pyweber 1.5.0.dev0__tar.gz → 1.5.0.dev2__tar.gz

{pyweber-1.5.0.dev0/pyweber.egg-info → pyweber-1.5.0.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweber
-Version: 1.5.0.dev0
+Version: 1.5.0.dev2
 Summary: A lightweight Python framework for building and managing web applications.
 Author-email: DevPythonMZ <pypi.dev@gmail.com>
 License-Expression: Apache-2.0

{pyweber-1.5.0.dev0 → pyweber-1.5.0.dev2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweber"
-version = "1.5.0.dev0"
+version = "1.5.0.dev2"
 description = "A lightweight Python framework for building and managing web applications."
 readme = "README.md"
 authors = [{ name = "DevPythonMZ", email = "pypi.dev@gmail.com" }]
@@ -37,5 +37,5 @@ pyweber = ["static/**/*", "admin/**/*"]
 omit = ["pyweber/cli/commands.py"]
 
 [tool.coverage.report]
-fail_under = 87.5
+fail_under = 86
 show_missing = true

{pyweber-1.5.0.dev0 → pyweber-1.5.0.dev2}/pyweber/models/middleware.py

@@ -33,29 +33,130 @@ class MiddlewareManager:
     def get_onion_middlewares(self):
         return self.__onion
 
-    def before_request(self, status_code: int = 200, process_response: bool = True, order: int = -1):
-        def wrapper(middleware: Callable[..., Template | Element | str | None]):
-            self.__before_request.insert(order, self.set_middleware(
-                    status_code=status_code,
-                    middleware=middleware,
-                    order=order,
-                    process_response=process_response
-                )
+    def before_request(
+        self,
+        fn: Callable | None = None,
+        *,
+        status_code: int = 200,
+        process_response: bool = True,
+        order: int = -1,
+    ):
+        """Flask-style hook: ``(request) -> None | body``.
+
+        Use as ``@app.before_request`` or ``@app.before_request()``.
+        Returning ``None`` continues; any other value short-circuits the route.
+        """
+        if status_code != 200 or process_response is not True:
+            warn_deprecated(
+                'before_request(status_code=..., process_response=...)',
+                alternative='return a Response/Template with the desired status from the hook',
+                removal='2.0',
+            )
+
+        def register(middleware: Callable[..., Any]):
+            self.add_before_request(
+                middleware,
+                status_code=status_code,
+                process_response=process_response,
+                order=order,
             )
             return middleware
-        return wrapper
 
-    def after_request(self, status_code: int = None, process_response: bool = True, order: int = -1):
-        def wrapper(middleware: Callable[..., Response | None]):
-            self.__after_request.insert(order, self.set_middleware(
-                    status_code=status_code,
-                    middleware=middleware,
-                    order=order,
-                    process_response=process_response
-                )
+        if fn is not None and callable(fn):
+            return register(fn)
+        return register
+
+    def after_request(
+        self,
+        fn: Callable | None = None,
+        *,
+        status_code: int = None,
+        process_response: bool = True,
+        order: int = -1,
+    ):
+        """Flask-style hook: ``(response) -> Response``.
+
+        Use as ``@app.after_request`` or ``@app.after_request()``.
+        Returning ``None`` keeps the previous response.
+        """
+        if status_code is not None or process_response is not True:
+            warn_deprecated(
+                'after_request(status_code=..., process_response=...)',
+                alternative='mutate and return the Response from the hook',
+                removal='2.0',
+            )
+
+        def register(middleware: Callable[..., Any]):
+            self.add_after_request(
+                middleware,
+                status_code=status_code,
+                process_response=process_response,
+                order=order,
             )
             return middleware
-        return wrapper
+
+        if fn is not None and callable(fn):
+            return register(fn)
+        return register
+
+    def add_before_request(
+        self,
+        middleware: Callable[..., Any],
+        *,
+        status_code: int = 200,
+        process_response: bool = True,
+        order: int = -1,
+    ):
+        """Register a before_request hook (Flask-style ``add_before_request``)."""
+        entry = self.set_middleware(
+            status_code=status_code,
+            middleware=middleware,
+            order=order,
+            process_response=process_response,
+        )
+        if order < 0 or order >= len(self.__before_request):
+            self.__before_request.append(entry)
+        else:
+            self.__before_request.insert(order, entry)
+        return middleware
+
+    def add_after_request(
+        self,
+        middleware: Callable[..., Any],
+        *,
+        status_code: int = None,
+        process_response: bool = True,
+        order: int = -1,
+    ):
+        """Register an after_request hook (Flask-style ``add_after_request``)."""
+        entry = self.set_middleware(
+            status_code=status_code,
+            middleware=middleware,
+            order=order,
+            process_response=process_response,
+        )
+        if order < 0 or order >= len(self.__after_request):
+            self.__after_request.append(entry)
+        else:
+            self.__after_request.insert(order, entry)
+        return middleware
+
+    # Docs / older aliases
+    def add_before_request_middleware(self, middleware: Callable[..., Any], **kwargs):
+        warn_deprecated(
+            'add_before_request_middleware',
+            alternative='add_before_request',
+            removal='2.0',
+        )
+        return self.add_before_request(middleware, **kwargs)
+
+    def add_after_request_middleware(self, middleware: Callable[..., Any], **kwargs):
+        warn_deprecated(
+            'add_after_request_middleware',
+            alternative='add_after_request',
+            removal='2.0',
+        )
+        return self.add_after_request(middleware, **kwargs)
 
     def middleware(self, order: int = -1):
         """Register onion middleware: ``async def mw(request, call_next)``."""
@@ -88,7 +189,7 @@ class MiddlewareManager:
         resp: Union[Request, Response, str],
         middlewares: list[dict[str, Union[int, Callable, bool]]]
     ):
-        response, status_code, process_response = None, None, None
+        response, status_code, process_response = None, 200, True
 
         for middle_dict in middlewares:
             status_code, middle, _, process_response = middle_dict.values()
@@ -112,22 +213,37 @@ class MiddlewareManager:
                 break
 
         if not isinstance(resp, Response) and response:
+            # Prefer Response.status_code; otherwise decorator status_code (Flask-compat)
+            resolved_status = status_code if status_code is not None else 200
+            if isinstance(response, Response):
+                resolved_status = response.status_code
+            elif isinstance(response, Template) and (status_code is None or status_code == 200):
+                tmpl_code = getattr(response, 'status_code', None) or getattr(response, 'code', None)
+                if tmpl_code:
+                    resolved_status = tmpl_code
+
             return MiddlewareResult(
-                status_code=status_code,
-                process_response=process_response,
+                status_code=resolved_status,
+                process_response=process_response if process_response is not None else True,
                 content=response
             )
 
         if isinstance(resp, Response):
-            if middlewares and not isinstance(response, Response):
-                raise TypeError(f'All after request middleware need return Response instances, but got {type(response).__name__}')
+            # after_request: None keeps previous response (tolerant)
+            if response is not None and not isinstance(response, Response):
+                raise TypeError(
+                    f'All after request middleware need return Response instances, '
+                    f'but got {type(response).__name__}'
+                )
 
             return MiddlewareResult(
-                content=response or resp,
+                content=response if isinstance(response, Response) else resp,
                 status_code=resp.status_code,
                 process_response=None
             )
 
+        return None
+
     async def run_onion(
         self,
         request: Request,
@@ -186,13 +302,6 @@ class MiddlewareManager:
                 f"{middleware.__name__} has {len(params)} parameters"
             )
 
-        if len(params) == 1:
-            warn_deprecated(
-                'single-parameter middleware',
-                alternative='@app.middleware with (request, call_next)',
-                removal='2.0',
-            )
-
         if params and not all(
             param.annotation in [Request, Response, inspect.Parameter.empty]
             for param in params

