pyweber 1.5.0.dev3__tar.gz → 1.6.0__tar.gz

{pyweber-1.5.0.dev3/pyweber.egg-info → pyweber-1.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyweber
-Version: 1.5.0.dev3
+Version: 1.6.0
 Summary: A lightweight Python framework for building and managing web applications.
 Author-email: DevPythonMZ <pypi.dev@gmail.com>
 License-Expression: Apache-2.0
@@ -10,6 +10,7 @@ Project-URL: Tracker, https://github.com/pyweber/pyweber/issues
 Project-URL: PyPI, https://pypi.org/project/pyweber/
 Project-URL: YouTube, https://youtube.com/@devpythonMZ
 Project-URL: Examples, https://github.com/pyweber-examples
+Project-URL: Security, https://pyweber.dev/guides/supported-versions/
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -24,6 +25,19 @@ Requires-Dist: pytest-cov; extra == "dev"
 Requires-Dist: pytest-asyncio; extra == "dev"
 Provides-Extra: fast-html
 Requires-Dist: lxml; extra == "fast-html"
+Provides-Extra: db
+Requires-Dist: sqlalchemy[asyncio]>=2.0; extra == "db"
+Requires-Dist: alembic>=1.13; extra == "db"
+Provides-Extra: db-sqlite
+Requires-Dist: aiosqlite>=0.20; extra == "db-sqlite"
+Provides-Extra: db-pg
+Requires-Dist: asyncpg>=0.29; extra == "db-pg"
+Provides-Extra: db-mysql
+Requires-Dist: aiomysql>=0.2; extra == "db-mysql"
+Provides-Extra: db-mssql
+Requires-Dist: aioodbc>=0.5; extra == "db-mssql"
+Provides-Extra: redis
+Requires-Dist: redis[hiredis]>=8.1.0; extra == "redis"
 Dynamic: license-file
 
 # Pyweber Framework
@@ -42,17 +56,25 @@ Pyweber is a lightweight Python web framework designed to create dynamic, reacti
 - **Intuitive DOM Manipulation**: Query and modify elements with familiar selectors
 - **Event-Driven Programming**: Handle user interactions with Python event handlers
 - **WebSocket Integration**: Real-time communication between client and server
-- **Template Handoff (1.3.0)**: WebSocket sessions reuse the HTTP-rendered template — handlers are not executed twice on connect
+- **Template Handoff (1.3.0+)**: WebSocket sessions reuse the HTTP-rendered template — handlers are not executed twice on connect
+- **Identity-preserving sync (1.6.0+)**: `self` / subclass element refs stay valid after WS connect
+- **Optional ORM & Redis sessions (1.6.0+)**: `pyweber[db]`, `pyweber[redis]`
+- **Auth & RBAC (1.5+)**: signed login cookie, roles/permissions
 - **Minimal Configuration**: Get started quickly with sensible defaults
 
 ## Quick Start
 
 ### Installation
 
+!!! danger "Avoid ≤ 1.3.1"
+    Older lines are **not recommended** for production. Use a current release:
+
 ```bash
-pip install pyweber
+pip install -U 'pyweber>=1.6'
 ```
 
+See [Supported versions](https://pyweber.dev/guides/supported-versions/) (docs) for yank / security notes. `pyproject.toml` cannot warn when someone pins an old wheel — that requires [PyPI yanking](https://docs.pypi.org/project-management/yanking/).
+
 ### Create a Project
 
 ```bash
@@ -249,7 +271,7 @@ pyweber add-section --section-name database
 pyweber --update
 ```
 
-Visit [Pyweber Docs](https://pyweber.dev/) for complete documentation. See [CHANGELOG.md](CHANGELOG.md) for release notes (latest: **1.3.0** — Template Handoff, 405 fixes, recursion tracking).
+Visit [Pyweber Docs](https://pyweber.dev/) for complete documentation. See [CHANGELOG.md](CHANGELOG.md) for release notes (latest: **1.6.0** — optional ORM/Redis, identity-preserving WS sync, reactive event fixes).
 
 ## License
 

{pyweber-1.5.0.dev3 → pyweber-1.6.0}/README.md

@@ -14,17 +14,25 @@ Pyweber is a lightweight Python web framework designed to create dynamic, reacti
 - **Intuitive DOM Manipulation**: Query and modify elements with familiar selectors
 - **Event-Driven Programming**: Handle user interactions with Python event handlers
 - **WebSocket Integration**: Real-time communication between client and server
-- **Template Handoff (1.3.0)**: WebSocket sessions reuse the HTTP-rendered template — handlers are not executed twice on connect
+- **Template Handoff (1.3.0+)**: WebSocket sessions reuse the HTTP-rendered template — handlers are not executed twice on connect
+- **Identity-preserving sync (1.6.0+)**: `self` / subclass element refs stay valid after WS connect
+- **Optional ORM & Redis sessions (1.6.0+)**: `pyweber[db]`, `pyweber[redis]`
+- **Auth & RBAC (1.5+)**: signed login cookie, roles/permissions
 - **Minimal Configuration**: Get started quickly with sensible defaults
 
 ## Quick Start
 
 ### Installation
 
+!!! danger "Avoid ≤ 1.3.1"
+    Older lines are **not recommended** for production. Use a current release:
+
 ```bash
-pip install pyweber
+pip install -U 'pyweber>=1.6'
 ```
 
+See [Supported versions](https://pyweber.dev/guides/supported-versions/) (docs) for yank / security notes. `pyproject.toml` cannot warn when someone pins an old wheel — that requires [PyPI yanking](https://docs.pypi.org/project-management/yanking/).
+
 ### Create a Project
 
 ```bash
@@ -221,7 +229,7 @@ pyweber add-section --section-name database
 pyweber --update
 ```
 
-Visit [Pyweber Docs](https://pyweber.dev/) for complete documentation. See [CHANGELOG.md](CHANGELOG.md) for release notes (latest: **1.3.0** — Template Handoff, 405 fixes, recursion tracking).
+Visit [Pyweber Docs](https://pyweber.dev/) for complete documentation. See [CHANGELOG.md](CHANGELOG.md) for release notes (latest: **1.6.0** — optional ORM/Redis, identity-preserving WS sync, reactive event fixes).
 
 ## License
 

{pyweber-1.5.0.dev3 → pyweber-1.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyweber"
-version = "1.5.0.dev3"
+version = "1.6.0"
 description = "A lightweight Python framework for building and managing web applications."
 readme = "README.md"
 authors = [{ name = "DevPythonMZ", email = "pypi.dev@gmail.com" }]
@@ -18,6 +18,8 @@ Tracker = "https://github.com/pyweber/pyweber/issues"
 PyPI = "https://pypi.org/project/pyweber/"
 YouTube = "https://youtube.com/@devpythonMZ"
 Examples = "https://github.com/pyweber-examples"
+# Supported versions / security policy (≤1.3.1 not recommended; yank on PyPI — not via this file)
+Security = "https://pyweber.dev/guides/supported-versions/"
 
 [project.scripts]
 pyweber = "pyweber.cli.commands:app"
@@ -29,6 +31,12 @@ include = ["pyweber*"]
 [project.optional-dependencies]
 dev = ["pytest", "pytest-cov", "pytest-asyncio"]
 fast-html = ["lxml"]
+db = ["sqlalchemy[asyncio]>=2.0", "alembic>=1.13"]
+db-sqlite = ["aiosqlite>=0.20"]
+db-pg = ["asyncpg>=0.29"]
+db-mysql = ["aiomysql>=0.2"]
+db-mssql = ["aioodbc>=0.5"]
+redis = ["redis[hiredis]>=8.1.0"]
 
 [tool.setuptools.package-data]
 pyweber = ["static/**/*", "admin/**/*"]

{pyweber-1.5.0.dev3 → pyweber-1.6.0}/pyweber/__init__.py

@@ -76,17 +76,35 @@ from .utils.security import (
     sign_value,
     unsign_value,
     generate_csrf_token,
+    get_csrf_token,
 )
 from .utils.icons import Icons
 from .utils.deprecation import warn_deprecated
 from .testing import TestClient
+from .auth import (
+    login_required,
+    login_user,
+    logout_user,
+    current_user,
+    get_user_id,
+    hash_password,
+    check_password,
+    permission_required,
+    role_required,
+    register_roles,
+    clear_roles,
+    define_role,
+    has_role,
+    has_all_roles,
+    has_permission,
+    user_permissions,
+)
 
 from .utils.types import (
     ContentTypes,
     EventType,
     HTMLTag,
     HTTPStatusCode,
-    JWTAlgorithms,
     NonSelfClosingHTMLTags,
     WebSocketStatusCode,
     WindowEventType,
@@ -129,7 +147,6 @@ from .components.input import (
     Input,
     InputButton,
     InputCheckbox,
-    InputCheckbox,
     InputColor,
     InputDate,
     InputEmail,
@@ -200,6 +217,7 @@ __all__ = [
     'sign_value',
     'unsign_value',
     'generate_csrf_token',
+    'get_csrf_token',
     'ContentTypes',
     'EventType',
     'HTMLTag',
@@ -244,6 +262,22 @@ __all__ = [
     'SecurityEnforcer',
     'SecurityError',
     'ForbiddenError',
+    'login_required',
+    'login_user',
+    'logout_user',
+    'current_user',
+    'get_user_id',
+    'hash_password',
+    'check_password',
+    'permission_required',
+    'role_required',
+    'register_roles',
+    'clear_roles',
+    'define_role',
+    'has_role',
+    'has_all_roles',
+    'has_permission',
+    'user_permissions',
     'Icon',
     'Style',
     'Script',
@@ -251,7 +285,6 @@ __all__ = [
     'Input',
     'InputButton',
     'InputCheckbox',
-    'InputCheckbox',
     'InputColor',
     'InputDate',
     'InputEmail',
@@ -271,3 +304,21 @@ __all__ = [
     'Label',
     'TextArea',
 ]
+
+
+def __getattr__(name: str):
+    if name == 'JWTAlgorithms':
+        from pyweber.utils.deprecation import warn_deprecated
+        from pyweber.utils.types import JWTAlgorithms as _JWTAlgorithms
+
+        warn_deprecated(
+            'pyweber.JWTAlgorithms',
+            alternative=(
+                'pyjwt (or similar) for encode/decode/verify; '
+                'pyweber.auth for session login. '
+                'JWTAlgorithms remains an algorithm-name enum only until 2.0'
+            ),
+            removal='2.0',
+        )
+        return _JWTAlgorithms
+    raise AttributeError(f'module {__name__!r} has no attribute {name!r}')

pyweber-1.6.0/pyweber/auth/__init__.py

@@ -0,0 +1,44 @@
+"""Lightweight session login helpers (Flask-Login style, no ORM) + RBAC."""
+
+from pyweber.auth.decorators import login_required, permission_required, role_required
+from pyweber.auth.passwords import check_password, hash_password
+from pyweber.auth.rbac import (
+    RoleRegistry,
+    clear_roles,
+    define_role,
+    get_role_registry,
+    has_all_roles,
+    has_permission,
+    has_role,
+    register_roles,
+    user_permissions,
+)
+from pyweber.auth.session import (
+    USER_COOKIE_NAME,
+    current_user,
+    get_user_id,
+    login_user,
+    logout_user,
+)
+
+__all__ = [
+    'USER_COOKIE_NAME',
+    'RoleRegistry',
+    'check_password',
+    'clear_roles',
+    'current_user',
+    'define_role',
+    'get_role_registry',
+    'get_user_id',
+    'has_all_roles',
+    'has_permission',
+    'has_role',
+    'hash_password',
+    'login_required',
+    'login_user',
+    'logout_user',
+    'permission_required',
+    'register_roles',
+    'role_required',
+    'user_permissions',
+]

pyweber-1.6.0/pyweber/auth/decorators.py

@@ -0,0 +1,201 @@
+"""``@login_required`` / ``@permission_required`` / ``@role_required``."""
+
+from __future__ import annotations
+
+import inspect
+from functools import wraps
+from typing import Any, Callable
+
+from pyweber.auth.rbac import user_has_permissions, user_has_roles
+from pyweber.auth.session import current_user
+from pyweber.models.context import get_current_request
+from pyweber.models.response import Response
+from pyweber.utils.types import ContentTypes
+
+
+def _wants_json(request) -> bool:
+    if request is None:
+        return False
+    accept = (request.headers.get('accept') or '').lower()
+    if 'application/json' in accept:
+        if 'text/html' not in accept:
+            return True
+        return accept.find('application/json') <= accept.find('text/html')
+    return False
+
+
+def _unauthorized(*, redirect: str | None, request) -> Response:
+    if redirect and not _wants_json(request):
+        return Response(
+            content=b'',
+            status=302,
+            request=request,
+            route=redirect,
+            headers={'Location': redirect},
+            content_type=ContentTypes.txt,
+        )
+    return Response.json({'detail': 'Unauthorized'}, status=401, request=request)
+
+
+def _forbidden(*, request) -> Response:
+    return Response.json({'detail': 'Forbidden'}, status=403, request=request)
+
+
+def _authorize(
+    user: dict[str, Any] | None,
+    *,
+    roles: list[str] | None,
+    roles_all: list[str] | None,
+    permissions: list[str] | None,
+    permissions_all: list[str] | None,
+) -> str | None:
+    """Return ``'unauthorized'``, ``'forbidden'``, or ``None`` if allowed."""
+    if user is None:
+        return 'unauthorized'
+    if not user_has_roles(user, roles, roles_all=roles_all):
+        return 'forbidden'
+    if not user_has_permissions(user, permissions, permissions_all=permissions_all):
+        return 'forbidden'
+    return None
+
+
+def _wrap_handler(
+    func: Callable,
+    *,
+    redirect: str | None,
+    roles: list[str] | None,
+    roles_all: list[str] | None,
+    permissions: list[str] | None,
+    permissions_all: list[str] | None,
+):
+    if inspect.iscoroutinefunction(func):
+        @wraps(func)
+        async def async_wrapper(*args, **kwargs):
+            request = get_current_request()
+            decision = _authorize(
+                current_user(),
+                roles=roles,
+                roles_all=roles_all,
+                permissions=permissions,
+                permissions_all=permissions_all,
+            )
+            if decision == 'unauthorized':
+                return _unauthorized(redirect=redirect, request=request)
+            if decision == 'forbidden':
+                return _forbidden(request=request)
+            return await func(*args, **kwargs)
+
+        return async_wrapper
+
+    @wraps(func)
+    def sync_wrapper(*args, **kwargs):
+        request = get_current_request()
+        decision = _authorize(
+            current_user(),
+            roles=roles,
+            roles_all=roles_all,
+            permissions=permissions,
+            permissions_all=permissions_all,
+        )
+        if decision == 'unauthorized':
+            return _unauthorized(redirect=redirect, request=request)
+        if decision == 'forbidden':
+            return _forbidden(request=request)
+        return func(*args, **kwargs)
+
+    return sync_wrapper
+
+
+def login_required(
+    fn: Callable | None = None,
+    *,
+    redirect: str | None = None,
+    roles: list[str] | None = None,
+    roles_all: list[str] | None = None,
+    permissions: list[str] | None = None,
+    permissions_all: list[str] | None = None,
+):
+    """Require a logged-in user (cookie) or ``request.auth`` from OpenAPI schemes.
+
+    RBAC (optional)::
+
+        @login_required(roles=['admin', 'moderator'])          # any role
+        @login_required(roles_all=['staff', 'verified'])       # all roles
+        @login_required(permissions=['posts:write'])           # via register_roles()
+        @login_required(permissions_all=['posts:read', 'posts:write'])
+
+    Usage::
+
+        @app.route('/dash')
+        @login_required(redirect='/login')
+        def dash():
+            ...
+
+        @login_required  # bare form
+        def api_me():
+            ...
+    """
+
+    def decorator(func: Callable):
+        return _wrap_handler(
+            func,
+            redirect=redirect,
+            roles=roles,
+            roles_all=roles_all,
+            permissions=permissions,
+            permissions_all=permissions_all,
+        )
+
+    if fn is not None and callable(fn):
+        return decorator(fn)
+    return decorator
+
+
+def permission_required(
+    *permissions: str,
+    redirect: str | None = None,
+    require_all: bool = False,
+):
+    """Shorthand for ``@login_required(permissions=…)`` / ``permissions_all=``.
+
+    ::
+
+        @permission_required('posts:write')
+        def create(): ...
+
+        @permission_required('a', 'b', require_all=True)
+        def both(): ...
+    """
+    if not permissions:
+        raise TypeError('permission_required() needs at least one permission')
+    perms = list(permissions)
+    return login_required(
+        redirect=redirect,
+        permissions=None if require_all else perms,
+        permissions_all=perms if require_all else None,
+    )
+
+
+def role_required(
+    *roles: str,
+    redirect: str | None = None,
+    require_all: bool = False,
+):
+    """Shorthand for ``@login_required(roles=…)`` / ``roles_all=``.
+
+    ::
+
+        @role_required('admin')
+        def admin_panel(): ...
+
+        @role_required('staff', 'verified', require_all=True)
+        def staff_only(): ...
+    """
+    if not roles:
+        raise TypeError('role_required() needs at least one role')
+    rs = list(roles)
+    return login_required(
+        redirect=redirect,
+        roles=None if require_all else rs,
+        roles_all=rs if require_all else None,
+    )

pyweber-1.6.0/pyweber/auth/passwords.py

@@ -0,0 +1,52 @@
+"""Password hashing helpers (stdlib PBKDF2-HMAC-SHA256)."""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+import secrets
+
+DEFAULT_ITERATIONS = 260_000
+_SCHEME = 'pbkdf2_sha256'
+
+
+def hash_password(password: str, *, iterations: int = DEFAULT_ITERATIONS) -> str:
+    """Hash a password for storage.
+
+    Format: ``pbkdf2_sha256$<iterations>$<salt_hex>$<digest_hex>``
+    """
+    if not isinstance(password, str) or password == '':
+        raise ValueError('password must be a non-empty string')
+    salt = secrets.token_hex(16)
+    digest = hashlib.pbkdf2_hmac(
+        'sha256',
+        password.encode('utf-8'),
+        bytes.fromhex(salt),
+        iterations,
+    ).hex()
+    return f'{_SCHEME}${iterations}${salt}${digest}'
+
+
+def check_password(password: str, encoded: str) -> bool:
+    """Constant-time verify of ``password`` against ``hash_password`` output."""
+    if not password or not encoded or not isinstance(encoded, str):
+        return False
+    try:
+        scheme, iter_s, salt, digest = encoded.split('$', 3)
+    except ValueError:
+        return False
+    if scheme != _SCHEME:
+        return False
+    try:
+        iterations = int(iter_s)
+        salt_b = bytes.fromhex(salt)
+        expected = bytes.fromhex(digest)
+    except (TypeError, ValueError):
+        return False
+    actual = hashlib.pbkdf2_hmac(
+        'sha256',
+        password.encode('utf-8'),
+        salt_b,
+        iterations,
+    )
+    return hmac.compare_digest(actual, expected)