quantum-framework 0.12.0__tar.gz → 0.13.0__tar.gz

{quantum_framework-0.12.0/quantum_framework.egg-info → quantum_framework-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: quantum-framework
-Version: 0.12.0
+Version: 0.13.0
 Summary: Full-stack declarative framework for building web, desktop, and mobile applications
 Author-email: Daniel Gregorio <danielgregorio2611@gmail.com>
 License: MIT

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "quantum-framework"
-version = "0.12.0"
+version = "0.13.0"
 description = "Full-stack declarative framework for building web, desktop, and mobile applications"
 readme = "README.md"
 license = {text = "MIT"}

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/cli/commands/migrate.py

@@ -70,7 +70,9 @@ class DatabaseConnection:
             if not caminho.is_absolute():
                 caminho = self.project_path / caminho
             caminho.parent.mkdir(parents=True, exist_ok=True)
-            self._conn = sqlite3.connect(str(caminho))
+            # isolation_level=None: execute_script opens the transaction
+            # itself, so a CREATE TABLE is inside it too (DB-8).
+            self._conn = sqlite3.connect(str(caminho), isolation_level=None)
             self._db_type = 'sqlite'
             logger.info("Migrating datasource %s (SQLite at %s)", nome, caminho)
             return self._conn
@@ -128,6 +130,32 @@ class DatabaseConnection:
             cursor.execute(sql)
         return cursor
 
+    def execute_script(self, sql: str):
+        """Run a whole migration file, in one transaction (DB-8).
+
+        sqlite3's execute() takes ONE statement, so every migration with more
+        than one — a table and its index — failed with "You can only execute
+        one statement at a time". The statements are split here and run
+        inside an explicit BEGIN, which commit()/rollback() close: a failure
+        halfway leaves no table behind.
+        """
+        if self._db_type != 'sqlite':
+            return self.execute(sql)
+        import sqlite3
+        cursor = self._conn.cursor()
+        if not self._conn.in_transaction:
+            cursor.execute('BEGIN')
+        pedaco = ''
+        for linha in sql.splitlines(keepends=True):
+            pedaco += linha
+            if sqlite3.complete_statement(pedaco):
+                if pedaco.strip():
+                    cursor.execute(pedaco)
+                pedaco = ''
+        if pedaco.strip() and not all(l.strip().startswith('--') or not l.strip() for l in pedaco.splitlines()):
+            raise MigrationError(f"incomplete SQL statement at the end: {pedaco.strip()[:80]!r}")
+        return cursor
+
     def commit(self):
         self._conn.commit()
 
@@ -275,7 +303,7 @@ class MigrationRunner:
                 click.echo(f"Applying {migration.version}: {migration.name}...")
 
                 # Execute migration SQL
-                self.db.execute(migration.content)
+                self.db.execute_script(migration.content)
 
                 # Record migration
                 self._record_migration(migration)
@@ -338,7 +366,7 @@ class MigrationRunner:
                 click.echo(f"Rolling back {version}: {migration_info['name']}...")
 
                 # Execute rollback SQL
-                self.db.execute(down_file.read_text())
+                self.db.execute_script(down_file.read_text())
 
                 # Remove migration record
                 self._remove_migration_record(version)

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/cli/runner.py

@@ -24,6 +24,7 @@ if os.name == 'nt':  # Windows
 from quantum.core.parser import QuantumParser, QuantumParseError
 from quantum.core.ast_nodes import ComponentNode, ApplicationNode, JobNode
 from quantum.runtime.component import ComponentRuntime, ComponentExecutionError
+from quantum.runtime.executors.control_flow.redirect_executor import PageRedirect
 from quantum.runtime.web_server import QuantumWebServer
 
 # Import deploy commands (lazy load to avoid import errors if requests not installed)
@@ -166,6 +167,9 @@ class QuantumRunner:
         except ComponentExecutionError as e:
             print(f"[ERROR] Execution error: {e}")
             return 1
+        except PageRedirect as r:
+            print(f"[REDIRECT] {r.status} {r.url}")
+            return 0
     
     def _execute_application(self, app: ApplicationNode, debug: bool = False) -> int:
         """Execute q:application"""

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/core/expression_stdlib.py

@@ -15,6 +15,9 @@ Functions are looked up by name from expressions, so anything added here
 becomes language surface. That is the reason to keep it short.
 """
 
+import math
+import re
+from decimal import Decimal, ROUND_HALF_UP
 from datetime import datetime, timedelta
 from typing import Any, Iterable, Optional
 
@@ -84,6 +87,13 @@ def _split(v: Any, sep: str = ",") -> list: return str(v).split(sep)
 def _contains(v: Any, needle: Any) -> bool: return str(needle) in str(v)
 
 
+def _slugify(v: Any) -> str:
+    """'Olá, Mundo!' -> 'ola-mundo': for URLs made from a title (EXPR-9)."""
+    import unicodedata
+    texto = unicodedata.normalize('NFKD', str(v)).encode('ascii', 'ignore').decode('ascii')
+    return re.sub(r'[^a-z0-9]+', '-', texto.lower()).strip('-')
+
+
 # -- collections -----------------------------------------------------------
 
 def _len(v: Any) -> int:
@@ -114,8 +124,21 @@ def _sort(v: Iterable, reverse: bool = False) -> list:
 # -- numbers ---------------------------------------------------------------
 
 def _round(v: Any, digits: int = 0) -> Any:
-    result = round(float(v), int(digits))
-    return int(result) if digits == 0 else result
+    # EXPR-9: half away from zero, as in ColdFusion and spreadsheets. Python's
+    # round() is banker's rounding over binary floats: round(2.5) was 2 and
+    # round(0.125, 2) was 0.12. Decimal over the number's text avoids both.
+    casas = int(digits)
+    passo = Decimal(1).scaleb(-casas)
+    result = Decimal(str(v)).quantize(passo, rounding=ROUND_HALF_UP)
+    return int(result) if casas <= 0 else float(result)
+
+
+def _ceil(v: Any) -> int:
+    return math.ceil(float(v))
+
+
+def _floor(v: Any) -> int:
+    return math.floor(float(v))
 
 
 # -- passwords ---------------------------------------------------------------
@@ -165,6 +188,7 @@ STDLIB = {
     'replace': _replace,
     'split': _split,
     'contains': _contains,
+    'slugify': _slugify,
     # collections
     'len': _len,
     'first': _first,
@@ -173,6 +197,8 @@ STDLIB = {
     'sort': _sort,
     # numbers
     'round': _round,
+    'ceil': _ceil,
+    'floor': _floor,
     'abs': abs,
     'min': min,
     'max': max,

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/core/expressions.py

@@ -23,6 +23,7 @@ access, and the whole arithmetic/comparison/call surface is about 15%.
 """
 
 import ast
+import contextvars
 import math
 import operator
 import re
@@ -30,6 +31,11 @@ from typing import Any, Callable, Dict, Optional
 
 from quantum.core.expression_stdlib import STDLIB
 
+# EXPR-8: in a condition, a key a scope does not have (`session.userId`
+# before login) is absent, not a failure — see ExpressionEvaluator.evaluate.
+_SCOPES = ('session', 'application', 'request', 'cookie', 'form', 'query')
+_ABSENT_SCOPE_KEY_IS_NONE = contextvars.ContextVar('absent_scope_key_is_none', default=False)
+
 
 class ExpressionError(Exception):
     """Raised when an expression cannot be evaluated."""
@@ -249,6 +255,43 @@ def _normalise_js_operators(source: str) -> str:
     return ''.join(out)
 
 
+# EXPR-10: what a JavaScript habit is called here. `Math.ceil(x)` and
+# `text.split(' ')` are the first things people write; the bare "only named
+# function calls are allowed" did not say what to write instead.
+_JS_EQUIVALENTS = {
+    'Math.ceil': 'ceil(x)', 'Math.floor': 'floor(x)', 'Math.round': 'round(x)',
+    'Math.max': 'max(a, b)', 'Math.min': 'min(a, b)', 'Math.abs': 'abs(x)',
+    'Date.now': 'now()', 'parseInt': 'int(x)', 'parseFloat': 'float(x)',
+    'split': "split(text, ' ')", 'join': "join(items, ', ')", 'toUpperCase': 'upper(text)',
+    'toLowerCase': 'lower(text)', 'trim': 'trim(text)', 'replace': 'replace(text, old, new)',
+    'includes': 'contains(text, part)', 'indexOf': 'contains(text, part)',
+}
+
+
+def _method_hint(func: ast.AST) -> str:
+    if not isinstance(func, ast.Attribute):
+        return ""
+    base = func.value.id if isinstance(func.value, ast.Name) else None
+    chave = f"{base}.{func.attr}" if base in ('Math', 'Date') else func.attr
+    if chave in _JS_EQUIVALENTS:
+        escrito = chave if '.' in chave else f"x.{func.attr}"
+        return f"; write {_JS_EQUIVALENTS[chave]} instead of {escrito}(...)"
+    return f"; call functions by name, e.g. {func.attr}(x), not x.{func.attr}()"
+
+
+def names_read(expression: str) -> set:
+    """The root names an expression reads — `user` in `user.name > 1` — not the
+    functions it calls. An expression that does not parse reads nothing here;
+    evaluating it reports the error."""
+    try:
+        tree = ast.parse(_normalise_js_operators(expression.strip()), mode='eval')
+    except SyntaxError:
+        return set()
+    chamadas = {id(n.func) for n in ast.walk(tree) if isinstance(n, ast.Call)}
+    return {n.id for n in ast.walk(tree)
+            if isinstance(n, ast.Name) and id(n) not in chamadas}
+
+
 class ExpressionEvaluator:
     """Evaluates Quantum `{...}` expressions against a variable context."""
 
@@ -274,8 +317,24 @@ class ExpressionEvaluator:
 
     # -- public API --------------------------------------------------------
 
-    def evaluate(self, expression: str, context: Dict[str, Any]) -> Any:
-        """Evaluate an expression, raising ExpressionError on any failure."""
+    def evaluate(self, expression: str, context: Dict[str, Any],
+                 absent_scope_key_is_none: bool = False) -> Any:
+        """Evaluate an expression, raising ExpressionError on any failure.
+
+        absent_scope_key_is_none (conditions, EXPR-8): `session.x` where the
+        scope has no `x` reads as None instead of raising. A condition is a
+        presence test, and a scope key that is not there yet is the ordinary
+        case (a page runs before login) — raising made the WHOLE condition
+        false, so `not session.authenticated` was false for a visitor with no
+        session and a guard written that way never fired.
+        """
+        marca = _ABSENT_SCOPE_KEY_IS_NONE.set(absent_scope_key_is_none)
+        try:
+            return self._evaluate(expression, context)
+        finally:
+            _ABSENT_SCOPE_KEY_IS_NONE.reset(marca)
+
+    def _evaluate(self, expression: str, context: Dict[str, Any]) -> Any:
         if expression is None:
             raise ExpressionError("expression is None")
 
@@ -473,6 +532,11 @@ class ExpressionEvaluator:
             plano = self._dotted_name(node)
             if plano is not None and plano in ctx:
                 return ctx[plano]
+            if (_ABSENT_SCOPE_KEY_IS_NONE.get() and isinstance(node.value, ast.Name)
+                    and node.value.id in _SCOPES):
+                escopo = ctx.get(node.value.id)
+                if escopo is None or (isinstance(escopo, dict) and node.attr not in escopo):
+                    return None
             return self._attribute(self._eval(node.value, ctx), node.attr)
 
         if isinstance(node, ast.Subscript):
@@ -588,7 +652,7 @@ class ExpressionEvaluator:
 
     def _call(self, node: ast.Call, ctx: Dict[str, Any]) -> Any:
         if not isinstance(node.func, ast.Name):
-            raise ExpressionError("only named function calls are allowed")
+            raise ExpressionError("only named function calls are allowed" + _method_hint(node.func))
         fn = self.functions.get(node.func.id)
         if fn is None and self.function_resolver is not None:
             # A q:function declared by the component being executed.
@@ -600,7 +664,8 @@ class ExpressionEvaluator:
         if fn is None:
             raise ExpressionError(
                 f"function {node.func.id!r} is not defined"
-                f"{_suggest(node.func.id, self.functions)}"
+                + (f"; write {_JS_EQUIVALENTS[node.func.id]}" if node.func.id in _JS_EQUIVALENTS
+                   else _suggest(node.func.id, self.functions))
             )
         args = [self._eval(a, ctx) for a in node.args]
         kwargs = {kw.arg: self._eval(kw.value, ctx) for kw in node.keywords}

quantum_framework-0.13.0/quantum/core/guards.py

@@ -0,0 +1,53 @@
+"""Page guards (AUTH-6): a q:if at the top of a page whose branch has a q:redirect.
+
+    <q:if condition="not session.authenticated">
+      <q:redirect url="/login" />
+    </q:if>
+
+A q:action does not run the page's statements, so a guard written like this
+used to protect only the GET — the POST ran the action without a session.
+Guards now run before each action of the page as well as before the render.
+"""
+
+from typing import List
+
+from quantum.core.ast_nodes import RedirectNode
+from quantum.core.features.conditionals.src.ast_node import IfNode
+
+
+def _branches(node: IfNode) -> List:
+    corpo = list(node.if_body)
+    for bloco in node.elseif_blocks:
+        corpo += list(bloco.get('body', []))
+    return corpo + list(node.else_body)
+
+
+def _has_redirect(nodes) -> bool:
+    return any(isinstance(n, RedirectNode) or (isinstance(n, IfNode) and _has_redirect(_branches(n)))
+               for n in nodes)
+
+
+def page_guards(component) -> List[IfNode]:
+    """The top-level q:if statements that can redirect, in document order."""
+    return [s for s in getattr(component, 'statements', [])
+            if isinstance(s, IfNode) and _has_redirect(_branches(s))]
+
+
+def guard_conditions(node: IfNode) -> List[str]:
+    """Every condition a guard evaluates, nested q:if included."""
+    condicoes = [node.condition] + [b.get('condition', '') for b in node.elseif_blocks]
+    for filho in _branches(node):
+        if isinstance(filho, IfNode):
+            condicoes += guard_conditions(filho)
+    return [c for c in condicoes if c]
+
+
+def mark_guards(component) -> None:
+    """Flag each guard, nested q:if included, so its condition fails closed (AUTH-6)."""
+    def marcar(node):
+        node.is_guard = True
+        for filho in _branches(node):
+            if isinstance(filho, IfNode):
+                marcar(filho)
+    for guarda in page_guards(component):
+        marcar(guarda)

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/core/parser.py

@@ -626,9 +626,60 @@ class QuantumParser:
         self._parse_control_flow_statements(root, component)
 
         self._check_statements_in_markup(component)
+        self._check_guards(component)
 
         return component
 
+    def _check_guards(self, component: ComponentNode) -> None:
+        """AUTH-6: a guard of a page with actions reads only what exists before the page runs.
+
+        Guards also run before each q:action, and an action does not run the
+        page's other statements. A guard reading a page variable would find it
+        missing there, read the condition as false, and let the action run.
+        """
+        from quantum.core.guards import guard_conditions, mark_guards, page_guards
+        from quantum.core.expressions import names_read
+
+        mark_guards(component)
+        if not any(isinstance(s, ActionNode) for s in component.statements):
+            return
+        guardas = page_guards(component)
+        if not guardas:
+            return
+
+        definidos = {p.name for p in getattr(component, 'params', []) or []}
+
+        def definir(nodes):
+            for node in nodes:
+                if isinstance(node, (ActionNode, FunctionNode, HTMLNode, TextNode, CommentNode)):
+                    continue
+                if isinstance(node, IfNode):
+                    corpo = list(node.if_body) + list(node.else_body)
+                    for bloco in node.elseif_blocks:
+                        corpo += list(bloco.get('body', []))
+                    definir(corpo)
+                    continue
+                if isinstance(node, LoopNode):
+                    definir(node.body)
+                    continue
+                nome = getattr(node, 'name', None)
+                if isinstance(nome, str) and nome and '.' not in nome:
+                    definidos.update({nome, f'{nome}_result'})
+
+        definir([s for s in component.statements if not any(s is g for g in guardas)])
+
+        for guarda in guardas:
+            for condicao in guard_conditions(guarda):
+                lidos = names_read(re.sub(r'\{([^{}]*)\}', r'\1', condicao)) & definidos
+                if lidos:
+                    nome = sorted(lidos)[0]
+                    raise QuantumParseError(
+                        f'<q:if condition="{condicao}"> in <q:component name="{component.name}"> '
+                        f'redirects, so it also runs before the page\'s q:action — where the page '
+                        f'has not run and {{{nome}}} does not exist, and the guard would let the '
+                        f'action through. Read the scope directly (e.g. session.x), or protect the '
+                        f'page with require_auth / require_role.')
+
     # Nodes the HTML renderer draws. Anything else inside markup is a statement,
     # and statements run in the execution pass, before the render pass sees
     # the markup around them.
@@ -769,20 +820,13 @@ class QuantumParser:
 
     def _attach_else_sibling(self, if_node: 'IfNode', kind: str, element: ET.Element):
         """Anexa um else/elseif IRMAO ao IfNode anterior — mesmo resultado da
-        forma aninhada que o IfParser ja monta."""
+        forma aninhada que o IfParser ja monta, texto incluido (IF-3)."""
+        corpo = self._parser_registry.get_parser('if')._body(element)
         if kind == 'elseif':
-            condicao = element.get('condition', '')
-            corpo = []
-            for filho in element:
-                stmt = self._parse_statement(filho)
-                if stmt:
-                    corpo.append(stmt)
-            if_node.add_elseif_block(condicao, corpo)
+            if_node.add_elseif_block(element.get('condition', ''), corpo)
         else:
-            for filho in element:
-                stmt = self._parse_statement(filho)
-                if stmt:
-                    if_node.add_else_statement(stmt)
+            for stmt in corpo:
+                if_node.add_else_statement(stmt)
 
     def _parse_statement(self, element: ET.Element) -> Optional[QuantumNode]:
         """Parse individual statement (return, set, dispatchEvent, etc)"""
@@ -791,6 +835,17 @@ class QuantumParser:
         # === MODULAR PARSER REGISTRY (no fallback) ===
         # PHASE 1 DIAGNOSTIC: Legacy fallback disabled to test modular coverage
         if self._use_modular_parsers and self._parser_registry:
+            # PARSE-1: <q:html>, <q:div> — an HTML element name in the q:
+            # namespace. The registry answered for it with the HTML parser, so
+            # <q:html value="{post.content}"/> became an empty <html> element
+            # instead of an unknown tag.
+            # q:script is a Quantum tag on purpose: client JavaScript, kept as
+            # an HTML node (see ui_desktop_adapter).
+            if (self._is_quantum_tag(element) and element_type != 'script'
+                    and element_type in self._parser_registry.html_parser.tag_names):
+                raise QuantumParseError(
+                    f"<q:{element_type}> is not a Quantum tag: HTML elements are written "
+                    f"without the q: prefix (<{element_type}>)")
             if self._parser_registry.has_parser(element_type):
                 return self._parser_registry.parse(element, element_type)
 

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/core/parsers/control_flow/if_parser.py

@@ -8,6 +8,7 @@ from typing import List
 from xml.etree import ElementTree as ET
 from quantum.core.parsers.base import BaseTagParser
 from quantum.core.features.conditionals.src.ast_node import IfNode
+from quantum.core.ast_nodes import TextNode
 
 
 class IfParser(BaseTagParser):
@@ -37,32 +38,34 @@ class IfParser(BaseTagParser):
         condition = self.get_attr(element, 'condition', '')
         if_node = IfNode(condition)
 
+        # IF-3: text directly in a branch is content, like in q:loop and in an
+        # HTML element. Only child elements were read, so
+        # <h2><q:if condition="tag">Posts tagged {tag}</q:if></h2> rendered
+        # an empty heading.
+        principal = self._body(element, skip=('elseif', 'else'))
+        for statement in principal:
+            if_node.add_if_statement(statement)
+
         for child in element:
             child_type = self.get_element_name(child)
-
             if child_type == 'elseif':
-                # Parse elseif block
-                elseif_condition = self.get_attr(child, 'condition', '')
-                elseif_body = []
-
-                for elseif_child in child:
-                    statement = self.parse_statement(elseif_child)
-                    if statement:
-                        elseif_body.append(statement)
-
-                if_node.add_elseif_block(elseif_condition, elseif_body)
-
+                if_node.add_elseif_block(self.get_attr(child, 'condition', ''), self._body(child))
             elif child_type == 'else':
-                # Parse else block
-                for else_child in child:
-                    statement = self.parse_statement(else_child)
-                    if statement:
-                        if_node.add_else_statement(statement)
+                for statement in self._body(child):
+                    if_node.add_else_statement(statement)
 
-            else:
-                # Main if block statement
+        return if_node
+
+    def _body(self, element: ET.Element, skip=()) -> list:
+        """The statements and text of a branch, in document order."""
+        corpo = []
+        if element.text and element.text.strip():
+            corpo.append(TextNode(element.text))
+        for child in element:
+            if self.get_element_name(child) not in skip:
                 statement = self.parse_statement(child)
                 if statement:
-                    if_node.add_if_statement(statement)
-
-        return if_node
+                    corpo.append(statement)
+            if child.tail and child.tail.strip():
+                corpo.append(TextNode(child.tail))
+        return corpo

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/core/parsers/forms/action_parser.py

@@ -8,6 +8,14 @@ from quantum.core.parsers.base import BaseTagParser
 from quantum.core.ast_nodes import ActionNode
 
 
+_NEVER_ENFORCED = {
+    'require_auth': 'Protect the page with require_auth / require_role on the '
+                    'q:component: that covers its actions too (AUTH-1, AUTH-6).',
+    'csrf': 'There is no CSRF token; the session cookie is SameSite=Lax (AUTH-5).',
+    'rate_limit': 'Nothing limits requests; put a reverse proxy in front for that.',
+}
+
+
 class ActionParser(BaseTagParser):
     """
     Parser for q:action statements.
@@ -30,13 +38,15 @@ class ActionParser(BaseTagParser):
         method = element.get('method', 'POST')
         action_node = ActionNode(name, method)
 
-        # Parse optional attributes
-        if element.get('csrf') == 'false':
-            action_node.validate_csrf = False
-        if element.get('rate_limit'):
-            action_node.rate_limit = element.get('rate_limit')
-        if element.get('require_auth') == 'true':
-            action_node.require_auth = True
+        # AUTH-7: attributes that were parsed and never enforced. The worst
+        # is require_auth="true": the action ran for anyone, while the page
+        # read as protected. The docs promised csrf= and rate_limit= too.
+        for attr, porque in _NEVER_ENFORCED.items():
+            if element.get(attr) is not None:
+                from quantum.core.parser import QuantumParseError
+                raise QuantumParseError(
+                    f'<q:action name="{name}"> {attr}= is not supported: it was accepted '
+                    f'and never enforced. {porque}')
 
         # Parse children (params, statements)
         for child in element:

{quantum_framework-0.12.0 → quantum_framework-0.13.0}/quantum/runtime/action_handler.py

@@ -139,13 +139,19 @@ class ActionHandler:
             # nothing — the failure existed only as a flash message the user
             # might never see. Whoever is debugging gets the action name, the
             # exception and the stack.
+            # ACT-9: the most common failure. The action runs without the
+            # page's statements, so a variable the page sets is not here.
+            mensagem = str(e)
+            if 'is not defined' in mensagem:
+                mensagem += (". A q:action does not run the page's statements: "
+                             "query or compute what it needs inside the action")
             logger.exception(
-                "q:action %r failed: %s", getattr(action, 'name', '?'), e
+                "q:action %r failed: %s", getattr(action, 'name', '?'), mensagem
             )
             if owns_context:
                 session['quantum_session'] = context.session_vars
                 session.modified = True
-            self._set_flash_message(f'Action error: {str(e)}', 'error')
+            self._set_flash_message(f'Action error: {mensagem}', 'error')
             return None, 500
 
     def _extract_form_data(self) -> Dict[str, Any]: