pyweb-stack 0.4.3__tar.gz → 0.4.4__tar.gz

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweb-stack
-Version: 0.4.3
+Version: 0.4.4
 Summary: Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC.
 Author-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
 Maintainer-email: MaanavKrishna <67054795+MaanavKrishna@users.noreply.github.com>
@@ -384,7 +384,7 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
-| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching |
+| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching; 0.4.4: key rotation, session revocation, typed arguments, Redis-shared limits, `check --production` |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/README.md

@@ -330,7 +330,7 @@ Upgrade with `pip install -U pyweb-stack`.
 
 | Version | Highlights |
 |---|---|
-| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching |
+| 0.4 | npm packages without Node, layouts and client-side navigation, streaming server functions and `<Markdown>` for AI apps, live queries, page head tags, `.pyweb` error pages; 0.4.1: richer MCP tools; 0.4.2: VS Code run, new-app and MCP commands; 0.4.3: fixes, security hardening, gzip and caching; 0.4.4: key rotation, session revocation, typed arguments, Redis-shared limits, `check --production` |
 | 0.3 | Hydration, live updates (SSE), multi-file apps, language server + VS Code extension, browser playground, faster rendering, screenshot/test MCP tools |
 | 0.2 | MCP server for AI assistants, AI guide, project templates, `AGENTS.md`/`CLAUDE.md`, `llms.txt` |
 | 0.1 | First public release: compiler, reactive runtime, server rendering, typed RPC, sessions, databases, CLI |

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweb-stack"
-version = "0.4.3"
+version = "0.4.4"
 description = "Full-stack web apps in one Python file: server-rendered pages, reactive browser UI, typed RPC."
 readme = "README.md"
 license = { text = "MIT" }

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/ai/guide.md

@@ -166,7 +166,12 @@ def Item(item_id: int):
 ```
 
 - `session.login(user_id, **claims)`, `session.user()`, `session.logout()`,
-  `session.require("admin")`.
+  `session.require("admin")`. `pyweb.auth.revoke_user(user_id)` signs a user
+  out on every device (e.g. after a password change).
+- Give every `@server` parameter a type hint (`str`, `int`, `list[int]`,
+  a dataclass or Model, `Literal[...]`): arguments are checked against
+  them, and wrong types or unknown arguments get a 422 before your code
+  runs. Still check permissions and business rules yourself.
 - `pyweb.auth.hash_password` / `verify_password` for passwords.
 - Database: `from pyweb.db import connect; db = connect("sqlite:///app.db")`;
   `db.execute("select ... where id = ?", (x,)).dicts()`; always use `?`

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/asgi.py

@@ -52,6 +52,8 @@ def create_app(target="app.pyweb", *, debug=False, max_body=1_048_576, **server_
                 if msg["type"] == "lifespan.startup":
                     await send({"type": "lifespan.startup.complete"})
                 elif msg["type"] == "lifespan.shutdown":
+                    from .hosting import shutdown
+                    await asyncio.to_thread(shutdown)
                     await send({"type": "lifespan.shutdown.complete"})
                     return
         if scope["type"] != "http":

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/auth.py

@@ -275,13 +275,92 @@ def issue_session(data: dict, secret: str, max_age: int = 3600) -> str:
     return f"{payload_b64}.{_sign(payload_b64, secret)}"
 
 
-def verify_session(cookie: str, secret: str, max_age: int = 3600):
-    """Verify a stateless session cookie; return payload dict or ``None``."""
+class SessionVersions:
+    """Per-user session versions, for signing a user out everywhere (in memory: one process).
+
+    Sessions carry the version current when they were made; :func:`revoke_user`
+    bumps it, so every older session stops working.
+    """
+
+    def __init__(self):
+        self._v: dict = {}
+        self._lock = __import__("threading").Lock()
+
+    def get(self, user_id) -> int:
+        with self._lock:
+            return self._v.get(str(user_id), 0)
+
+    def bump(self, user_id) -> int:
+        with self._lock:
+            self._v[str(user_id)] = self._v.get(str(user_id), 0) + 1
+            return self._v[str(user_id)]
+
+
+class RedisSessionVersions(SessionVersions):
+    """Session versions in Redis, shared by every server process."""
