flask-construct-ui 0.10.0__tar.gz → 0.10.2__tar.gz

{flask_construct_ui-0.10.0 → flask_construct_ui-0.10.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flask-construct-ui
-Version: 0.10.0
+Version: 0.10.2
 Summary: A UI toolkit for Flask with CRUD and component features.
 Author-email: Olof Tjerngren <olof@tjerngren.net>
 License-Expression: LGPL-3.0-or-later
@@ -30,8 +30,6 @@ Requires-Dist: pygal
 Requires-Dist: markdown-it-py
 Requires-Dist: SQLAlchemy
 Requires-Dist: orgparse
-Provides-Extra: security
-Requires-Dist: flask-security-too; extra == "security"
 Provides-Extra: oidc
 Requires-Dist: flask-oidc; extra == "oidc"
 Dynamic: license-file
@@ -42,6 +40,8 @@ A UI toolkit for Flask with CRUD and component features.
 Very influenced by flask-admin and flask-restx, used for quick admin UIs.
 Recommended user authentication is oidc if required.
 
+> Optional flask-security-too package removed until security issue fixed.
+
 ## Documentation
 
 The [user manual](https://gitlab.com/Resample2545/flask-construct-ui/-/blob/release/manual/index.org?ref_type=heads) best read on the release branch to not get fooled.

{flask_construct_ui-0.10.0 → flask_construct_ui-0.10.2}/README.md

@@ -4,6 +4,8 @@ A UI toolkit for Flask with CRUD and component features.
 Very influenced by flask-admin and flask-restx, used for quick admin UIs.
 Recommended user authentication is oidc if required.
 
+> Optional flask-security-too package removed until security issue fixed.
+
 ## Documentation
 
 The [user manual](https://gitlab.com/Resample2545/flask-construct-ui/-/blob/release/manual/index.org?ref_type=heads) best read on the release branch to not get fooled.

{flask_construct_ui-0.10.0 → flask_construct_ui-0.10.2}/flask_construct_ui/auth.py

@@ -1,14 +1,18 @@
 from __future__ import annotations
 
+import hashlib
+
 from flask import (
     abort,
     current_app,
     g,
+    make_response,
     redirect,
     render_template,
     request,
     url_for,
 )
+from markupsafe import escape
 
 # --- Authentication & authorization ---------------------------------------
 # Construct routes are guarded fail-closed: once an ``AuthProvider`` is passed
@@ -19,10 +23,69 @@ from flask import (
 # ``before_request`` in ``base.py`` (see ``auth_protect``), which is why this
 # covers the dynamically-registered RCRUD nested routes too.
 #
-# The boundary is server-side, so it behaves identically with JavaScript on or
-# off: an unauthenticated request gets a plain 302 to the login endpoint (a
-# browser follows it without JS; Unpoly follows it too) and an authenticated
-# request lacking the required group gets a server-rendered themed 403 page.
+# The boundary is server-side, so it decides the same thing with JavaScript on
+# or off; only the *shape* of the answer differs. Without JS an unauthenticated
+# request gets a plain 302 the browser follows. Under Unpoly a fragment request
+# cannot be answered that way (see ``on_unauthenticated``), so it gets a 401
+# carrying the login URL in ``X-Construct-Login``. An authenticated request
+# lacking the required group gets a server-rendered themed 403 page either way.
+
+#: Response header carrying an opaque fingerprint of the auth state a response
+#: was rendered for. The full-page layout stamps the same value on
+#: ``<html data-fcu-auth>``, so the browser can notice that a fragment was
+#: rendered for a *different* session than the surrounding shell.
+AUTH_STAMP_HEADER = "X-Construct-Auth"
+
+#: Response header asking the browser to leave the fragment pipeline and load
+#: the given login URL as a full page navigation.
+LOGIN_HEADER = "X-Construct-Login"
+
+#: Stamp value for a request with no logged-in user.
+ANONYMOUS_STAMP = "anon"
+
+_STAMP_CACHE_KEY = "_construct_auth_stamp"
+
+
+def is_unpoly_request() -> bool:
+    """True when the current request was issued by Unpoly (i.e. JS is on)."""
+    return bool(request.headers.get("X-Up-Version"))
+
+
+def auth_stamp(provider) -> str:
+    """Opaque fingerprint of the identity this request is being served for.
+
+    Returns :data:`ANONYMOUS_STAMP` when nobody is logged in, otherwise a hash
+    of the user name and their groups. It is hashed so that no user name or
+    group ever rides along in a response header — only *changes* are
+    observable, which is all the client needs to tell a stale shell from a
+    current one. Group membership is folded in so that a re-login as someone
+    else, or a permission change, also invalidates the rendered menu.
+    """
+    cached = g.get(_STAMP_CACHE_KEY, None)
+    if cached is not None:
+        return cached
+    if provider is None or not provider.is_authenticated():
+        stamp = ANONYMOUS_STAMP
+    else:
+        groups = ",".join(sorted(provider.current_groups()))
+        ident = f"{provider.current_user_name() or ''}|{groups}"
+        stamp = hashlib.sha256(ident.encode("utf-8")).hexdigest()[:16]
+    setattr(g, _STAMP_CACHE_KEY, stamp)
+    return stamp
+
+
+def _t(msg_id: str, fallback: str) -> str:
+    """Translate ``msg_id``, falling back when l10n is absent or has no key.
+
+    The guard responds before ``set_language_from_browser`` has run, so this
+    resolves against English (see ``Translator.t``); it is only ever used for
+    text a JS-mode client replaces with a page navigation anyway.
+    """
+    translator = getattr(current_app, "l10n", None)
+    if translator is None:
+        return fallback
+    text = translator.t(msg_id)
+    return fallback if text == msg_id else text
 
 
 def public(f):
@@ -122,11 +185,33 @@ class AuthProvider:
             return f"{target}{sep}next={nxt}"
 
     def on_unauthenticated(self):
-        """Default: 302 redirect to the login URL (401 if none configured)."""
+        """Send the user to the login page (401 when none is configured).
+
+        Plain requests get a 302 the browser follows. An Unpoly *fragment*
+        request cannot be answered that way: its XHR follows the redirect
+        itself, and a hosted IdP bounces the login endpoint to another origin,
+        where the redirected XHR dies on CORS — the user sees a network error
+        while the shell keeps showing them as logged in. Even a same-origin
+        login form would only be swapped into ``#main-content``, leaving the
+        navbar and sidebar (rendered once, by the full-page layout) advertising
+        a session that no longer exists.
+
+        So JS-mode requests get a 401 carrying the login URL in
+        :data:`LOGIN_HEADER`, which ``construct-core.js`` turns into a full
+        page navigation. The small body is a no-JS-style fallback for the case
+        where the response is rendered anyway.
+        """
         url = self.login_url()
         if url is None:
             abort(401)
-        return redirect(url)
+        if not is_unpoly_request():
+            return redirect(url)
+        label = _t("auth-login-required", "You must log in to access this page.")
+        body = f'<p class="fcu-alert"><a href="{escape(url)}">{escape(label)}</a></p>'
+        response = make_response(body, 401)
+        response.headers[LOGIN_HEADER] = url
+        response.headers[AUTH_STAMP_HEADER] = ANONYMOUS_STAMP
+        return response
 
     def on_forbidden(self):
         """Default: render the themed access-denied page with HTTP 403."""

{flask_construct_ui-0.10.0 → flask_construct_ui-0.10.2}/flask_construct_ui/base.py

@@ -53,6 +53,7 @@ from .pagination import (
     DEFAULT_PAGE_SIZE,
     MAX_PAGE_SIZE,
 )
+from .auth import AUTH_STAMP_HEADER, auth_stamp
 
 
 def list_action(name, icon):
@@ -773,6 +774,21 @@ class FlaskConstructUI:
                     response.headers["Vary"] = (existing + ", X-Up-Target").lstrip(", ")
             return response
 
+        @app.after_request
+        def add_auth_stamp(response):
+            # Tag every HTML response with the auth state it was rendered for.
+            # A fragment render only replaces #main-content, so the navbar and
+            # sidebar cannot correct themselves when the session ends (or
+            # switches user) while the page sits open — a logged-out request to
+            # a @public page still answers 200 with fresh content under a shell
+            # that names the old user. The client compares this header against
+            # the stamp the full-page layout put on <html data-fcu-auth> and
+            # reloads the whole document when they disagree.
+            if self._auth is None or "text/html" not in response.content_type:
+                return response
+            response.headers.setdefault(AUTH_STAMP_HEADER, auth_stamp(self._auth))
+            return response
+
         @app.before_request
         def csrf_protect():
             # Only guard state-changing requests against construct-owned
@@ -1060,8 +1076,8 @@ class FlaskConstructUI:
         collapsible submenu group with that title instead of being placed at
         the top level. Pages sharing the same ``submenu`` title are collected
         into the same group, in the order they are added. ``submenu_icon`` sets
-        the icon for the group the first time it is created (themes that render
-        a submenu icon use it; flat themes show the title as a section header).
+        the icon for the group the first time it is created; if omitted, the
+        group falls back to the ``folder`` icon.
         """
         self._pages.append(page)
         self._blueprint_names.add(page.endpoint)
@@ -1083,7 +1099,10 @@ class FlaskConstructUI:
                     + page.menu["link"]
                 )
                 if submenu is not None:
-                    self._add_to_submenu(submenu, menu, submenu_icon)
+                    if submenu_icon is None:
+                        self._add_to_submenu(submenu, menu)
+                    else:
+                        self._add_to_submenu(submenu, menu, submenu_icon)
                 else:
                     self._menu.append(menu)
 
@@ -1151,6 +1170,18 @@ class FlaskConstructUI:
     def auth(self):
         return self._auth
 
+    @property
+    def auth_stamp(self):
+        """Fingerprint of the current auth state, or None when auth is off.
+
+        Rendered into the full-page layout as ``<html data-fcu-auth>`` so the
+        browser can compare it against the ``X-Construct-Auth`` header of later
+        fragment responses. Must be called within a request context.
+        """
+        if self._auth is None:
+            return None
+        return auth_stamp(self._auth)
+
     @property
     def navbar_features_available(self):
         """Whether navbar search/notifications should be rendered.

{flask_construct_ui-0.10.0 → flask_construct_ui-0.10.2}/flask_construct_ui/components.py

@@ -13,6 +13,7 @@ from markupsafe import Markup
 from textwrap import dedent
 import jinja2
 import pygal
+from pygal.style import Style
 from markdown_it import MarkdownIt
 from flask import current_app, g, url_for
 from flask_construct_ui.language import LOCALE_MAPPING
@@ -45,6 +46,7 @@ class Field:
     options: Optional[Union[List[str], str, Dict[str, str]]] = None
     value: Any = None
     secret: bool = False
+    autofocus: bool = False
 
 
 class FieldRendererRegistry:
@@ -392,6 +394,40 @@ class FormComponent(Component):
         return result
 
 
+# Theme-aware pygal style. Every value is a CSS custom property, so the numbers
+# are resolved by the browser against the inline SVG's host page -- which means
+# charts pick up the active design's font and colours and follow light/dark
+# mode automatically, with no server-side scheme detection. Restyle charts by
+# overriding these `--fcu-chart-*` tokens in a design stylesheet (see
+# whitelabel.css); nothing here needs to change. `background` is left on the
+# surface token (not transparent) so hover tooltips keep a readable box.
+CHART_STYLE = Style(
+    background="var(--fcu-surface)",
+    plot_background="transparent",
+    foreground="var(--fcu-text-muted)",
+    foreground_strong="var(--fcu-text)",
+    foreground_subtle="var(--fcu-border)",
+    font_family="var(--fcu-chart-font-family)",
+    title_font_size=15,
+    legend_font_size=13,
+    label_font_size=12,
+    major_label_font_size=12,
+    value_font_size=12,
+    tooltip_font_size=13,
+    opacity=".85",
+    opacity_hover="1",
+    transition="150ms ease-in-out",
+    colors=(
+        "var(--fcu-chart-color-1)",
+        "var(--fcu-chart-color-2)",
+        "var(--fcu-chart-color-3)",
+        "var(--fcu-chart-color-4)",
+        "var(--fcu-chart-color-5)",
+        "var(--fcu-chart-color-6)",
+    ),
+)
+
+
 @dataclass
 class ChartComponent(Component):
     data: List[Tuple[str, List[Any]]] = field(default_factory=list)
@@ -418,7 +454,7 @@ class ChartComponent(Component):
         ):
             is_timeseries = True
 
-        config_kwargs = {}
+        config_kwargs = {"style": CHART_STYLE}
         if self.width:
             config_kwargs["width"] = self.width
         if self.height: