flask-construct-ui 0.9.5__py3-none-any.whl

flask_construct_ui/csrf.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+import secrets
+from flask import session, request, abort
+from markupsafe import Markup
+
+# --- CSRF protection -------------------------------------------------------
+# Synchronizer-token pattern. The token lives in the session and is rendered
+# into every state-changing form as a hidden field (the authoritative source,
+# so submissions work with JavaScript disabled). JavaScript-driven requests
+# (e.g. Unpoly) may instead send it in the ``X-CSRFToken`` header.
+CSRF_SESSION_KEY = "_construct_csrf_token"
+CSRF_FORM_FIELD = "_csrf_token"
+CSRF_HEADER = "X-CSRFToken"
+CSRF_UNSAFE_METHODS = frozenset({"POST", "PUT", "PATCH", "DELETE"})
+
+
+def generate_csrf_token() -> str:
+    """Return the session CSRF token, creating one on first use."""
+    if CSRF_SESSION_KEY not in session:
+        session[CSRF_SESSION_KEY] = secrets.token_urlsafe(32)
+    return session[CSRF_SESSION_KEY]
+
+
+def csrf_field() -> Markup:
+    """Render the hidden CSRF input for inclusion in a POST form."""
+    token = generate_csrf_token()
+    return Markup(f'<input type="hidden" name="{CSRF_FORM_FIELD}" value="{token}">')  # nosemgrep: explicit-unescape-with-markup  # nosec B704
+
+
+def validate_csrf_token() -> None:
+    """Abort with 400 if the request lacks a valid CSRF token."""
+    expected = session.get(CSRF_SESSION_KEY)
+    submitted = request.form.get(CSRF_FORM_FIELD) or request.headers.get(CSRF_HEADER)
+    if (
+        not expected
+        or not submitted
+        or not secrets.compare_digest(str(submitted), str(expected))
+    ):
+        abort(400, description="CSRF validation failed")

flask_construct_ui/data.py

@@ -0,0 +1,257 @@
+from typing import Dict, List, Any
+from flask import current_app, has_app_context
+from .schema import SchemaField, Related, ManyRelated, List as ListField
+import re
+
+# Data base layer.
+
+# Hard cap applied when no app context is available to provide
+# CONSTRUCT_MAX_PAGE_SIZE (e.g. data classes used in scripts/tests).
+MAX_PAGE_SIZE_FALLBACK = 100
+
+
+def effective_limit(limit=None):
+    """Return a (offset, count) pair that is always bounded.
+
+    Data backends must run every list-returning query through this so a
+    missing or oversized ``limit`` can never produce an unbounded scan:
+    ``None`` becomes ``(0, max)``, the count is clamped to the configured
+    ``CONSTRUCT_MAX_PAGE_SIZE`` and the offset is floored at 0.
+    """
+
+    if has_app_context():
+        max_count = current_app.config.get(
+            "CONSTRUCT_MAX_PAGE_SIZE", MAX_PAGE_SIZE_FALLBACK
+        )
+    else:
+        max_count = MAX_PAGE_SIZE_FALLBACK
+    try:
+        max_count = int(max_count)
+    except (TypeError, ValueError):
+        max_count = MAX_PAGE_SIZE_FALLBACK
+
+    if limit is None:
+        return (0, max_count)
+
+    try:
+        offset, count = limit
+        offset = int(offset)
+        count = int(count)
+    except (TypeError, ValueError):
+        return (0, max_count)
+
+    return (max(0, offset), min(max(1, count), max_count))
+
+
+# QBE format
+# ---
+# qbe is passed as a dictionary with "fieldname": "qbe_formatted_string"
+# Special characters
+# | or, any of these will match.
+# .. Used in the beginning for >= and the end for <= and .. for inclusive between
+# * is the multi-character wildcard.
+# ? is the single-character wildcard.
+# () groups expressions to be joined with AND
+# \ is escape for the above and will cancel their special behaviour.
+#
+# Example:
+# qbe = {
+#     "field1": "match_this",
+#     "field2": "!match_all_except_this",
+#     "field3": "..below_and_equal_to_this",
+#     "field4": "above_and_equal_to_this..",
+#     "field5": "between_this..and_this",
+#     "field6": "starts_with*",
+#     "field7": "*ends_with",
+#     "field8": "starts*with",  # Starts and ends with, wildcard in middle.
