hyperflask 0.2.3__tar.gz → 0.3.0__tar.gz

{hyperflask-0.2.3 → hyperflask-0.3.0}/PKG-INFO

@@ -1,32 +1,31 @@
 Metadata-Version: 2.4
 Name: hyperflask
-Version: 0.2.3
+Version: 0.3.0
 Summary: Full stack web framework
 Author: Maxime Bouroumeau-Fuseau
 Author-email: Maxime Bouroumeau-Fuseau <maxime.bouroumeau@gmail.com>
 License-Expression: MIT
 Requires-Dist: flask>=3.0.0,<4.0.0
-Requires-Dist: flask-assets-pipeline~=0.6
+Requires-Dist: flask-assets-pipeline~=0.7
 Requires-Dist: flask-babel-hyper~=5.1
 Requires-Dist: flask-collections~=0.2
 Requires-Dist: flask-configurator~=0.1
 Requires-Dist: flask-debugtoolbar~=0.16
 Requires-Dist: flask-dramatiq~=0.6
-Requires-Dist: flask-file-routes~=0.2
+Requires-Dist: flask-file-routes~=0.3
 Requires-Dist: flask-files~=0.2
 Requires-Dist: flask-geo~=0.1
 Requires-Dist: flask-mailman-templates~=0.1
-Requires-Dist: flask-mercure-sse~=0.2
-Requires-Dist: flask-sqlorm~=0.2
+Requires-Dist: flask-mercure-sse~=0.3
+Requires-Dist: flask-sqlorm~=0.3
 Requires-Dist: flask-super-macros~=0.1
-Requires-Dist: flask-talisman~=1.1
+Requires-Dist: flask-suspense~=0.1
 Requires-Dist: flask-wtf~=1.2
 Requires-Dist: frozen-flask~=1.0
 Requires-Dist: gunicorn~=23.0
 Requires-Dist: honcho~=2.0
 Requires-Dist: html-sanitizer~=2.6
 Requires-Dist: htmx-flask~=0.1
-Requires-Dist: jinja2-fragments~=1.9
 Requires-Dist: jinja-layout~=0.4
 Requires-Dist: jinja-wtforms~=0.2
 Requires-Dist: periodiq~=0.13
@@ -108,7 +107,7 @@ A good part of these extensions is developed as part of the Hyperflask project.
 | [Flask-Mercure-SSE](https://github.com/hyperflask/flask-mercure-sse) | Push events via server-sent events using the [Mercure](https://mercure.rocks) protocol
 | [Flask-SQLORM](https://github.com/hyperflask/flask-sqlorm) | Flask integration of [sqlorm](https://github.com/hyperflask/sqlorm)
 | [Flask-Super-Macros](https://github.com/hyperflask/flask-super-macros) | Better macro management for Jinja
-| [Flask-Talisman](https://github.com/wntrblm/flask-talisman) | HTTP security headers for Flask
+| [Flask-Suspense](https://github.com/hyperflask/flask-suspense) | Suspense for Flask
 | [Flask-WTF](https://flask-wtf.readthedocs.io) | [WTForms](https://wtforms.readthedocs.io) integration
 
 ## Using without Hyperflask-Start
@@ -116,6 +115,5 @@ A good part of these extensions is developed as part of the Hyperflask project.
 1. Create your project directory: `mkdir example-project && cd example-project`
 2. Create and activate a virtualenv: `python -m venv .venv && source .venv/bin/activate`
 3. `pip install hyperflask`
-4. Create a pages directory: `mkdir pages`
-5. Create your index page: `echo "hello world" > pages/index.html`
-6. Start a development server using `hyperflask dev`
+4. Run `hyperflask init .`
+5. Start a development server using `hyperflask dev`

{hyperflask-0.2.3 → hyperflask-0.3.0}/README.md

@@ -70,7 +70,7 @@ A good part of these extensions is developed as part of the Hyperflask project.
 | [Flask-Mercure-SSE](https://github.com/hyperflask/flask-mercure-sse) | Push events via server-sent events using the [Mercure](https://mercure.rocks) protocol
 | [Flask-SQLORM](https://github.com/hyperflask/flask-sqlorm) | Flask integration of [sqlorm](https://github.com/hyperflask/sqlorm)
 | [Flask-Super-Macros](https://github.com/hyperflask/flask-super-macros) | Better macro management for Jinja
-| [Flask-Talisman](https://github.com/wntrblm/flask-talisman) | HTTP security headers for Flask
+| [Flask-Suspense](https://github.com/hyperflask/flask-suspense) | Suspense for Flask
 | [Flask-WTF](https://flask-wtf.readthedocs.io) | [WTForms](https://wtforms.readthedocs.io) integration
 
 ## Using without Hyperflask-Start
@@ -78,6 +78,5 @@ A good part of these extensions is developed as part of the Hyperflask project.
 1. Create your project directory: `mkdir example-project && cd example-project`
 2. Create and activate a virtualenv: `python -m venv .venv && source .venv/bin/activate`
 3. `pip install hyperflask`
-4. Create a pages directory: `mkdir pages`
-5. Create your index page: `echo "hello world" > pages/index.html`
-6. Start a development server using `hyperflask dev`
+4. Run `hyperflask init .`
+5. Start a development server using `hyperflask dev`

{hyperflask-0.2.3 → hyperflask-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "hyperflask"
-version = "0.2.3"
+version = "0.3.0"
 description = "Full stack web framework"
 authors = [
     {"name" = "Maxime Bouroumeau-Fuseau", email = "maxime.bouroumeau@gmail.com"}
@@ -10,21 +10,21 @@ license = "MIT"
 requires-python = ">=3.10"
 dependencies = [
     "flask>=3.0.0,<4.0.0",
-    "flask-assets-pipeline ~=0.6",
+    "flask-assets-pipeline ~=0.7",
     "flask-babel-hyper ~=5.1",
     "flask-collections ~=0.2",
     "flask-configurator ~=0.1",
     "flask-debugtoolbar ~=0.16",
     "flask-dramatiq ~=0.6",
-    "flask-file-routes ~=0.2",
+    "flask-file-routes ~=0.3",
     "flask-files ~=0.2",
     "flask-geo ~=0.1",
     "flask-mailman-templates ~=0.1",
-    "flask-mercure-sse ~=0.2",
+    "flask-mercure-sse ~=0.3",
     #"flask-observability ~=0.1"
-    "flask-sqlorm ~=0.2",
+    "flask-sqlorm ~=0.3",
     "flask-super-macros ~=0.1",
-    "flask-talisman ~=1.1",
+    "flask-suspense ~=0.1",
     "flask-wtf ~=1.2",
     "frozen-flask ~=1.0",
     #"dramatiq-sqlite ~=0.1"
@@ -32,12 +32,11 @@ dependencies = [
     "honcho ~=2.0",
     "html-sanitizer ~=2.6",
     "htmx-flask ~=0.1",
-    "jinja2-fragments ~=1.9",
     "jinja-layout ~=0.4",
     "jinja-wtforms ~=0.2",
     "periodiq ~=0.13",
     "python-slugify ~=8.0.4",
-    "redis ~=6.4"
+    "redis ~=6.4",
 ]
 
 [tool.uv.sources]

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/__init__.py

@@ -1,6 +1,7 @@
 from flask import *
 from .app import Hyperflask
 from .utils.htmx import htmx_redirect, htmx_oob
+from .security import csp_nonce
 
 # useful exports from hyperflask managed extensions
 from flask_babel import gettext, _, pgettext, _p, ngettext, _n, npgettext, _np, lazy_gettext, _lazy
@@ -8,9 +9,9 @@ from flask_file_routes import page
 from flask_files import save_file, validate_file
 from flask_mailman_templates import send_mail
 from flask_mercure_sse import publish_signal, mercure_publish
+from flask_suspense import render_template, stream_template, defer
 
 # useful exports from 3rd party libs
 from htmx_flask import request, make_response
-from jinja2_fragments.flask import render_block
 from slugify import slugify
 from blinker import signal

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/app.py

@@ -1,6 +1,6 @@
 # flask
 from flask import Flask
-from jinja2 import ChoiceLoader, FileSystemLoader, PrefixLoader
+from jinja2 import ChoiceLoader, FileSystemLoader, PrefixLoader, TemplateNotFound
 from werkzeug.middleware.proxy_fix import ProxyFix
 # hyperflask extensions
 from jinja_layout import LayoutExtension
@@ -8,7 +8,7 @@ from jinja_wtforms import WtformExtension
 from flask_assets_pipeline import AssetsPipeline
 from flask_super_macros import SuperMacros
 from flask_collections import Collections
-from flask_file_routes import FileRoutes
+from flask_file_routes import FileRoutes, ModuleView, page
 from flask_configurator import Config
 from flask_babel import Babel, _, _p, _n, _np, lazy_gettext
 from flask_geo import Geolocation
@@ -16,10 +16,10 @@ from flask_files import Files
 from flask_sqlorm import FlaskSQLORM
 from flask_mercure_sse import MercureSSE
 from flask_mailman_templates import MailTemplates
+from flask_suspense import Suspense, render_template, suspense_before_render_template, suspense_before_render_blocks
 #from flask_observability import Observability
 # 3rd party extensions
 from flask_wtf.csrf import CSRFProtect
-from flask_talisman import Talisman
 from flask_frozen import Freezer
 from htmx_flask import Htmx
 from flask_mailman import Mail
@@ -28,13 +28,12 @@ from flask_debugtoolbar import DebugToolbarExtension
 # from hyperflask
 from .forms import Form
 from .utils.page_actions import page_action_url
-from .utils.htmx import htmx_oob
+from .utils.htmx import htmx_oob, respond_with_flash_messages
 from .utils.markdown import jinja_markdown, MarkdownExtension
 from .utils.html import sanitize_html, nl2br
-from .utils.models import File as SQLFileType
-from .components import discover_components, register_components
-from .components.jsx import ReactAdapter
-from .model import Model
+from .components import register_components
+from .model import Model, File as SQLFileType
+from .security import respond_with_security_headers, csp_nonce
 from . import page_helpers
 # others
 from jinja_super_macros.registry import FileLoader
@@ -54,7 +53,7 @@ map_jinja_call_node_to_func(lazy_gettext, "lazy_gettext")
 class Hyperflask(Flask):
     config_class = Config
 
-    def __init__(self, *args, static_mode="hybrid", instrument=False, layouts_folder="layouts", partials_folder="partials",
+    def __init__(self, *args, static_mode="hybrid", instrument=False, layouts_folder="layouts",
                  emails_folder="emails", forms_folder="forms", assets_folder="assets", pages_folder="pages", migrations_folder="migrations",
                  config=None, config_filename="config.yml", database_uri="sqlite://:memory:", proxy_fix=True, **kwargs):
 
@@ -69,14 +68,28 @@ class Hyperflask(Flask):
             "OTEL_INSTRUMENT": instrument,
             "DRAMATIQ_BROKER": "dramatiq.brokers.redis:RedisBroker",
             "DEBUG_TB_INTERCEPT_REDIRECTS": False,
+            "SESSION_COOKIE_HTTPONLY": True,
+            "SESSION_COOKIE_SAMESITE": "Lax",
             # Hyperflask specific
             "LAYOUT": "layouts/default.html",
+            "ALPINE": False,
             "STATIC_MODE": static_mode,
-            "ASSETS_INCLUDE_HTMX": True,
-            "HTMX_EXT": ["hf-modal"],
+            "ASSETS_INCLUDE_ALPINE": False,
+            "HTMX_EXT": [],
             "HTMX_BOOST_SITE": False,
             "MARKDOWN_OPTIONS": {"extensions": ["fenced_code", "nl2br", "attr_list", "admonition", "codehilite"]},
-            "MARKDOWN_SANITIZER_CONFIG": {}
+            "MARKDOWN_SANITIZER_CONFIG": {},
+            "FLASH_TOAST_OOB": True,
+            "FLASH_TOAST_REMOVE_AFTER": None,
+            "SERVER_SECURED": False,
+            "CSP_HEADER": True,
+            "CSP_SAFE_SRC": ["'self'"],
+            "CSP_UNSAFE_EVAL": True,
+            "CSP_UNSAFE_INLINE": True,
+            "CSP_FRAME_ANCESTORS": True,
+            "CSP_FRAME_ANCESTORS_SAFE_ENDPOINTS": [],
+            "REFERRER_POLICY": "strict-origin-when-cross-origin",
+            "HSTS_HEADER": False
         })
         if config:
             self.config.update(config)
@@ -89,12 +102,22 @@ class Hyperflask(Flask):
         self.config["COLLECTIONS_MARKDOWN_OPTIONS"] = self.config["MARKDOWN_OPTIONS"]
         self.config["MAIL_TEMPLATES_MARKDOWN_OPTIONS"] = self.config["MARKDOWN_OPTIONS"]
 
+        if self.config['SERVER_SECURED']:
+            self.config.update({
+                'FORCE_URL_SCHEME': 'https',
+                'PREFERRED_URL_SCHEME': 'https',
+                'SESSION_COOKIE_SECURE': True,
+                'REMEMBER_COOKIE_SECURE': True
+            })
+            self.config.setdefault("HSTS_HEADER", "max-age=31556926; includeSubDomains") # 1 year
+
         #self.otel = Observability(self)
 
         self.jinja_env.add_extension(LayoutExtension)
         self.jinja_env.add_extension(WtformExtension)
         self.jinja_env.add_extension(MarkdownExtension)
         self.jinja_env.filters.update(markdown=jinja_markdown, sanitize=sanitize_html, nl2br=nl2br)
+        self.jinja_env.globals.update(page_action_url=page_action_url, app=self, csp_nonce=csp_nonce)
         self.jinja_env.form_base_cls = Form
         self.jinja_env.default_layout = self.config["LAYOUT"]
         self.forms = self.jinja_env.forms
@@ -125,7 +148,7 @@ class Hyperflask(Flask):
         Geolocation(self)
         Files(self)
         MailTemplates(self, template_folder=emails_folder)
-        file_routes = FileRoutes(self, pages_folder=pages_folder, partials_folder=partials_folder)
+        file_routes = FileRoutes(self, pages_folder=pages_folder, module_view_class=HyperModuleView)
         self.page_helper = file_routes.page_helper
         self.collections = Collections(self)
         self.sse = MercureSSE(self)
@@ -148,12 +171,13 @@ class Hyperflask(Flask):
         })
         self.assets.bundle(
             {"@hyperflask": ["app.js"],
-             "@hyperflask/reactive": ["reactive.js"],
-             "@hyperflask/alpine": ["alpine.js"]},
+             "@hyperflask/alpine": ["alpine-csp.js" if not self.config["CSP_UNSAFE_EVAL"] else "alpine.js"]},
             from_package="hyperflask",
             assets_folder="static"
         )
         self.assets.include("@hyperflask", 0)
+        if self.config["ALPINE"]:
+            self.assets.include("@hyperflask/alpine", 0)
 
         self.extensions['mail_templates'].jinja_env.add_extension(LayoutExtension)
         self.extensions['mail_templates'].jinja_env.default_layout = "layout.mjml"
@@ -175,7 +199,9 @@ class Hyperflask(Flask):
             for macro in self.macros.create_from_directory(os.path.join(self.root_path, forms_folder)):
                 self.forms.register(self.macros.resolve_template(macro), macro)
 
-        self.jinja_env.globals.update(page_action_url=page_action_url)
+        self.after_request(respond_with_security_headers)
+        if self.config["FLASH_TOAST_OOB"]:
+            self.after_request(respond_with_flash_messages)
 
         self.collections.register_freezer_generator(self.freezer)
 
@@ -184,10 +210,39 @@ class Hyperflask(Flask):
         self.db.Model = Model
         self.db.File = SQLFileType
 
+        Suspense(self, nonce_getter="csp_nonce()")
+
+        @suspense_before_render_template.connect_via(self, weak=False)
+        def on_suspense_before_render_template(sender, **kwargs):
+            csp_nonce() # we will need a nonce but the first call will be after the template started rendering
+
+        @suspense_before_render_blocks.connect_via(self, weak=False)
+        def on_suspense_before_render_blocks(sender, **kwargs):
+            return f'<script nonce="{csp_nonce()}">htmx.bootstrap()</script>'
+
+        @self.errorhandler(404)
+        def not_found(error):
+            try:
+                return render_template("404.html"), 404
+            except TemplateNotFound:
+                return self.make_response(("404 Not Found", 404))
+
+        @self.errorhandler(500)
+        def internal_server_error(error):
+            try:
+                return render_template("500.html"), 500
+            except TemplateNotFound:
+                return self.make_response(("500 Internal Server Error", 500))
+
     def relative_import_name(self, name):
         return f"{self.import_name}.{name}" if self.import_name != "__main__" else name
 
 
+class HyperModuleView(ModuleView):
+    def _render_template(self):
+        return render_template(page.template)
+
+
 def static(func):
     pass
 

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/cli.py

@@ -33,6 +33,7 @@ cli.add_command(freeze_command)
 @click.pass_context
 def build_command(ctx):
     ctx.invoke(assets_cli.build)
+    ctx.invoke(freeze_command)
 
 cli.add_command(build_command)
 
@@ -69,8 +70,9 @@ cli.add_command(serve_command)
 @click.option("--host", "-h", default="127.0.0.1", help="The interface to bind to.")
 @click.option("--port", "-p", default=5000, help="The port to bind to.")
 @click.option('--concurrency')
+@click.option("--extend-procfile")
 @click.option("--dev", is_flag=True)
-def run_command(processes, host, port, concurrency, dev):
+def run_command(processes, host, port, concurrency, extend_procfile, dev):
     from honcho.command import _procfile, _parse_concurrency
     from honcho.manager import Manager
     from honcho.printer import Printer
@@ -85,14 +87,18 @@ def run_command(processes, host, port, concurrency, dev):
         if os.path.exists(filename):
             _processes = _procfile(filename).processes
             break
-    if _processes is None:
-        _processes = {
+    if _processes is None or extend_procfile:
+        if not _processes:
+            _processes = {}
+        _processes.update({
             "web": [sys.argv[0], "serve", "--host", host, "--port", "$PORT"],
             # "worker": [sys.argv[0], "worker"],
             # "scheduler": [sys.argv[0], "periodiq"]
-        }
+        })
         if dev:
             _processes["assets"] = [sys.argv[0], "assets", "dev"]
+        else:
+            _processes["mercurehub"] = [sys.executable, "-m", "flask_mercure_sse.server"]
 
     processes = {name: " ".join(_processes[name]) if isinstance(_processes[name], list) else _processes[name]
                  for name in _processes if name in _processes}
@@ -124,6 +130,13 @@ dev_command.params = list(run_command.params)
 cli.add_command(dev_command)
 
 
+@click.command("init")
+def init_command():
+    pass
+
+cli.add_command(init_command)
+
+
 def main():
     cli.main()
 

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/components/core.py

@@ -2,6 +2,7 @@ from markupsafe import Markup
 from flask import request, current_app
 from flask.views import http_method_funcs
 from flask_file_routes import page
+from flask_suspense import render_template
 from jinjapy import extract_frontmatter
 import importlib
 import re
@@ -55,19 +56,34 @@ class ComponentAdapter(BaseComponentAdapter):
                     return props
                 if not props:
                     props = {}
-            return self.render(None, **props)
+            ctx = self.get_render_context(None, **props)
+            return render_template(self.template, **ctx)
 
         if methods:
             app.add_url_rule(url, self.name, view_func=view_func, methods=methods)
 
-    def render(self, caller, *args, **kwargs):
-        tpl = current_app.jinja_env.get_template(self.template)
+    def get_render_context(self, caller, *args, **kwargs):
         ctx = kwargs.pop('_ctx', {})
-        ctx.update(dict(args=args, kwargs=kwargs, props=kwargs, caller=caller, children=caller))
+        ctx.update(dict(args=args, kwargs=kwargs, props=PropsWrapper(kwargs), caller=caller, children=caller))
         if self.module_name:
             module = importlib.import_module(self.module_name)
             if module and "render" in dir(module):
                 _ctx = module.render(*args, **kwargs)
                 if _ctx:
                     ctx.update(_ctx)
-        return Markup(tpl.render(**ctx))
+        return ctx
+
+    def render(self, caller, *args, **kwargs):
+        tpl = current_app.jinja_env.get_template(self.template)
+        ctx = self.get_render_context(caller, *args, **kwargs)
+        return Markup(tpl.render(**ctx)) # do not use render_template() so we don't trigger flask signals
+
+
+class PropsWrapper:
+    def __init__(self, props):
+        self._props = props
+
+    def __getattr__(self, name):
+        if name in self._props:
+            return self._props[name]
+        raise Exception(f"No such prop: {name}")

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/factory.py

@@ -68,7 +68,7 @@ def create_app(root_path=None):
     try_import(app, "signals")
     try_import(app, "app")
 
-    if models:
+    if models and app.config.get("INIT_DATABASE", True):
         db.init_db()
 
     return app

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/forms/widgets.py

@@ -5,6 +5,7 @@ def create_widget_class(basecls, cssclass="input"):
     class Input(basecls):
         def __call__(self, field, **kwargs):
             extend_class(kwargs, cssclass)
+            kwargs = {k.replace('_', '-'): v for k, v in kwargs.items() if v is not None}
             return super().__call__(field, **kwargs)
     return Input
 

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/layouts/email.mjml

@@ -21,10 +21,10 @@
       </mj-style>
       {% endblock %}
     </mj-head>
-    <mj-body {% block body_tags %}background-color="{{config.get("EMAIL_BACKGROUND_COLOR", "#c8c8c8")}}" width="600px"{% endblock %}>
-      <mj-section full-width="full-width" background-color="{{config.get("EMAIL_BACKGROUND_ACCENT_COLOR", "#a6a6a6")}}" padding-bottom="0">
+    <mj-body {% block body_tags %}background-color="{{config.get("EMAIL_BACKGROUND_COLOR", "#ebebebff")}}" width="600px"{% endblock %}>
+      <mj-section full-width="full-width" background-color="{{config.get("EMAIL_BACKGROUND_ACCENT_COLOR", "#d1d1d1ff")}}" padding-bottom="0">
         <mj-column width="100%">
-          <mj-text color="#4d4d4d" font-weight="bold" align="center" font-size="16px" letter-spacing="1px">
+          <mj-text color="#474747ff" font-weight="bold" align="center" font-size="16px" letter-spacing="1px">
             {% block brand %}
               {{config.get("SITE_TITLE", "")}}
             {% endblock %}

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/layouts/web.html

@@ -6,11 +6,13 @@
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         {% endblock %}
-        {% if config["PWA"] -%}
-        <link rel="manifest" href="{{url_for("pwa_manifest")}}" />
-        {%- endif %}
-        {% block page_title %}<title>{% if page_title is defined %}{{ page_title }}{% if config.get("SITE_TITLE") %} | {% endif %}{% endif %}{% if config.get("SITE_TITLE") %}{{config["SITE_TITLE"]}}{% endif %}</title>{% endblock %}
-        {% asset_tags %}
+        {% block page_title %}
+          <title>{% if site_title is defined %}{{site_title}}{% else %}{% if page_title is defined %}{{ page_title }}{% if config.get("SITE_TITLE") %} | {% endif %}{% endif %}{% if config.get("SITE_TITLE") %}{{config["SITE_TITLE"]}}{% endif %}{% endif %}</title>
+        {% endblock %}
+        {% if metadata is defined %}
+          <{PageMetadata metadata=metadata}/>
+        {% endif %}
+        {% asset_tags nonce=csp_nonce %}
         {% block head_assets %}{% endblock %}
         {%- endblock %}
     </head>
@@ -25,7 +27,7 @@
         {% block footer %}{% endblock %}
         {% block flash_messages %}
           {% autoescape false %} {# Jinja bug #}
-            <{FlashMessages}/>
+            <{FlashMessagesToast}/>
           {% endautoescape %}
         {% endblock %}
         {% block body_end %}{% endblock %}

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/model.py

@@ -1,10 +1,15 @@
-from flask_sqlorm import Model as BaseModel
 from flask import current_app
+from flask_sqlorm import Model as BaseModel
+from flask_files import save_file, File
 from sqlorm.resultset import CompositeResultSet
+from sqlorm import SQLType
 from markupsafe import Markup
 import abc
 
 
+File = SQLType("text", save_file, File.from_uri)
+
+
 class ModelResultSet(CompositeResultSet):
     def __str__(self):
         return Markup("".join([str(item) for item in self]))

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/page_helpers.py

@@ -1,5 +1,5 @@
 from flask_file_routes import DEFAULT_HELPERS
-from flask import g, current_app
+from flask import current_app
 from .utils.page_actions import page_action
 
 
@@ -18,19 +18,11 @@ def form(page):
     return form_helper
 
 
-def stream(page):
-    g.__page_stream__ = True
-    return
-
-
 def action(page):
-    def decorator(func=None, name=None):
-        return page_action(func, name)
-    return decorator
+    return page_action
 
 
 DEFAULT_HELPERS.update(csrf_protect=csrf_protect,
                        forms=forms,
                        form=form,
-                       stream=stream,
-                       action=action)
+                       action=action)

hyperflask-0.3.0/src/hyperflask/security.py

@@ -0,0 +1,81 @@
+from flask import request, current_app, g
+from urllib.parse import urlparse, urljoin
+import secrets
+
+
+def is_safe_redirect_url(target):
+    host_url = urlparse(request.host_url)
+    redirect_url = urlparse(urljoin(request.host_url, target))
+    return (
+        redirect_url.scheme in ("http", "https")
+        and host_url.netloc == redirect_url.netloc
+    )
+
+
+def respond_with_security_headers(response):
+    if current_app.config["CSP_HEADER"] is not False:
+        response.headers['X-XSS-Protection'] = '1; mode=block'
+        response.headers['X-Content-Type-Options'] = 'nosniff'
+        response.headers['Content-Security-Policy'] = generate_csp_policy()
+
+    if current_app.config['HSTS_HEADER']:
+        response.headers['Strict-Transport-Security'] = current_app.config['HSTS_HEADER']
+
+    if current_app.config['REFERRER_POLICY']:
+        response.headers['Referrer-Policy'] = current_app.config['REFERRER_POLICY']
+
+    return response
+
+
+def generate_csp_policy():
+    policy = current_app.config["CSP_HEADER"]
+    if policy is True:
+        policy = {
+            "default-src": "'safe-src'",
+            "manifest-src": "'self'",
+            "connect-src": 'https: wss:' if current_app.config['SERVER_SECURED'] else 'http: ws:',
+            "img-src": "* data: blob:",
+            "media-src": "* data: blob:",
+            "frame-src": "* data: blob:",
+            "object-src": "* data: blob:"
+        }
+    policy.setdefault("script-src", policy["default-src"])
+    policy.setdefault("style-src", policy["default-src"])
+
+    if not current_app.config['CSP_FRAME_ANCESTORS']:
+        policy["frame-ancestors"] = "'none'"
+    elif isinstance(current_app.config['CSP_FRAME_ANCESTORS'], (list, tuple)):
+        frame_ancestors = list(current_app.config['CSP_FRAME_ANCESTORS'])
+        add_frame_ancestors = True
+        for endpoint in current_app.config['CSP_FRAME_ANCESTORS_SAFE_ENDPOINTS']:
+            ancestors = []
+            if isinstance(endpoint, (list, tuple)):
+                endpoint, ancestors = endpoint
+            if request.endpoint == endpoint:
+                if ancestors:
+                    frame_ancestors.extend(ancestors)
+                else:
+                    add_frame_ancestors = False
+                break
+        if add_frame_ancestors:
+            policy["frame-ancestors"] = ' '.join(set(frame_ancestors))
+
+    if current_app.config.get('CSP_UNSAFE_EVAL'):
+        policy["script-src"] += " 'unsafe-eval'"
+
+    unsafe_inline = current_app.debug or current_app.config.get('CSP_UNSAFE_INLINE')
+    if unsafe_inline:
+        policy["script-src"] += " 'unsafe-inline'"
+        policy["style-src"] += " 'unsafe-inline'"
+    elif 'csp_nonce' in g:
+        policy["style-src"] += f" 'nonce-{g.csp_nonce}'"
+        policy["script-src"] += f" 'nonce-{g.csp_nonce}'"
+
+    safe_srcs = " ".join(set(current_app.config['CSP_SAFE_SRC']))
+    return "; ".join(("%s %s" % (k, v.replace("'safe-src'", safe_srcs))).strip() for k, v in policy.items()) + ";"
+
+
+def csp_nonce():
+    if 'csp_nonce' not in g:
+        g.csp_nonce = secrets.token_urlsafe(16)[:16]
+    return g.csp_nonce

hyperflask-0.3.0/src/hyperflask/static/alpine-csp.js

@@ -0,0 +1,5 @@
+import Alpine from '@alpinejs/csp'
+
+window.Alpine = Alpine
+
+export default Alpine

{hyperflask-0.2.3 → hyperflask-0.3.0}/src/hyperflask/static/alpine.js

@@ -2,4 +2,4 @@ import Alpine from 'alpinejs'
 
 window.Alpine = Alpine
 
-export default Alpine
+export default Alpine

hyperflask-0.3.0/src/hyperflask/static/app.js

@@ -0,0 +1,14 @@
+import htmx from "htmx.org";
+import "htmx-ext-sse";
+import "./htmx-exts";
+import "./app.css";
+
+const DEFAULT_HTMX_EXTS = ['hf-modal', 'hx-bottom-scroll-on-trigger', 'hx-active-url', 'hx-stream'];
+document.body.setAttribute('hx-ext', [document.body.getAttribute('hx-ext'), ...DEFAULT_HTMX_EXTS].filter(Boolean).join(","))
+
+window.htmx = htmx;
+export { htmx };
+
+if (window.Alpine) {
+    window.Alpine.start()
+}