html-golive 0.4.1__py3-none-any.whl

golive/__init__.py

@@ -0,0 +1,3 @@
+"""html-golive — self-hosted one-command HTML deployment."""
+
+__version__ = "0.4.1"

golive/backends/__init__.py

@@ -0,0 +1 @@
+

golive/backends/auth/__init__.py

@@ -0,0 +1 @@
+

golive/backends/auth/base.py

@@ -0,0 +1,17 @@
+"""golive.backends.auth.base — AuthProvider interface."""
+
+from abc import ABC, abstractmethod
+
+
+class AuthProvider(ABC):
+    """Auth abstraction for serve-mode write operations (and M3 editor)."""
+
+    name = "base"
+
+    @abstractmethod
+    def verify(self, request_headers: dict) -> bool:
+        """Return True when the request is allowed to perform write ops."""
+
+    def identity(self, request_headers: dict) -> str:
+        """Best-effort caller identity (empty string when unknown)."""
+        return ""

golive/backends/auth/none.py

@@ -0,0 +1,12 @@
+"""golive.backends.auth.none — no-auth provider (default for single-user)."""
+
+from golive.backends.auth.base import AuthProvider
+
+
+class NoneAuth(AuthProvider):
+    """Allows everything. Fine on localhost; use TokenAuth on shared hosts."""
+
+    name = "none"
+
+    def verify(self, request_headers: dict) -> bool:
+        return True

golive/backends/auth/oauth.py

@@ -0,0 +1,330 @@
+"""golive.backends.auth.oauth — generic OIDC AuthProvider (M3).
+
+Works with any OpenID Connect IdP that publishes a discovery document
+(``/.well-known/openid-configuration``): Google, Keycloak, Authentik,
+Okta, Auth0, self-hosted Dex … GitHub's OAuth is not OIDC — use an OIDC
+bridge (e.g. Dex) or a provider that issues OIDC tokens.
+
+Flow (implemented in golive.server.app via this provider):
+  GET /auth/login     -> 302 to IdP authorization endpoint (state + PKCE)
+  GET /auth/callback  -> code -> token -> userinfo -> golive session cookie
+  GET /auth/logout    -> clear cookie (+ optional IdP end_session redirect)
+  GET /auth/me        -> current session identity JSON
+
+Session model: in-memory dict with TTL (restart invalidates sessions —
+acceptable for M3; a shared store lands in M4). The cookie carries only
+a random session id, HMAC-signed with a server secret so a forged id is
+rejected even before the dict lookup.
+
+Config (golive.yaml):
+  auth:
+    provider: oidc
+    oidc:
+      issuer: https://accounts.google.com
+      client_id: xxx.apps.googleusercontent.com
+      client_secret_env: GOLIVE_OIDC_CLIENT_SECRET
+      redirect_uri: http://localhost:8787/auth/callback
+      scopes: "openid email profile"
+      session_ttl: 28800
+      cookie_secret_env: GOLIVE_COOKIE_SECRET
+      force_secure_cookie: false
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import time
+import urllib.parse
+from typing import Optional
+
+from golive.backends.auth.base import AuthProvider
+
+COOKIE_NAME = "golive_session"
+STATE_TTL = 600          # seconds an auth request (state/PKCE) stays valid
+DEFAULT_TIMEOUT = 15
+
+
+class OIDCError(RuntimeError):
+    pass
+
+
+def _b64url(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _load_or_create_cookie_secret() -> str:
+    """Return a stable cookie-signing secret persisted under GOLIVE_HOME.
+
+    Generated once (0600 file) so signed session cookies survive a server
+    restart without the operator having to set GOLIVE_COOKIE_SECRET. If the
+    home dir is unwritable we fall back to an ephemeral per-process key and
+    warn — sessions then die on restart, but auth still works.
+    """
+    try:
+        from golive.core.paths import get_home
+        path = get_home() / ".cookie_secret"
+        if path.exists():
+            val = path.read_text(encoding="utf-8").strip()
+            if val:
+                return val
+        val = secrets.token_hex(32)
+        path.write_text(val, encoding="utf-8")
+        try:
+            os.chmod(path, 0o600)
+        except OSError:
+            pass
+        return val
+    except Exception as e:  # noqa: BLE001 — degrade to ephemeral
+        import sys
+        print(f"⚠️  could not persist cookie secret ({e}); using an "
+              f"ephemeral key — sessions will not survive a restart. "
+              f"Set GOLIVE_COOKIE_SECRET to silence this.", file=sys.stderr)
+        return secrets.token_hex(32)
+
+
+class OIDCAuth(AuthProvider):
+    """Generic OIDC provider with PKCE + signed session cookies."""
+
+    name = "oidc"
+
+    def __init__(self, issuer: str = "", client_id: str = "",
+                 client_secret: str = "", redirect_uri: str = "",
+                 scopes: str = "openid email profile",
+                 session_ttl: int = 8 * 3600, cookie_secret: str = "",
+                 force_secure_cookie: bool = False):
+        if not issuer:
+            from golive.config import get_config
+            au = get_config().auth
+            issuer = au.oidc_issuer
+            client_id = client_id or au.oidc_client_id
+            client_secret = client_secret or au.oidc_client_secret
+            redirect_uri = redirect_uri or au.oidc_redirect_uri
+            scopes = au.oidc_scopes or scopes
+            session_ttl = au.oidc_session_ttl or session_ttl
+            cookie_secret = cookie_secret or au.oidc_cookie_secret
+            force_secure_cookie = au.oidc_force_secure_cookie
+        if not issuer or not client_id:
+            raise OIDCError("auth.oidc.issuer and auth.oidc.client_id are required")
+        self.issuer = issuer.rstrip("/")
+        self.client_id = client_id
+        self.client_secret = client_secret
+        self.redirect_uri = redirect_uri
+        self.scopes = scopes
+        self.session_ttl = int(session_ttl)
+        self.force_secure_cookie = bool(force_secure_cookie)
+        # cookie secret precedence: explicit arg > env > persisted file.
+        # The persisted file lives under GOLIVE_HOME so sessions survive a
+        # restart even when the operator never set GOLIVE_COOKIE_SECRET
+        # (falls back to an ephemeral key only if the file is unwritable).
+        _sec = cookie_secret or os.environ.get("GOLIVE_COOKIE_SECRET", "")
+        if not _sec:
+            _sec = _load_or_create_cookie_secret()
+        self._cookie_secret = _sec.encode("utf-8")
+        self._discovery: Optional[dict] = None
+        self._sessions: dict = {}       # sid -> {sub, email, name, exp}
+        self._pending: dict = {}        # state -> {verifier, exp}
+
+    # ── discovery ───────────────────────────────────────────────────────────
+
+    def discovery(self) -> dict:
+        if self._discovery is None:
+            import requests
+            url = self.issuer + "/.well-known/openid-configuration"
+            resp = requests.get(url, timeout=DEFAULT_TIMEOUT)
+            if resp.status_code != 200:
+                raise OIDCError(f"OIDC discovery failed (HTTP {resp.status_code}) at {url}")
+            doc = resp.json()
+            for key in ("authorization_endpoint", "token_endpoint"):
+                if key not in doc:
+                    raise OIDCError(f"OIDC discovery document missing {key}")
+            self._discovery = doc
+        return self._discovery
+
+    # ── login: build the authorization redirect ─────────────────────────────
+
+    def _prune_pending(self) -> None:
+        now = time.time()
+        for k in [k for k, v in self._pending.items() if v["exp"] < now]:
+            self._pending.pop(k, None)
+
+    def begin_login(self) -> str:
+        """Return the IdP authorization URL (registers state + PKCE)."""
+        self._prune_pending()
+        doc = self.discovery()
+        state = secrets.token_urlsafe(24)
+        verifier = _b64url(secrets.token_bytes(48))
+        challenge = _b64url(hashlib.sha256(verifier.encode("ascii")).digest())
+        self._pending[state] = {"verifier": verifier,
+                                "exp": time.time() + STATE_TTL}
+        params = {
+            "response_type": "code",
+            "client_id": self.client_id,
+            "redirect_uri": self.redirect_uri,
+            "scope": self.scopes,
+            "state": state,
+            "code_challenge": challenge,
+            "code_challenge_method": "S256",
+        }
+        return doc["authorization_endpoint"] + "?" + urllib.parse.urlencode(params)
+
+    # ── callback: code -> tokens -> userinfo -> session ─────────────────────
+
+    def complete_login(self, code: str, state: str) -> dict:
+        """Exchange the code; return {sid, cookie_value, user}. Raises OIDCError."""
+        import requests
+
+        pend = self._pending.pop(state or "", None)
+        if pend is None or pend["exp"] < time.time():
+            raise OIDCError("invalid or expired state (possible CSRF) — retry login")
+
+        doc = self.discovery()
+        data = {
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": self.redirect_uri,
+            "client_id": self.client_id,
+            "code_verifier": pend["verifier"],
+        }
+        if self.client_secret:
+            data["client_secret"] = self.client_secret
+        resp = requests.post(doc["token_endpoint"], data=data,
+                             headers={"Accept": "application/json"},
+                             timeout=DEFAULT_TIMEOUT)
+        if resp.status_code != 200:
+            raise OIDCError(f"token exchange failed (HTTP {resp.status_code}): "
+                            f"{resp.text[:200]}")
+        tokens = resp.json()
+
+        user = self._resolve_user(doc, tokens)
+        if not (user.get("sub") or user.get("email")):
+            raise OIDCError("IdP returned no usable identity (sub/email)")
+
+        sid = secrets.token_urlsafe(32)
+        self._sessions[sid] = {**user, "exp": time.time() + self.session_ttl}
+        return {"sid": sid, "cookie_value": self._sign_sid(sid), "user": user}
+
+    def _resolve_user(self, doc: dict, tokens: dict) -> dict:
+        """userinfo endpoint preferred; fall back to id_token claims."""
+        import requests
+
+        access_token = tokens.get("access_token", "")
+        userinfo_ep = doc.get("userinfo_endpoint", "")
+        if access_token and userinfo_ep:
+            try:
+                resp = requests.get(
+                    userinfo_ep,
+                    headers={"Authorization": f"Bearer {access_token}"},
+                    timeout=DEFAULT_TIMEOUT)
+                if resp.status_code == 200:
+                    ui = resp.json()
+                    return {"sub": str(ui.get("sub", "")),
+                            "email": str(ui.get("email", "")).lower(),
+                            "name": str(ui.get("name", "")
+                                        or ui.get("preferred_username", ""))}
+            except requests.RequestException:
+                pass
+        # fallback: unverified id_token payload decode (transport already
+        # authenticated via TLS + client credentials at the token endpoint)
+        id_token = tokens.get("id_token", "")
+        if id_token and id_token.count(".") == 2:
+            try:
+                payload = id_token.split(".")[1]
+                payload += "=" * (-len(payload) % 4)
+                claims = json.loads(base64.urlsafe_b64decode(payload))
+                return {"sub": str(claims.get("sub", "")),
+                        "email": str(claims.get("email", "")).lower(),
+                        "name": str(claims.get("name", ""))}
+            except (ValueError, TypeError):
+                pass
+        return {}
+
+    # ── cookie signing / session lookup ─────────────────────────────────────
+
+    def _sign_sid(self, sid: str) -> str:
+        mac = hmac.new(self._cookie_secret, sid.encode("ascii"),
+                       hashlib.sha256).hexdigest()
+        return f"{sid}.{mac}"
+
+    def _verify_cookie(self, cookie_value: str) -> Optional[str]:
+        if not cookie_value or "." not in cookie_value:
+            return None
+        sid, mac = cookie_value.rsplit(".", 1)
+        expect = hmac.new(self._cookie_secret, sid.encode("ascii"),
+                          hashlib.sha256).hexdigest()
+        if not hmac.compare_digest(mac, expect):
+            return None
+        return sid
+
+    def _prune_sessions(self) -> None:
+        now = time.time()
+        for k in [k for k, v in self._sessions.items() if v["exp"] < now]:
+            self._sessions.pop(k, None)
+
+    def session_user(self, request_headers: dict) -> Optional[dict]:
+        """Resolve the session cookie into a user dict (or None)."""
+        headers = {str(k).lower(): str(v) for k, v in (request_headers or {}).items()}
+        raw = headers.get("cookie", "")
+        cookie_value = ""
+        for part in raw.split(";"):
+            k, _, v = part.strip().partition("=")
+            if k == COOKIE_NAME:
+                cookie_value = v
+                break
+        sid = self._verify_cookie(cookie_value)
+        if not sid:
+            return None
+        self._prune_sessions()
+        sess = self._sessions.get(sid)
+        if not sess or sess["exp"] < time.time():
+            self._sessions.pop(sid, None)
+            return None
+        return {"sub": sess.get("sub", ""), "email": sess.get("email", ""),
+                "name": sess.get("name", "")}
+
+    def logout(self, request_headers: dict) -> None:
+        headers = {str(k).lower(): str(v) for k, v in (request_headers or {}).items()}
+        raw = headers.get("cookie", "")
+        for part in raw.split(";"):
+            k, _, v = part.strip().partition("=")
+            if k == COOKIE_NAME:
+                sid = self._verify_cookie(v)
+                if sid:
+                    self._sessions.pop(sid, None)
+                break
+
+    def build_cookie(self, cookie_value: str, secure: bool) -> str:
+        attrs = [f"{COOKIE_NAME}={cookie_value}", "Path=/", "HttpOnly",
+                 "SameSite=Lax", f"Max-Age={self.session_ttl}"]
+        if secure or self.force_secure_cookie:
+            attrs.append("Secure")
+        return "; ".join(attrs)
+
+    def clear_cookie(self) -> str:
+        return f"{COOKIE_NAME}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0"
+
+    def end_session_url(self, post_logout_redirect: str = "") -> str:
+        """IdP end_session URL when the IdP advertises one ('' otherwise)."""
+        try:
+            ep = self.discovery().get("end_session_endpoint", "")
+        except OIDCError:
+            return ""
+        if not ep:
+            return ""
+        if post_logout_redirect:
+            return ep + "?" + urllib.parse.urlencode(
+                {"post_logout_redirect_uri": post_logout_redirect})
+        return ep
+
+    # ── AuthProvider interface ──────────────────────────────────────────────
+
+    def verify(self, request_headers: dict) -> bool:
+        return self.session_user(request_headers) is not None
+
+    def identity(self, request_headers: dict) -> str:
+        user = self.session_user(request_headers)
+        return (user or {}).get("email", "")

golive/backends/auth/presets.py

@@ -0,0 +1,84 @@
+"""golive.backends.auth.presets — one-line OIDC provider presets.
+
+Set ``auth.oidc.preset: google`` (or okta / auth0 / keycloak / authentik /
+azure) and golive fills in the well-known public fields for that IdP —
+issuer template, default scopes — so you only supply ``client_id`` and
+the secret env. Explicit ``auth.oidc.*`` fields always override a preset.
+
+Presets only ever contain PUBLIC, non-secret values. Never put a client
+secret here.
+"""
+
+from __future__ import annotations
+
+# Each preset supplies the fields that are safe to hard-code for a given
+# IdP. `issuer` may contain a `{domain}` / `{tenant}` placeholder that is
+# resolved from auth.oidc.domain / auth.oidc.tenant when present.
+PRESETS: dict = {
+    "google": {
+        "issuer": "https://accounts.google.com",
+        "scopes": "openid email profile",
+    },
+    "auth0": {
+        # requires auth.oidc.domain: your-tenant.us.auth0.com
+        "issuer": "https://{domain}",
+        "scopes": "openid email profile",
+    },
+    "okta": {
+        # requires auth.oidc.domain: your-org.okta.com
+        "issuer": "https://{domain}",
+        "scopes": "openid email profile",
+    },
+    "azure": {
+        # requires auth.oidc.tenant: <tenant-id> or "organizations"/"common"
+        "issuer": "https://login.microsoftonline.com/{tenant}/v2.0",
+        "scopes": "openid email profile",
+    },
+    "keycloak": {
+        # requires auth.oidc.issuer OR domain+realm; kept generic
+        # e.g. issuer: https://kc.example.com/realms/myrealm
+        "scopes": "openid email profile",
+    },
+    "authentik": {
+        # requires auth.oidc.issuer: https://authentik.example.com/application/o/<slug>/
+        "scopes": "openid email profile",
+    },
+}
+
+SUPPORTED = sorted(PRESETS.keys())
+
+
+def resolve_preset(preset: str, *, domain: str = "", tenant: str = "",
+                   realm: str = "") -> dict:
+    """Return {issuer, scopes} for a named preset, or raise ValueError.
+
+    `domain` / `tenant` / `realm` fill placeholders where a preset needs
+    tenant-specific host info. Fields the preset omits are returned empty
+    so the caller keeps whatever the user configured explicitly.
+    """
+    key = (preset or "").strip().lower()
+    if key not in PRESETS:
+        raise ValueError(
+            f"unknown auth.oidc.preset: {preset!r} "
+            f"(supported: {', '.join(SUPPORTED)})"
+        )
+    spec = dict(PRESETS[key])
+    issuer = spec.get("issuer", "")
+    if "{domain}" in issuer:
+        if not domain:
+            raise ValueError(
+                f"auth.oidc.preset: {key} requires auth.oidc.domain "
+                f"(e.g. your-tenant.{key}.com)"
+            )
+        issuer = issuer.replace("{domain}", domain.strip().rstrip("/"))
+    if "{tenant}" in issuer:
+        if not tenant:
+            raise ValueError(
+                "auth.oidc.preset: azure requires auth.oidc.tenant "
+                "(tenant id, or 'organizations' / 'common')"
+            )
+        issuer = issuer.replace("{tenant}", tenant.strip())
+    out = {"scopes": spec.get("scopes", "")}
+    if issuer:
+        out["issuer"] = issuer.rstrip("/")
+    return out

golive/backends/auth/token.py

@@ -0,0 +1,49 @@
+"""golive.backends.auth.token — static-token auth provider.
+
+Token source order:
+  1. explicit token passed to constructor (from golive.yaml)
+  2. env GOLIVE_TOKEN
+
+Clients authenticate with either header:
+  Authorization: Bearer <token>
+  X-Golive-Token: <token>
+"""
+
+import hmac
+import os
+
+from golive.backends.auth.base import AuthProvider
+
+
+class TokenAuth(AuthProvider):
+    name = "token"
+
+    def __init__(self, token: str = ""):
+        self.token = token or os.environ.get("GOLIVE_TOKEN", "")
+
+    @property
+    def configured(self) -> bool:
+        return bool(self.token)
+
+    def verify(self, request_headers: dict) -> bool:
+        if not self.configured:
+            return False
+        # normalize header keys to lowercase
+        headers = {str(k).lower(): str(v) for k, v in (request_headers or {}).items()}
+        candidate = headers.get("x-golive-token", "")
+        if not candidate:
+            auth = headers.get("authorization", "")
+            if auth.lower().startswith("bearer "):
+                candidate = auth[7:].strip()
+        if not candidate:
+            return False
+        return hmac.compare_digest(candidate, self.token)
+
+
+def get_auth_provider():
+    """Factory: TokenAuth when GOLIVE_TOKEN is set, else NoneAuth."""
+    tok = os.environ.get("GOLIVE_TOKEN", "")
+    if tok:
+        return TokenAuth(tok)
+    from golive.backends.auth.none import NoneAuth
+    return NoneAuth()

golive/backends/data/__init__.py

@@ -0,0 +1,5 @@
+"""golive.backends.data — data-layer backends (TemplateAPI storage).
+
+``none`` (default): no data layer; pages calling TemplateAPI get a stub.
+``supabase``: templates stored in a PostgREST table (golive_templates).
+"""

golive/backends/data/supabase.py

@@ -0,0 +1,151 @@
+"""golive.backends.data.supabase — Python-side template CRUD (PostgREST).
+
+The open-source data layer stores TemplateAPI records in one table:
+
+    create table if not exists golive_templates (
+        id          uuid primary key default gen_random_uuid(),
+        model_code  text not null,
+        name        text not null,
+        user_id     text not null default '',
+        description text not null default '',
+        content     jsonb,
+        version     text not null default '1.0.0',
+        sort_index  bigint not null default 0,
+        created_at  timestamptz not null default now(),
+        updated_at  timestamptz not null default now(),
+        unique (model_code, name, user_id)
+    );
+
+``model_code`` maps the intranet modelCode concept: a namespace per site
+(or per logical dataset). The injected window.TemplateAPI (see
+golive.inject.template_api) talks PostgREST directly from the browser;
+this module is the server-side/CLI twin used by ``golive data ...``.
+"""
+
+from __future__ import annotations
+
+import json
+from typing import Optional
+
+from golive.backends.postgrest import PostgrestClient, client_from_config
+
+DEFAULT_TABLE = "golive_templates"
+
+CREATE_TABLE_SQL = """\
+create table if not exists {table} (
+    id          uuid primary key default gen_random_uuid(),
+    model_code  text not null,
+    name        text not null,
+    user_id     text not null default '',
+    description text not null default '',
+    content     jsonb,
+    version     text not null default '1.0.0',
+    sort_index  bigint not null default 0,
+    created_at  timestamptz not null default now(),
+    updated_at  timestamptz not null default now(),
+    unique (model_code, name, user_id)
+);
+-- RLS example (anon key in the browser NEEDS policies like these):
+-- alter table {table} enable row level security;
+-- create policy "read all"  on {table} for select using (true);
+-- create policy "insert"    on {table} for insert with check (true);
+-- create policy "update"    on {table} for update using (true);
+-- create policy "delete"    on {table} for delete using (true);
+-- Tighten the policies to your auth setup before going to production.
+"""
+
+
+class TemplateStore:
+    """CRUD for golive_templates via PostgREST."""
+
+    def __init__(self, client: Optional[PostgrestClient] = None,
+                 table: str = ""):
+        self.client = client or client_from_config()
+        if not table:
+            from golive.config import get_config
+            table = get_config().data.templates_table or DEFAULT_TABLE
+        self.table = table
+
+    # ── queries ─────────────────────────────────────────────────────────────
+
+    def list(self, model_code: str, name_prefix: str = "", user_id: str = "",
+             page_no: int = 1, page_size: int = 20) -> dict:
+        params = {
+            "model_code": f"eq.{model_code}",
+            "order": "sort_index.desc,created_at.desc",
+            "limit": str(page_size),
+            "offset": str((max(page_no, 1) - 1) * page_size),
+        }
+        if user_id:
+            params["user_id"] = f"eq.{user_id}"
+        if name_prefix:
+            params["name"] = f"like.{name_prefix}*"
+        rows, total = self.client.select(self.table, params, count=True)
+        return {"total": total or 0, "list": rows}
+
+    def get(self, template_id: str) -> Optional[dict]:
+        rows, _ = self.client.select(
+            self.table, {"id": f"eq.{template_id}", "limit": "1"})
+        return rows[0] if rows else None
+
+    def count(self, model_code: str) -> int:
+        return self.client.count(self.table,
+                                 {"model_code": f"eq.{model_code}"})
+
+    # ── writes ──────────────────────────────────────────────────────────────
+
+    def create(self, model_code: str, name: str, content=None,
+               description: str = "", version: str = "1.0.0",
+               user_id: str = "") -> dict:
+        row = {
+            "model_code": model_code,
+            "name": name,
+            "user_id": user_id,
+            "description": description,
+            "content": self._jsonify(content),
+            "version": version,
+        }
+        created = self.client.insert(self.table, row)
+        return created[0] if created else row
+
+    def update(self, template_id: str, patch: dict) -> dict:
+        values = {"updated_at": "now()"}
+        mapping = {"name": "name", "desc": "description",
+                   "description": "description", "version": "version",
+                   "model_code": "model_code", "modelCode": "model_code",
+                   "sort_index": "sort_index"}
+        for k, col in mapping.items():
+            if k in patch and patch[k] is not None:
+                values[col] = patch[k]
+        if "content" in patch:
+            values["content"] = self._jsonify(patch["content"])
+        rows = self.client.update(self.table,
+                                  {"id": f"eq.{template_id}"}, values)
+        if not rows:
+            raise KeyError(f"template not found: {template_id}")
+        return rows[0]
+
+    def upsert(self, model_code: str, name: str, content=None,
+               user_id: str = "", **kw) -> dict:
+        rows, _ = self.client.select(self.table, {
+            "model_code": f"eq.{model_code}", "name": f"eq.{name}",
+            "user_id": f"eq.{user_id}", "limit": "1"})
+        if rows:
+            return self.update(rows[0]["id"], {"content": content, **kw})
+        return self.create(model_code, name, content=content,
+                           user_id=user_id, **kw)
+
+    def delete(self, template_id: str) -> bool:
+        return self.client.delete(self.table,
+                                  {"id": f"eq.{template_id}"}) > 0
+
+    @staticmethod
+    def _jsonify(content):
+        if content is None:
+            return {}
+        if isinstance(content, str):
+            try:
+                return json.loads(content)
+            except ValueError:
+                return {"raw": content}
+        return content