+#     "field9": "*somewhere*",# Match with string somewhere in it.
+#     "field10": "this|that|other", # Matches all of these
+#     "field11": "..this|that..|other..end", # Matches all where less than 'this', greater than 'that' and between other and end.
+#     "field12": "starts_with*|*ends_with",
+#     "field13": "\*match_with_escape", # Escape special character.
+#     "field14": "(ab|ac)|abc", # ab AND ac OR abc
+#     "field15": "(ab|ac|abc)", # ab AND ac AND abc
+#     "field16": "\(ok!\)|\(mostly ok!\)" # (ok!) OR (mostly ok!)
+# }
+
+
+class DataBase:
+    _schema: Dict[str, SchemaField]
+    _primary_key: str
+
+    def to_dict(self, obj):
+        res = {}
+        for field, ftype in self._schema.items():
+            if isinstance(ftype, Related):
+                val = getattr(obj, field, None)
+                if val:
+                    res[field] = ftype.related_class().to_dict(val)
+                else:
+                    res[field] = None
+            elif isinstance(ftype, ManyRelated):
+                items = list(getattr(obj, ftype.related_field, None) or [])
+                res[field] = [ftype.related_class().to_dict(item) for item in items]
+            elif isinstance(ftype, ListField):
+                res[field] = [
+                    ftype.list_class().to_dict(item)
+                    for item in self.get_list(obj, field)
+                ]
+            else:
+                res[field] = getattr(obj, field, None)
+        return res
+
+    def get_list(self, obj, field):
+        return None
+
+    def _unescape(self, text: str) -> str:
+        """Removes one level of escaping from a string."""
+        return re.sub(r"\\(.)", r"\1", text)
+
+    def _build_like_pattern(self, part: str) -> str:
+        pattern = ""
+        i = 0
+        while i < len(part):
+            char = part[i]
+            if char == "\\":
+                if i + 1 < len(part):
+                    next_char = part[i + 1]
+                    pattern += next_char
+                    i += 2
+                else:  # dangling backslash
+                    pattern += "\\"
+                    i += 1
+            elif char == "*":
+                pattern += "%"
+                i += 1
+            elif char == "?":
+                pattern += "_"
+                i += 1
+            elif char == "%":
+                pattern += "\\%"
+                i += 1
+            elif char == "_":
+                pattern += "\\_"
+                i += 1
+            else:
+                pattern += char
+                i += 1
+        return pattern
+
+    def _parse_single_expr(self, part: str) -> dict:
+        """Parses a string that does not contain any logical operators like `|` or `()`."""
+        if re.search(r"(?<!\\)[*?]", part):
+            return {"like": self._build_like_pattern(part)}
+
+        match = re.search(r"(?<!\\)\.\.", part)
+
+        if match:
+            start_index = match.start()
+            if start_index == 0:
+                return {"<=": self._unescape(part[2:])}
+            elif start_index == len(part) - 2:
+                return {">=": self._unescape(part[:-2])}
+            else:
+                start_val = part[:start_index]
+                end_val = part[start_index + 2 :]
+                return {
+                    "and": [
+                        {">=": self._unescape(start_val)},
+                        {"<=": self._unescape(end_val)},
+                    ]
+                }
+
+        if part.startswith("!") and not part.startswith(r"\\!"):
+            return {"!=": self._unescape(part[1:])}
+
+        return {"=": self._unescape(part)}
+
+    def process_qbe(self, qbe: Dict[str, str]) -> Dict[str, List[Dict[str, Any]]]:
+        processed_qbe = {}
+        for field, query in qbe.items():
+            if isinstance(query, list):
+                processed_qbe[field] = query
+                continue
+            or_parts = []
+            level = 0
+            last_split = 0
+            i = 0
+            is_bool = False
+            if type(query) is bool:
+                query = str(query)
+                is_bool = True
+
+            while i < len(query):
+                char = query[i]
+                if char == "\\":
+                    i += 2
+                    continue
+                if char == "(":
+                    level += 1
+                elif char == ")":
+                    level -= 1
+                elif char == "|" and level == 0:
+                    or_parts.append(query[last_split:i])
+                    last_split = i + 1
+                i += 1
+            or_parts.append(query[last_split:])
+
+            final_conditions = []
+            for part in or_parts:
+                part = part.strip()
+                if (
+                    part.startswith("(")
+                    and part.endswith(")")
+                    and not part.startswith(r"\\(")
+                ):
+                    group_content = part[1:-1]
+                    and_parts = re.split(r"(?<!\\)\|", group_content)
+                    and_conditions = []
+                    for and_part in and_parts:
+                        condition = self._parse_single_expr(and_part.strip())
+                        and_conditions.append(condition)
+                    if len(and_conditions) > 1:
+                        final_conditions.append({"and": and_conditions})
+                    elif and_conditions:
+                        final_conditions.append(and_conditions[0])
+                else:
+                    condition = self._parse_single_expr(part)
+                    final_conditions.append(condition)
+            if is_bool:
+                if final_conditions[0]["="] == "True":
+                    final_conditions[0]["="] = True
+                else:
+                    final_conditions[0]["="] = False
+            processed_qbe[field] = final_conditions
+        return processed_qbe
+
+    def read(self, id):
+        raise NotImplementedError("Read method not implemented.")
+
+    def create(self, data):
+        raise NotImplementedError("Create method not implemented.")
+
+    def update(self, id, data):
+        raise NotImplementedError("Update method not implemented.")
+
+    def delete(self, id):
+        raise NotImplementedError("Delete method not implemented.")
+
+    def filter(self, qbe=None, limit=None):
+        """Return ``(rows, total)`` for the QBE dict.
+
+        ``limit`` is an ``(offset, count)`` pair. Implementations must pass
+        it through :func:`effective_limit` and apply the result, so the
+        query is bounded even when the caller omits it.
+        """
+        raise NotImplementedError("Filter method not implemented.")
+
+    def search(self, q=None, limit=None, fields=None):
+        """Return ``(rows, total)`` for a free-text search.
+
+        Same ``limit`` contract as :meth:`filter`. ``fields``, when given,
+        restricts the match to those schema fields; the library only passes
+        it for ``ManyRelated`` fields declaring ``search_fields``, so
+        backends without support may ignore the feature until an app opts
+        a field in.
+        """
+        raise NotImplementedError("Search method not implememted.")

flask_construct_ui/data_sqlalchemy.py

@@ -0,0 +1,304 @@
+from sqlalchemy.sql.expression import func
+from .data import DataBase, effective_limit
+from .schema import Related, ManyRelated, List
+from .schema import PK
+
+# from flask_sqlalchemy import SQLAlchemy
+from sqlalchemy import and_, or_, select
+from sqlalchemy.orm import DeclarativeBase, Session
+
+
+class DataSQLAlchemy(DataBase):
+    session = type[Session]
+    model = type[DeclarativeBase]
+    # def __init__(self, model: Type[DeclarativeBase]):
+    #    self.model = model
+
+    def _get_column(self, field):
+        if field not in self._schema:
+            raise KeyError(
+                f"Field '{field}' is not declared in the schema of "
+                f"{type(self).__name__}; refusing to filter on it."
+            )
+        ftype = self._schema.get(field)
+        if isinstance(ftype, Related):
+            base = self.model
+            field_name = ftype.related_field.split(".")[-1]
+            for item in ftype.related_field.split(".")[:-1]:
+                base = getattr(base, item).property.mapper.class_
+            return getattr(base, field_name)
+        return getattr(self.model, field)
+
+    def get_list(self, obj, field):
+        ftype = self._schema.get(field)
+        if isinstance(ftype, List):
+            res = getattr(obj, field)
+            getter = getattr(self, f"get_{field}", None)
+            if getter:
+                return getter(obj)
+            return res
+        return None
+
+    def _build_clause(self, field, op, value):
+        column = self._get_column(field)
+        if isinstance(column, property):
+            return None
+        if op == "=":
+            return column == value
+        elif op == "!=":
+            return column != value
+        elif op == ">":
+            return column > value
+        elif op == ">=":
+            return column >= value
+        elif op == "<":
+            return column < value
+        elif op == "<=":
+            return column <= value
+        elif op == "like":
+            return column.like(value, escape="\\")
+        return None
+
+    def get_base_query(self):
+        base_query = select(self.model)
+        for fldname, ftype in self._schema.items():
+            if isinstance(ftype, Related):
+                base_query = base_query.outerjoin(ftype.related_class.model)
+
+        return base_query
+
+    def filter(self, qbe=None, limit=None):
+        limit = effective_limit(limit)
+        if qbe is None:
+            tot = self.session.scalar(
+                select(func.count()).select_from(self.get_base_query().subquery())
+            )
+            return (
+                self.session.scalars(
+                    self.get_base_query().offset(limit[0]).limit(limit[1])
+                ).all(),
+                tot,
+            )
+
+        processed_qbe = self.process_qbe(qbe)
+        query = self.get_base_query()
+        clauses = []
+
+        for field, conditions in processed_qbe.items():
+            field_clauses = []
+            for condition in conditions:
+                if "and" in condition:
+                    and_clauses = []
+                    for sub_condition in condition["and"]:
+                        op, value = list(sub_condition.items())[0]
+                        and_clauses.append(self._build_clause(field, op, value))
+                    field_clauses.append(and_(*and_clauses))
+                else:
+                    op, value = list(condition.items())[0]
+                    field_clauses.append(self._build_clause(field, op, value))
+            clauses.append(or_(*field_clauses))
+
+        if clauses:
+            query = query.filter(and_(*clauses))
+        tot = self.session.scalar(select(func.count()).select_from(query.subquery()))
+
+        return (
+            self.session.scalars(query.offset(limit[0]).limit(limit[1])).all(),
+            tot,
+        )
+
+    def read(self, id):
+        return self.session.get(self.model, id)
+
+    def _resolve_many_related(self, ftype, pks, staged):
+        """The full related collection for a ManyRelated field: existing
+        records by primary key plus staged creations (``quick`` values and
+        ``new`` sub-form dicts). New records stay transient — they are
+        committed together with the parent."""
+        related_ds = ftype.related_class()
+        pks = pks if isinstance(pks, list) else []
+        staged = staged or {}
+        objs = []
+        seen = set()
+        for pk in pks:
+            if not pk:
+                continue
+            obj = related_ds.read(pk)
+            if obj is None:
+                continue
+            obj_pk = getattr(obj, related_ds._primary_key)
+            if obj_pk not in seen:
+                seen.add(obj_pk)
+                objs.append(obj)
+        for value in staged.get("quick") or []:
+            quick_field = ftype.resolve_quick_field()
+            # Pre-processed condition list: bypasses QBE parsing so the
+            # user-typed value needs no special-character escaping.
+            rows, _ = related_ds.filter({quick_field: [{"=": value}]}, limit=(0, 1))
+            if rows:
+                obj_pk = getattr(rows[0], related_ds._primary_key)
+                if obj_pk not in seen:
+                    seen.add(obj_pk)
+                    objs.append(rows[0])
+            else:
+                sub_ftype = related_ds._schema[quick_field]
+                objs.append(
+                    related_ds.model(**{quick_field: sub_ftype.parse_value(value)})
+                )
+        for item in staged.get("new") or []:
+            sub_kwargs = {
+                sub_key: related_ds._schema[sub_key].parse_value(sub_value)
+                for sub_key, sub_value in item.items()
+                if sub_key in related_ds._schema
+            }
+            objs.append(related_ds.model(**sub_kwargs))
+        return objs
+
+    def create(self, data):
+        kwargs = {}
+        list_items_data = data.pop("list_items", None)
+        many_related_new = data.pop("many_related_new", None) or {}
+        model_columns = self.model.__table__.columns.keys()
+        many_related_data = {}
+        for key, ftype in self._schema.items():
+            if key in data and key != "id":
+                if isinstance(ftype, ManyRelated):
+                    many_related_data[key] = data[key]
+                elif isinstance(ftype, Related):
+                    if data[key]:
+                        related_obj = ftype.related_class().read(data[key])
+                        kwargs[ftype.related_field.split(".")[0]] = related_obj
+                elif key in model_columns and not isinstance(ftype, List):
+                    kwargs[key] = ftype.parse_value(data[key])
+
+        rec = self.model(**kwargs)
+
+        for key, pks in many_related_data.items():
+            ftype = self._schema[key]
+            related_objs = self._resolve_many_related(
+                ftype, pks, many_related_new.get(key)
+            )
+            setattr(rec, ftype.related_field, related_objs)
+
+        if list_items_data:
+            for field, actions in list_items_data.items():
+                ftype = self._schema[field]
+                if "new" in actions:
+                    list_class_ds = ftype.list_class()
+                    for new_item_data in actions["new"]:
+                        sub_kwargs = {}
+                        for sub_key, sub_ftype in list_class_ds._schema.items():
+                            if sub_key in new_item_data and sub_key != "id":
+                                sub_kwargs[sub_key] = new_item_data[sub_key]
+
+                        sub_rec = list_class_ds.model(**sub_kwargs)
+                        getattr(rec, ftype.list_field).append(sub_rec)
+
+        self.session.add(rec)
+        self.session.commit()
+        return rec
+
+    def update(self, id, data):
+        rec = self.read(id)
+        if rec is None:
+            return False
+
+        list_items_data = data.pop("list_items", None)
+        many_related_new = data.pop("many_related_new", None) or {}
+        model_columns = self.model.__table__.columns.keys()
+
+        for key, value in data.items():
+            ftype = self._schema.get(key)
+            if ftype:
+                if isinstance(ftype, ManyRelated):
+                    related_objs = self._resolve_many_related(
+                        ftype, value, many_related_new.get(key)
+                    )
+                    setattr(rec, ftype.related_field, related_objs)
+                elif isinstance(ftype, Related):
+                    if value:
+                        related_obj = ftype.related_class().read(value)
+                        setattr(rec, ftype.related_field.split(".")[0], related_obj)
+                    else:
+                        setattr(rec, ftype.related_field.split(".")[0], None)
+                elif key in model_columns and not isinstance(ftype, List):
+                    setattr(rec, key, ftype.parse_value(value))
+
+        if list_items_data:
+            for field, actions in list_items_data.items():
+                ftype = self._schema[field]
+                if "new" in actions:
+                    list_class_ds = ftype.list_class()
+                    for new_item_data in actions["new"]:
+                        sub_kwargs = {}
+                        for sub_key, sub_ftype in list_class_ds._schema.items():
+                            if sub_key in new_item_data and sub_key != "id":
+                                sub_kwargs[sub_key] = new_item_data[sub_key]
+
+                        sub_rec = list_class_ds.model(**sub_kwargs)
+                        getattr(rec, ftype.list_field).append(sub_rec)
+                if "delete" in actions:
+                    list_class_ds = ftype.list_class()
+                    for item_id_to_delete in actions["delete"]:
+                        item_to_delete = list_class_ds.read(item_id_to_delete)
+                        if item_to_delete:
+                            self.session.delete(item_to_delete)
+
+                if "update" in actions:
+                    list_class_ds = ftype.list_class()
+                    for item_to_update_data in actions["update"]:
+                        item_id_to_update = item_to_update_data.pop("id")
+                        item_to_update = list_class_ds.read(item_id_to_update)
+                        if item_to_update:
+                            for sub_key, sub_value in item_to_update_data.items():
+                                setattr(item_to_update, sub_key, sub_value)
+
+        self.session.commit()
+        return True
+
+    def delete(self, id):
+        rec = self.read(id)
+        if rec is None:
+            return False
+        self.session.delete(rec)
+        self.session.commit()
+        return True
+
+    def search(self, q=None, limit=None, fields=None):
+        limit = effective_limit(limit)
+        if q is None:
+            tot = self.session.scalar(
+                select(func.count()).select_from(self.get_base_query().subquery())
+            )
+            return (
+                self.session.scalars(
+                    self.get_base_query().offset(limit[0]).limit(limit[1])
+                ).all(),
+                tot,
+            )
+        qry = self.get_base_query()
+        clauses = []
+        if fields is not None:
+            for field in fields:
+                ftype = self._schema.get(field)
+                if isinstance(ftype, (PK, List, ManyRelated)):
+                    raise ValueError(
+                        f"Field '{field}' of {type(self).__name__} cannot be"
+                        f" free-text searched."
+                    )
+                # Related is allowed: _get_column resolves its (dotted)
+                # display column and get_base_query already joins the table.
+                column = self._get_column(field)
+                if not isinstance(column, property):
+                    clauses.append(column.like(f"%{q}%"))
+        else:
+            for field, ftype in self._schema.items():
+                if isinstance(ftype, (PK, List, Related, ManyRelated)):
+                    continue
+                column = self._get_column(field)
+                if not isinstance(column, property):
+                    clauses.append(column.like(f"%{q}%"))
+        if clauses:
+            qry = qry.filter(or_(*clauses))
+        tot = self.session.scalar(select(func.count()).select_from(qry.subquery()))
+        return (self.session.scalars(qry.offset(limit[0]).limit(limit[1])).all(), tot)