pyweb-stack 0.1.0__py3-none-any.whl

pyweb/serve.py

@@ -0,0 +1,335 @@
+"""Production server: threaded stdlib HTTP over a built ``dist/``.
+
+``pyweb build`` copies the app source into ``dist/app.pyweb``; ``serve``
+loads it (:class:`pyweb.app_loader.LoadedApp`), so ``@server`` functions
+are live RPC endpoints and pages render per request with real data. It
+serves hashed static assets with immutable caching and answers
+``/healthz`` for orchestrators.
+
+For process managers and HTTP/2, prefer the ASGI adapter
+(:mod:`pyweb.asgi`) under uvicorn/gunicorn; this server is dependency-free
+and fine behind a reverse proxy for small and medium deployments.
+``--app mod:attr`` (legacy) mounts RPC implementations from a factory
+returning ``(compiled, rpc_impls)``.
+"""
+
+from __future__ import annotations
+
+import http.server
+import json
+import os
+import socketserver
+import threading
+import time
+
+def _version():
+    try:
+        from pyweb import __version__ as _v
+        return _v
+    except ImportError:  # pragma: no cover - serve imported standalone
+        return "0.0.0+unknown"
+
+
+VERSION = _version()
+
+
+class ThreadedServer(socketserver.ThreadingMixIn, socketserver.TCPServer):
+    daemon_threads = True
+    allow_reuse_address = True
+
+
+def load_dist(dist):
+    manifest_path = os.path.join(dist, "manifest.json")
+    with open(manifest_path) as fh:
+        manifest = json.load(fh)
+    static_dir = os.path.join(dist, "static")
+    server_dir = os.path.join(dist, "server")
+    return manifest, static_dir, server_dir
+
+
+def parse_cookies(header_value):
+    """Parse a ``Cookie`` header into a dict. Malformed pairs are skipped
+    (never raise on attacker-controlled input)."""
+    cookies = {}
+    for pair in (header_value or "").split(";"):
+        name, sep, value = pair.partition("=")
+        name = name.strip()
+        if sep and name:
+            cookies[name] = value.strip().strip('"')
+    return cookies
+
+
+#: Default cap for request bodies (1 MiB). Override per-call with
+#: ``serve(..., max_body=...)`` or ``make_handler(..., max_body=...)``.
+MAX_BODY = 1_048_576
+
+#: Security headers applied to every response. The app's own values win
+#: on conflict (merged with ``setdefault`` semantics per header).
+#: Content-Security-Policy for HTML responses (override with PYWEB_CSP).
+#: Scripts only from this origin; the page-state JSON block is data, not code.
+DEFAULT_CSP = ("default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; "
+               "frame-ancestors 'self'; img-src 'self' data: https:; "
+               "style-src 'self' 'unsafe-inline' https:; font-src 'self' data: https:; "
+               "connect-src 'self'")
+
+SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "same-origin",
+    "X-Frame-Options": "SAMEORIGIN",
+}
+
+
+def make_handler(*, static_dir, server_runtime=None, logger=None,
+                 started_at=None, max_body=MAX_BODY):
+    started = started_at or time.time()
+
+    class H(http.server.BaseHTTPRequestHandler):
+        server_version = f"PyWeb/{VERSION}"
+
+        def _bytes(self, body, status=200, ctype="text/plain", extra=None):
+            raw = body.encode() if isinstance(body, str) else body
+            self.send_response(status)
+            self.send_header("Content-Type", ctype)
+            self.send_header("Content-Length", str(len(raw)))
+            merged = dict(SECURITY_HEADERS)
+            if ctype.startswith("text/html"):
+                merged["Content-Security-Policy"] = os.environ.get("PYWEB_CSP", DEFAULT_CSP)
+            merged.update(extra or {})
+            for k, v in merged.items():
+                for item in (v if isinstance(v, list) else [v]):
+                    self.send_header(k, item)
+            self.end_headers()
+            if self.command != "HEAD":
+                self.wfile.write(raw)
+
+        def _static(self, rel):
+            # Contain path traversal: rel must resolve inside static_dir.
+            base = os.path.realpath(static_dir)
+            target = os.path.realpath(os.path.join(base, rel))
+            if target != base and not target.startswith(base + os.sep):
+                return self._bytes("forbidden", 403)
+            if not os.path.isfile(target):
+                return self._bytes("not found", 404)
+            ctype = "text/javascript" if target.endswith(".js") else (
+                "text/css" if target.endswith(".css") else
+                "application/json" if target.endswith(".map") else
+                "application/octet-stream")
+            extra = {}
+            if "?" in self.path or target.endswith((".js", ".css", ".map")):
+                # Production assets are content-hashed; dev ``?v=`` query
+                # strings version the rest. Both are safe to cache forever.
+                extra["Cache-Control"] = "public, max-age=31536000, immutable"
+            with open(target, "rb") as fh:
+                return self._bytes(fh.read(), 200, ctype, extra)
+
+        def do_GET(self):  # noqa: N802
+            path = self.path.split("?")[0]
+            if path in ("/healthz", "/health", "/readyz"):
+                uptime = round(time.time() - started, 3)
+                return self._bytes(
+                    json.dumps({"ok": True, "version": VERSION,
+                                "uptime_s": uptime}),
+                    200, "application/json")
+            if path.startswith("/static/"):
+                return self._static(path[len("/static/"):].split("?")[0])
+            if server_runtime is not None:
+                from pyweb.runtime.server import Request
+                resp = server_runtime.handle(Request(
+                    "GET", self.path, dict(self.headers),
+                    cookies=parse_cookies(self.headers.get("Cookie"))))
+                return self._bytes(resp.body, resp.status,
+                                   resp.headers.get("Content-Type", "text/html"),
+                                   {k: v for k, v in resp.headers.items()
+                                    if k != "Content-Type"})
+            # Static fallback: pre-rendered page shell if present.
+            return self._bytes("not found", 404)
+
+        def _drain(self, n, limit=16_777_216):
+            """Discard up to ``n`` request-body bytes in bounded chunks.
+
+            HTTP/1.1 keep-alive requires the server to consume the declared
+            body before responding on the same connection; answering 413
+            while bytes are still in flight RSTs the socket and the client
+            sees a broken pipe instead of the rejection. Discarding (not
+            buffering) keeps memory flat. Beyond ``limit`` (16 MiB) the
+            client is told to go away with the connection closed.
+            """
+            left = min(n, limit)
+            while left > 0:
+                chunk = self.rfile.read(min(65536, left))
+                if not chunk:
+                    break
+                left -= len(chunk)
+            return n <= limit
+
+        def _read_body(self):
+            """Read the request body, enforcing ``max_body``. Returns bytes,
+            or sends 413 and returns None."""
+            try:
+                n = int(self.headers.get("Content-Length", 0))
+            except (TypeError, ValueError):
+                n = 0
+            if n < 0:
+                n = 0
+            if n > max_body:
+                clean = self._drain(n)
+                extra = {} if clean else {"Connection": "close"}
+                self._bytes(json.dumps(
+                    {"ok": False, "error": "body-too-large",
+                     "message": f"request body exceeds {max_body} bytes"}),
+                    413, "application/json", extra)
+                if not clean:
+                    try:
+                        self.close_connection = True
+                    except AttributeError:
+                        pass
+                return None
+            return self.rfile.read(n) if n else b""
+
+        def do_HEAD(self):  # noqa: N802
+            # Same routing as GET; _bytes suppresses the body but keeps
+            # Content-Length so link checkers/crawlers get real metadata.
+            self.do_GET()
+
+        def do_POST(self):  # noqa: N802
+            body = self._read_body()
+            if body is None:
+                return
+            if server_runtime is None:
+                return self._bytes(json.dumps(
+                    {"ok": False, "error": "rpc-unavailable",
+                     "message": "this dist has no app.pyweb; rebuild with `pyweb build`"}),
+                    501, "application/json")
+            from pyweb.runtime.server import Request
+            resp = server_runtime.handle(Request(
+                "POST", self.path.split("?")[0], dict(self.headers), body,
+                cookies=parse_cookies(self.headers.get("Cookie"))))
+            return self._bytes(resp.body, resp.status,
+                               resp.headers.get("Content-Type", "application/json"),
+                               {k: v for k, v in resp.headers.items()
+                                if k not in ("Content-Type", "Content-Length")})
+
+        def log_message(self, fmt, *args):  # noqa: N802
+            if logger is not None:
+                logger.info("http %s %s" % (self.command, self.path))
+
+    return H
+
+
+def load_factory(app_factory):
+    """Import ``module:attr`` and return the factory. Raises RuntimeError
+    with an actionable message instead of a bare traceback."""