+
+    def __init__(self, url="redis://localhost:6379/0", client=None, prefix="pyweb:sessver:"):
+        super().__init__()
+        if client is None:
+            import redis  # noqa: PLC0415 - optional dependency
+            client = redis.Redis.from_url(url)
+        self._r, self._prefix = client, prefix
+
+    def get(self, user_id) -> int:
+        return int(self._r.get(self._prefix + str(user_id)) or 0)
+
+    def bump(self, user_id) -> int:
+        return int(self._r.incr(self._prefix + str(user_id)))
+
+
+_versions: SessionVersions | None = None
+
+
+def use_session_versions(store):
+    """Turn on revocation with ``store`` (a :class:`SessionVersions`); returns it."""
+    global _versions
+    _versions = store
+    return store
+
+
+def session_versions():
+    return _versions
+
+
+def revoke_user(user_id):
+    """Sign ``user_id`` out of every session (every device). Turns revocation on if needed."""
+    store = _versions if _versions is not None else use_session_versions(SessionVersions())
+    return store.bump(user_id)
+
+
+#: Sessions end this long after sign-in, however active the user is.
+ABSOLUTE_AGE = 30 * 24 * 3600
+
+
+def session_valid(payload, *, absolute_age=ABSOLUTE_AGE, now=None) -> bool:
+    """Checks beyond the signature: the absolute lifetime and revocation."""
+    now = time.time() if now is None else now
+    started = payload.get("auth_time", payload.get("iat", 0))
+    if not isinstance(started, (int, float)) or now - started > absolute_age:
+        return False
+    if _versions is not None and "sub" in payload:
+        if int(payload.get("ver", 0) or 0) < _versions.get(payload["sub"]):
+            return False
+    return True
+
+
+def verify_session(cookie: str, secret, max_age: int = 3600):
+    """Verify a stateless session cookie; return payload dict or ``None``.
+
+    ``secret`` may be a list of keys (key rotation): any of them may have signed it.
+    """
+    from .keys import any_valid
     try:
         payload_b64, sig = cookie.rsplit(".", 1)
-    except ValueError:
+    except (ValueError, AttributeError):
         return None
-    if not hmac.compare_digest(_sign(payload_b64, secret), sig):
+    candidates = secret if isinstance(secret, (list, tuple)) else [secret]
+    if not any_valid(candidates, lambda k: hmac.compare_digest(_sign(payload_b64, k), sig)):
         return None
     try:
         payload = json.loads(_b64d(payload_b64))

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/build.py

@@ -168,6 +168,13 @@ def build(compiled: dict, out: str, *, minifier=None, extract_css=True,
     os.makedirs(f"{out}/static", exist_ok=True)
     os.makedirs(f"{out}/server", exist_ok=True)
 
+    if app_dir and os.path.isfile(os.path.join(app_dir, "pyweb.lock")):
+        from pyweb import packages
+        problems = packages.verify(app_dir)
+        if problems:
+            listing = "\n".join(f"  {path}: {why}" for path, why in problems[:20])
+            raise RuntimeError("npm package files don't match pyweb.lock (edited or tampered with?):\n"
+                               f"{listing}\nRun `pyweb add` to reinstall them, then build again.")
     if app_dir and os.path.isdir(os.path.join(app_dir, "static")):
         shutil.copytree(os.path.join(app_dir, "static"), f"{out}/static", dirs_exist_ok=True)
 

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/cache.py

@@ -108,23 +108,38 @@ class MemoryCache(Cache):
             self._tags.clear()
 
 
-def _dumps(value) -> bytes:
+def _dumps(value, allow_pickle=False) -> bytes:
     try:
         return b"j:" + json.dumps(value).encode("utf-8")
     except (TypeError, ValueError):
+        if not allow_pickle:
+            raise TypeError(f"RedisCache stores JSON values; {type(value).__name__} isn't one "
+                            "(convert it, or pass allow_pickle=True if only you can write to Redis)") from None
         return b"p:" + pickle.dumps(value)
 
 
-def _loads(raw: bytes):
+_MISS = object()
+
+
+def _loads(raw: bytes, allow_pickle=False):
     if raw.startswith(b"j:"):
         return json.loads(raw[2:].decode("utf-8"))
     if raw.startswith(b"p:"):
-        return pickle.loads(raw[2:])
+        # Unpickling runs code chosen by whoever wrote the bytes: only with explicit trust.
+        return pickle.loads(raw[2:]) if allow_pickle else _MISS  # noqa: S301
     return raw
 
 
 class RedisCache(Cache):
-    def __init__(self, url="redis://localhost:6379/0", client=None, prefix="pyweb:"):
+    """A cache in Redis, shared by every server process.
+
+    Values are stored as JSON. ``allow_pickle=True`` also stores other Python
+    objects with pickle; only use it when nobody else can write to your Redis,
+    because reading a pickle can run arbitrary code.
+    """
+
+    def __init__(self, url="redis://localhost:6379/0", client=None, prefix="pyweb:", allow_pickle=False):
+        self.allow_pickle = allow_pickle
         if client is not None:
             self._r = client
         else:
@@ -145,7 +160,7 @@ class RedisCache(Cache):
         return f"{self._prefix}tag:{tag}"
 
     def set(self, key, value, ttl=None, tags=()):
-        self._r.set(self._k(key), _dumps(value), ex=ttl)
+        self._r.set(self._k(key), _dumps(value, self.allow_pickle), ex=ttl)
         for t in tags:
             self._r.sadd(self._t(t), self._k(key))
 
@@ -153,7 +168,8 @@ class RedisCache(Cache):
         raw = self._r.get(self._k(key))
         if raw is None:
             return default
-        return _loads(bytes(raw))
+        value = _loads(bytes(raw), self.allow_pickle)
+        return default if value is _MISS else value
 
     def delete(self, key):
         return bool(self._r.delete(self._k(key)))

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/cli/__init__.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import argparse
-import http.server
 import os
 import sys
 
@@ -53,18 +52,66 @@ def cmd_check(args):
         findings.append({"kind": "compile-error", "line": 0, "message": str(exc)})
     for f in findings:
         print(f"{f['kind']} {args.file}:{f['line']}: {f['message']}")
-    if any(f["kind"] in ("secret-leak", "compile-error") for f in findings):
+    problems = production_problems(src, os.path.dirname(os.path.abspath(args.file))) \
+        if getattr(args, "production", False) else []
+    for p in problems:
+        print(f"production: {p}")
+    if getattr(args, "production", False) and not problems:
+        print("production: ready")
+    if problems or any(f["kind"] in ("secret-leak", "compile-error") for f in findings):
         raise SystemExit(1)
 
 
+def production_problems(source="", app_dir="."):
+    """What would make this app unsafe or unreliable in production, from the environment and the app."""
+    from pyweb import config
+    out = []
+    try:
+        s = config.settings()
+    except ValueError as exc:
+        return [str(exc)]
+    if not s.auth_secret:
+        out.append("PYWEB_AUTH_SECRET isn't set: sessions would use a development key "
+                   "(generate one: python -c \"import secrets; print(secrets.token_hex(32))\")")
+    elif len(s.auth_secret) < 32:
+        out.append("PYWEB_AUTH_SECRET is shorter than 32 characters; use a long random value")
+    if not s.production:
+        out.append("PYWEB_ENV isn't 'production' (it makes a missing secret an error instead of a fallback)")
+    if not s.cookie_secure:
+        out.append("PYWEB_COOKIE_SECURE isn't on: cookies would also travel over plain HTTP "
+                   "(set it when you serve over HTTPS, which you should)")
+    if not s.trust_proxy:
+        out.append("PYWEB_TRUST_PROXY isn't set: behind nginx, Caddy or a load balancer every visitor "
+                   "looks like the proxy to rate limits (set it to 1, or the number of proxies; "
+                   "ignore this if clients connect directly)")
+    try:
+        workers = int(os.environ.get("WEB_CONCURRENCY", "1") or 1)
+    except ValueError:
+        workers = 1
+    if workers > 1 and not s.redis_url:
+        out.append(f"WEB_CONCURRENCY={workers} without PYWEB_REDIS_URL: each worker would keep its own rate "
+                   "limits and live updates (connect Redis to share them)")
+    if "allow_pickle=True" in (source or ""):
+        out.append("RedisCache(allow_pickle=True): anyone who can write to Redis could run code; store JSON")
+    if os.path.isfile(os.path.join(app_dir, "pyweb.lock")):
+        from pyweb import packages
+        for path, why in packages.verify(app_dir)[:5]:
+            out.append(f"{path}: {why} (run pyweb add to reinstall)")
+    return out
+
+
 def cmd_build(args):
     from pyweb.compiler import compile_source
     from pyweb.build import build as _build
     src = _load(args.file)
     out = compile_source(src, filename=args.file)
     production = getattr(args, "production", False)
-    manifest = _build(out, args.out, source=src, production=production,
-                      app_dir=os.path.dirname(os.path.abspath(args.file)))
+    try:
+        manifest = _build(out, args.out, source=src, production=production,
+                          app_dir=os.path.dirname(os.path.abspath(args.file)))
+    except RuntimeError as exc:
+        print(f"build failed: {exc}", file=sys.stderr)
+        raise SystemExit(1) from None
     mode = " (production)" if production else ""
     print(f"built {len(manifest['pages'])} page(s) + {len(out['rpc'])} rpc(s) -> {args.out}/{mode}")
     from pathlib import Path as _Path
@@ -137,14 +184,14 @@ def _dev_load(state, Site):
 def cmd_dev(args):
     """Development server: compile on save, live reload, error overlay."""
     from pyweb.hosting import Site
-    from pyweb.serve import ThreadedServer
+    from pyweb.serve import LimitedHandler, ThreadedServer
 
     state = _DevState(args.file)
     _dev_load(state, Site)
     if state.error is not None:
         print(f"error: {state.error}", file=sys.stderr)
 
-    class H(http.server.BaseHTTPRequestHandler):
+    class H(LimitedHandler):
         def _send(self, status, headers, body):
             from pyweb.hosting import write_http
             write_http(self, status, headers, body, head=self.command == "HEAD")
@@ -364,8 +411,11 @@ def cmd_deploy(args):
     files = {}
     if target in ("docker", "compose"):
         files["Dockerfile"] = D.dockerfile(port=args.port)
+        domain = getattr(args, "domain", "") or ""
         if target == "compose" or args.compose:
-            files["compose.yaml"] = D.compose(port=args.port, db_url=args.db_url or "")
+            files["compose.yaml"] = D.compose(port=args.port, db_url=args.db_url or "", domain=domain)
+            if domain:
+                files["Caddyfile"] = D.caddyfile(domain, port=args.port)
     elif target == "k8s":
         files["k8s.yaml"] = D.k8s_manifest(app=args.app, image=args.image, port=args.port)
     else:
@@ -374,6 +424,10 @@ def cmd_deploy(args):
         with open(os.path.join(outdir, name), "w") as fh:
             fh.write(body)
     print(f"deploy {target} -> {outdir}/ ({', '.join(files)})")
+    if "Caddyfile" in files:
+        print(f"next: point {args.domain}'s DNS at this server, then run\n"
+              f"  PYWEB_AUTH_SECRET=... docker compose up -d   (in {outdir}/, with your app files)\n"
+              "Caddy gets the HTTPS certificate by itself; the app is only reachable through it.")
 
 
 def cmd_dts(args):
@@ -444,7 +498,9 @@ def main(argv=None):
     p = sub.add_parser("new"); p.add_argument("name"); p.add_argument("--template", default="counter", choices=["blank", "counter", "todo", "blog", "auth", "chat", "ai-chat"], help="starter app"); p.set_defaults(fn=cmd_new)
     p = sub.add_parser("mcp", help="run the MCP server (stdio) for AI assistants"); p.set_defaults(fn=cmd_mcp)
     p = sub.add_parser("lsp", help="run the language server (stdio) for editors"); p.set_defaults(fn=cmd_lsp)
-    p = sub.add_parser("check"); p.add_argument("file"); p.set_defaults(fn=cmd_check)
+    p = sub.add_parser("check"); p.add_argument("file")
+    p.add_argument("--production", action="store_true", help="also check the environment is ready for production")
+    p.set_defaults(fn=cmd_check)
     p = sub.add_parser("dts", help="generate Python stubs from a TypeScript .d.ts file (experimental)")
     p.add_argument("dts"); p.add_argument("-o", "--out", default=None); p.set_defaults(fn=cmd_dts)
     p = sub.add_parser("add", help="add npm packages for browser code (no Node.js needed)")
@@ -461,6 +517,7 @@ def main(argv=None):
     p.add_argument("--port", type=int, default=8000)
     p.add_argument("--compose", action="store_true")
     p.add_argument("--db-url", default="")
+    p.add_argument("--domain", default="", help="compose: put Caddy in front with automatic HTTPS for this domain")
     p.add_argument("--app", default="pyweb")
     p.add_argument("--image", default="pyweb:latest")
     p.set_defaults(fn=cmd_deploy)

pyweb_stack-0.4.4/pyweb/config.py

@@ -0,0 +1,122 @@
+"""Settings from the environment, in one place.
+
+Every ``PYWEB_*`` variable the servers read is parsed and checked here.
+``settings()`` reads the environment each time it's called (cheap), so a
+changed variable takes effect without restarting tests or tools; a bad
+value raises ``ValueError`` naming the variable.
+
+=============================  ===========  =====================================================
+Variable                       Default      Meaning
+=============================  ===========  =====================================================
+``PYWEB_ENV``                  development  ``production`` requires ``PYWEB_AUTH_SECRET``
+``PYWEB_AUTH_SECRET``          (dev key)    root signing secret (sessions, feeds, live queries)
+``PYWEB_AUTH_SECRET_PREVIOUS`` (none)       old secrets still accepted, comma-separated
+``PYWEB_CSRF_SECRET``          (none)       token CSRF checks for ``@auth_required`` RPCs
+``PYWEB_COOKIE_SECURE``        off          ``Secure`` cookies and HSTS (set behind HTTPS)
+``PYWEB_CSP``                  built in     Content-Security-Policy for pages
+``PYWEB_TRUST_PROXY``          0            reverse proxies in front (for ``X-Forwarded-For``)
+``PYWEB_REDIS_URL``            (none)       share rate limits and live updates across servers
+``PYWEB_MAX_CONNECTIONS``      256          simultaneous connections (``pyweb serve``)
+``PYWEB_SOCKET_TIMEOUT``       30           seconds before a stalled client is dropped
+``PYWEB_MAX_STREAMS_PER_CLIENT`` 20         open live connections per client address
+``PYWEB_RENDER_TIMEOUT``       30           seconds a page may take to render (504 after)
+=============================  ===========  =====================================================
+"""
+
+from __future__ import annotations
+
+import dataclasses
+import os
+
+_TRUE = ("1", "true", "yes", "on")
+_FALSE = ("", "0", "false", "no", "off")
+
+
+def _bool(name, env):
+    raw = env.get(name, "").strip().lower()
+    if raw in _TRUE:
+        return True
+    if raw in _FALSE:
+        return False
+    raise ValueError(f"{name}={env[name]!r}: use 1/true or 0/false")
+
+
+def _int(name, env, default, minimum=1):
+    raw = env.get(name, "").strip()
+    if not raw:
+        return default
+    try:
+        value = int(raw)
+    except ValueError:
+        raise ValueError(f"{name}={raw!r} isn't a whole number") from None
+    if value < minimum:
+        raise ValueError(f"{name} must be at least {minimum}")
+    return value
+
+
+def _proxies(env):
+    raw = env.get("PYWEB_TRUST_PROXY", "").strip().lower()
+    if raw in _FALSE:
+        return 0
+    if raw in _TRUE:
+        return 1
+    return _int("PYWEB_TRUST_PROXY", env, 0, minimum=0)
+
+
+@dataclasses.dataclass(frozen=True)
+class Settings:
+    env: str = "development"
+    auth_secret: str | None = None
+    previous_secrets: tuple = ()
+    csrf_secret: str | None = None
+    cookie_secure: bool = False
+    csp: str | None = None
+    trust_proxy: int = 0
+    redis_url: str | None = None
+    max_connections: int = 256
+    socket_timeout: int = 30
+    max_streams_per_client: int = 20
+    render_timeout: int = 30
+
+    @property
+    def production(self):
+        return self.env == "production"
+
+    @classmethod
+    def from_env(cls, env=None):
+        env = os.environ if env is None else env
+        return cls(
+            env=env.get("PYWEB_ENV", "development").strip() or "development",
+            auth_secret=env.get("PYWEB_AUTH_SECRET") or None,
+            previous_secrets=tuple(s.strip() for s in env.get("PYWEB_AUTH_SECRET_PREVIOUS", "").split(",")
+                                   if s.strip()),
+            csrf_secret=env.get("PYWEB_CSRF_SECRET") or None,
+            cookie_secure=_bool("PYWEB_COOKIE_SECURE", env),
+            csp=env.get("PYWEB_CSP") or None,
+            trust_proxy=_proxies(env),
+            redis_url=env.get("PYWEB_REDIS_URL") or None,
+            max_connections=_int("PYWEB_MAX_CONNECTIONS", env, 256),
+            socket_timeout=_int("PYWEB_SOCKET_TIMEOUT", env, 30),
+            max_streams_per_client=_int("PYWEB_MAX_STREAMS_PER_CLIENT", env, 20),
+            render_timeout=_int("PYWEB_RENDER_TIMEOUT", env, 30),
+        )
+
+
+def settings(env=None) -> Settings:
+    """The current settings (read from the environment now)."""
+    return Settings.from_env(env)
+
+
+def startup():
+    """Validate settings when a server starts (a bad value stops it with a clear error) and
+    connect shared services: with ``PYWEB_REDIS_URL``, live updates go through Redis so
+    every server process sees them."""
+    current = settings()
+    if current.redis_url:
+        from . import realtime
+        if type(realtime.current_bus()) is realtime.Bus:
+            try:
+                realtime.use_bus(realtime.RedisBus(current.redis_url))
+            except ImportError:
+                pass
+    return current

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/context.py

@@ -171,30 +171,62 @@ def _secret(ctx):
     return _dev_secret
 
 
+def sign_key(purpose, ctx=None):
+    """The key that signs new ``purpose`` tokens (see :mod:`pyweb.keys`)."""
+    from . import keys
+    return keys.signing_key(_secret(ctx or current()), purpose)
+
+
+def verify_keys(purpose, ctx=None):
+    """Every key a ``purpose`` token may carry: current, previous secrets, pre-0.4.4."""
+    from . import keys
+    return keys.verify_keys(_secret(ctx or current()), purpose)
+
+
 class _SessionProxy:
     """``pyweb.session``: signed-cookie login sessions."""
 
+    #: Logged out after this long without a visit (seconds).
     max_age = 7 * 24 * 3600
+    #: Logged out this long after signing in, however active (seconds).
+    absolute_age = 30 * 24 * 3600
+    #: A visit after this long renews the idle timer (the cookie is reissued).
+    renew_after = 24 * 3600
 
     def user(self):
         """The session payload (``{"sub": user_id, ...}``) or ``None``."""
         ctx = current()
         if not ctx._session_loaded:
             from pyweb import auth
-            ctx._session = auth.session_from_request(ctx.request, _secret(ctx), self.max_age)
+            payload = auth.session_from_request(ctx.request, verify_keys("session", ctx), self.max_age)
+            if payload is not None and not auth.session_valid(payload, absolute_age=self.absolute_age):
+                payload = None
+            ctx._session = payload
             ctx._session_loaded = True
+            if payload is not None and auth.time.time() - payload.get("iat", 0) > self.renew_after:
+                self._issue(ctx, {k: v for k, v in payload.items() if k != "iat"})
         return ctx._session
 
-    def login(self, user_id, **claims):
+    def _issue(self, ctx, payload):
         from pyweb import auth
-        ctx = current()
-        payload = {"sub": user_id, **claims}
-        token = auth.issue_session(payload, _secret(ctx), self.max_age)
+        token = auth.issue_session(payload, sign_key("session", ctx), self.max_age)
         request.set_cookie(auth.SESSION_COOKIE, token, max_age=self.max_age)
-        ctx._session = auth.verify_session(token, _secret(ctx), self.max_age)
+        ctx._session = auth.verify_session(token, sign_key("session", ctx), self.max_age)
         ctx._session_loaded = True
         return ctx._session
 
+    def login(self, user_id, **claims):
+        """Sign ``user_id`` in. Each login starts a new session (a fresh ``sid``)."""
+        import secrets as _secrets
+        import time as _time
+        from pyweb import auth
+        ctx = current()
+        payload = {**claims, "sub": user_id, "sid": _secrets.token_urlsafe(16), "auth_time": int(_time.time())}
+        versions = auth.session_versions()
+        if versions is not None:
+            payload["ver"] = versions.get(user_id)
+        return self._issue(ctx, payload)
+
     def logout(self):
         from pyweb import auth
         ctx = current()

{pyweb_stack-0.4.3 → pyweb_stack-0.4.4}/pyweb/db/__init__.py

@@ -7,6 +7,7 @@ import os
 import queue
 import re
 import threading
+import weakref
 from contextlib import contextmanager
 
 _OPS = {
@@ -253,6 +254,10 @@ class TransientDBError(Exception):
     """Retriable error (deadlock, serialization failure, conn reset)."""
 
 
+#: Every database opened with connect(), for readiness checks (/readyz).
+OPEN: "weakref.WeakSet" = weakref.WeakSet()
+
+
 class _PooledDB:
     """Shared DB-API pool: thread-local transactions, prepared statements,
     streaming cursors, prepared-statement cache, retriable-error mapping.
@@ -283,6 +288,11 @@ class _PooledDB:
         self._local = threading.local()
         self._stmt_cache_size = statement_cache
         self._stmt_cache: dict[str, str] = {}
+        OPEN.add(self)
+
+    def ping(self):
+        """Raise if the database can't answer a trivial query (readiness checks)."""
+        self.execute("SELECT 1")
 
     def _current(self):
         return getattr(self._local, "conn", None)