pyweb-stack 0.1.0__py3-none-any.whl

pyweb/compiler/rpc.py

@@ -0,0 +1,35 @@
+"""Automatic RPC: @server/@worker/@edge functions → endpoints + stubs."""
+
+from __future__ import annotations
+
+import ast
+
+
+def is_rpc(node):
+    for d in node.decorator_list:
+        name = ast.unparse(d) if hasattr(ast, "unparse") else ""
+        if any(k in name for k in ("server", "worker", "edge", "task")):
+            return True
+    return False
+
+
+def rpc_specs(tree):
+    specs = []
+    for node in tree.body:
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)) and is_rpc(node):
+            args = []
+            for a in node.args.args:
+                ann = ast.unparse(a.annotation) if (hasattr(ast, "unparse") and a.annotation) else "Any"
+                args.append({"name": a.arg, "type": ann})
+            ret = ast.unparse(node.returns) if (hasattr(ast, "unparse") and node.returns) else "Any"
+            loc = "server"
+            for d in node.decorator_list:
+                name = ast.unparse(d) if hasattr(ast, "unparse") else ""
+                if "worker" in name:
+                    loc = "worker"
+                elif "edge" in name:
+                    loc = "edge"
+            specs.append({"name": node.name, "args": args, "returns": ret,
+                          "location": loc, "line": node.lineno,
+                          "async": isinstance(node, ast.AsyncFunctionDef)})
+    return specs

pyweb/context.py

@@ -0,0 +1,193 @@
+"""Per-request context for server code: ``request``, ``session``, ``redirect``.
+
+Server functions and page bodies run inside a request. They can read it
+and influence the response without threading a request object through
+every call::
+
+    from pyweb import request, session, redirect
+
+    @server
+    def login(email: str, password: str) -> bool:
+        user = find_user(email)
+        if user and verify_password(password, user["hash"]):
+            session.login(user["id"], roles=user["roles"])
+            return True
+        return False
+
+    @app.page("/admin")
+    def Admin():
+        if not session.user():
+            return redirect("/login")
+        ...
+
+The context is a :class:`contextvars.ContextVar`, so it is correct under
+threads (``pyweb serve``) and asyncio (ASGI) alike.
+"""
+
+from __future__ import annotations
+
+import contextvars
+import os
+import urllib.parse
+
+_current = contextvars.ContextVar("pyweb_request", default=None)
+
+
+def _derive_dev_secret():
+    # Development only: stable across worker processes of the same project so
+    # sessions survive reloads and multi-worker dev servers. Production must
+    # set PYWEB_AUTH_SECRET (enforced when PYWEB_ENV=production).
+    import getpass
+    import hashlib
+    import socket
+    seed = f"pyweb-dev|{socket.gethostname()}|{os.getcwd()}|{getpass.getuser()}"
+    return hashlib.sha256(seed.encode()).hexdigest()
+
+
+_dev_secret = _derive_dev_secret()
+
+
+class Redirect:
+    """Return ``redirect(url)`` from a page to answer with a redirect."""
+
+    def __init__(self, url, status=303):
+        self.url = url
+        self.status = status
+
+
+def redirect(url, status=303):
+    return Redirect(url, status)
+
+
+class NotFound(Exception):
+    """Raise from a page (or route param conversion) to answer 404."""
+
+
+class RequestContext:
+    def __init__(self, request, *, auth_secret=None, secure_cookies=False):
+        self.request = request
+        self.auth_secret = auth_secret
+        self.secure_cookies = secure_cookies
+        self.set_cookies = []      # raw Set-Cookie header values
+        self._session = None
+        self._session_loaded = False
+
+
+def current():
+    ctx = _current.get()
+    if ctx is None:
+        raise RuntimeError("no active request: request/session are only available while "
+                           "PyWeb is handling a page or RPC call")
+    return ctx
+
+
+def activate(ctx):
+    return _current.set(ctx)
+
+
+def deactivate(token):
+    _current.reset(token)
+
+
+class _RequestProxy:
+    """``pyweb.request``: the current HTTP request (read-only)."""
+
+    @property
+    def path(self):
+        return current().request.path.split("?")[0]
+
+    @property
+    def method(self):
+        return current().request.method
+
+    @property
+    def headers(self):
+        return dict(current().request.headers or {})
+
+    @property
+    def cookies(self):
+        return dict(current().request.cookies or {})
+
+    @property
+    def query(self):
+        q = current().request.path.partition("?")[2]
+        return {k: v[-1] for k, v in urllib.parse.parse_qs(q).items()}
+
+    @property
+    def id(self):
+        return current().request.id
+
+    def set_cookie(self, name, value, *, max_age=None, path="/", http_only=True,
+                   same_site="Lax", secure=None):
+        ctx = current()
+        secure = ctx.secure_cookies if secure is None else secure
+        parts = [f"{name}={value}", f"Path={path}", f"SameSite={same_site}"]
+        if max_age is not None:
+            parts.append(f"Max-Age={int(max_age)}")
+        if http_only:
+            parts.append("HttpOnly")
+        if secure:
+            parts.append("Secure")
+        ctx.set_cookies.append("; ".join(parts))
+
+    def __repr__(self):
+        try:
+            return f"<pyweb.request {self.method} {self.path}>"
+        except RuntimeError:
+            return "<pyweb.request (no active request)>"
+
+
+def _secret(ctx):
+    secret = ctx.auth_secret or os.environ.get("PYWEB_AUTH_SECRET")
+    if secret:
+        return secret
+    if os.environ.get("PYWEB_ENV", "development") == "production":
+        raise RuntimeError("PYWEB_AUTH_SECRET must be set in production to use sessions")
+    return _dev_secret
+
+
+class _SessionProxy:
+    """``pyweb.session``: signed-cookie login sessions."""
+
+    max_age = 7 * 24 * 3600
+
+    def user(self):
+        """The session payload (``{"sub": user_id, ...}``) or ``None``."""
+        ctx = current()
+        if not ctx._session_loaded:
+            from pyweb import auth
+            ctx._session = auth.session_from_request(ctx.request, _secret(ctx), self.max_age)
+            ctx._session_loaded = True
+        return ctx._session
+
+    def login(self, user_id, **claims):
+        from pyweb import auth
+        ctx = current()
+        payload = {"sub": user_id, **claims}
+        token = auth.issue_session(payload, _secret(ctx), self.max_age)
+        request.set_cookie(auth.SESSION_COOKIE, token, max_age=self.max_age)
+        ctx._session = auth.verify_session(token, _secret(ctx), self.max_age)
+        ctx._session_loaded = True
+        return ctx._session
+
+    def logout(self):
+        from pyweb import auth
+        ctx = current()
+        request.set_cookie(auth.SESSION_COOKIE, "", max_age=0)
+        ctx._session = None
+        ctx._session_loaded = True
+
+    def require(self, *roles):
+        """Return the session or raise ``RPCError(unauthenticated/forbidden)``."""
+        from pyweb.rpc import Code, RPCError
+        user = self.user()
+        if not user:
+            raise RPCError(Code.AUTH, "login required")
+        missing = [r for r in roles if r not in (user.get("roles") or [])]
+        if missing:
+            raise RPCError(Code.FORBIDDEN, f"missing role(s): {', '.join(missing)}")
+        return user
+
+
+request = _RequestProxy()
+session = _SessionProxy()

pyweb/css.py

@@ -0,0 +1,115 @@
+"""Styling pipeline: scoped modules, tokens, dict CSS, Tailwind passthrough.
+
+Four levels, no lock-in — plain ``.css`` files keep working untouched:
+
+1. ``css({...})`` — Python dict -> scoped class name + stylesheet text.
+2. :class:`Tokens` — design tokens -> ``:root`` CSS variables.
+3. :func:`module` — ``.module.css``-style scoping: rewrites selectors
+   with a content hash so component styles never leak.
+4. Tailwind — ``tw("...")`` marks utility strings as intentional so the
+   compiler preserves them verbatim and the build can run the Tailwind
+   CLI over emitted HTML when configured.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import re
+
+__all__ = ["css", "Tokens", "module", "tw", "extract_styles",
+           "is_tailwind", "TAILWIND_MARK"]
+
+
+def _hash(text: str, n=6) -> str:
+    return hashlib.sha256(text.encode()).hexdigest()[:n]
+
+
+def css(rules: dict, *, name="c") -> tuple:
+    """``css({"padding": 12, "border_radius": 8})`` -> ``(cls, stylesheet)``.
+
+    Underscores become hyphens; bare numbers become ``px`` (except for
+    unitless properties like ``z_index``, ``opacity``, ``flex``).
+    """
+    _UNIT_LESS = {"z-index", "opacity", "flex", "flex-grow", "flex-shrink",
+                  "order", "font-weight", "line-height", "zoom"}
+    decls = []
+    for prop, value in rules.items():
+        css_prop = prop.replace("_", "-")
+        if isinstance(value, (int, float)) and css_prop not in _UNIT_LESS:
+            value = f"{value}px"
+        decls.append(f"{css_prop}:{value}")
+    cls = f"{name}_{_hash(repr(sorted(rules.items())))}"
+    return cls, f".{cls}{{{';'.join(decls)}}}"
+
+
+class Tokens:
+    """Design tokens -> ``:root`` variables + typed Python access.
+
+    ``Tokens(primary="#635bff").var("primary")`` -> ``"var(--primary)"``.
+    """
+
+    def __init__(self, **tokens):
+        self._tokens = tokens
+
+    def __getattr__(self, name):
+        if name.startswith("_"):
+            raise AttributeError(name)
+        try:
+            return self._tokens[name]
+        except KeyError:
+            raise AttributeError(f"unknown token {name!r}") from None
+
+    def var(self, name):
+        if name not in self._tokens:
+            raise KeyError(f"unknown token {name!r}")
+        return f"var(--{name.replace('_', '-')})"
+
+    def stylesheet(self) -> str:
+        decls = ";".join(f"--{k.replace('_', '-')}:{v}"
+                         for k, v in self._tokens.items())
+        return f":root{{{decls}}}"
+
+
+def module(css_text: str, *, namespace="m") -> tuple:
+    """Scope a stylesheet: ``.btn`` -> ``.btn_<hash>``.
+
+    Returns ``(mapping, scoped_css)`` where mapping is
+    ``{"btn": "btn_<hash>"}`` for use as ``class_={m['btn']}``.
+    Element selectors (``h1``, ``article``) and at-rules pass through
+    untouched — only class selectors are namespaced.
+    """
+    digest = _hash(css_text)
+    classes = sorted(set(re.findall(r"\.([A-Za-z_][\w-]*)", css_text)))
+    mapping = {c: f"{c}_{namespace}_{digest}" for c in classes}
+
+    def _repl(match):
+        return "." + mapping[match.group(1)]
+
+    scoped = re.sub(r"\.([A-Za-z_][\w-]*)", _repl, css_text)
+    return mapping, scoped
+
+
+TAILWIND_MARK = "tw:"
+
+
+def tw(utilities: str) -> str:
+    """Mark a Tailwind utility string as intentional (``tw:` prefix)."""
+    return f"{TAILWIND_MARK}{utilities}"
+
+
+def is_tailwind(value: str) -> bool:
+    return isinstance(value, str) and value.startswith(TAILWIND_MARK)
+
+
+_STYLE_RE = re.compile(r"<style>(.*?)</style>", re.S)
+
+
+def extract_styles(html: str) -> tuple:
+    """Split ``<style>`` blocks out of SSR HTML -> ``(html, css)``.
+
+    The build writes extracted CSS to hashed ``.css`` files so pages
+    stream HTML without duplicated inline styles.
+    """
+    parts = _STYLE_RE.findall(html)
+    clean = _STYLE_RE.sub("", html)
+    return clean, "\n".join(parts)