+    mod_name, sep, attr = (app_factory or "").partition(":")
+    if not sep or not mod_name or not attr:
+        raise RuntimeError(
+            f"bad --app {app_factory!r}: expected module:attr, "
+            "e.g. --app myapp:factory where factory(manifest) returns "
+            "(compiled, rpc_impls)")
+    import importlib
+    try:
+        mod = importlib.import_module(mod_name)
+    except ImportError as exc:
+        raise RuntimeError(
+            f"bad --app {app_factory!r}: cannot import {mod_name!r} "
+            f"({exc}); is it on PYTHONPATH?") from exc
+    factory = getattr(mod, attr, None)
+    if not callable(factory):
+        raise RuntimeError(
+            f"bad --app {app_factory!r}: {mod_name}.{attr} is not callable; "
+            "it must be factory(manifest) -> (compiled, rpc_impls)")
+    return factory
+
+
+def serve(dist, *, host="0.0.0.0", port=8000, app_factory=None, logger=None,
+          rate_limit=None, rpc_timeout=30.0, auth_secret=None,
+          csrf_secret=None, max_body=1_048_576):
+    """Serve ``dist/`` forever. Returns the server (for tests, use
+    ``serve_in_thread``).
+
+    RPC protection is on by default: 120 calls/min/IP unless
+    ``rate_limit=`` overrides (``False`` disables — tests only).
+    ``auth_secret``/``csrf_secret`` default to ``PYWEB_AUTH_SECRET`` /
+    ``PYWEB_CSRF_SECRET`` env vars; without a secret, auth decorators
+    stay advisory (sessions cannot verify). ``max_body`` caps request
+    bodies (413 beyond it).
+    """
+    from pyweb import rpc as _rpc
+    from pyweb.runtime.server import Server
+    manifest, static_dir, _ = load_dist(dist)
+    if rate_limit is False:
+        rate_limit = None
+    elif rate_limit is None:
+        rate_limit = _rpc.RateLimiter(max_calls=120, window=60.0)
+    if auth_secret is None:
+        auth_secret = os.environ.get("PYWEB_AUTH_SECRET")
+    if csrf_secret is None:
+        csrf_secret = os.environ.get("PYWEB_CSRF_SECRET")
+    if logger is not None and auth_secret:
+        from pyweb import auth as _auth
+        warning = _auth.warn_if_insecure_cookies(
+            os.environ.get("PYWEB_COOKIE_SECURE", "").lower() in ("1", "true"),
+            host=host)
+        if warning is not None:
+            logger.info(f"security warning: {warning}")
+    runtime = None
+    app_source = os.path.join(dist, manifest.get("app") or "app.pyweb")
+    if not app_factory and os.path.isfile(app_source):
+        from pyweb.app_loader import LoadedApp
+        asset_urls = {name: f"/static/{p['js']}" for name, p in manifest.get("pages", {}).items()
+                      if p.get("js")}
+        app = LoadedApp(app_source, asset_urls=asset_urls)
+        secure = os.environ.get("PYWEB_COOKIE_SECURE", "").lower() in ("1", "true")
+        runtime = Server(app=app, rate_limit=rate_limit, rpc_timeout=rpc_timeout,
+                         auth_secret=auth_secret, csrf_secret=csrf_secret,
+                         max_body=max_body, logger=logger, secure_cookies=secure)
+    elif app_factory:
+        factory = load_factory(app_factory)
+        compiled, impls = factory(manifest) if callable(factory) else (None, {})
+        runtime = Server(compiled or {"pages": {}, "rpc": []},
+                         rate_limit=rate_limit, rpc_timeout=rpc_timeout,
+                         auth_secret=auth_secret, csrf_secret=csrf_secret,
+                         max_body=max_body)
+        for fn in (impls or {}).values():
+            runtime.register_rpc(fn)
+    handler = make_handler(static_dir=static_dir, server_runtime=runtime,
+                           logger=logger, max_body=max_body)
+    httpd = ThreadedServer((host, port), handler)
+    if logger is not None:
+        logger.info(f"serving {dist}", host=host, port=httpd.server_address[1])
+    return httpd
+
+
+def install_shutdown_handlers(httpd, *, logger=None, timeout=25.0):
+    """Handle SIGTERM/SIGINT by draining in-flight requests, then exiting.
+
+    Container orchestrators (k8s, Docker, Fly) send SIGTERM before SIGKILL;
+    without this, in-flight RPCs die mid-write. Returns the previous
+    handlers so tests can restore them. Main-thread only — silently skips
+    elsewhere (threads cannot receive process signals).
+    """
+    import signal
+    prev = {}
+
+    def _drain(signum, _frame):
+        name = "SIGTERM" if signum == signal.SIGTERM else "SIGINT"
+        if logger is not None:
+            logger.info(f"received {name}: draining in-flight requests")
+        t = threading.Thread(target=httpd.shutdown, daemon=True,
+                             name="pyweb-shutdown")
+        t.start()
+        t.join(timeout)
+
+    try:
+        for sig in (signal.SIGTERM, signal.SIGINT):
+            prev[sig] = signal.getsignal(sig)
+            signal.signal(sig, _drain)
+    except ValueError:
+        pass  # not the main thread: process signals unavailable
+    return prev
+
+
+def serve_in_thread(dist, **kwargs):
+    httpd = serve(dist, host="127.0.0.1", port=0, **kwargs)
+    thread = threading.Thread(target=httpd.serve_forever, daemon=True)
+    thread.start()
+    return httpd, thread

pyweb/ssr.py

@@ -0,0 +1,260 @@
+"""Server-side rendering: UI tree + Python values → HTML.
+
+The same UI tree the compiler turns into browser JS is rendered here with
+real Python semantics, so the first paint is complete, crawlable HTML.
+Rendering rules match the browser runtime:
+
+* ``{expr}`` renders ``str(value)``; ``None`` renders nothing.
+* text and attribute values are HTML-escaped; ``javascript:`` URLs in
+  ``href``/``src``/``action`` are neutralised.
+* ``attr={True}`` renders a bare attribute, ``False``/``None`` omit it.
+* ``class={{"done": flag}}`` and ``style={{"color": c}}`` accept dicts.
+* ``on*`` handlers are dropped; ``bind={x}`` renders ``x`` as the value.
+"""
+
+from __future__ import annotations
+
+import ast
+import builtins
+import html as _html
+import json
+import re
+
+from .compiler.ast import ControlFor, ControlIf, Element, ExprNode, TextNode
+
+VOID = {"input", "img", "br", "hr", "meta", "link", "source", "wbr",
+        "col", "base", "area", "embed", "track", "param"}
+URL_ATTRS = {"href", "src", "action", "formaction", "xlink:href"}
+BOOL_PROPS = {"checked", "selected", "disabled", "readonly", "required", "multiple", "hidden"}
+_BAD_URL = re.compile(r"^\s*(javascript|vbscript|data:text/html)", re.I)
+
+
+class Markup(str):
+    """Pre-rendered HTML (component children). Not escaped again."""
+
+
+class RenderError(Exception):
+    def __init__(self, msg, lineno=None):
+        super().__init__(f"line {lineno}: {msg}" if lineno else msg)
+        self.lineno = lineno
+
+
+def safe_url(v):
+    s = str(v)
+    return "#" if _BAD_URL.match(re.sub(r"[\x00-\x1f]", "", s)) else s
+
+
+def text_of(v):
+    if v is None:
+        return ""
+    if isinstance(v, Markup):
+        return v
+    return _html.escape(str(v), quote=False)
+
+
+def clsx(v):
+    if v is None or v is False:
+        return ""
+    if isinstance(v, dict):
+        return " ".join(k for k, on in v.items() if on)
+    if isinstance(v, (list, tuple)):
+        return " ".join(c for c in (clsx(x) for x in v) if c)
+    return str(v)
+
+
+def _kebab(k):
+    return re.sub(r"[A-Z]", lambda m: "-" + m.group(0).lower(), k).replace("_", "-")
+
+
+def style_of(v):
+    if isinstance(v, dict):
+        return "; ".join(f"{_kebab(k)}: {val}" for k, val in v.items() if val is not None and val is not False)
+    return str(v)
+
+
+def to_jsonable(v):
+    """Convert server values to JSON for the page state payload."""
+    import dataclasses
+    import datetime
+    import decimal
+    if v is None or isinstance(v, (bool, int, float, str)):
+        return v
+    if isinstance(v, (list, tuple, set, frozenset)):
+        return [to_jsonable(x) for x in v]
+    if isinstance(v, dict):
+        return {str(k): to_jsonable(x) for k, x in v.items()}
+    if dataclasses.is_dataclass(v) and not isinstance(v, type):
+        return to_jsonable(dataclasses.asdict(v))
+    if isinstance(v, (datetime.datetime, datetime.date, datetime.time)):
+        return v.isoformat()
+    if isinstance(v, decimal.Decimal):
+        return float(v)
+    for attr in ("to_dict", "dict", "model_dump"):
+        fn = getattr(v, attr, None)
+        if callable(fn):
+            return to_jsonable(fn())
+    if hasattr(v, "__dict__"):
+        return {k: to_jsonable(x) for k, x in vars(v).items() if not k.startswith("_")}
+    raise TypeError(f"value of type {type(v).__name__} cannot be sent to the browser")
+
+
+def state_json(state):
+    """JSON for ``<script id="pw-state">`` — safe inside HTML."""
+    raw = json.dumps(to_jsonable(state), separators=(",", ":"))
+    return raw.replace("<", "\\u003c").replace(">", "\\u003e").replace("&", "\\u0026")
+
+
+class Renderer:
+    """Render UI nodes.
+
+    ``component_state(name, props) -> (ui_nodes, env)`` is supplied by the
+    caller: the compiler uses static evaluation, the server calls the real
+    component function.
+    """
+
+    def __init__(self, globals_=None, component_state=None, strict=True):
+        self.globals = dict(globals_ or {})
+        self.globals.setdefault("__builtins__", builtins)
+        self.component_state = component_state
+        self.strict = strict
+
+    def eval(self, code, env, lineno=None):
+        scope = dict(self.globals)
+        scope.update(env)
+        try:
+            return eval(compile(code, "<pyweb-ssr>", "eval"), scope)  # noqa: S307 - app's own code
+        except Exception as exc:  # noqa: BLE001
+            if self.strict:
+                raise RenderError(f"{{{code}}} raised {type(exc).__name__}: {exc}", lineno) from exc
+            return None
+
+    def render(self, nodes, env):
+        return "".join(self.node(n, env) for n in nodes)
+
+    def node(self, n, env):
+        if isinstance(n, TextNode):
+            return _html.escape(n.text, quote=False)
+        if isinstance(n, ExprNode):
+            return text_of(self.eval(n.code, env, n.line))
+        if isinstance(n, ControlFor):
+            items = self.eval(n.iterable, env, n.line)
+            if items is None:
+                return ""
+            target = ast.parse(n.target, mode="eval").body
+            out = []
+            for item in items:
+                scope = dict(env)
+                _bind(target, item, scope)
+                out.append(self.render(n.body, scope))
+            return "".join(out)
+        if isinstance(n, ControlIf):
+            if self.eval(n.test, env, n.line):
+                return self.render(n.body, env)
+            return self.render(n.orelse, env)
+        if isinstance(n, Element):
+            if n.is_component:
+                return self.component(n, env)
+            return self.element(n, env)
+        return ""
+
+    def attrs_html(self, n, env):
+        parts = []
+        for key, val in n.attrs.items():
+            if key.startswith("on"):
+                continue
+            if key == "bind":
+                if not isinstance(val, tuple):
+                    continue
+                v = self.eval(val[1], env, val[2])
+                typ = n.attrs.get("type")
+                typ = typ[1] if isinstance(typ, tuple) else None
+                if typ == "checkbox":
+                    if v:
+                        parts.append(" checked")
+                elif typ == "radio":
+                    own = n.attrs.get("value")
+                    if isinstance(own, tuple) and str(v) == own[1]:
+                        parts.append(" checked")
+                elif n.tag.lower() not in ("select", "textarea"):
+                    parts.append(f' value="{_html.escape("" if v is None else str(v))}"')
+                continue
+            name = "class" if key in ("class_", "className") else key
+            if val is True:
+                parts.append(f" {name}")
+                continue
+            kind, body, line = val
+            v = body if kind == "lit" else self.eval(body, env, line)
+            if name == "class":
+                v = clsx(v)
+                if not v:
+                    continue
+            elif name == "style" and isinstance(v, dict):
+                v = style_of(v)
+            if v is None or v is False:
+                continue
+            if v is True:
+                parts.append(f" {name}")
+                continue
+            if name in URL_ATTRS:
+                v = safe_url(v)
+            parts.append(f' {name}="{_html.escape(str(v))}"')
+        return "".join(parts)
+
+    def element(self, n, env):
+        tag = n.tag
+        attrs = self.attrs_html(n, env)
+        if tag.lower() in VOID:
+            return f"<{tag}{attrs}>"
+        inner = self.render(n.children, env)
+        if tag.lower() == "textarea" and "bind" in n.attrs and isinstance(n.attrs["bind"], tuple):
+            v = self.eval(n.attrs["bind"][1], env, n.line)
+            inner = _html.escape("" if v is None else str(v), quote=False)
+        if tag.lower() == "select" and "bind" in n.attrs and isinstance(n.attrs["bind"], tuple):
+            v = self.eval(n.attrs["bind"][1], env, n.line)
+            inner = re.sub(r'<option value="([^"]*)"',
+                           lambda m: m.group(0) + (" selected" if _html.unescape(m.group(1)) == str(v) else ""),
+                           inner)
+        return f"<{tag}{attrs}>{inner}</{tag}>"
+
+    def component(self, n, env):
+        if self.component_state is None:
+            raise RenderError(f"unknown component <{n.tag}>", n.line)
+        props = {}
+        for key, val in n.attrs.items():
+            if val is True:
+                props[key] = True
+            elif val[0] == "lit":
+                props[key] = val[1]
+            else:
+                props[key] = self.eval(val[1], env, val[2])
+        if n.children:
+            props["children"] = Markup(self.render(n.children, env))
+        ui, cenv = self.component_state(n.tag, props)
+        return self.render(ui, cenv)
+
+
+def _bind(target, value, scope):
+    if isinstance(target, ast.Name):
+        scope[target.id] = value
+        return
+    if isinstance(target, (ast.Tuple, ast.List)):
+        vals = list(value)
+        if len(vals) != len(target.elts):
+            raise RenderError(f"cannot unpack {len(vals)} values into {len(target.elts)} names")
+        for t, v in zip(target.elts, vals):
+            _bind(t, v, scope)
+        return
+    raise RenderError("unsupported loop target")
+
+
+def page_html(*, name, title, body, state, js_url=None, css_urls=(), head_extra="", lang="en"):
+    """The full HTML document for one page."""
+    css = "".join(f'<link rel="stylesheet" href="{_html.escape(u)}">' for u in css_urls)
+    script = ""
+    if js_url:
+        script = (f'<script id="pw-state" type="application/json">{state_json(state)}</script>'
+                  f'<script type="module" src="{_html.escape(js_url)}"></script>')
+    return (f"<!doctype html>\n<html lang=\"{_html.escape(lang)}\"><head><meta charset=\"utf-8\">"
+            "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">"
+            f"<title>{_html.escape(title)}</title>{css}{head_extra}</head>"
+            f"<body><div data-pw-root=\"{_html.escape(name)}\">{body}</div>{script}</body></html>\n")