pyweber 1.3.0.dev20260609__tar.gz → 1.5.0.dev0__tar.gz

{pyweber-1.3.0.dev20260609/pyweber.egg-info → pyweber-1.5.0.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweber
-Version: 1.3.0.dev20260609
+Version: 1.5.0.dev0
 Summary: A lightweight Python framework for building and managing web applications.
 Author-email: DevPythonMZ <pypi.dev@gmail.com>
 License-Expression: Apache-2.0
@@ -15,7 +15,6 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: NOTICE
 Requires-Dist: watchdog
-Requires-Dist: lxml
 Requires-Dist: toml
 Requires-Dist: questionary
 Requires-Dist: qrcode[pil]
@@ -23,6 +22,8 @@ Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-cov; extra == "dev"
 Requires-Dist: pytest-asyncio; extra == "dev"
+Provides-Extra: fast-html
+Requires-Dist: lxml; extra == "fast-html"
 Dynamic: license-file
 
 # Pyweber Framework

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweber"
-version = "1.3.0.dev20260609"
+version = "1.5.0.dev0"
 description = "A lightweight Python framework for building and managing web applications."
 readme = "README.md"
 authors = [{ name = "DevPythonMZ", email = "pypi.dev@gmail.com" }]
 license = "Apache-2.0"
 requires-python = ">=3.10"
-dependencies = ["watchdog", "lxml", "toml", "questionary", "qrcode[pil]"]
+dependencies = ["watchdog", "toml", "questionary", "qrcode[pil]"]
 [project.urls]
 Documentation = "https://pyweber.dev/"
 Source = "https://github.com/pyweber/pyweber"
@@ -28,6 +28,7 @@ include = ["pyweber*"]
 
 [project.optional-dependencies]
 dev = ["pytest", "pytest-cov", "pytest-asyncio"]
+fast-html = ["lxml"]
 
 [tool.setuptools.package-data]
 pyweber = ["static/**/*", "admin/**/*"]
@@ -36,5 +37,5 @@ pyweber = ["static/**/*", "admin/**/*"]
 omit = ["pyweber/cli/commands.py"]
 
 [tool.coverage.report]
-fail_under = 84
+fail_under = 87.5
 show_missing = true

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/__init__.py

@@ -1,4 +1,4 @@
-# pyweber run
+# pyweber run
 from .models.run import (
     run,
     run_as_asgi
@@ -39,6 +39,22 @@ from .models.strem_stats import (
     AdaptiveController,
     StreamStats
 )
+from .models.openapi import (
+    OpenApiProcessor,
+    OpenAPIConfig,
+    OpenAPIBuilder,
+    HTTPBearer,
+    HTTPBasic,
+    APIKeyHeader,
+    APIKeyQuery,
+    APIKeyCookie,
+)
+from .models.security import (
+    AuthContext,
+    SecurityEnforcer,
+    SecurityError,
+    ForbiddenError,
+)
 
 # pyweber events
 from .core.events import (
@@ -54,6 +70,16 @@ from .utils.utils import (
     WriteLine,
     Colors
 )
+from .utils.security import (
+    secure_filename,
+    safe_join,
+    sign_value,
+    unsign_value,
+    generate_csrf_token,
+)
+from .utils.icons import Icons
+from .utils.deprecation import warn_deprecated
+from .testing import TestClient
 
 from .utils.types import (
     ContentTypes,
@@ -64,7 +90,6 @@ from .utils.types import (
     NonSelfClosingHTMLTags,
     WebSocketStatusCode,
     WindowEventType,
-    Icons,
     GetBy,
     DateFormat,
     DateTimeFormat,
@@ -79,7 +104,8 @@ from .utils.types import (
     Int32Format,
     Int64Format,
     FloatFormat,
-    DoubleFormnat
+    DoubleFormat,
+    DoubleFormnat,
 )
 from .utils.exceptions import (
     InvalidRouteFormatError,
@@ -169,6 +195,11 @@ __all__ = [
     'PrintLine',
     'WriteLine',
     'LoadStaticFiles',
+    'secure_filename',
+    'safe_join',
+    'sign_value',
+    'unsign_value',
+    'generate_csrf_token',
     'ContentTypes',
     'EventType',
     'HTMLTag',
@@ -187,6 +218,7 @@ __all__ = [
     'Int32Format',
     'Int64Format',
     'FloatFormat',
+    'DoubleFormat',
     'DoubleFormnat',
     'HTTPStatusCode',
     'JWTAlgorithms',
@@ -198,6 +230,20 @@ __all__ = [
     'InvalidTemplateError',
     'RouteNotFoundError',
     'RouterError',
+    'TestClient',
+    'warn_deprecated',
+    'OpenApiProcessor',
+    'OpenAPIConfig',
+    'OpenAPIBuilder',
+    'HTTPBearer',
+    'HTTPBasic',
+    'APIKeyHeader',
+    'APIKeyQuery',
+    'APIKeyCookie',
+    'AuthContext',
+    'SecurityEnforcer',
+    'SecurityError',
+    'ForbiddenError',
     'Icon',
     'Style',
     'Script',

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/cli/commands.py

@@ -531,7 +531,7 @@ class CommandFunctions:
         config.save()
     
     def install_requirements(self, path: str):
-        if not Path.exists(path):
+        if not Path(path).exists():
             raise FileNotFoundError('This project does not have a config file')
         
         requires: list[str] = config.get('requirements', 'packages')

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/components/form.py

@@ -1,7 +1,14 @@
 from pyweber.core.element import Element
-from pyweber.components.input import Input
+from pyweber.components.input import Input, InputHidden
 from typing import Callable, Literal
 
+from pyweber.utils.security import (
+    CSRF_FORM_FIELD,
+    csrf_enabled,
+    generate_csrf_token,
+)
+
+
 class Form(Element):
     def __init__(
         self,
@@ -24,6 +31,7 @@ class Form(Element):
         novalidate: bool = True,
         autocapitalize: bool = False,
         spellcheck: bool = False,
+        csrf_token: str = None,
         **kwargs
     ):
         super().__init__(tag='form', classes=classes, style=style, id=id, childs=childs, **kwargs)
@@ -43,16 +51,22 @@ class Form(Element):
         self.onsubmit = onsubmit
         self.onreset = onreset
         self.attrs = {}
-    
+
+        if csrf_enabled() and method and str(method).upper() == 'POST':
+            token = csrf_token or generate_csrf_token()
+            self.childs.append(
+                InputHidden(name=CSRF_FORM_FIELD, value=token, id=f'{id or "form"}_csrf')
+            )
+
     @property
     def onclick(self):
         return self.events.__dict__.get('onclick', None)
-    
+
     @onclick.setter
     def onclick(self, value: Callable):
         if value and callable(value):
             setattr(self.events, 'onclick', value)
-    
+
     @property
     def onsubmit(self):
         return self.events.__dict__.get('onsubmit', None)
@@ -61,7 +75,7 @@ class Form(Element):
     def onsubmit(self, value: Callable):
         if value and callable(value):
             setattr(self.events, 'onsubmit', value)
-    
+
     @property
     def onreset(self):
         return self.events.__dict__.get('onreset', None)
@@ -70,16 +84,16 @@ class Form(Element):
     def onreset(self, value):
         if value and callable(value):
             setattr(self.events, 'onreset', value)
-    
+
     @property
     def attrs(self):
         return self.__attrs
-    
+
     @attrs.setter
     def attrs(self, value: dict[str, str]):
         if value:
             raise AttributeError('Subscript not allowed to this attribute')
-        
+
         self.__attrs = {}
         for key, value in self.__dict__.items():
             if key in ['method', 'name', 'action', 'autocomplete', 'spellcheck', 'autocapitalize', 'novalidate', 'target', 'enctype', 'accept_charset', 'rel', 'tabindex'] and value:
@@ -89,4 +103,4 @@ class Form(Element):
                     if key == 'accept_charset':
                         self.__attrs['accept-charset'] = value
                     else:
-                        self.__attrs[key] = value
+                        self.__attrs[key] = value

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/components/general.py

@@ -95,7 +95,7 @@ class TextArea(Element):
         oninput: Callable = None,
         onclick: Callable = None,
         onselect: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__(tag='textarea')
         self.sanitize = sanitize
@@ -200,4 +200,4 @@ class TextArea(Element):
                 elif key == 'spellcheck':
                     self.__attrs[key] = 'true' if value else 'false'
                 else:
-                    self.__attrs[key] = str(value)
+                    self.__attrs[key] = str(value)

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/components/input.py

@@ -120,7 +120,7 @@ class InputColor(Input):
         onchange = None,
         oninput = None,
         onclick = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('color', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -151,7 +151,7 @@ class InputText(Input):
         onchange = None,
         oninput = None,
         onclick = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('text', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -200,7 +200,7 @@ class InputPassword(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('password', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -259,7 +259,7 @@ class InputEmail(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('email', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -307,7 +307,7 @@ class InputNumber(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('number', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -581,7 +581,7 @@ class InputSearch(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('search', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -630,7 +630,7 @@ class InputTel(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('tel', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -679,7 +679,7 @@ class InputUrl(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('url', name, id, form, tabindex, classes, style, disabled, autofocus, required, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -717,7 +717,7 @@ class InputHidden(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('hidden', name, id, form, None, classes, style, None, None, None, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -745,7 +745,7 @@ class InputSubmit(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('submit', name, id, form, tabindex, classes, style, disabled, autofocus, None, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -783,7 +783,7 @@ class InputButton(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('button', name, id, form, tabindex, classes, style, disabled, autofocus, None, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
@@ -807,8 +807,8 @@ class InputReset(Input):
         onchange: Callable = None,
         oninput: Callable = None,
         onclick: Callable = None,
-        sanitize: bool = False
+        sanitize: bool = True
     ):
         super().__init__('reset', name, id, form, tabindex, classes, style, disabled, autofocus, None, onfocus, onblur, onchange, oninput, onclick,)
         self.sanitize = sanitize
-        self.value = value
+        self.value = value

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/connection/http.py

@@ -11,10 +11,13 @@ from typing import Union, Any
 from concurrent.futures import ThreadPoolExecutor
 
 from pyweber.pyweber.pyweber import Pyweber
+from pyweber.utils.async_utils import async_timeout
 from pyweber.utils.utils import Colors, PrintLine
+from pyweber.utils.security import get_max_body_size
 from pyweber.models.request import Request, ClientInfo
 from pyweber.connection.websocket import WebsocketUpgrade, WebsocketServer
 from pyweber.connection.selector import IOSelector
+from pyweber.utils.types import ContentTypes, HTTPStatusCode
 
 class HttpServer:
     def __init__(self, *args, **kwargs):
@@ -47,10 +50,32 @@ class HttpServer:
         loop = asyncio.get_event_loop()
         return await loop.run_in_executor(None, client.recv, length)
 
+    def _parse_cookies(self, header_text: str) -> dict[str, str]:
+        cookies = {}
+        match = re.search(r'(?im)^Cookie:\s*(.+)$', header_text)
+        if not match:
+            return cookies
+        for part in match.group(1).split(';'):
+            if '=' not in part:
+                continue
+            name, value = part.split('=', 1)
+            cookies[name.strip()] = value.strip()
+        return cookies
+
+    async def _send_simple_error(self, client, code: int, body: bytes, content_type: str = 'text/plain'):
+        reason = HTTPStatusCode.search_by_code(code) if hasattr(HTTPStatusCode, 'search_by_code') else f'{code}'
+        response = (
+            f'HTTP/1.1 {reason}\r\n'
+            f'Content-Type: {content_type}; charset=UTF-8\r\n'
+            f'Content-Length: {len(body)}\r\n'
+            'Connection: close\r\n\r\n'
+        ).encode() + body
+        await self.send_data(client, response)
+
     async def process_request(self, client: Union[socket.socket, ssl.SSLSocket]):
         try:
             request_data = bytearray()
-            async with asyncio.timeout(self.timeout):
+            async with async_timeout(self.timeout):
                 while b'\r\n\r\n' not in request_data:
                     chunk = await self.read_data(client, 4096)
                     if not chunk: break
@@ -64,14 +89,30 @@ class HttpServer:
             if content_match:
                 content_length = int(content_match.group(1))
 
+            max_body = get_max_body_size()
+            if content_length > max_body:
+                await self._send_simple_error(
+                    client,
+                    413,
+                    b'Payload Too Large',
+                )
+                return None, None
+
             body = bytearray(body_start)
-            async with asyncio.timeout(self.timeout):
+            if len(body) > max_body:
+                await self._send_simple_error(client, 413, b'Payload Too Large')
+                return None, None
+
+            async with async_timeout(self.timeout):
                 while len(body) < content_length:
-                    remaining = content_length - len(body)
+                    remaining = min(content_length - len(body), max_body - len(body) + 1)
                     chunk = await self.read_data(client, remaining)
                     if not chunk:
                         break
                     body.extend(chunk)
+                    if len(body) > max_body:
+                        await self._send_simple_error(client, 413, b'Payload Too Large')
+                        return None, None
 
             return header_bytes, bytes(body)
 
@@ -84,7 +125,7 @@ class HttpServer:
         try:
             headers, body = await self.process_request(client)
 
-            if not headers:
+            if headers is None or not headers:
                 return
 
             client_details = client.getpeername()
@@ -114,7 +155,7 @@ class HttpServer:
         try:
             headers, body = await self.process_request(client)
 
-            if not headers:
+            if headers is None or not headers:
                 return
 
             request = Request(
@@ -126,7 +167,7 @@ class HttpServer:
             upgrade = WebsocketUpgrade(headers=headers)
             await self.send_data(client, upgrade.upgrade_response.encode('utf-8'))
 
-            ws_connection = WebsocketServer(client)
+            ws_connection = WebsocketServer(client, cookies=dict(request.cookies))
             await self.app.ws_server.connect_wsgi(ws_connection=ws_connection)
 
         except TypeError:
@@ -185,15 +226,24 @@ class HttpServer:
             if match:
                 content_length = int(match.group(1))
 
+            max_body = get_max_body_size()
+            if content_length > max_body:
+                await self._send_simple_error(client, 413, b'Payload Too Large')
+                return
+
             body = bytearray(body_start)
-            async with asyncio.timeout(self.timeout):
+            async with async_timeout(self.timeout):
                 while len(body) < content_length:
+                    remaining = min(content_length - len(body), max_body - len(body) + 1)
                     chunk = await asyncio.get_event_loop().run_in_executor(
-                        None, client.recv, content_length - len(body)
+                        None, client.recv, remaining
                     )
                     if not chunk:
                         break
                     body.extend(chunk)
+                    if len(body) > max_body:
+                        await self._send_simple_error(client, 413, b'Payload Too Large')
+                        return
 
             client_details = client.getpeername()
             client_info = ClientInfo(
@@ -221,11 +271,13 @@ class HttpServer:
         """WebSocket com headers já lidos."""
         try:
             header_bytes = raw.partition(b'\r\n\r\n')[0]
+            header_text = header_bytes.decode('iso-8859-1')
+            cookies = self._parse_cookies(header_text)
 
             upgrade = WebsocketUpgrade(headers=header_bytes)
             client.sendall(upgrade.upgrade_response.encode('utf-8'))
 
-            ws_connection = WebsocketServer(client)
+            ws_connection = WebsocketServer(client, cookies=cookies)
             await self.app.ws_server.connect_wsgi(ws_connection=ws_connection)
 
         except TypeError:

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/connection/websocket.py

@@ -12,6 +12,11 @@ from time import time
 
 from pyweber.models.ws_message import wsMessage
 from pyweber.utils.utils import PrintLine
+from pyweber.utils.security import (
+    SESSION_COOKIE_NAME,
+    generate_session_id,
+    unsign_value,
+)
 from pyweber.connection.session import sessions, Session
 from pyweber.models.template_diff import TemplateDiff
 from pyweber.models.task_manager import TaskManager
@@ -85,9 +90,10 @@ class WebsocketUpgrade:
 
 class WebsocketServer:
 
-    def __init__(self, client: Union[socket.socket, ssl.SSLSocket]):
+    def __init__(self, client: Union[socket.socket, ssl.SSLSocket], cookies: dict[str, str] | None = None):
         self.id = None
         self.client = client
+        self.cookies = cookies or {}
         self.__all_message: bytes = b''
         self.__messages: list[bytes] = []
 
@@ -491,8 +497,15 @@ class WebsocketManager(BaseWebsockets):
             group, route = self.app.get_group_and_route(route=route)
             self.app.update_route(route=route, group=group, template=new_template)
 
-    def get_session_id(self, session_id: str = None):
-        return session_id or str(uuid4())
+    def get_session_id(self, session_id: str = None, cookies: dict[str, str] | None = None):
+        """Resolve session id from signed HttpOnly cookie; never trust client id alone."""
+        cookie_jar = cookies or {}
+        signed = cookie_jar.get(SESSION_COOKIE_NAME)
+        cookie_sid = unsign_value(signed) if signed else None
+        if cookie_sid:
+            return cookie_sid
+        # Ignore client-supplied session_id when cookie is missing/invalid
+        return generate_session_id()
 
     async def get_sync_template(self, message: wsMessage):
         assert isinstance(message, wsMessage)
@@ -502,11 +515,6 @@ class WebsocketManager(BaseWebsockets):
             session.old_template = sync_template.clone()
         return sync_template
 
-    def update_app_template(self, new_template: 'Template', route: str):
-        if route in self.app.list_routes:
-            group, route = self.app.get_group_and_route(route=route)
-            self.app.update_route(route=route, group=group, template=new_template)
-
     def add_session(self, session_id: str, template: 'Template', window: 'Window', route: str):
         sessions.add_session(
             session_id=session_id,
@@ -593,7 +601,10 @@ class WebsocketManager(BaseWebsockets):
             )
 
             if is_new_session:
-                ws_server.id = self.get_session_id(session_id=message.session_id)
+                ws_server.id = self.get_session_id(
+                    session_id=message.session_id,
+                    cookies=getattr(ws_server, 'cookies', {}) or {},
+                )
                 self.ws_connections[ws_server.id] = ws_server
 
                 self.add_session(
@@ -633,8 +644,9 @@ class WebsocketManager(BaseWebsockets):
                 )
                 await self.message_handler(message=message)
 
-    async def ws_handler_asgi(self, receive: Callable, send: Callable):
+    async def ws_handler_asgi(self, receive: Callable, send: Callable, cookies: dict[str, str] | None = None):
         ws_connection: str = None
+        handshake_cookies = cookies or {}
 
         try:
             while True:
@@ -665,7 +677,10 @@ class WebsocketManager(BaseWebsockets):
                             )
 
                             if is_new_session:
-                                ws_connection = self.get_session_id(session_id=message.session_id)
+                                ws_connection = self.get_session_id(
+                                    session_id=message.session_id,
+                                    cookies=handshake_cookies,
+                                )
 
                                 self.add_session(
                                     session_id=ws_connection,
@@ -720,7 +735,17 @@ class WebsocketManager(BaseWebsockets):
 
     async def __call__(self, scope, receive, send):
         assert scope.get('type', None) == 'websocket'
-        await self.ws_handler_asgi(receive=receive, send=send)
+        headers = {
+            (k.decode() if isinstance(k, bytes) else k).lower():
+            (v.decode() if isinstance(v, bytes) else v)
+            for k, v in scope.get('headers', [])
+        }
+        cookie_header = headers.get('cookie', '')
+        cookies = {
+            part.split('=', 1)[0].strip(): part.split('=', 1)[-1].strip()
+            for part in cookie_header.split(';') if part.strip() and '=' in part
+        }
+        await self.ws_handler_asgi(receive=receive, send=send, cookies=cookies)
 
         for id, handler in self.ws_connections.items():
             if handler == send:

{pyweber-1.3.0.dev20260609 → pyweber-1.5.0.dev0}/pyweber/core/__init__.py

@@ -6,6 +6,11 @@ from .events import (
     WindowEvents,
     TemplateEvents
 )
+from .html_parser import (
+    get_html_parser_backend,
+    set_html_parser_backend,
+    reset_html_parser_backend,
+)
 
 __all__ = [
     'Element',
@@ -13,5 +18,8 @@ __all__ = [
     'window',
     'EventHandler',
     'WindowEvents',
-    'TemplateEvents'
+    'TemplateEvents',
+    'get_html_parser_backend',
+    'set_html_parser_backend',
+    'reset_html_parser_backend',
 ]