,
+            "path": clean_path,
+            "query_string": query_string.encode(),
+            "headers": header_list,
+            "client": ("127.0.0.1", 0),
+        }
+
+        # Create Request from scope
+        request = Request.from_scope(scope, raw_body)
+
+        # Match route
+        route, params = Router.match(method, clean_path)
+
+        if route is None:
+            # No route found — return 404
+            resp = Response()
+            resp.status_code = 404
+            resp.content = b'{"error":"Not found"}'
+            resp.content_type = "application/json"
+            return TestResponse(resp)
+
+        # Inject route params
+        request._route_params = params
+        request.merge_route_params()
+
+        # Create response callable
+        response = Response()
+
+        # Execute handler (sync or async)
+        handler = route["handler"]
+        result = handler(request, response)
+
+        # If handler is async, run it in an event loop
+        if asyncio.iscoroutine(result):
+            try:
+                loop = asyncio.get_running_loop()
+            except RuntimeError:
+                loop = None
+
+            if loop and loop.is_running():
+                # Already in an async context — create a task
+                import concurrent.futures
+                with concurrent.futures.ThreadPoolExecutor() as pool:
+                    result = pool.submit(asyncio.run, result).result()
+            else:
+                result = asyncio.run(result)
+
+        # The handler should have returned the response via response(...)
+        # If the handler returned a Response, use that
+        if isinstance(result, Response):
+            return TestResponse(result)
+
+        return TestResponse(response)