pyweber 1.5.0.dev2__tar.gz → 1.5.0.dev3__tar.gz

{pyweber-1.5.0.dev2/pyweber.egg-info → pyweber-1.5.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweber
-Version: 1.5.0.dev2
+Version: 1.5.0.dev3
 Summary: A lightweight Python framework for building and managing web applications.
 Author-email: DevPythonMZ <pypi.dev@gmail.com>
 License-Expression: Apache-2.0

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweber"
-version = "1.5.0.dev2"
+version = "1.5.0.dev3"
 description = "A lightweight Python framework for building and managing web applications."
 readme = "README.md"
 authors = [{ name = "DevPythonMZ", email = "pypi.dev@gmail.com" }]

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyweber/core/template.py

@@ -15,6 +15,11 @@ class Template:
         self.title = title
         self.__root = self.parse_html()
 
+    @property
+    def include_uuid(self) -> bool:
+        """When False, HTML is static (no uuid attrs) and the reactive WS script is not injected."""
+        return self.__include_uuid
+
     @property
     def template(self):
         return self.__template
@@ -135,6 +140,7 @@ class Template:
         return element
 
     def __create_default_element(self, *args, **kwargs):
+        kwargs.setdefault('include_uuid', self.__include_uuid)
         return Element(*args, **kwargs)
 
     @staticmethod
@@ -204,9 +210,13 @@ class Template:
                 break
 
         if not has_websocket_script:
+            # Reactivity requires stable uuid attrs in HTML. Static pages
+            # (include_uuid=False) must not load the WS client — it stamps
+            # random uuids and can rewrite documentElement (breaking CSS).
             disable_ws = os.environ.get('PYWEBER_DISABLE_WS', False)
+            ws_disabled = disable_ws in [True, 'True', 'true', '1', 1]
 
-            if disable_ws not in [True, 'True', 'true', '1', 1]:
+            if self.__include_uuid and not ws_disabled:
                 head.childs.extend(
                     [
                         self.__create_default_element(
@@ -269,6 +279,7 @@ class Template:
             template=self.template,
             status_code=self.status_code,
             title=self.title,
+            include_uuid=self.__include_uuid,
             **self.kwargs
         )
         tpl.data = self.data

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyweber/models/response.py

@@ -7,19 +7,16 @@ from typing import Any
 from pyweber.utils.types import ContentTypes, HTTPStatusCode
 from pyweber.models.request import Request
 from pyweber.utils.utils import PrintLine, Colors
-from pyweber.utils.security import get_allowed_origins, https_enabled
-
-DEFAULT_CSP = (
-    "default-src 'self'; "
-    "script-src 'self' 'unsafe-inline'; "
-    "style-src 'self' 'unsafe-inline'; "
-    "img-src 'self' data:; "
-    "connect-src 'self' ws: wss:; "
-    "frame-ancestors 'none'; "
-    "base-uri 'self'; "
-    "form-action 'self'"
+from pyweber.utils.security import (
+    DEFAULT_CSP,
+    get_allowed_origins,
+    https_enabled,
+    resolve_csp,
 )
 
+# Re-export for callers that imported DEFAULT_CSP from response
+__all_csp__ = (DEFAULT_CSP, resolve_csp)
+
 # Internal bookkeeping headers — stripped on ASGI wire format
 INTERNAL_RESPONSE_HEADERS = frozenset({
     'method',
@@ -121,11 +118,14 @@ class Response:
             "X-Content-Type-Options": "nosniff",
             "X-Frame-Options": "DENY",
             "Referrer-Policy": "strict-origin-when-cross-origin",
-            "Content-Security-Policy": DEFAULT_CSP,
             "X-Forwarded-Proto": "https" if https_enabled() else "http",
             "X-Forwarded-Host": getattr(request, 'host', None) or 'localhost',
         }
 
+        csp = resolve_csp()
+        if csp:
+            self.__headers["Content-Security-Policy"] = csp
+
         if https_enabled():
             self.__headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
 
@@ -133,7 +133,10 @@ class Response:
 
         if headers:
             for key, value in headers.items():
-                self.__headers[key] = value
+                if value is None:
+                    self.__headers.pop(key, None)
+                else:
+                    self.__headers[key] = value
 
         self.http_status_code = HTTPStatusCode.search_by_code(status)
         self.__check_status_code()

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyweber/models/ws_message.py

@@ -41,6 +41,7 @@ class wsMessage:
 
     async def get_template(self):
         self.__app: 'Pyweber' = self.__app
+        used_handoff = False
         if self.session_id in sessions.all_sessions:
             session_template = sessions.get_session(session_id=self.session_id).template
         else:
@@ -48,12 +49,23 @@ class wsMessage:
                 token=self.get_value(key='handoffToken'),
                 route=self.route or '',
             )
+            if session_template is not None:
+                used_handoff = True
             if session_template is None:
                 session_template = await self.__app.clone_template(route=self.route)
 
-        if self.get_value(key='template'):
-            session_template.root = session_template.parse_html(html=self.get_value('template'))
-            self.insert_values(element=session_template.root)
+        client_html = self.get_value(key='template')
+        if client_html:
+            # With include_uuid=False (or handoff without uuid attrs in HTML),
+            # never parse client outerHTML over the server template — client
+            # may have stamped random uuids that poison the diff contract.
+            keep_server = (
+                not getattr(session_template, 'include_uuid', True)
+                or (used_handoff and 'uuid=' not in client_html.lower())
+            )
+            if not keep_server:
+                session_template.root = session_template.parse_html(html=client_html)
+                self.insert_values(element=session_template.root)
 
         return session_template
 

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyweber/pyweber/pyweber.py

@@ -591,7 +591,14 @@ class Pyweber(
             return False
 
         template = template_result.template
-        return not isinstance(template, (dict, list, set))
+        if isinstance(template, (dict, list, set)):
+            return False
+        # No stable uuid contract → no reactive session handoff
+        if isinstance(template, Template) and not template.include_uuid:
+            return False
+        if isinstance(template, Element) and not getattr(template, 'include_uuid', True):
+            return False
+        return True
 
     def _ensure_template_object(
         self,

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyweber/static/config.toml

@@ -40,5 +40,6 @@ rate_limit_enabled = false
 rate_limit_rpm = 120
 gzip_enabled = true
 gzip_min_bytes = 500
+# csp = 'off'  # or a full Content-Security-Policy string; env PYWEBER_CSP wins
 
 [api_keys]

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyweber/static/js.js

@@ -41,7 +41,9 @@ function connectWebSocket() {
     socket.onopen = async function () {
         socketReady = true;
         reconnectAttempts = 0;
-        sendToServer(await getEventData({ includeTemplate: true }));
+        // Só envia outerHTML no handshake se existir contrato uuid estável
+        const includeTemplate = pageHasStableUuids();
+        sendToServer(await getEventData({ includeTemplate }));
     };
 
     socket.onerror = function (error) {
@@ -250,20 +252,34 @@ async function send_file_chunk(file_id, status, data) {
 }
 
 // ─── DOM ──────────────────────────────────────────────────────────────────────
+function pageHasStableUuids() {
+    return !!document.documentElement.querySelector('[uuid]');
+}
+
 function applyDifferences(differences) {
+    if (!differences || typeof differences !== 'object') return;
+
     Object.keys(differences).forEach(key => {
         const diff = differences[key];
+        if (!diff) return;
 
+        // Root-level replace destroys <link rel="stylesheet"> / Bootstrap / scripts.
+        // Never rewrite documentElement.innerHTML — ignore and keep the live DOM.
         if (!diff.parent) {
             if (diff.status === 'Changed') {
-                const doc = new DOMParser().parseFromString(diff.element, 'text/html');
-                document.documentElement.innerHTML = doc.documentElement.innerHTML;
+                console.warn(
+                    'PyWeber: ignored root document replace (would break CSS/scripts). ' +
+                    'Use include_uuid=True for reactive updates.'
+                );
             }
             return;
         }
 
         const parentElement = document.querySelector(`[uuid="${diff.parent}"]`);
-        if (!parentElement) return;
+        if (!parentElement) {
+            // UUID contract broken (e.g. stamped client uuids vs server) — skip, do not invent a full replace
+            return;
+        }
 
         switch (diff.status) {
             case 'Added':
@@ -286,6 +302,7 @@ function applyDifferences(differences) {
                     if (toChange) {
                         toChange.parentNode.replaceChild(createElementFromHTML(diff.element), toChange);
                     }
+                    // missing uuid target → ignore (do not fall back to full-document rewrite)
                 }
                 break;
             }
@@ -377,9 +394,12 @@ function getHandoffToken() {
     return document.querySelector('meta[name="pyweber-handoff"]')?.content || null;
 }
 
-/** Atribui uuid a nós injectados por JS (ou libs externas) antes do sync com o servidor. */
+/** Atribui uuid a nós injectados por JS (ou libs externas) antes do sync com o servidor.
+ *  Só corre se a página já tiver o contrato uuid (include_uuid=True). Nunca inventa
+ *  um universo de UUIDs em páginas estáticas — isso parte o handoff/diff. */
 function stampMissingUuids(root = document.documentElement) {
     if (!(root instanceof Element)) return;
+    if (!pageHasStableUuids()) return;
 
     const nodes = root === document.documentElement
         ? root.querySelectorAll('*')
@@ -395,6 +415,7 @@ function stampMissingUuids(root = document.documentElement) {
 /** Re-sincroniza DOM → servidor depois de JS injectar HTML (sem uuid) após o WS abrir. */
 async function resyncDomWithServer() {
     if (!socketReady || socket.readyState !== WebSocket.OPEN) return;
+    if (!pageHasStableUuids()) return;
     stampMissingUuids();
     await sendToServer(await getEventData({ includeTemplate: true }));
 }

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3}/pyweber/utils/security.py

@@ -110,6 +110,40 @@ def csrf_enabled() -> bool:
     return bool(value)
 
 
+# Allows HTTPS CDNs (Bootstrap, Google Fonts, jsDelivr icons) while still
+# blocking exotic schemes and clickjacking. Override with PYWEBER_CSP /
+# [security].csp; set to "off" to omit the header.
+DEFAULT_CSP = (
+    "default-src 'self'; "
+    "script-src 'self' 'unsafe-inline' https:; "
+    "style-src 'self' 'unsafe-inline' https:; "
+    "font-src 'self' data: https:; "
+    "img-src 'self' data: https:; "
+    "connect-src 'self' ws: wss: https:; "
+    "frame-ancestors 'none'; "
+    "base-uri 'self'; "
+    "form-action 'self'"
+)
+
+_CSP_OFF = frozenset({'', '0', 'false', 'off', 'none', 'disable', 'disabled'})
+
+
+def resolve_csp() -> str | None:
+    """Return CSP header value, or None to omit the header.
+
+    Precedence: ``PYWEBER_CSP`` env → ``[security].csp`` config → ``DEFAULT_CSP``.
+    """
+    raw = os.environ.get('PYWEBER_CSP')
+    if raw is None:
+        raw = _config().get('security', 'csp', default=None)
+    if raw is None:
+        return DEFAULT_CSP
+    value = str(raw).strip()
+    if value.lower() in _CSP_OFF:
+        return None
+    return value
+
+
 def get_allowed_origins() -> set[str]:
     origins = _config().get('security', 'allowed_origins', default=None)
     if origins is None:

{pyweber-1.5.0.dev2 → pyweber-1.5.0.dev3/pyweber.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweber
-Version: 1.5.0.dev2
+Version: 1.5.0.dev3
 Summary: A lightweight Python framework for building and managing web applications.
 Author-email: DevPythonMZ <pypi.dev@gmail.com>
 License-Expression: Apache-2.0