hyperflask 0.2.4__tar.gz → 0.3.0__tar.gz

{hyperflask-0.2.4 → hyperflask-0.3.0}/PKG-INFO

@@ -1,32 +1,31 @@
 Metadata-Version: 2.4
 Name: hyperflask
-Version: 0.2.4
+Version: 0.3.0
 Summary: Full stack web framework
 Author: Maxime Bouroumeau-Fuseau
 Author-email: Maxime Bouroumeau-Fuseau <maxime.bouroumeau@gmail.com>
 License-Expression: MIT
 Requires-Dist: flask>=3.0.0,<4.0.0
-Requires-Dist: flask-assets-pipeline~=0.6
+Requires-Dist: flask-assets-pipeline~=0.7
 Requires-Dist: flask-babel-hyper~=5.1
 Requires-Dist: flask-collections~=0.2
 Requires-Dist: flask-configurator~=0.1
 Requires-Dist: flask-debugtoolbar~=0.16
 Requires-Dist: flask-dramatiq~=0.6
-Requires-Dist: flask-file-routes~=0.2
+Requires-Dist: flask-file-routes~=0.3
 Requires-Dist: flask-files~=0.2
 Requires-Dist: flask-geo~=0.1
 Requires-Dist: flask-mailman-templates~=0.1
-Requires-Dist: flask-mercure-sse~=0.2
-Requires-Dist: flask-sqlorm~=0.2
+Requires-Dist: flask-mercure-sse~=0.3
+Requires-Dist: flask-sqlorm~=0.3
 Requires-Dist: flask-super-macros~=0.1
-Requires-Dist: flask-talisman~=1.1
+Requires-Dist: flask-suspense~=0.1
 Requires-Dist: flask-wtf~=1.2
 Requires-Dist: frozen-flask~=1.0
 Requires-Dist: gunicorn~=23.0
 Requires-Dist: honcho~=2.0
 Requires-Dist: html-sanitizer~=2.6
 Requires-Dist: htmx-flask~=0.1
-Requires-Dist: jinja2-fragments~=1.9
 Requires-Dist: jinja-layout~=0.4
 Requires-Dist: jinja-wtforms~=0.2
 Requires-Dist: periodiq~=0.13
@@ -108,7 +107,7 @@ A good part of these extensions is developed as part of the Hyperflask project.
 | [Flask-Mercure-SSE](https://github.com/hyperflask/flask-mercure-sse) | Push events via server-sent events using the [Mercure](https://mercure.rocks) protocol
 | [Flask-SQLORM](https://github.com/hyperflask/flask-sqlorm) | Flask integration of [sqlorm](https://github.com/hyperflask/sqlorm)
 | [Flask-Super-Macros](https://github.com/hyperflask/flask-super-macros) | Better macro management for Jinja
-| [Flask-Talisman](https://github.com/wntrblm/flask-talisman) | HTTP security headers for Flask
+| [Flask-Suspense](https://github.com/hyperflask/flask-suspense) | Suspense for Flask
 | [Flask-WTF](https://flask-wtf.readthedocs.io) | [WTForms](https://wtforms.readthedocs.io) integration
 
 ## Using without Hyperflask-Start
@@ -116,6 +115,5 @@ A good part of these extensions is developed as part of the Hyperflask project.
 1. Create your project directory: `mkdir example-project && cd example-project`
 2. Create and activate a virtualenv: `python -m venv .venv && source .venv/bin/activate`
 3. `pip install hyperflask`
-4. Create a pages directory: `mkdir pages`
-5. Create your index page: `echo "hello world" > pages/index.html`
-6. Start a development server using `hyperflask dev`
+4. Run `hyperflask init .`
+5. Start a development server using `hyperflask dev`

{hyperflask-0.2.4 → hyperflask-0.3.0}/README.md

@@ -70,7 +70,7 @@ A good part of these extensions is developed as part of the Hyperflask project.
 | [Flask-Mercure-SSE](https://github.com/hyperflask/flask-mercure-sse) | Push events via server-sent events using the [Mercure](https://mercure.rocks) protocol
 | [Flask-SQLORM](https://github.com/hyperflask/flask-sqlorm) | Flask integration of [sqlorm](https://github.com/hyperflask/sqlorm)
 | [Flask-Super-Macros](https://github.com/hyperflask/flask-super-macros) | Better macro management for Jinja
-| [Flask-Talisman](https://github.com/wntrblm/flask-talisman) | HTTP security headers for Flask
+| [Flask-Suspense](https://github.com/hyperflask/flask-suspense) | Suspense for Flask
 | [Flask-WTF](https://flask-wtf.readthedocs.io) | [WTForms](https://wtforms.readthedocs.io) integration
 
 ## Using without Hyperflask-Start
@@ -78,6 +78,5 @@ A good part of these extensions is developed as part of the Hyperflask project.
 1. Create your project directory: `mkdir example-project && cd example-project`
 2. Create and activate a virtualenv: `python -m venv .venv && source .venv/bin/activate`
 3. `pip install hyperflask`
-4. Create a pages directory: `mkdir pages`
-5. Create your index page: `echo "hello world" > pages/index.html`
-6. Start a development server using `hyperflask dev`
+4. Run `hyperflask init .`
+5. Start a development server using `hyperflask dev`

{hyperflask-0.2.4 → hyperflask-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "hyperflask"
-version = "0.2.4"
+version = "0.3.0"
 description = "Full stack web framework"
 authors = [
     {"name" = "Maxime Bouroumeau-Fuseau", email = "maxime.bouroumeau@gmail.com"}
@@ -10,21 +10,21 @@ license = "MIT"
 requires-python = ">=3.10"
 dependencies = [
     "flask>=3.0.0,<4.0.0",
-    "flask-assets-pipeline ~=0.6",
+    "flask-assets-pipeline ~=0.7",
     "flask-babel-hyper ~=5.1",
     "flask-collections ~=0.2",
     "flask-configurator ~=0.1",
     "flask-debugtoolbar ~=0.16",
     "flask-dramatiq ~=0.6",
-    "flask-file-routes ~=0.2",
+    "flask-file-routes ~=0.3",
     "flask-files ~=0.2",
     "flask-geo ~=0.1",
     "flask-mailman-templates ~=0.1",
-    "flask-mercure-sse ~=0.2",
+    "flask-mercure-sse ~=0.3",
     #"flask-observability ~=0.1"
-    "flask-sqlorm ~=0.2",
+    "flask-sqlorm ~=0.3",
     "flask-super-macros ~=0.1",
-    "flask-talisman ~=1.1",
+    "flask-suspense ~=0.1",
     "flask-wtf ~=1.2",
     "frozen-flask ~=1.0",
     #"dramatiq-sqlite ~=0.1"
@@ -32,12 +32,11 @@ dependencies = [
     "honcho ~=2.0",
     "html-sanitizer ~=2.6",
     "htmx-flask ~=0.1",
-    "jinja2-fragments ~=1.9",
     "jinja-layout ~=0.4",
     "jinja-wtforms ~=0.2",
     "periodiq ~=0.13",
     "python-slugify ~=8.0.4",
-    "redis ~=6.4"
+    "redis ~=6.4",
 ]
 
 [tool.uv.sources]

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/__init__.py

@@ -1,6 +1,7 @@
 from flask import *
 from .app import Hyperflask
 from .utils.htmx import htmx_redirect, htmx_oob
+from .security import csp_nonce
 
 # useful exports from hyperflask managed extensions
 from flask_babel import gettext, _, pgettext, _p, ngettext, _n, npgettext, _np, lazy_gettext, _lazy
@@ -8,9 +9,9 @@ from flask_file_routes import page
 from flask_files import save_file, validate_file
 from flask_mailman_templates import send_mail
 from flask_mercure_sse import publish_signal, mercure_publish
+from flask_suspense import render_template, stream_template, defer
 
 # useful exports from 3rd party libs
 from htmx_flask import request, make_response
-from jinja2_fragments.flask import render_block
 from slugify import slugify
 from blinker import signal

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/app.py

@@ -1,6 +1,6 @@
 # flask
 from flask import Flask
-from jinja2 import ChoiceLoader, FileSystemLoader, PrefixLoader
+from jinja2 import ChoiceLoader, FileSystemLoader, PrefixLoader, TemplateNotFound
 from werkzeug.middleware.proxy_fix import ProxyFix
 # hyperflask extensions
 from jinja_layout import LayoutExtension
@@ -8,7 +8,7 @@ from jinja_wtforms import WtformExtension
 from flask_assets_pipeline import AssetsPipeline
 from flask_super_macros import SuperMacros
 from flask_collections import Collections
-from flask_file_routes import FileRoutes
+from flask_file_routes import FileRoutes, ModuleView, page
 from flask_configurator import Config
 from flask_babel import Babel, _, _p, _n, _np, lazy_gettext
 from flask_geo import Geolocation
@@ -16,10 +16,10 @@ from flask_files import Files
 from flask_sqlorm import FlaskSQLORM
 from flask_mercure_sse import MercureSSE
 from flask_mailman_templates import MailTemplates
+from flask_suspense import Suspense, render_template, suspense_before_render_template, suspense_before_render_blocks
 #from flask_observability import Observability
 # 3rd party extensions
 from flask_wtf.csrf import CSRFProtect
-from flask_talisman import Talisman
 from flask_frozen import Freezer
 from htmx_flask import Htmx
 from flask_mailman import Mail
@@ -31,10 +31,9 @@ from .utils.page_actions import page_action_url
 from .utils.htmx import htmx_oob, respond_with_flash_messages
 from .utils.markdown import jinja_markdown, MarkdownExtension
 from .utils.html import sanitize_html, nl2br
-from .utils.models import File as SQLFileType
-from .components import discover_components, register_components
-from .components.jsx import ReactAdapter
-from .model import Model
+from .components import register_components
+from .model import Model, File as SQLFileType
+from .security import respond_with_security_headers, csp_nonce
 from . import page_helpers
 # others
 from jinja_super_macros.registry import FileLoader
@@ -54,7 +53,7 @@ map_jinja_call_node_to_func(lazy_gettext, "lazy_gettext")
 class Hyperflask(Flask):
     config_class = Config
 
-    def __init__(self, *args, static_mode="hybrid", instrument=False, layouts_folder="layouts", partials_folder="partials",
+    def __init__(self, *args, static_mode="hybrid", instrument=False, layouts_folder="layouts",
                  emails_folder="emails", forms_folder="forms", assets_folder="assets", pages_folder="pages", migrations_folder="migrations",
                  config=None, config_filename="config.yml", database_uri="sqlite://:memory:", proxy_fix=True, **kwargs):
 
@@ -73,14 +72,24 @@ class Hyperflask(Flask):
             "SESSION_COOKIE_SAMESITE": "Lax",
             # Hyperflask specific
             "LAYOUT": "layouts/default.html",
+            "ALPINE": False,
             "STATIC_MODE": static_mode,
-            "ASSETS_INCLUDE_HTMX": True,
-            "HTMX_EXT": ["hf-modal"],
+            "ASSETS_INCLUDE_ALPINE": False,
+            "HTMX_EXT": [],
             "HTMX_BOOST_SITE": False,
             "MARKDOWN_OPTIONS": {"extensions": ["fenced_code", "nl2br", "attr_list", "admonition", "codehilite"]},
             "MARKDOWN_SANITIZER_CONFIG": {},
             "FLASH_TOAST_OOB": True,
-            "FLASH_TOAST_REMOVE_AFTER": None
+            "FLASH_TOAST_REMOVE_AFTER": None,
+            "SERVER_SECURED": False,
+            "CSP_HEADER": True,
+            "CSP_SAFE_SRC": ["'self'"],
+            "CSP_UNSAFE_EVAL": True,
+            "CSP_UNSAFE_INLINE": True,
+            "CSP_FRAME_ANCESTORS": True,
+            "CSP_FRAME_ANCESTORS_SAFE_ENDPOINTS": [],
+            "REFERRER_POLICY": "strict-origin-when-cross-origin",
+            "HSTS_HEADER": False
         })
         if config:
             self.config.update(config)
@@ -93,13 +102,22 @@ class Hyperflask(Flask):
         self.config["COLLECTIONS_MARKDOWN_OPTIONS"] = self.config["MARKDOWN_OPTIONS"]
         self.config["MAIL_TEMPLATES_MARKDOWN_OPTIONS"] = self.config["MARKDOWN_OPTIONS"]
 
+        if self.config['SERVER_SECURED']:
+            self.config.update({
+                'FORCE_URL_SCHEME': 'https',
+                'PREFERRED_URL_SCHEME': 'https',
+                'SESSION_COOKIE_SECURE': True,
+                'REMEMBER_COOKIE_SECURE': True
+            })
+            self.config.setdefault("HSTS_HEADER", "max-age=31556926; includeSubDomains") # 1 year
+
         #self.otel = Observability(self)
 
         self.jinja_env.add_extension(LayoutExtension)
         self.jinja_env.add_extension(WtformExtension)
         self.jinja_env.add_extension(MarkdownExtension)
         self.jinja_env.filters.update(markdown=jinja_markdown, sanitize=sanitize_html, nl2br=nl2br)
-        self.jinja_env.globals.update(page_action_url=page_action_url, app=self)
+        self.jinja_env.globals.update(page_action_url=page_action_url, app=self, csp_nonce=csp_nonce)
         self.jinja_env.form_base_cls = Form
         self.jinja_env.default_layout = self.config["LAYOUT"]
         self.forms = self.jinja_env.forms
@@ -130,7 +148,7 @@ class Hyperflask(Flask):
         Geolocation(self)
         Files(self)
         MailTemplates(self, template_folder=emails_folder)
-        file_routes = FileRoutes(self, pages_folder=pages_folder, partials_folder=partials_folder)
+        file_routes = FileRoutes(self, pages_folder=pages_folder, module_view_class=HyperModuleView)
         self.page_helper = file_routes.page_helper
         self.collections = Collections(self)
         self.sse = MercureSSE(self)
@@ -153,11 +171,13 @@ class Hyperflask(Flask):
         })
         self.assets.bundle(
             {"@hyperflask": ["app.js"],
-             "@hyperflask/alpine": ["alpine.js"]},
+             "@hyperflask/alpine": ["alpine-csp.js" if not self.config["CSP_UNSAFE_EVAL"] else "alpine.js"]},
             from_package="hyperflask",
             assets_folder="static"
         )
         self.assets.include("@hyperflask", 0)
+        if self.config["ALPINE"]:
+            self.assets.include("@hyperflask/alpine", 0)
 
         self.extensions['mail_templates'].jinja_env.add_extension(LayoutExtension)
         self.extensions['mail_templates'].jinja_env.default_layout = "layout.mjml"
@@ -179,6 +199,7 @@ class Hyperflask(Flask):
             for macro in self.macros.create_from_directory(os.path.join(self.root_path, forms_folder)):
                 self.forms.register(self.macros.resolve_template(macro), macro)
 
+        self.after_request(respond_with_security_headers)
         if self.config["FLASH_TOAST_OOB"]:
             self.after_request(respond_with_flash_messages)
 
@@ -189,10 +210,39 @@ class Hyperflask(Flask):
         self.db.Model = Model
         self.db.File = SQLFileType
 
+        Suspense(self, nonce_getter="csp_nonce()")
+
+        @suspense_before_render_template.connect_via(self, weak=False)
+        def on_suspense_before_render_template(sender, **kwargs):
+            csp_nonce() # we will need a nonce but the first call will be after the template started rendering
+
+        @suspense_before_render_blocks.connect_via(self, weak=False)
+        def on_suspense_before_render_blocks(sender, **kwargs):
+            return f'<script nonce="{csp_nonce()}">htmx.bootstrap()</script>'
+
+        @self.errorhandler(404)
+        def not_found(error):
+            try:
+                return render_template("404.html"), 404
+            except TemplateNotFound:
+                return self.make_response(("404 Not Found", 404))
+
+        @self.errorhandler(500)
+        def internal_server_error(error):
+            try:
+                return render_template("500.html"), 500
+            except TemplateNotFound:
+                return self.make_response(("500 Internal Server Error", 500))
+
     def relative_import_name(self, name):
         return f"{self.import_name}.{name}" if self.import_name != "__main__" else name
 
 
+class HyperModuleView(ModuleView):
+    def _render_template(self):
+        return render_template(page.template)
+
+
 def static(func):
     pass
 

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/cli.py

@@ -33,6 +33,7 @@ cli.add_command(freeze_command)
 @click.pass_context
 def build_command(ctx):
     ctx.invoke(assets_cli.build)
+    ctx.invoke(freeze_command)
 
 cli.add_command(build_command)
 
@@ -69,8 +70,9 @@ cli.add_command(serve_command)
 @click.option("--host", "-h", default="127.0.0.1", help="The interface to bind to.")
 @click.option("--port", "-p", default=5000, help="The port to bind to.")
 @click.option('--concurrency')
+@click.option("--extend-procfile")
 @click.option("--dev", is_flag=True)
-def run_command(processes, host, port, concurrency, dev):
+def run_command(processes, host, port, concurrency, extend_procfile, dev):
     from honcho.command import _procfile, _parse_concurrency
     from honcho.manager import Manager
     from honcho.printer import Printer
@@ -85,14 +87,18 @@ def run_command(processes, host, port, concurrency, dev):
         if os.path.exists(filename):
             _processes = _procfile(filename).processes
             break
-    if _processes is None:
-        _processes = {
+    if _processes is None or extend_procfile:
+        if not _processes:
+            _processes = {}
+        _processes.update({
             "web": [sys.argv[0], "serve", "--host", host, "--port", "$PORT"],
             # "worker": [sys.argv[0], "worker"],
             # "scheduler": [sys.argv[0], "periodiq"]
-        }
+        })
         if dev:
             _processes["assets"] = [sys.argv[0], "assets", "dev"]
+        else:
+            _processes["mercurehub"] = [sys.executable, "-m", "flask_mercure_sse.server"]
 
     processes = {name: " ".join(_processes[name]) if isinstance(_processes[name], list) else _processes[name]
                  for name in _processes if name in _processes}
@@ -124,6 +130,13 @@ dev_command.params = list(run_command.params)
 cli.add_command(dev_command)
 
 
+@click.command("init")
+def init_command():
+    pass
+
+cli.add_command(init_command)
+
+
 def main():
     cli.main()
 

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/components/core.py

@@ -2,6 +2,7 @@ from markupsafe import Markup
 from flask import request, current_app
 from flask.views import http_method_funcs
 from flask_file_routes import page
+from flask_suspense import render_template
 from jinjapy import extract_frontmatter
 import importlib
 import re
@@ -55,19 +56,34 @@ class ComponentAdapter(BaseComponentAdapter):
                     return props
                 if not props:
                     props = {}
-            return self.render(None, **props)
+            ctx = self.get_render_context(None, **props)
+            return render_template(self.template, **ctx)
 
         if methods:
             app.add_url_rule(url, self.name, view_func=view_func, methods=methods)
 
-    def render(self, caller, *args, **kwargs):
-        tpl = current_app.jinja_env.get_template(self.template)
+    def get_render_context(self, caller, *args, **kwargs):
         ctx = kwargs.pop('_ctx', {})
-        ctx.update(dict(args=args, kwargs=kwargs, props=kwargs, caller=caller, children=caller))
+        ctx.update(dict(args=args, kwargs=kwargs, props=PropsWrapper(kwargs), caller=caller, children=caller))
         if self.module_name:
             module = importlib.import_module(self.module_name)
             if module and "render" in dir(module):
                 _ctx = module.render(*args, **kwargs)
                 if _ctx:
                     ctx.update(_ctx)
-        return Markup(tpl.render(**ctx))
+        return ctx
+
+    def render(self, caller, *args, **kwargs):
+        tpl = current_app.jinja_env.get_template(self.template)
+        ctx = self.get_render_context(caller, *args, **kwargs)
+        return Markup(tpl.render(**ctx)) # do not use render_template() so we don't trigger flask signals
+
+
+class PropsWrapper:
+    def __init__(self, props):
+        self._props = props
+
+    def __getattr__(self, name):
+        if name in self._props:
+            return self._props[name]
+        raise Exception(f"No such prop: {name}")

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/factory.py

@@ -68,7 +68,7 @@ def create_app(root_path=None):
     try_import(app, "signals")
     try_import(app, "app")
 
-    if models:
+    if models and app.config.get("INIT_DATABASE", True):
         db.init_db()
 
     return app

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/forms/widgets.py

@@ -5,6 +5,7 @@ def create_widget_class(basecls, cssclass="input"):
     class Input(basecls):
         def __call__(self, field, **kwargs):
             extend_class(kwargs, cssclass)
+            kwargs = {k.replace('_', '-'): v for k, v in kwargs.items() if v is not None}
             return super().__call__(field, **kwargs)
     return Input
 

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/layouts/web.html

@@ -6,8 +6,13 @@
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         {% endblock %}
-        {% block page_title %}<title>{% if page_title is defined %}{{ page_title }}{% if config.get("SITE_TITLE") %} | {% endif %}{% endif %}{% if config.get("SITE_TITLE") %}{{config["SITE_TITLE"]}}{% endif %}</title>{% endblock %}
-        {% asset_tags %}
+        {% block page_title %}
+          <title>{% if site_title is defined %}{{site_title}}{% else %}{% if page_title is defined %}{{ page_title }}{% if config.get("SITE_TITLE") %} | {% endif %}{% endif %}{% if config.get("SITE_TITLE") %}{{config["SITE_TITLE"]}}{% endif %}{% endif %}</title>
+        {% endblock %}
+        {% if metadata is defined %}
+          <{PageMetadata metadata=metadata}/>
+        {% endif %}
+        {% asset_tags nonce=csp_nonce %}
         {% block head_assets %}{% endblock %}
         {%- endblock %}
     </head>

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/model.py

@@ -1,10 +1,15 @@
-from flask_sqlorm import Model as BaseModel
 from flask import current_app
+from flask_sqlorm import Model as BaseModel
+from flask_files import save_file, File
 from sqlorm.resultset import CompositeResultSet
+from sqlorm import SQLType
 from markupsafe import Markup
 import abc
 
 
+File = SQLType("text", save_file, File.from_uri)
+
+
 class ModelResultSet(CompositeResultSet):
     def __str__(self):
         return Markup("".join([str(item) for item in self]))

hyperflask-0.3.0/src/hyperflask/security.py

@@ -0,0 +1,81 @@
+from flask import request, current_app, g
+from urllib.parse import urlparse, urljoin
+import secrets
+
+
+def is_safe_redirect_url(target):
+    host_url = urlparse(request.host_url)
+    redirect_url = urlparse(urljoin(request.host_url, target))
+    return (
+        redirect_url.scheme in ("http", "https")
+        and host_url.netloc == redirect_url.netloc
+    )
+
+
+def respond_with_security_headers(response):
+    if current_app.config["CSP_HEADER"] is not False:
+        response.headers['X-XSS-Protection'] = '1; mode=block'
+        response.headers['X-Content-Type-Options'] = 'nosniff'
+        response.headers['Content-Security-Policy'] = generate_csp_policy()
+
+    if current_app.config['HSTS_HEADER']:
+        response.headers['Strict-Transport-Security'] = current_app.config['HSTS_HEADER']
+
+    if current_app.config['REFERRER_POLICY']:
+        response.headers['Referrer-Policy'] = current_app.config['REFERRER_POLICY']
+
+    return response
+
+
+def generate_csp_policy():
+    policy = current_app.config["CSP_HEADER"]
+    if policy is True:
+        policy = {
+            "default-src": "'safe-src'",
+            "manifest-src": "'self'",
+            "connect-src": 'https: wss:' if current_app.config['SERVER_SECURED'] else 'http: ws:',
+            "img-src": "* data: blob:",
+            "media-src": "* data: blob:",
+            "frame-src": "* data: blob:",
+            "object-src": "* data: blob:"
+        }
+    policy.setdefault("script-src", policy["default-src"])
+    policy.setdefault("style-src", policy["default-src"])
+
+    if not current_app.config['CSP_FRAME_ANCESTORS']:
+        policy["frame-ancestors"] = "'none'"
+    elif isinstance(current_app.config['CSP_FRAME_ANCESTORS'], (list, tuple)):
+        frame_ancestors = list(current_app.config['CSP_FRAME_ANCESTORS'])
+        add_frame_ancestors = True
+        for endpoint in current_app.config['CSP_FRAME_ANCESTORS_SAFE_ENDPOINTS']:
+            ancestors = []
+            if isinstance(endpoint, (list, tuple)):
+                endpoint, ancestors = endpoint
+            if request.endpoint == endpoint:
+                if ancestors:
+                    frame_ancestors.extend(ancestors)
+                else:
+                    add_frame_ancestors = False
+                break
+        if add_frame_ancestors:
+            policy["frame-ancestors"] = ' '.join(set(frame_ancestors))
+
+    if current_app.config.get('CSP_UNSAFE_EVAL'):
+        policy["script-src"] += " 'unsafe-eval'"
+
+    unsafe_inline = current_app.debug or current_app.config.get('CSP_UNSAFE_INLINE')
+    if unsafe_inline:
+        policy["script-src"] += " 'unsafe-inline'"
+        policy["style-src"] += " 'unsafe-inline'"
+    elif 'csp_nonce' in g:
+        policy["style-src"] += f" 'nonce-{g.csp_nonce}'"
+        policy["script-src"] += f" 'nonce-{g.csp_nonce}'"
+
+    safe_srcs = " ".join(set(current_app.config['CSP_SAFE_SRC']))
+    return "; ".join(("%s %s" % (k, v.replace("'safe-src'", safe_srcs))).strip() for k, v in policy.items()) + ";"
+
+
+def csp_nonce():
+    if 'csp_nonce' not in g:
+        g.csp_nonce = secrets.token_urlsafe(16)[:16]
+    return g.csp_nonce

hyperflask-0.3.0/src/hyperflask/static/alpine-csp.js

@@ -0,0 +1,5 @@
+import Alpine from '@alpinejs/csp'
+
+window.Alpine = Alpine
+
+export default Alpine

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/static/alpine.js

@@ -2,4 +2,4 @@ import Alpine from 'alpinejs'
 
 window.Alpine = Alpine
 
-export default Alpine
+export default Alpine

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/static/app.js

@@ -3,7 +3,7 @@ import "htmx-ext-sse";
 import "./htmx-exts";
 import "./app.css";
 
-const DEFAULT_HTMX_EXTS = ['hf-modal', 'hx-bottom-scroll-on-trigger', 'hx-active-url'];
+const DEFAULT_HTMX_EXTS = ['hf-modal', 'hx-bottom-scroll-on-trigger', 'hx-active-url', 'hx-stream'];
 document.body.setAttribute('hx-ext', [document.body.getAttribute('hx-ext'), ...DEFAULT_HTMX_EXTS].filter(Boolean).join(","))
 
 window.htmx = htmx;

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/static/htmx-exts.js

@@ -4,7 +4,7 @@ import htmx from "htmx.org";
   let triggerElement = false, enableTriggerElement;
   htmx.defineExtension("hf-modal", {
     getSelectors() {
-        return ['[hf-modal]'];
+      return ['[hf-modal]'];
     },
     onEvent(name, evt) {
       if (name === "htmx:beforeProcessNode" && evt.target.hasAttribute("hf-modal")) {
@@ -42,21 +42,21 @@ import htmx from "htmx.org";
 
 htmx.defineExtension("hx-bottom-scroll-on-trigger", {
   getSelectors() {
-      return ['[hx-bottom-scroll-on-trigger]'];
+    return ['[hx-bottom-scroll-on-trigger]'];
   },
   onEvent(name, evt) {
     if (name === "htmx:afterProcessNode" && evt.target.hasAttribute("hx-bottom-scroll-on-trigger")) {
-        const elt = evt.target;
-        elt.scrollTop = elt.scrollHeight - elt.clientHeight;
-        elt.classList.add("at-bottom");
-        elt.addEventListener("scroll", (e) => {
-          if (e.target.scrollTop < e.target.scrollHeight - e.target.clientHeight - 20) {
-            e.target.classList.remove("at-bottom");
-          } else {
-            e.target.classList.add("at-bottom");
-          }
-        });
-        return;
+      const elt = evt.target;
+      elt.scrollTop = elt.scrollHeight - elt.clientHeight;
+      elt.classList.add("at-bottom");
+      elt.addEventListener("scroll", (e) => {
+        if (e.target.scrollTop < e.target.scrollHeight - e.target.clientHeight - 20) {
+          e.target.classList.remove("at-bottom");
+        } else {
+          e.target.classList.add("at-bottom");
+        }
+      });
+      return;
     }
 
     const eventName = evt.target.getAttribute("hx-bottom-scroll-on-trigger");
@@ -96,7 +96,7 @@ htmx.defineExtension("hx-active-url", {
     document.addEventListener("htmx:pushedIntoHistory", ensureLinksAreActive);
   },
   getSelectors() {
-      return ['[hx-href]'];
+    return ['[hx-href]'];
   },
   onEvent(name, evt) {
     if (name === "htmx:beforeProcessNode" && evt.target.hasAttribute("hx-href")) {
@@ -105,3 +105,21 @@ htmx.defineExtension("hx-active-url", {
     }
   }
 });
+
+htmx.defineExtension("hx-stream", {
+  getSelectors() {
+    return ['[hx-stream]'];
+  },
+  onEvent: function (name, evt) {
+    if (name === "htmx:beforeRequest" && evt.target.hasAttribute("hx-stream")) {
+      const target = evt.detail.target;
+      const xhr = evt.detail.xhr;
+      xhr.addEventListener('readystatechange', function () {
+        if (xhr.readyState === 2 || xhr.readyState === 3) {
+          target.innerHTML = xhr.responseText;
+        }
+      });
+    }
+    return true;
+  }
+});

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/ui/forms.html

@@ -26,7 +26,7 @@
 
 {% macro FormField(field=None, label=None) -%}
   {% if label %}<{Label}>{{label}}</{Label}>{% elif field.label and label == None %}<{Label for=field.label.field_id}>{{field.label.text}}</{Label}>{% endif %}
-  {{field if field else caller()}}
+  {{field(**kwargs) if field else caller()}}
 {%- endmacro %}
 
 {% macro SubmitButton() %}

{hyperflask-0.2.4 → hyperflask-0.3.0}/src/hyperflask/ui/layout.html

@@ -16,7 +16,7 @@
 
 {% macro Sidebar() -%}
   {%- set inner = caller() -%}
-  <{DrawerSide id="sidebar" drawer_id="app-drawer" class=html_class("min-w-[250px] bg-base-200", kwargs.pop('class', None)) **kwargs }>
+  <{DrawerSide id="sidebar" drawer_id="app-drawer" class=html_class("min-w-[250px] max-w-[250px] bg-base-200", kwargs.pop('class', None)) **kwargs }>
     <div class="flex flex-col h-full w-full" id="sidebar-content">
         {{inner}}
     </div>

hyperflask-0.3.0/src/hyperflask/ui/metadata.html

@@ -0,0 +1,4 @@
+
+{% macro PageMetadata(metadata) -%}
+
+{%- endmacro %}

hyperflask-0.3.0/src/hyperflask/ui/skeleton.html

@@ -0,0 +1,33 @@
+
+{% macro SkeletonLines(with_title=True, nb_lines=4) -%}
+  <div class="max-w-full animate-pulse">
+    <div
+      class="block w-4/5 h-3 mb-4 font-sans text-5xl antialiased font-semibold leading-tight tracking-normal bg-gray-300 rounded-full text-inherit">
+      &nbsp;
+    </div>
+    {% for _ in range(nb_lines - 1) -%}
+      <div
+        class="block h-2 mb-2 font-sans text-base antialiased font-light leading-relaxed bg-gray-300 rounded-full text-inherit w-full">
+        &nbsp;
+      </div>
+    {%- endfor %}
+  </div>
+{%- endmacro %}
+
+{% macro SkeletonBlock(icon=None) -%}
+  {{html_tag("div", class_="grid h-full animate-pulse place-items-center rounded-lg bg-gray-300 text-xxl text-gray-500", **kwargs)}}
+    {% if icon %}<{Icon icon}/>{% endif %}
+  </div>
+{%- endmacro -%}
+
+{% macro SkeletonCard() -%}
+
+{%- endmacro %}
+
+{% macro SkeletonList() -%}
+
+{%- endmacro %}
+
+{% macro SkeletonTable() -%}
+
+{%- endmacro %}

hyperflask-0.3.0/src/hyperflask/ui/sse.html

@@ -0,0 +1,22 @@
+
+{% macro MercureStream(topic=None, private=True, hx_swap="beforeend", type=None, auto_scroll=False, with_subscriptions=False) -%}
+  {% set sse_url = mercure_authentified_hub_url(topic, with_subscriptions=with_subscriptions) if private else mercure_hub_url(topic, with_subscriptions=with_subscriptions) %}
+  <div {% if topic %}hx-ext="sse" sse-connect="{{sse_url}}"{% endif %}
+    sse-swap="{{mercure_topic(topic if topic and not type and app.extensions['mercure_sse'].type_is_topic else (type or 'message'))}}"
+    {% if auto_scroll %}hx-bottom-scroll-on-trigger="htmx:sseMessage"{% endif %} {{html_attrs(hx_swap=hx_swap, class_="mercure-stream", **kwargs)}}>
+      {{ caller() }}
+  </div>
+{%- endmacro %}
+
+{% macro MercureStreamContext(topics, private=True, with_subscriptions=False) -%}
+  {% set sse_url = mercure_authentified_hub_url(topics, with_subscriptions=with_subscriptions) if private else mercure_hub_url(topics, with_subscriptions=with_subscriptions) %}
+  <div hx-ext="sse" sse-connect="{{sse_url}}" {{html_attrs(class_="mercure-stream-context", **kwargs)}}>
+      {{ caller() }}
+  </div>
+{%- endmacro %}
+
+{% macro MercurePresence(hx_get, topic=None) -%}
+  <div {% if topic %}hx-ext="sse" sse-connect="{{mercure_authentified_hub_url(mercure_subscription_topic(topic))}}"{% endif %}
+    hx-trigger="sse:Subscription" {{html_attrs(hx_get=hx_get, class_="mercure-presence", **kwargs)}}>
+  </div>
+{%- endmacro %}

hyperflask-0.2.4/src/hyperflask/ui/sse.html

@@ -1,14 +0,0 @@
-
-{% macro MercureStream(topic=None, private=True, hx_swap="beforeend", type=None, auto_scroll=False) -%}
-<div {% if topic %}hx-ext="sse" sse-connect="{{mercure_authentified_hub_url(topic) if private else mercure_hub_url(topic)}}"{% endif %}
-  sse-swap="{{mercure_topic(topic if topic and not type and app.extensions['mercure_sse'].type_is_topic else (type or 'message'))}}"
-  hx-swap="{{hx_swap}}" {% if auto_scroll %}hx-bottom-scroll-on-trigger="htmx:sseMessage"{% endif %} {{html_attrs(**kwargs)}}>
-    {{ caller() }}
-</div>
-{%- endmacro %}
-
-{% macro MercureStreamContext(topics, private=True) -%}
-<div hx-ext="sse" sse-connect="{{mercure_authentified_hub_url(topics) if private else mercure_hub_url(topic)}}" {{html_attrs(**kwargs)}}>
-    {{ caller() }}
-</div>
-{%- endmacro %}

hyperflask-0.2.4/src/hyperflask/utils/models.py

@@ -1,5 +0,0 @@
-from sqlorm import SQLType
-from flask_files import save_file, File
-
-
-File = SQLType("text", save_file, File.from_uri)

hyperflask-0.2.4/src/hyperflask/utils/request.py

@@ -1,25 +0,0 @@
-from flask import request
-from urllib.parse import urlparse, urljoin
-import functools
-
-
-def is_safe_redirect_url(target):
-    host_url = urlparse(request.host_url)
-    redirect_url = urlparse(urljoin(request.host_url, target))
-    return (
-        redirect_url.scheme in ("http", "https")
-        and host_url.netloc == redirect_url.netloc
-    )
-
-
-def marshal_with_depends(content_types):
-    def decorator(func):
-        @functools.wraps(func)
-        def wrapper(*args, **kwargs):
-            response = func(*args, **kwargs)
-            response.headers["Content-Type"] = content_types
-            return response
-
-        return wrapper
-
-    return decorator