pyweb-stack 0.4.2__tar.gz → 0.4.4__tar.gz

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: pyweb-stack
-Version: 0.4.2
+Version: 0.4.4
 Summary: Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC.
 Author-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
 Maintainer-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
 License: MIT
 Project-URL: Homepage, https://maanavkrishna.github.io/PyWeb/
-Project-URL: Documentation, https://maanavkrishna.github.io/PyWeb/guide.html
+Project-URL: Documentation, https://maanavkrishna.github.io/PyWeb/introduction.html
 Project-URL: Source, https://github.com/MaanavKrishna/PyWeb
 Project-URL: Changelog, https://github.com/MaanavKrishna/PyWeb/blob/main/CHANGELOG.md
 Project-URL: Issues, https://github.com/MaanavKrishna/PyWeb/issues
@@ -72,6 +72,10 @@ your server, live data and streaming AI, with no JavaScript toolchain.
 **[Examples](#examples)** ·
 **[Changelog](CHANGELOG.md)**
 
+<br>
+
+<img src="https://raw.githubusercontent.com/MaanavKrishna/PyWeb/main/docs/images/demo.gif" alt="A guestbook app written in one .pyweb file: the submit handler runs in the browser and sign() runs on the server" width="860">
+
 </div>
 
 ```pyweb
@@ -380,7 +384,7 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
-| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands |
+| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching; 0.4.4: key rotation, session revocation, typed arguments, Redis-shared limits, `check --production` |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/README.md

@@ -18,6 +18,10 @@ your server, live data and streaming AI, with no JavaScript toolchain.
 **[Examples](#examples)** ·
 **[Changelog](CHANGELOG.md)**
 
+<br>
+
+<img src="https://raw.githubusercontent.com/MaanavKrishna/PyWeb/main/docs/images/demo.gif" alt="A guestbook app written in one .pyweb file: the submit handler runs in the browser and sign() runs on the server" width="860">
+
 </div>
 
 ```pyweb
@@ -326,7 +330,7 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
-| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands |
+| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching; 0.4.4: key rotation, session revocation, typed arguments, Redis-shared limits, `check --production` |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweb-stack"
-version = "0.4.2"
+version = "0.4.4"
 description = "Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC."
 readme = "README.md"
 license = { text = "MIT" }
@@ -45,7 +45,7 @@ test = ["pytest>=8", "playwright>=1.45", "mcp>=1.2"]
 
 [project.urls]
 Homepage = "https://maanavkrishna.github.io/PyWeb/"
-Documentation = "https://maanavkrishna.github.io/PyWeb/guide.html"
+Documentation = "https://maanavkrishna.github.io/PyWeb/introduction.html"
 Source = "https://github.com/MaanavKrishna/PyWeb"
 Changelog = "https://github.com/MaanavKrishna/PyWeb/blob/main/CHANGELOG.md"
 Issues = "https://github.com/MaanavKrishna/PyWeb/issues"

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyweb/ai/guide.md

@@ -55,7 +55,7 @@ Static files go in `static/` next to `app.pyweb`, served at `/static/...`.
 | Code | Runs |
 |---|---|
 | imports, classes, DB connections, module objects | server only |
-| `NAME = <literal>` at module level | both (inlined into browser JS) |
+| `NAME = <literal>` at module level | both (inlined into browser JS); server only if any code changes it (`.append`, `[k] =`, `global`) |
 | `@server` functions | server; browser calls become RPC |
 | undecorated module functions | server; compiled to JS only if browser code calls them |
 | page function body (top to the markup) | server, every request |
@@ -166,7 +166,12 @@ def Item(item_id: int):
 ```
 
 - `session.login(user_id, **claims)`, `session.user()`, `session.logout()`,
-  `session.require("admin")`.
+  `session.require("admin")`. `pyweb.auth.revoke_user(user_id)` signs a user
+  out on every device (e.g. after a password change).
+- Give every `@server` parameter a type hint (`str`, `int`, `list[int]`,
+  a dataclass or Model, `Literal[...]`): arguments are checked against
+  them, and wrong types or unknown arguments get a 422 before your code
+  runs. Still check permissions and business rules yourself.
 - `pyweb.auth.hash_password` / `verify_password` for passwords.
 - Database: `from pyweb.db import connect; db = connect("sqlite:///app.db")`;
   `db.execute("select ... where id = ?", (x,)).dicts()`; always use `?`

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyweb/asgi.py

@@ -52,6 +52,8 @@ def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_
                 if msg["type"] == "lifespan.startup":
                     await send({"type": "lifespan.startup.complete"})
                 elif msg["type"] == "lifespan.shutdown":
+                    from .hosting import shutdown
+                    await asyncio.to_thread(shutdown)
                     await send({"type": "lifespan.shutdown.complete"})
                     return
         if scope["type"] != "http":
@@ -71,8 +73,10 @@ def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_
                 break
         headers = {}
         for k, v in scope.get("headers", []):
-            name = k.decode("latin-1").title()
-            headers[name] = v.decode("latin-1")
+            name, value = k.decode("latin-1").title(), v.decode("latin-1")
+            if name in headers:  # repeated (HTTP/2 sends cookies as several headers)
+                value = headers[name] + ("; " if name == "Cookie" else ", ") + value
+            headers[name] = value
         path = scope.get("path", "/")
         if scope.get("query_string"):
             path += "?" + scope["query_string"].decode("latin-1")
@@ -81,7 +85,8 @@ def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_
                 b'{"error": {"code": "http_413", "message": "request body too large"}}'
         else:
             status, hdrs, body = await asyncio.to_thread(
-                site.respond, scope.get("method", "GET"), path, headers, b"".join(chunks))
+                site.respond, scope.get("method", "GET"), path, headers, b"".join(chunks),
+                (scope.get("client") or [None])[0])
         raw_headers = [(k.lower().encode("latin-1"), v.encode("latin-1")) for k, v in hdrs]
         if hasattr(body, "aiter"):  # Server-Sent Events, streamed RPC results
             await send({"type": "http.response.start", "status": status, "headers": raw_headers})

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyweb/auth.py

@@ -205,7 +205,20 @@ def require_session(req, secret: str, max_age: int = 3600):
     session = session_from_request(req, secret, max_age)
     if session is not None and "sub" in session:
         return session, None
-    return None, Response(302, "", {"Location": f"{LOGIN_URL}?next={req.path}"})
+    nxt = urllib.parse.quote(safe_next(req.path), safe="/")
+    return None, Response(302, "", {"Location": f"{LOGIN_URL}?next={nxt}"})
+
+
+def safe_next(url, default="/"):
+    """``url`` if it's a path on this site, else ``default``.
+
+    Use it on a ``?next=`` value before redirecting there after login, so a
+    link like ``/login?next=//evil.example`` can't send people elsewhere.
+    """
+    url = str(url or "")
+    if not url.startswith("/") or url.startswith(("//", "/\\")) or any(c in url for c in "\r\n\t"):
+        return default
+    return url
 
 
 def login_response(user_id, secret: str, *, extra=None, next_url="/",
@@ -222,7 +235,7 @@ def login_response(user_id, secret: str, *, extra=None, next_url="/",
     flags = (f"HttpOnly; Path=/; Max-Age={int(max_age)}; SameSite=Lax"
              + ("; Secure" if secure else ""))
     return Response(302, "", {
-        "Location": next_url,
+        "Location": safe_next(next_url),
         "Set-Cookie": f"{SESSION_COOKIE}={token}; {flags}",
     })
 
@@ -262,13 +275,92 @@ def issue_session(data: dict, secret: str, max_age: int = 3600) -> str:
     return f"{payload_b64}.{_sign(payload_b64, secret)}"
 
 
-def verify_session(cookie: str, secret: str, max_age: int = 3600):
-    """Verify a stateless session cookie; return payload dict or ``None``."""
+class SessionVersions:
+    """Per-user session versions, for signing a user out everywhere (in memory: one process).
+
+    Sessions carry the version current when they were made; :func:`revoke_user`
+    bumps it, so every older session stops working.
+    """
+
+    def __init__(self):
+        self._v: dict = {}
+        self._lock = __import__("threading").Lock()
+
+    def get(self, user_id) -> int:
+        with self._lock:
+            return self._v.get(str(user_id), 0)
+
+    def bump(self, user_id) -> int:
+        with self._lock:
+            self._v[str(user_id)] = self._v.get(str(user_id), 0) + 1
+            return self._v[str(user_id)]
+
+
+class RedisSessionVersions(SessionVersions):
+    """Session versions in Redis, shared by every server process."""
+
+    def __init__(self, url="redis://localhost:6379/0", client=None, prefix="pyweb:sessver:"):
+        super().__init__()
+        if client is None:
+            import redis  # noqa: PLC0415 - optional dependency
+            client = redis.Redis.from_url(url)
+        self._r, self._prefix = client, prefix
+
+    def get(self, user_id) -> int:
+        return int(self._r.get(self._prefix + str(user_id)) or 0)
+
+    def bump(self, user_id) -> int:
+        return int(self._r.incr(self._prefix + str(user_id)))
+
+
+_versions: SessionVersions | None = None
+
+
+def use_session_versions(store):
+    """Turn on revocation with ``store`` (a :class:`SessionVersions`); returns it."""
+    global _versions
+    _versions = store
+    return store
+
+
+def session_versions():
+    return _versions
+
+
+def revoke_user(user_id):
+    """Sign ``user_id`` out of every session (every device). Turns revocation on if needed."""
+    store = _versions if _versions is not None else use_session_versions(SessionVersions())
+    return store.bump(user_id)
+
+
+#: Sessions end this long after sign-in, however active the user is.
+ABSOLUTE_AGE = 30 * 24 * 3600
+
+
+def session_valid(payload, *, absolute_age=ABSOLUTE_AGE, now=None) -> bool:
+    """Checks beyond the signature: the absolute lifetime and revocation."""
+    now = time.time() if now is None else now
+    started = payload.get("auth_time", payload.get("iat", 0))
+    if not isinstance(started, (int, float)) or now - started > absolute_age:
+        return False
+    if _versions is not None and "sub" in payload:
+        if int(payload.get("ver", 0) or 0) < _versions.get(payload["sub"]):
+            return False
+    return True
+
+
+def verify_session(cookie: str, secret, max_age: int = 3600):
+    """Verify a stateless session cookie; return payload dict or ``None``.
+
+    ``secret`` may be a list of keys (key rotation): any of them may have signed it.
+    """
+    from .keys import any_valid
     try:
         payload_b64, sig = cookie.rsplit(".", 1)
-    except ValueError:
+    except (ValueError, AttributeError):
         return None
-    if not hmac.compare_digest(_sign(payload_b64, secret), sig):
+    candidates = secret if isinstance(secret, (list, tuple)) else [secret]
+    if not any_valid(candidates, lambda k: hmac.compare_digest(_sign(payload_b64, k), sig)):
         return None
     try:
         payload = json.loads(_b64d(payload_b64))
@@ -334,7 +426,8 @@ class OAuthClient:
 def issue_magic_token(secret: str, email: str, ttl: int = 900) -> str:
     payload = {"email": email, "exp": int(time.time()) + ttl}
     payload_b64 = _b64e(json.dumps(payload, separators=(",", ":")).encode())
-    return f"{payload_b64}.{_sign(payload_b64, secret)}"
+    # Signed under its own prefix, so a session cookie can never pass as a login link (or back).
+    return f"{payload_b64}.{_sign('magic:' + payload_b64, secret)}"
 
 
 def verify_magic_token(secret: str, token: str, max_age: int = 900):
@@ -342,13 +435,13 @@ def verify_magic_token(secret: str, token: str, max_age: int = 900):
         payload_b64, sig = token.rsplit(".", 1)
     except ValueError:
         return None
-    if not hmac.compare_digest(_sign(payload_b64, secret), sig):
+    if not hmac.compare_digest(_sign("magic:" + payload_b64, secret), sig):
         return None
     try:
         payload = json.loads(_b64d(payload_b64))
     except (ValueError, base64.binascii.Error, json.JSONDecodeError):
         return None
-    if time.time() > payload.get("exp", 0):
+    if not isinstance(payload, dict) or time.time() > payload.get("exp", 0):
         return None
     return payload.get("email")
 

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyweb/build.py

@@ -168,6 +168,13 @@ def build(compiled: dict, out: str, *, minifier=None, extract_css=True,
     os.makedirs(f"{out}/static", exist_ok=True)
     os.makedirs(f"{out}/server", exist_ok=True)
 
+    if app_dir and os.path.isfile(os.path.join(app_dir, "pyweb.lock")):
+        from pyweb import packages
+        problems = packages.verify(app_dir)
+        if problems:
+            listing = "\n".join(f"  {path}: {why}" for path, why in problems[:20])
+            raise RuntimeError("npm package files don't match pyweb.lock (edited or tampered with?):\n"
+                               f"{listing}\nRun `pyweb add` to reinstall them, then build again.")
     if app_dir and os.path.isdir(os.path.join(app_dir, "static")):
         shutil.copytree(os.path.join(app_dir, "static"), f"{out}/static", dirs_exist_ok=True)
 

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyweb/cache.py

@@ -32,6 +32,24 @@ class MemoryCache(Cache):
         self._tags: dict[str, set] = {}
         self._lock = threading.Lock()
         self._now = time_fn or time.monotonic
+        self._sets = 0
+
+    def _drop(self, key):
+        """Remove ``key`` and its tag entries. Hold the lock."""
+        item = self._store.pop(key, None)
+        if item is not None:
+            for t in item[2]:
+                keys = self._tags.get(t)
+                if keys is not None:
+                    keys.discard(key)
+                    if not keys:
+                        del self._tags[t]
+
+    def _sweep(self):
+        """Forget expired entries nobody asked for again. Hold the lock."""
+        now = self._now()
+        for key in [k for k, (_v, exp, _t) in self._store.items() if exp is not None and exp <= now]:
+            self._drop(key)
 
     def get(self, key, default=None):
         """Return ``(value, hit)`` tuple, preserving the prototype API."""
@@ -41,7 +59,7 @@ class MemoryCache(Cache):
                 return None, False
             value, expires, _tags = item
             if expires is not None and expires <= self._now():
-                del self._store[key]
+                self._drop(key)
                 return None, False
             return value, True
 
@@ -55,6 +73,9 @@ class MemoryCache(Cache):
             ttl = kw["minutes"] * 60
         expires = None if ttl is None else self._now() + ttl
         with self._lock:
+            self._sets += 1
+            if self._sets % 256 == 0:
+                self._sweep()
             old = self._store.get(key)
             if isinstance(old, tuple) and len(old) == 3:
                 for t in old[2]:
@@ -87,23 +108,38 @@ class MemoryCache(Cache):
             self._tags.clear()
 
 
-def _dumps(value) -> bytes:
+def _dumps(value, allow_pickle=False) -> bytes:
     try:
         return b"j:" + json.dumps(value).encode("utf-8")
     except (TypeError, ValueError):
+        if not allow_pickle:
+            raise TypeError(f"RedisCache stores JSON values; {type(value).__name__} isn't one "
+                            "(convert it, or pass allow_pickle=True if only you can write to Redis)") from None
         return b"p:" + pickle.dumps(value)
 
 
-def _loads(raw: bytes):
+_MISS = object()
+
+
+def _loads(raw: bytes, allow_pickle=False):
     if raw.startswith(b"j:"):
         return json.loads(raw[2:].decode("utf-8"))
     if raw.startswith(b"p:"):
-        return pickle.loads(raw[2:])
+        # Unpickling runs code chosen by whoever wrote the bytes: only with explicit trust.
+        return pickle.loads(raw[2:]) if allow_pickle else _MISS  # noqa: S301
     return raw
 
 
 class RedisCache(Cache):
-    def __init__(self, url="redis://localhost:6379/0", client=None, prefix="pyweb:"):
+    """A cache in Redis, shared by every server process.
+
+    Values are stored as JSON. ``allow_pickle=True`` also stores other Python
+    objects with pickle; only use it when nobody else can write to your Redis,
+    because reading a pickle can run arbitrary code.
+    """
+
+    def __init__(self, url="redis://localhost:6379/0", client=None, prefix="pyweb:", allow_pickle=False):
+        self.allow_pickle = allow_pickle
         if client is not None:
             self._r = client
         else:
@@ -124,7 +160,7 @@ class RedisCache(Cache):
         return f"{self._prefix}tag:{tag}"
 
     def set(self, key, value, ttl=None, tags=()):
-        self._r.set(self._k(key), _dumps(value), ex=ttl)
+        self._r.set(self._k(key), _dumps(value, self.allow_pickle), ex=ttl)
         for t in tags:
             self._r.sadd(self._t(t), self._k(key))
 
@@ -132,7 +168,8 @@ class RedisCache(Cache):
         raw = self._r.get(self._k(key))
         if raw is None:
             return default
-        return _loads(bytes(raw))
+        value = _loads(bytes(raw), self.allow_pickle)
+        return default if value is _MISS else value
 
     def delete(self, key):
         return bool(self._r.delete(self._k(key)))

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyweb/cli/__init__.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import argparse
-import http.server
 import os
 import sys
 
@@ -53,18 +52,66 @@ def cmd_check(args):
         findings.append({"kind": "compile-error", "line": 0, "message": str(exc)})
     for f in findings:
         print(f"{f['kind']} {args.file}:{f['line']}: {f['message']}")
-    if any(f["kind"] in ("secret-leak", "compile-error") for f in findings):
+    problems = production_problems(src, os.path.dirname(os.path.abspath(args.file))) \
+        if getattr(args, "production", False) else []
+    for p in problems:
+        print(f"production: {p}")
+    if getattr(args, "production", False) and not problems:
+        print("production: ready")
+    if problems or any(f["kind"] in ("secret-leak", "compile-error") for f in findings):
         raise SystemExit(1)
 
 
+def production_problems(source="", app_dir="."):
+    """What would make this app unsafe or unreliable in production, from the environment and the app."""
+    from pyweb import config
+    out = []
+    try:
+        s = config.settings()
+    except ValueError as exc:
+        return [str(exc)]
+    if not s.auth_secret:
+        out.append("PYWEB_AUTH_SECRET isn't set: sessions would use a development key "
+                   "(generate one: python -c \"import secrets; print(secrets.token_hex(32))\")")
+    elif len(s.auth_secret) < 32:
+        out.append("PYWEB_AUTH_SECRET is shorter than 32 characters; use a long random value")
+    if not s.production:
+        out.append("PYWEB_ENV isn't 'production' (it makes a missing secret an error instead of a fallback)")
+    if not s.cookie_secure:
+        out.append("PYWEB_COOKIE_SECURE isn't on: cookies would also travel over plain HTTP "
+                   "(set it when you serve over HTTPS, which you should)")
+    if not s.trust_proxy:
+        out.append("PYWEB_TRUST_PROXY isn't set: behind nginx, Caddy or a load balancer every visitor "
+                   "looks like the proxy to rate limits (set it to 1, or the number of proxies; "
+                   "ignore this if clients connect directly)")
+    try:
+        workers = int(os.environ.get("WEB_CONCURRENCY", "1") or 1)
+    except ValueError:
+        workers = 1
+    if workers > 1 and not s.redis_url:
+        out.append(f"WEB_CONCURRENCY={workers} without PYWEB_REDIS_URL: each worker would keep its own rate "
+                   "limits and live updates (connect Redis to share them)")
+    if "allow_pickle=True" in (source or ""):
+        out.append("RedisCache(allow_pickle=True): anyone who can write to Redis could run code; store JSON")
+    if os.path.isfile(os.path.join(app_dir, "pyweb.lock")):
+        from pyweb import packages
+        for path, why in packages.verify(app_dir)[:5]:
+            out.append(f"{path}: {why} (run pyweb add to reinstall)")
+    return out
+
+
 def cmd_build(args):
     from pyweb.compiler import compile_source
     from pyweb.build import build as _build
     src = _load(args.file)
     out = compile_source(src, filename=args.file)
     production = getattr(args, "production", False)
-    manifest = _build(out, args.out, source=src, production=production,
-                      app_dir=os.path.dirname(os.path.abspath(args.file)))
+    try:
+        manifest = _build(out, args.out, source=src, production=production,
+                          app_dir=os.path.dirname(os.path.abspath(args.file)))
+    except RuntimeError as exc:
+        print(f"build failed: {exc}", file=sys.stderr)
+        raise SystemExit(1) from None
     mode = " (production)" if production else ""
     print(f"built {len(manifest['pages'])} page(s) + {len(out['rpc'])} rpc(s) -> {args.out}/{mode}")
     from pathlib import Path as _Path
@@ -137,14 +184,14 @@ def _dev_load(state, Site):
 def cmd_dev(args):
     """Development server: compile on save, live reload, error overlay."""
     from pyweb.hosting import Site
-    from pyweb.serve import ThreadedServer
+    from pyweb.serve import LimitedHandler, ThreadedServer
 
     state = _DevState(args.file)
     _dev_load(state, Site)
     if state.error is not None:
         print(f"error: {state.error}", file=sys.stderr)
 
-    class H(http.server.BaseHTTPRequestHandler):
+    class H(LimitedHandler):
         def _send(self, status, headers, body):
             from pyweb.hosting import write_http
             write_http(self, status, headers, body, head=self.command == "HEAD")
@@ -156,7 +203,8 @@ def cmd_dev(args):
             if state.error is not None or state.site is None:
                 html = _error_overlay(state.error, state.path).encode()
                 return self._send(500, [("Content-Type", "text/html; charset=utf-8")], html)
-            status, headers, raw = state.site.respond(method, self.path, dict(self.headers), body)
+            status, headers, raw = state.site.respond(method, self.path, dict(self.headers), body,
+                                                      client=self.client_address[0])
             ctype = next((v for k, v in headers if k.lower() == "content-type"), "")
             if ctype.startswith("text/html") and isinstance(raw, bytes) and b"</body>" in raw:
                 raw = raw.replace(b"</body>", DEV_RELOAD_JS.encode() + b"</body>", 1)
@@ -193,12 +241,17 @@ def _watch_and_reload(state, Site):
 
     app_dir = os.path.dirname(os.path.abspath(state.path))
 
+    skip = {"__pycache__", "node_modules", "dist", "build", "venv", "env", "site-packages", "vendor"}
+
     def snapshot():
         stamps = {}
         for root, dirs, files in os.walk(app_dir):
-            dirs[:] = [d for d in dirs if not d.startswith((".", "__pycache__", "node_modules", "dist"))]
+            # Virtualenvs (any folder with a pyvenv.cfg) hold thousands of files that never matter here;
+            # npm packages are covered by pyweb.lock, which changes whenever they do.
+            dirs[:] = [d for d in dirs if not d.startswith(".") and d not in skip
+                       and not os.path.exists(os.path.join(root, d, "pyvenv.cfg"))]
             for fn in files:
-                if fn.endswith((".pyweb", ".py", ".css", ".js")):
+                if fn.endswith((".pyweb", ".py", ".css", ".js")) or fn == "pyweb.lock":
                     p = os.path.join(root, fn)
                     try:
                         stamps[p] = os.path.getmtime(p)
@@ -358,8 +411,11 @@ def cmd_deploy(args):
     files = {}
     if target in ("docker", "compose"):
         files["Dockerfile"] = D.dockerfile(port=args.port)
+        domain = getattr(args, "domain", "") or ""
         if target == "compose" or args.compose:
-            files["compose.yaml"] = D.compose(port=args.port, db_url=args.db_url or "")
+            files["compose.yaml"] = D.compose(port=args.port, db_url=args.db_url or "", domain=domain)
+            if domain:
+                files["Caddyfile"] = D.caddyfile(domain, port=args.port)
     elif target == "k8s":
         files["k8s.yaml"] = D.k8s_manifest(app=args.app, image=args.image, port=args.port)
     else:
@@ -368,6 +424,10 @@ def cmd_deploy(args):
         with open(os.path.join(outdir, name), "w") as fh:
             fh.write(body)
     print(f"deploy {target} -> {outdir}/ ({', '.join(files)})")
+    if "Caddyfile" in files:
+        print(f"next: point {args.domain}'s DNS at this server, then run\n"
+              f"  PYWEB_AUTH_SECRET=... docker compose up -d   (in {outdir}/, with your app files)\n"
+              "Caddy gets the HTTPS certificate by itself; the app is only reachable through it.")
 
 
 def cmd_dts(args):
@@ -438,7 +498,9 @@ def main(argv=None):
     p = sub.add_parser("new"); p.add_argument("name"); p.add_argument("--template", default="counter", choices=["blank", "counter", "todo", "blog", "auth", "chat", "ai-chat"], help="starter app"); p.set_defaults(fn=cmd_new)
     p = sub.add_parser("mcp", help="run the MCP server (stdio) for AI assistants"); p.set_defaults(fn=cmd_mcp)
     p = sub.add_parser("lsp", help="run the language server (stdio) for editors"); p.set_defaults(fn=cmd_lsp)
-    p = sub.add_parser("check"); p.add_argument("file"); p.set_defaults(fn=cmd_check)
+    p = sub.add_parser("check"); p.add_argument("file")
+    p.add_argument("--production", action="store_true", help="also check the environment is ready for production")
+    p.set_defaults(fn=cmd_check)
     p = sub.add_parser("dts", help="generate Python stubs from a TypeScript .d.ts file (experimental)")
     p.add_argument("dts"); p.add_argument("-o", "--out", default=None); p.set_defaults(fn=cmd_dts)
     p = sub.add_parser("add", help="add npm packages for browser code (no Node.js needed)")
@@ -455,6 +517,7 @@ def main(argv=None):
     p.add_argument("--port", type=int, default=8000)
     p.add_argument("--compose", action="store_true")
     p.add_argument("--db-url", default="")
+    p.add_argument("--domain", default="", help="compose: put Caddy in front with automatic HTTPS for this domain")
     p.add_argument("--app", default="pyweb")
     p.add_argument("--image", default="pyweb:latest")
     p.set_defaults(fn=cmd_deploy)

{pyweb_stack-0.4.2 → pyweb_stack-0.4.4}/pyweb/compiler/lower.py

@@ -321,6 +321,11 @@ def scan_module(tree, ui_all, filename, resolve=None):
                     except (ValueError, SyntaxError, TypeError):
                         ctx.server_only[name] = "a module-level object created on the server"
                         ctx.modconsts.pop(name, None)
+    for name in _mutated_globals(tree) & set(ctx.modconsts):
+        # e.g. `ITEMS = []` that an @server function appends to: a browser copy of the
+        # starting value would be wrong, so pages get its current value from the server.
+        ctx.modconsts.pop(name)
+        ctx.server_only[name] = "a module-level value that server code changes"
     taken = {i.name for i in pages + layouts} | set(ctx.components)
     if not any(p.error_status is None for p in pages):
         # Single-page fallback: the first function with markup is "/".
@@ -339,6 +344,32 @@ def scan_module(tree, ui_all, filename, resolve=None):
     return ctx, pages, components
 
 
+_MUTATORS = {"append", "extend", "insert", "pop", "remove", "clear", "update", "setdefault", "popitem",
+             "add", "discard", "sort", "reverse", "difference_update", "intersection_update",
+             "symmetric_difference_update"}
+
+
+def _mutated_globals(tree):
+    """Module-level names that some code changes after they're defined."""
+    out = set()
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Global):
+            out.update(node.names)
+        elif isinstance(node, ast.Call) and isinstance(node.func, ast.Attribute) \
+                and node.func.attr in _MUTATORS and isinstance(node.func.value, ast.Name):
+            out.add(node.func.value.id)
+        elif isinstance(node, (ast.Assign, ast.AugAssign, ast.AnnAssign, ast.Delete)):
+            targets = node.targets if isinstance(node, (ast.Assign, ast.Delete)) else [node.target]
+            for t in targets:
+                while isinstance(t, (ast.Subscript, ast.Attribute)):
+                    t = t.value
+                    if isinstance(t, ast.Name):
+                        out.add(t.id)
+            if isinstance(node, ast.AugAssign) and isinstance(node.target, ast.Name):
+                out.add(node.target.id)
+    return out
+
+
 def _ui_of(node, ui_all):
     span = (node.lineno, getattr(node, "end_lineno", node.lineno))
     return [n for n in ui_all if span[0] <= getattr(n, "line", 0) <= span[1]]
@@ -846,7 +877,7 @@ class Emitter:
                 lines.append(f"  const {js} = $s[{key}];")
             else:
                 lines.append(f"  const {js} = {fallback};")
-        for hname, hnode in info.handlers.items():
+        for hnode in info.handlers.values():
             lines.append(self.tr.function(hnode, scope, "  "))
         for name in getattr(info, "live", ()):
             if name in info.refs:
@@ -925,7 +956,7 @@ class Emitter:
                 return f"$dyn({_thunk(js)})"
             return f"$t($py.text({js}))"
         if t == "ControlFor":
-            it_node, it_js = self._expr(n.iterable, n.line, scope)
+            _it_node, it_js = self._expr(n.iterable, n.line, scope)
             target = self._parse(n.target, n.line)
             inner = scope.child({name: VALUE for name in pyjs._target_names(target)})
             try: