hyperflask 0.2.4__tar.gz → 0.3.1__tar.gz

{hyperflask-0.2.4 → hyperflask-0.3.1}/PKG-INFO

@@ -1,33 +1,32 @@
 Metadata-Version: 2.4
 Name: hyperflask
-Version: 0.2.4
+Version: 0.3.1
 Summary: Full stack web framework
 Author: Maxime Bouroumeau-Fuseau
 Author-email: Maxime Bouroumeau-Fuseau <maxime.bouroumeau@gmail.com>
 License-Expression: MIT
 Requires-Dist: flask>=3.0.0,<4.0.0
-Requires-Dist: flask-assets-pipeline~=0.6
+Requires-Dist: flask-assets-pipeline~=0.7
 Requires-Dist: flask-babel-hyper~=5.1
 Requires-Dist: flask-collections~=0.2
 Requires-Dist: flask-configurator~=0.1
 Requires-Dist: flask-debugtoolbar~=0.16
 Requires-Dist: flask-dramatiq~=0.6
-Requires-Dist: flask-file-routes~=0.2
+Requires-Dist: flask-file-routes~=0.3
 Requires-Dist: flask-files~=0.2
 Requires-Dist: flask-geo~=0.1
 Requires-Dist: flask-mailman-templates~=0.1
-Requires-Dist: flask-mercure-sse~=0.2
-Requires-Dist: flask-sqlorm~=0.2
+Requires-Dist: flask-mercure-sse~=0.3
+Requires-Dist: flask-sqlorm~=0.3
 Requires-Dist: flask-super-macros~=0.1
-Requires-Dist: flask-talisman~=1.1
+Requires-Dist: flask-suspense~=0.1
 Requires-Dist: flask-wtf~=1.2
 Requires-Dist: frozen-flask~=1.0
 Requires-Dist: gunicorn~=23.0
 Requires-Dist: honcho~=2.0
 Requires-Dist: html-sanitizer~=2.6
 Requires-Dist: htmx-flask~=0.1
-Requires-Dist: jinja2-fragments~=1.9
-Requires-Dist: jinja-layout~=0.4
+Requires-Dist: jinja-layout~=0.5
 Requires-Dist: jinja-wtforms~=0.2
 Requires-Dist: periodiq~=0.13
 Requires-Dist: python-slugify~=8.0.4
@@ -108,7 +107,7 @@ A good part of these extensions is developed as part of the Hyperflask project.
 | [Flask-Mercure-SSE](https://github.com/hyperflask/flask-mercure-sse) | Push events via server-sent events using the [Mercure](https://mercure.rocks) protocol
 | [Flask-SQLORM](https://github.com/hyperflask/flask-sqlorm) | Flask integration of [sqlorm](https://github.com/hyperflask/sqlorm)
 | [Flask-Super-Macros](https://github.com/hyperflask/flask-super-macros) | Better macro management for Jinja
-| [Flask-Talisman](https://github.com/wntrblm/flask-talisman) | HTTP security headers for Flask
+| [Flask-Suspense](https://github.com/hyperflask/flask-suspense) | Suspense for Flask
 | [Flask-WTF](https://flask-wtf.readthedocs.io) | [WTForms](https://wtforms.readthedocs.io) integration
 
 ## Using without Hyperflask-Start
@@ -116,6 +115,5 @@ A good part of these extensions is developed as part of the Hyperflask project.
 1. Create your project directory: `mkdir example-project && cd example-project`
 2. Create and activate a virtualenv: `python -m venv .venv && source .venv/bin/activate`
 3. `pip install hyperflask`
-4. Create a pages directory: `mkdir pages`
-5. Create your index page: `echo "hello world" > pages/index.html`
-6. Start a development server using `hyperflask dev`
+4. Run `hyperflask init .`
+5. Start a development server using `hyperflask dev`

{hyperflask-0.2.4 → hyperflask-0.3.1}/README.md

@@ -70,7 +70,7 @@ A good part of these extensions is developed as part of the Hyperflask project.
 | [Flask-Mercure-SSE](https://github.com/hyperflask/flask-mercure-sse) | Push events via server-sent events using the [Mercure](https://mercure.rocks) protocol
 | [Flask-SQLORM](https://github.com/hyperflask/flask-sqlorm) | Flask integration of [sqlorm](https://github.com/hyperflask/sqlorm)
 | [Flask-Super-Macros](https://github.com/hyperflask/flask-super-macros) | Better macro management for Jinja
-| [Flask-Talisman](https://github.com/wntrblm/flask-talisman) | HTTP security headers for Flask
+| [Flask-Suspense](https://github.com/hyperflask/flask-suspense) | Suspense for Flask
 | [Flask-WTF](https://flask-wtf.readthedocs.io) | [WTForms](https://wtforms.readthedocs.io) integration
 
 ## Using without Hyperflask-Start
@@ -78,6 +78,5 @@ A good part of these extensions is developed as part of the Hyperflask project.
 1. Create your project directory: `mkdir example-project && cd example-project`
 2. Create and activate a virtualenv: `python -m venv .venv && source .venv/bin/activate`
 3. `pip install hyperflask`
-4. Create a pages directory: `mkdir pages`
-5. Create your index page: `echo "hello world" > pages/index.html`
-6. Start a development server using `hyperflask dev`
+4. Run `hyperflask init .`
+5. Start a development server using `hyperflask dev`

{hyperflask-0.2.4 → hyperflask-0.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "hyperflask"
-version = "0.2.4"
+version = "0.3.1"
 description = "Full stack web framework"
 authors = [
     {"name" = "Maxime Bouroumeau-Fuseau", email = "maxime.bouroumeau@gmail.com"}
@@ -10,21 +10,21 @@ license = "MIT"
 requires-python = ">=3.10"
 dependencies = [
     "flask>=3.0.0,<4.0.0",
-    "flask-assets-pipeline ~=0.6",
+    "flask-assets-pipeline ~=0.7",
     "flask-babel-hyper ~=5.1",
     "flask-collections ~=0.2",
     "flask-configurator ~=0.1",
     "flask-debugtoolbar ~=0.16",
     "flask-dramatiq ~=0.6",
-    "flask-file-routes ~=0.2",
+    "flask-file-routes ~=0.3",
     "flask-files ~=0.2",
     "flask-geo ~=0.1",
     "flask-mailman-templates ~=0.1",
-    "flask-mercure-sse ~=0.2",
+    "flask-mercure-sse ~=0.3",
     #"flask-observability ~=0.1"
-    "flask-sqlorm ~=0.2",
+    "flask-sqlorm ~=0.3",
     "flask-super-macros ~=0.1",
-    "flask-talisman ~=1.1",
+    "flask-suspense ~=0.1",
     "flask-wtf ~=1.2",
     "frozen-flask ~=1.0",
     #"dramatiq-sqlite ~=0.1"
@@ -32,12 +32,11 @@ dependencies = [
     "honcho ~=2.0",
     "html-sanitizer ~=2.6",
     "htmx-flask ~=0.1",
-    "jinja2-fragments ~=1.9",
-    "jinja-layout ~=0.4",
+    "jinja-layout ~=0.5",
     "jinja-wtforms ~=0.2",
     "periodiq ~=0.13",
     "python-slugify ~=8.0.4",
-    "redis ~=6.4"
+    "redis ~=6.4",
 ]
 
 [tool.uv.sources]

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/__init__.py

@@ -1,6 +1,7 @@
 from flask import *
 from .app import Hyperflask
 from .utils.htmx import htmx_redirect, htmx_oob
+from .security import csp_nonce
 
 # useful exports from hyperflask managed extensions
 from flask_babel import gettext, _, pgettext, _p, ngettext, _n, npgettext, _np, lazy_gettext, _lazy
@@ -8,9 +9,9 @@ from flask_file_routes import page
 from flask_files import save_file, validate_file
 from flask_mailman_templates import send_mail
 from flask_mercure_sse import publish_signal, mercure_publish
+from flask_suspense import render_template, stream_template, defer
 
 # useful exports from 3rd party libs
 from htmx_flask import request, make_response
-from jinja2_fragments.flask import render_block
 from slugify import slugify
 from blinker import signal

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/app.py

@@ -1,6 +1,6 @@
 # flask
 from flask import Flask
-from jinja2 import ChoiceLoader, FileSystemLoader, PrefixLoader
+from jinja2 import ChoiceLoader, FileSystemLoader, PrefixLoader, TemplateNotFound
 from werkzeug.middleware.proxy_fix import ProxyFix
 # hyperflask extensions
 from jinja_layout import LayoutExtension
@@ -8,7 +8,7 @@ from jinja_wtforms import WtformExtension
 from flask_assets_pipeline import AssetsPipeline
 from flask_super_macros import SuperMacros
 from flask_collections import Collections
-from flask_file_routes import FileRoutes
+from flask_file_routes import FileRoutes, ModuleView, page
 from flask_configurator import Config
 from flask_babel import Babel, _, _p, _n, _np, lazy_gettext
 from flask_geo import Geolocation
@@ -16,10 +16,10 @@ from flask_files import Files
 from flask_sqlorm import FlaskSQLORM
 from flask_mercure_sse import MercureSSE
 from flask_mailman_templates import MailTemplates
+from flask_suspense import Suspense, render_template, suspense_before_render_template, suspense_before_render_blocks
 #from flask_observability import Observability
 # 3rd party extensions
 from flask_wtf.csrf import CSRFProtect
-from flask_talisman import Talisman
 from flask_frozen import Freezer
 from htmx_flask import Htmx
 from flask_mailman import Mail
@@ -31,10 +31,9 @@ from .utils.page_actions import page_action_url
 from .utils.htmx import htmx_oob, respond_with_flash_messages
 from .utils.markdown import jinja_markdown, MarkdownExtension
 from .utils.html import sanitize_html, nl2br
-from .utils.models import File as SQLFileType
-from .components import discover_components, register_components
-from .components.jsx import ReactAdapter
-from .model import Model
+from .components import register_components
+from .model import Model, File as SQLFileType
+from .security import respond_with_security_headers, csp_nonce
 from . import page_helpers
 # others
 from jinja_super_macros.registry import FileLoader
@@ -54,7 +53,7 @@ map_jinja_call_node_to_func(lazy_gettext, "lazy_gettext")
 class Hyperflask(Flask):
     config_class = Config
 
-    def __init__(self, *args, static_mode="hybrid", instrument=False, layouts_folder="layouts", partials_folder="partials",
+    def __init__(self, *args, static_mode="hybrid", instrument=False, layouts_folder="layouts",
                  emails_folder="emails", forms_folder="forms", assets_folder="assets", pages_folder="pages", migrations_folder="migrations",
                  config=None, config_filename="config.yml", database_uri="sqlite://:memory:", proxy_fix=True, **kwargs):
 
@@ -73,14 +72,24 @@ class Hyperflask(Flask):
             "SESSION_COOKIE_SAMESITE": "Lax",
             # Hyperflask specific
             "LAYOUT": "layouts/default.html",
+            "ALPINE": False,
             "STATIC_MODE": static_mode,
-            "ASSETS_INCLUDE_HTMX": True,
-            "HTMX_EXT": ["hf-modal"],
+            "ASSETS_INCLUDE_ALPINE": False,
+            "HTMX_EXT": [],
             "HTMX_BOOST_SITE": False,
             "MARKDOWN_OPTIONS": {"extensions": ["fenced_code", "nl2br", "attr_list", "admonition", "codehilite"]},
             "MARKDOWN_SANITIZER_CONFIG": {},
             "FLASH_TOAST_OOB": True,
-            "FLASH_TOAST_REMOVE_AFTER": None
+            "FLASH_TOAST_REMOVE_AFTER": None,
+            "SERVER_SECURED": False,
+            "CSP_HEADER": True,
+            "CSP_SAFE_SRC": ["'self'"],
+            "CSP_UNSAFE_EVAL": True,
+            "CSP_UNSAFE_INLINE": True,
+            "CSP_FRAME_ANCESTORS": True,
+            "CSP_FRAME_ANCESTORS_SAFE_ENDPOINTS": [],
+            "REFERRER_POLICY": "strict-origin-when-cross-origin",
+            "HSTS_HEADER": False
         })
         if config:
             self.config.update(config)
@@ -93,13 +102,22 @@ class Hyperflask(Flask):
         self.config["COLLECTIONS_MARKDOWN_OPTIONS"] = self.config["MARKDOWN_OPTIONS"]
         self.config["MAIL_TEMPLATES_MARKDOWN_OPTIONS"] = self.config["MARKDOWN_OPTIONS"]
 
+        if self.config['SERVER_SECURED']:
+            self.config.update({
+                'FORCE_URL_SCHEME': 'https',
+                'PREFERRED_URL_SCHEME': 'https',
+                'SESSION_COOKIE_SECURE': True,
+                'REMEMBER_COOKIE_SECURE': True
+            })
+            self.config.setdefault("HSTS_HEADER", "max-age=31556926; includeSubDomains") # 1 year
+
         #self.otel = Observability(self)
 
         self.jinja_env.add_extension(LayoutExtension)
         self.jinja_env.add_extension(WtformExtension)
         self.jinja_env.add_extension(MarkdownExtension)
         self.jinja_env.filters.update(markdown=jinja_markdown, sanitize=sanitize_html, nl2br=nl2br)
-        self.jinja_env.globals.update(page_action_url=page_action_url, app=self)
+        self.jinja_env.globals.update(page_action_url=page_action_url, app=self, csp_nonce=csp_nonce)
         self.jinja_env.form_base_cls = Form
         self.jinja_env.default_layout = self.config["LAYOUT"]
         self.forms = self.jinja_env.forms
@@ -130,7 +148,7 @@ class Hyperflask(Flask):
         Geolocation(self)
         Files(self)
         MailTemplates(self, template_folder=emails_folder)
-        file_routes = FileRoutes(self, pages_folder=pages_folder, partials_folder=partials_folder)
+        file_routes = FileRoutes(self, pages_folder=pages_folder, module_view_class=HyperModuleView)
         self.page_helper = file_routes.page_helper
         self.collections = Collections(self)
         self.sse = MercureSSE(self)
@@ -153,11 +171,13 @@ class Hyperflask(Flask):
         })
         self.assets.bundle(
             {"@hyperflask": ["app.js"],
-             "@hyperflask/alpine": ["alpine.js"]},
+             "@hyperflask/alpine": ["alpine-csp.js" if not self.config["CSP_UNSAFE_EVAL"] else "alpine.js"]},
             from_package="hyperflask",
             assets_folder="static"
         )
         self.assets.include("@hyperflask", 0)
+        if self.config["ALPINE"]:
+            self.assets.include("@hyperflask/alpine", 0)
 
         self.extensions['mail_templates'].jinja_env.add_extension(LayoutExtension)
         self.extensions['mail_templates'].jinja_env.default_layout = "layout.mjml"
@@ -179,6 +199,7 @@ class Hyperflask(Flask):
             for macro in self.macros.create_from_directory(os.path.join(self.root_path, forms_folder)):
                 self.forms.register(self.macros.resolve_template(macro), macro)
 
+        self.after_request(respond_with_security_headers)
         if self.config["FLASH_TOAST_OOB"]:
             self.after_request(respond_with_flash_messages)
 
@@ -189,10 +210,39 @@ class Hyperflask(Flask):
         self.db.Model = Model
         self.db.File = SQLFileType
 
+        Suspense(self, nonce_getter="csp_nonce()")
+
+        @suspense_before_render_template.connect_via(self, weak=False)
+        def on_suspense_before_render_template(sender, **kwargs):
+            csp_nonce() # we will need a nonce but the first call will be after the template started rendering
+
+        @suspense_before_render_blocks.connect_via(self, weak=False)
+        def on_suspense_before_render_blocks(sender, **kwargs):
+            return f'<script nonce="{csp_nonce()}">htmx.bootstrap()</script>'
+
+        @self.errorhandler(404)
+        def not_found(error):
+            try:
+                return render_template("404.html"), 404
+            except TemplateNotFound:
+                return self.make_response(("404 Not Found", 404))
+
+        @self.errorhandler(500)
+        def internal_server_error(error):
+            try:
+                return render_template("500.html"), 500
+            except TemplateNotFound:
+                return self.make_response(("500 Internal Server Error", 500))
+
     def relative_import_name(self, name):
         return f"{self.import_name}.{name}" if self.import_name != "__main__" else name
 
 
+class HyperModuleView(ModuleView):
+    def _render_template(self):
+        return render_template(page.template)
+
+
 def static(func):
     pass
 

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/cli.py

@@ -7,6 +7,7 @@ import sys
 import multiprocessing
 import gunicorn.app.base
 from .factory import load_config, create_app
+from .security import generate_csp_policy
 
 
 def _create_app():
@@ -22,19 +23,26 @@ cli.add_command(shell_command)
 cli.add_command(routes_command)
 
 
-@click.command("freeze")
+@cli.command("init")
+def init_command():
+    pass
+
+
+@cli.command("freeze")
 def freeze_command():
     current_app.freezer.freeze()
 
-cli.add_command(freeze_command)
-
 
-@click.command("build")
+@cli.command("build")
 @click.pass_context
 def build_command(ctx):
     ctx.invoke(assets_cli.build)
+    ctx.invoke(freeze_command)
 
-cli.add_command(build_command)
+
+@cli.command("csp-header")
+def csp_header_command():
+    click.echo(generate_csp_policy())
 
 
 @click.command("serve")
@@ -69,8 +77,9 @@ cli.add_command(serve_command)
 @click.option("--host", "-h", default="127.0.0.1", help="The interface to bind to.")
 @click.option("--port", "-p", default=5000, help="The port to bind to.")
 @click.option('--concurrency')
+@click.option("--extend-procfile")
 @click.option("--dev", is_flag=True)
-def run_command(processes, host, port, concurrency, dev):
+def run_command(processes, host, port, concurrency, extend_procfile, dev):
     from honcho.command import _procfile, _parse_concurrency
     from honcho.manager import Manager
     from honcho.printer import Printer
@@ -85,14 +94,18 @@ def run_command(processes, host, port, concurrency, dev):
         if os.path.exists(filename):
             _processes = _procfile(filename).processes
             break
-    if _processes is None:
-        _processes = {
+    if _processes is None or extend_procfile:
+        if not _processes:
+            _processes = {}
+        _processes.update({
             "web": [sys.argv[0], "serve", "--host", host, "--port", "$PORT"],
             # "worker": [sys.argv[0], "worker"],
             # "scheduler": [sys.argv[0], "periodiq"]
-        }
+        })
         if dev:
             _processes["assets"] = [sys.argv[0], "assets", "dev"]
+        else:
+            _processes["mercurehub"] = [sys.executable, "-m", "flask_mercure_sse.server"]
 
     processes = {name: " ".join(_processes[name]) if isinstance(_processes[name], list) else _processes[name]
                  for name in _processes if name in _processes}

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/components/core.py

@@ -2,6 +2,7 @@ from markupsafe import Markup
 from flask import request, current_app
 from flask.views import http_method_funcs
 from flask_file_routes import page
+from flask_suspense import render_template
 from jinjapy import extract_frontmatter
 import importlib
 import re
@@ -55,19 +56,34 @@ class ComponentAdapter(BaseComponentAdapter):
                     return props
                 if not props:
                     props = {}
-            return self.render(None, **props)
+            ctx = self.get_render_context(None, **props)
+            return render_template(self.template, **ctx)
 
         if methods:
             app.add_url_rule(url, self.name, view_func=view_func, methods=methods)
 
-    def render(self, caller, *args, **kwargs):
-        tpl = current_app.jinja_env.get_template(self.template)
+    def get_render_context(self, caller, *args, **kwargs):
         ctx = kwargs.pop('_ctx', {})
-        ctx.update(dict(args=args, kwargs=kwargs, props=kwargs, caller=caller, children=caller))
+        ctx.update(dict(args=args, kwargs=kwargs, props=PropsWrapper(kwargs), caller=caller, children=caller))
         if self.module_name:
             module = importlib.import_module(self.module_name)
             if module and "render" in dir(module):
                 _ctx = module.render(*args, **kwargs)
                 if _ctx:
                     ctx.update(_ctx)
-        return Markup(tpl.render(**ctx))
+        return ctx
+
+    def render(self, caller, *args, **kwargs):
+        tpl = current_app.jinja_env.get_template(self.template)
+        ctx = self.get_render_context(caller, *args, **kwargs)
+        return Markup(tpl.render(**ctx)) # do not use render_template() so we don't trigger flask signals
+
+
+class PropsWrapper:
+    def __init__(self, props):
+        self._props = props
+
+    def __getattr__(self, name):
+        if name in self._props:
+            return self._props[name]
+        raise Exception(f"No such prop: {name}")

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/factory.py

@@ -1,10 +1,10 @@
-from .app import Hyperflask
 from flask_configurator import Config
 import importlib
 from importlib.metadata import entry_points
 import logging
 import os
-
+from .app import Hyperflask
+from .model import init_db_locked
 
 app = None
 db = None
@@ -68,8 +68,8 @@ def create_app(root_path=None):
     try_import(app, "signals")
     try_import(app, "app")
 
-    if models:
-        db.init_db()
+    if models and app.config.get("INIT_DATABASE", True):
+        init_db_locked(app)
 
     return app
 

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/forms/widgets.py

@@ -5,6 +5,7 @@ def create_widget_class(basecls, cssclass="input"):
     class Input(basecls):
         def __call__(self, field, **kwargs):
             extend_class(kwargs, cssclass)
+            kwargs = {k.replace('_', '-'): v for k, v in kwargs.items() if v is not None}
             return super().__call__(field, **kwargs)
     return Input
 

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/layouts/web.html

@@ -6,8 +6,13 @@
         <meta charset="utf-8">
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         {% endblock %}
-        {% block page_title %}<title>{% if page_title is defined %}{{ page_title }}{% if config.get("SITE_TITLE") %} | {% endif %}{% endif %}{% if config.get("SITE_TITLE") %}{{config["SITE_TITLE"]}}{% endif %}</title>{% endblock %}
-        {% asset_tags %}
+        {% block page_title %}
+          <title>{% if site_title is defined %}{{site_title}}{% else %}{% if page_title is defined %}{{ page_title }}{% if config.get("SITE_TITLE") %} | {% endif %}{% endif %}{% if config.get("SITE_TITLE") %}{{config["SITE_TITLE"]}}{% endif %}{% endif %}</title>
+        {% endblock %}
+        {% if metadata is defined %}
+          <{PageMetadata metadata=metadata}/>
+        {% endif %}
+        {% asset_tags nonce=csp_nonce %}
         {% block head_assets %}{% endblock %}
         {%- endblock %}
     </head>

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/model.py

@@ -1,8 +1,15 @@
-from flask_sqlorm import Model as BaseModel
 from flask import current_app
+from flask_sqlorm import Model as BaseModel
+from flask_files import save_file, File
 from sqlorm.resultset import CompositeResultSet
+from sqlorm import SQLType
 from markupsafe import Markup
 import abc
+import os
+import fcntl
+
+
+File = SQLType("text", save_file, File.from_uri)
 
 
 class ModelResultSet(CompositeResultSet):
@@ -44,3 +51,19 @@ class Model(BaseModel, abc.ABC):
 
         props = {prop: self} if prop else {}
         return Markup(current_app.macros[macro](**props))
+
+
+def init_db_locked(app):
+    # this is required because multiple app process will start at the same time using the runner
+    lockfile = os.path.join(app.root_path, ".initdblock")
+    if os.path.exists(lockfile):
+        return False
+    with open(lockfile, "w") as f:
+        fcntl.flock(f.fileno(), fcntl.LOCK_EX)
+        f.write("lock\n")
+        fcntl.flock(f.fileno(), fcntl.LOCK_UN)
+    try:
+        app.db.init_db()
+    finally:
+        os.remove(lockfile)
+    return True

hyperflask-0.3.1/src/hyperflask/security.py

@@ -0,0 +1,81 @@
+from flask import request, current_app, g
+from urllib.parse import urlparse, urljoin
+import secrets
+
+
+def is_safe_redirect_url(target):
+    host_url = urlparse(request.host_url)
+    redirect_url = urlparse(urljoin(request.host_url, target))
+    return (
+        redirect_url.scheme in ("http", "https")
+        and host_url.netloc == redirect_url.netloc
+    )
+
+
+def respond_with_security_headers(response):
+    if current_app.config["CSP_HEADER"] is not False:
+        response.headers['X-XSS-Protection'] = '1; mode=block'
+        response.headers['X-Content-Type-Options'] = 'nosniff'
+        response.headers['Content-Security-Policy'] = generate_csp_policy()
+
+    if current_app.config['HSTS_HEADER']:
+        response.headers['Strict-Transport-Security'] = current_app.config['HSTS_HEADER']
+
+    if current_app.config['REFERRER_POLICY']:
+        response.headers['Referrer-Policy'] = current_app.config['REFERRER_POLICY']
+
+    return response
+
+
+def generate_csp_policy():
+    policy = current_app.config["CSP_HEADER"]
+    if policy is True:
+        policy = {
+            "default-src": "'safe-src'",
+            "manifest-src": "'self'",
+            "connect-src": 'https: wss:' if current_app.config['SERVER_SECURED'] else 'http: ws:',
+            "img-src": "* data: blob:",
+            "media-src": "* data: blob:",
+            "frame-src": "* data: blob:",
+            "object-src": "* data: blob:"
+        }
+    policy.setdefault("script-src", policy["default-src"])
+    policy.setdefault("style-src", policy["default-src"])
+
+    if not current_app.config['CSP_FRAME_ANCESTORS']:
+        policy["frame-ancestors"] = "'none'"
+    elif isinstance(current_app.config['CSP_FRAME_ANCESTORS'], (list, tuple)):
+        frame_ancestors = list(current_app.config['CSP_FRAME_ANCESTORS'])
+        add_frame_ancestors = True
+        for endpoint in current_app.config['CSP_FRAME_ANCESTORS_SAFE_ENDPOINTS']:
+            ancestors = []
+            if isinstance(endpoint, (list, tuple)):
+                endpoint, ancestors = endpoint
+            if request.endpoint == endpoint:
+                if ancestors:
+                    frame_ancestors.extend(ancestors)
+                else:
+                    add_frame_ancestors = False
+                break
+        if add_frame_ancestors:
+            policy["frame-ancestors"] = ' '.join(set(frame_ancestors))
+
+    if current_app.config.get('CSP_UNSAFE_EVAL'):
+        policy["script-src"] += " 'unsafe-eval'"
+
+    unsafe_inline = current_app.debug or current_app.config.get('CSP_UNSAFE_INLINE')
+    if unsafe_inline:
+        policy["script-src"] += " 'unsafe-inline'"
+        policy["style-src"] += " 'unsafe-inline'"
+    elif 'csp_nonce' in g:
+        policy["style-src"] += f" 'nonce-{g.csp_nonce}'"
+        policy["script-src"] += f" 'nonce-{g.csp_nonce}'"
+
+    safe_srcs = " ".join(set(current_app.config['CSP_SAFE_SRC']))
+    return "; ".join(("%s %s" % (k, v.replace("'safe-src'", safe_srcs))).strip() for k, v in policy.items()) + ";"
+
+
+def csp_nonce():
+    if 'csp_nonce' not in g:
+        g.csp_nonce = secrets.token_urlsafe(16)[:16]
+    return g.csp_nonce

hyperflask-0.3.1/src/hyperflask/static/alpine-csp.js

@@ -0,0 +1,5 @@
+import Alpine from '@alpinejs/csp'
+
+window.Alpine = Alpine
+
+export default Alpine

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/static/alpine.js

@@ -2,4 +2,4 @@ import Alpine from 'alpinejs'
 
 window.Alpine = Alpine
 
-export default Alpine
+export default Alpine

{hyperflask-0.2.4 → hyperflask-0.3.1}/src/hyperflask/static/app.js

@@ -3,7 +3,7 @@ import "htmx-ext-sse";
 import "./htmx-exts";
 import "./app.css";
 
-const DEFAULT_HTMX_EXTS = ['hf-modal', 'hx-bottom-scroll-on-trigger', 'hx-active-url'];
+const DEFAULT_HTMX_EXTS = ['hf-modal', 'hx-bottom-scroll-on-trigger', 'hx-active-url', 'hx-stream'];
 document.body.setAttribute('hx-ext', [document.body.getAttribute('hx-ext'), ...DEFAULT_HTMX_EXTS].filter(Boolean).join(","))
 
 window.htmx = htmx;