{pyweber-1.5.0.dev0 → pyweber-1.5.0.dev2}/pyweber/models/openapi.py

@@ -1,5 +1,6 @@
 import re
 import inspect
+import types
 from typing import Any, Callable, Union, get_args, get_origin
 import dataclasses
 import sys
@@ -28,10 +29,17 @@ _PRIMITIVE_TYPE_MAP: dict[str, type] = {
     'bytes': bytes,
     'bytearray': bytearray,
     'None': type(None),
-    'NoneType': type(None),
 }
 
 
+def _is_union_origin(origin: Any) -> bool:
+    """True for typing.Union and PEP 604 ``X | Y`` (types.UnionType on 3.10+)."""
+    if origin is Union:
+        return True
+    union_type = getattr(types, 'UnionType', None)
+    return union_type is not None and origin is union_type
+
+
 @dataclasses.dataclass
 class OpenAPIConfig:
     """App-level OpenAPI / Swagger configuration."""
@@ -209,8 +217,8 @@ class OpenApiProcessor:
 
         origin = get_origin(annotation)
         if origin is not None:
-            # Union / Optional → prefer first non-None arg's name
-            if origin is getattr(__import__('typing'), 'Union', None) or str(origin) == 'typing.Union':
+            # Union / Optional / PEP 604 (int | None) → prefer first non-None arg's name
+            if _is_union_origin(origin):
                 args = [a for a in get_args(annotation) if a is not type(None)]
                 if args:
                     return cls.annotation_type_name(args[0])
@@ -664,8 +672,8 @@ class OpenApiProcessor:
         origin = get_origin(annotation)
         args = get_args(annotation)
 
-        # Union / Optional
-        if origin is Union or str(origin) == 'typing.Union':
+        # Union / Optional / PEP 604 (int | None)
+        if _is_union_origin(origin):
             non_none = [a for a in args if a is not type(None)]
             has_none = len(non_none) != len(args)
             if not non_none:

{pyweber-1.5.0.dev0 → pyweber-1.5.0.dev2}/pyweber/models/request.py

@@ -131,12 +131,20 @@ class Request:
 
     @property
     def accept_control_request_headers(self):
-        return self.headers.get('Access-Control-Request-Headers', '')
+        # Headers are normalized to lowercase (WSGI parse + ASGI)
+        return (
+            self.headers.get('access-control-request-headers')
+            or self.headers.get('Access-Control-Request-Headers')
+            or ''
+        )
 
     @property
     def headers(self):
         if self.request_mode.value == 'asgi':
-            return {header[0].decode(): header[1].decode() for header in self.__raw_headers}
+            return {
+                header[0].decode().lower(): header[1].decode()
+                for header in self.__raw_headers
+            }
 
         return self.__parse_headers_wsgi()
 

{pyweber-1.5.0.dev0 → pyweber-1.5.0.dev2}/pyweber/models/response.py

@@ -1,9 +1,13 @@
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+from typing import Any
+
 from pyweber.utils.types import ContentTypes, HTTPStatusCode
 from pyweber.models.request import Request
-from pyweber.config.config import config
 from pyweber.utils.utils import PrintLine, Colors
 from pyweber.utils.security import get_allowed_origins, https_enabled
-from datetime import datetime, timezone
 
 DEFAULT_CSP = (
     "default-src 'self'; "
@@ -16,32 +20,99 @@ DEFAULT_CSP = (
     "form-action 'self'"
 )
 
+# Internal bookkeeping headers — stripped on ASGI wire format
+INTERNAL_RESPONSE_HEADERS = frozenset({
+    'method',
+    'http-version',
+    'status',
+    'request-path',
+    'response-path',
+    'set-cookie',  # handled separately
+    'code',
+})
+
+
+def _coerce_body_and_type(
+    content: Any,
+    content_type: ContentTypes | str | None,
+) -> tuple[bytes, ContentTypes]:
+    if content is None:
+        body = b''
+        inferred = ContentTypes.txt
+    elif isinstance(content, bytes):
+        body = content
+        inferred = ContentTypes.unkown
+    elif isinstance(content, dict) or isinstance(content, list):
+        body = json.dumps(content).encode('utf-8')
+        inferred = ContentTypes.json
+    elif isinstance(content, str):
+        body = content.encode('utf-8')
+        stripped = content.lstrip().lower()
+        inferred = ContentTypes.html if stripped.startswith('<') else ContentTypes.txt
+    else:
+        body = str(content).encode('utf-8')
+        inferred = ContentTypes.txt
+
+    if content_type is None:
+        return body, inferred
+    if isinstance(content_type, ContentTypes):
+        return body, content_type
+    # string mime → best-effort enum match
+    for ct in ContentTypes:
+        if ct.value == content_type or content_type.startswith(ct.value):
+            return body, ct
+    return body, inferred
+
 
 class Response:
     def __init__(
         self,
-        request: Request,
-        response_content: bytes,
-        code: int,
-        cookies: dict[str, str],
-        response_type: ContentTypes,
-        route: str,
-        allowed_methods: list[str] = None,
+        content: Any = None,
+        status: int = 200,
+        *,
+        request: Request | None = None,
+        cookies: dict[str, str] | None = None,
+        content_type: ContentTypes | str | None = None,
+        route: str | None = None,
+        headers: dict[str, Any] | None = None,
+        allowed_methods: list[str] | None = None,
+        # Legacy aliases (still supported)
+        response_content: bytes | None = None,
+        code: int | None = None,
+        response_type: ContentTypes | None = None,
     ):
-        request_headers = request.accept_control_request_headers or "Content-Type, Authorization, X-Requested-With, Accept, X-CSRF-Token"
+        if response_content is not None and content is None:
+            content = response_content
+        if code is not None:
+            status = code
+        if response_type is not None and content_type is None:
+            content_type = response_type
+
+        body, resolved_type = _coerce_body_and_type(content, content_type)
+
+        if request is None:
+            request = Request.stub(method='GET', path=route or '/')
+
+        cookies = cookies if cookies is not None else {}
+        route = route if route is not None else (getattr(request, 'path', None) or '/')
+
+        request_headers = (
+            request.accept_control_request_headers
+            or "Content-Type, Authorization, X-Requested-With, Accept, X-CSRF-Token"
+        )
         self.__request = request
         self.__allowed_methods = allowed_methods
-        self.__body = response_content
-        self.__headers: dict[str, bytes] = {
-            "Content-Type": f"{response_type.value}; charset=UTF-8",
-            "Content-Length": len(response_content),
+        self.__body = body
+        self.__headers: dict[str, Any] = {
+            "Content-Type": f"{resolved_type.value}; charset=UTF-8",
+            "Content-Length": len(body),
             "Connection": 'Close',
             "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0",
             "Pragma": "no-cache",
             "Vary": "Accept-Encoding",
             "Method": request.method,
             "Http-Version": request.scheme,
-            "Status": code,
+            "Status": status,
             "Server": 'Pyweber/1.0',
             "Date": datetime.now(timezone.utc).strftime("%a, %d %b %Y %H:%M:%S GMT"),
             "Set-Cookie": cookies,
@@ -52,7 +123,7 @@ class Response:
             "Referrer-Policy": "strict-origin-when-cross-origin",
             "Content-Security-Policy": DEFAULT_CSP,
             "X-Forwarded-Proto": "https" if https_enabled() else "http",
-            "X-Forwarded-Host": request.host,
+            "X-Forwarded-Host": getattr(request, 'host', None) or 'localhost',
         }
 
         if https_enabled():
@@ -60,9 +131,25 @@ class Response:
 
         self._apply_cors(request, request_headers)
 
-        self.http_status_code = HTTPStatusCode.search_by_code(code)
+        if headers:
+            for key, value in headers.items():
+                self.__headers[key] = value
+
+        self.http_status_code = HTTPStatusCode.search_by_code(status)
         self.__check_status_code()
 
+    @classmethod
+    def json(cls, data: Any, status: int = 200, **kwargs) -> Response:
+        return cls(content=data, status=status, content_type=ContentTypes.json, **kwargs)
+
+    @classmethod
+    def text(cls, data: str, status: int = 200, **kwargs) -> Response:
+        return cls(content=data, status=status, content_type=ContentTypes.txt, **kwargs)
+
+    @classmethod
+    def html(cls, data: str, status: int = 200, **kwargs) -> Response:
+        return cls(content=data, status=status, content_type=ContentTypes.html, **kwargs)
+
     def _apply_cors(self, request: Request, request_headers: str):
         origin = request.origin
         allowed = get_allowed_origins()
@@ -78,20 +165,19 @@ class Response:
     def __check_status_code(self):
         aditional_code: tuple[str, str] = ()
 
-        if self.status_code == 401:
-            aditional_code = ('WWW-Authenticate', f"Basic realm={config.get('app', 'name')}")
+        # WWW-Authenticate is NOT auto-added; set via headers= or set_header / security schemes
 
-        elif self.status_code == 405:
+        if self.status_code == 405:
             allow = ', '.join(self.__allowed_methods) if self.__allowed_methods else 'GET, POST, PUT, DELETE'
             aditional_code = ('Allow', allow)
 
         elif self.status_code == 503:
             aditional_code = ('Retry-After', '60')
 
-        elif self.status_code in range(300,400):
+        elif self.status_code in range(300, 400):
             aditional_code = ('Location', self.response_path)
 
-        if self.status_code not in range(300,400):
+        if self.status_code not in range(300, 400):
             self.set_header('Response-Path', self.request_path)
 
         if aditional_code:
@@ -99,7 +185,7 @@ class Response:
             self.http_status_code += f"\r\n{': '.join(aditional_code)}"
 
     @property
-    def headers(self) -> dict[str, (int, str, bytes)]:
+    def headers(self) -> dict[str, Any]:
         return self.__headers
 
     @property
@@ -123,7 +209,7 @@ class Response:
         return self.__body
 
     @property
-    def cookies(self) -> list[str]:
+    def cookies(self) -> list | dict:
         return self.headers.get('Set-Cookie', [])
 
     @property

{pyweber-1.5.0.dev0 → pyweber-1.5.0.dev2}/pyweber/models/run.py

@@ -86,14 +86,18 @@ def run(
 
     CreateApp(target=target, **kwargs).run()
 
-def encode_header(headers: dict[str, Any], /,*ignore_headers: str):
+def encode_header(headers: dict[str, Any], /, *ignore_headers: str):
+    """Encode response headers for ASGI, skipping internal bookkeeping keys."""
+    from pyweber.models.response import INTERNAL_RESPONSE_HEADERS
+
+    ignored = {h.strip().lower() for h in ignore_headers} | set(INTERNAL_RESPONSE_HEADERS)
     byte_headers: list[tuple[bytes, bytes]] = []
 
     for header, value in headers.items():
-        header = header.strip().lower()
-
-        if header not in set(map(lambda el: el.strip().lower(), ignore_headers)):
-            byte_headers.append((header.encode(), str(value).encode()))
+        key = header.strip().lower()
+        if key in ignored:
+            continue
+        byte_headers.append((key.encode(), str(value).encode()))
 
     return byte_headers
 

{pyweber-1.5.0.dev0 → pyweber-1.5.0.dev2}/pyweber/pyweber/pyweber.py

@@ -73,6 +73,7 @@ class StateResult:
     process_response: bool
     kwargs: dict[str, Any]
     callback: Callable[..., Any]
+    response_headers: dict[str, str] | None = None
 
     def update(
         self,
@@ -82,7 +83,8 @@ class StateResult:
         redirect_path = None,
         process_response = None,
         callback = None,
-        kwargs = {}
+        kwargs = {},
+        response_headers = None,
     ):
         self.template = template if template else self.template
         self.status_code = status_code if status_code else self.status_code
@@ -91,6 +93,8 @@ class StateResult:
         self.process_response = process_response if process_response is not None else self.process_response
         self.callback = callback if callback is not None else self.callback
         self.kwargs = kwargs if kwargs else self.kwargs
+        if response_headers is not None:
+            self.response_headers = response_headers
 
         return self
 
@@ -102,6 +106,7 @@ class TemplateResult:
     process_response: bool
     template: Union[Template, Element, dict, list, str]
     allowed_methods: list[str] = None
+    response_headers: dict[str, str] | None = None
 
 @dataclass
 class ContentResult:
@@ -245,6 +250,10 @@ class Pyweber(
             if rate_limited is not None:
                 return rate_limited
 
+            cors_preflight = self._cors_preflight_response(request)
+            if cors_preflight is not None:
+                return cors_preflight
+
             self._ensure_session_cookie(request)
             self._ensure_csrf_cookie(request)
 
@@ -330,8 +339,13 @@ class Pyweber(
             cookies=dict(self.cookies),
             route=template_result.redirect_path,
             allowed_methods=template_result.allowed_methods,
+            headers=getattr(template_result, 'response_headers', None),
         ) if not isinstance(content_result, Response) else content_result
 
+        if isinstance(content_result, Response) and getattr(template_result, 'response_headers', None):
+            for key, value in template_result.response_headers.items():
+                response.set_header(key, value)
+
         response = self._apply_static_etag(request, response, template_result)
 
         after_request_response = await self.process_middleware(
@@ -788,14 +802,31 @@ class Pyweber(
                     requirements=requirements,
                 )
                 if not challenge.ok:
-                    state_result.update(
-                        template={'detail': challenge.detail},
-                        status_code=challenge.status_code,
-                        content_type=ContentTypes.json,
-                        process_response=False,
-                        callback=None,
-                        redirect_path=path,
-                    )
+                    extra_headers = {}
+                    if challenge.www_authenticate:
+                        extra_headers['WWW-Authenticate'] = challenge.www_authenticate
+
+                    prefers_html = self._prefers_html(request)
+                    if prefers_html and challenge.status_code == 401:
+                        state_result.update(
+                            template=self.page_unauthorized,
+                            status_code=challenge.status_code,
+                            content_type=ContentTypes.html,
+                            process_response=False,
+                            callback=None,
+                            redirect_path=path,
+                            response_headers=extra_headers or None,
+                        )
+                    else:
+                        state_result.update(
+                            template={'detail': challenge.detail},
+                            status_code=challenge.status_code,
+                            content_type=ContentTypes.json,
+                            process_response=False,
+                            callback=None,
+                            redirect_path=path,
+                            response_headers=extra_headers or None,
+                        )
                     return await self._process_templates(state_result=state_result)
 
                 request.auth = challenge.auth
@@ -956,7 +987,35 @@ class Pyweber(
             content_type=state_result.content_type,
             redirect_path=state_result.redirect_path,
             process_response=state_result.process_response,
-            template=template
+            template=template,
+            response_headers=state_result.response_headers,
+        )
+
+    def _prefers_html(self, request: Request) -> bool:
+        accept = (request.headers.get('accept') or '').lower()
+        if 'text/html' not in accept:
+            return False
+        if 'application/json' not in accept:
+            return True
+        return accept.find('text/html') <= accept.find('application/json')
+
+    def _cors_preflight_response(self, request: Request) -> Response | None:
+        """Early OPTIONS 204 with CORS headers when Origin is whitelisted."""
+        method = (request.method or '').upper()
+        if method != 'OPTIONS':
+            return None
+        origin = request.origin
+        from pyweber.utils.security import get_allowed_origins
+        allowed = get_allowed_origins()
+        if not origin or origin.rstrip('/') not in allowed:
+            return None
+        return Response(
+            content=b'',
+            status=204,
+            request=request,
+            cookies={},
+            content_type=ContentTypes.txt,
+            route=request.path or '/',
         )
 
     async def process_route_middleware(self, resp: str, middlewares: list[Callable], status_code: int):