simple-module-hosting 0.0.1__py3-none-any.whl

simple_module_hosting/redirects.py

@@ -0,0 +1,45 @@
+"""Shared helpers for validating redirect targets.
+
+A raw ``Referer`` header is attacker-controlled — a crafted form on a third
+party site can set it to any value. Any endpoint that 303s back to the
+referring page must validate the URL is same-origin before trusting it, or
+become a reflected open-redirect.
+"""
+
+from __future__ import annotations
+
+from urllib.parse import urlsplit
+
+from fastapi import Request
+
+
+def safe_referer_or_root(request: Request) -> str:
+    """Return the Referer iff it's same-origin; otherwise fall back to ``/``.
+
+    Only honors references that (a) resolve to the same scheme+host as the
+    current request, or (b) are relative paths that don't try to escape to a
+    protocol-relative URL (``//evil.example``).
+    """
+    referer = request.headers.get("referer")
+    if not referer:
+        return "/"
+
+    # Protocol-relative URLs like "//evil.example/foo" resolve against the
+    # origin in browsers but leave the site — reject them.
+    if referer.startswith("//"):
+        return "/"
+
+    parsed = urlsplit(referer)
+    # Relative path with no scheme+host → same-origin by construction.
+    if not parsed.scheme and not parsed.netloc:
+        return referer if referer.startswith("/") else "/"
+
+    # Absolute URL → must match the current request's origin.
+    current = request.url
+    if parsed.scheme == current.scheme and parsed.netloc == current.netloc:
+        path = parsed.path or "/"
+        if parsed.query:
+            path = f"{path}?{parsed.query}"
+        return path
+
+    return "/"

simple_module_hosting/scaffolding.py

@@ -0,0 +1,294 @@
+"""Host + module scaffolding via package-data templates.
+
+* :func:`create_host` materializes a new host project from the templates
+  under ``simple_module_hosting/templates/host/``.
+* :func:`create_module` materializes a new module package from
+  ``simple_module_hosting/templates/module/``.
+
+The frontend pages manifest + per-module JS dep discovery used to live
+here as well; both moved to :mod:`simple_module_hosting.manifest` to
+keep this file under the project's per-file line cap. They're re-exported
+below so existing import sites keep working.
+"""
+
+from __future__ import annotations
+
+import importlib.resources
+import json as _json
+import logging
+import re
+import secrets as _secrets
+import shutil
+from collections.abc import Mapping, Sequence
+from pathlib import Path
+
+from simple_module_hosting.manifest import (
+    collect_module_js_deps,
+    compute_module_pages,
+    read_module_package_json,
+    repo_root_from_client_app,
+    write_module_pages_manifest,
+)
+
+__all__ = [
+    "collect_module_js_deps",
+    "compute_module_pages",
+    "create_app_project",
+    "create_host",
+    "create_module",
+    "read_module_package_json",
+    "repo_root_from_client_app",
+    "write_module_pages_manifest",
+]
+
+logger = logging.getLogger(__name__)
+
+# Templates ship as package data under simple_module_hosting/templates/{host,module}/.
+_TEMPLATES_PACKAGE = "simple_module_hosting.templates"
+
+# Path-segment substitution token used by create_module.
+_PACKAGE_PATH_TOKEN = "__PACKAGE__"
+
+
+def _module_to_pypi_name(name: str) -> str:
+    """'Products' -> 'simple_module_products'. Matches the publishing convention."""
+    return f"simple_module_{name.lower()}"
+
+
+def _iter_template_files(template_root: Path):
+    """Yield every file under ``template_root``, preserving relative paths."""
+    for path in template_root.rglob("*"):
+        if path.is_file():
+            yield path
+
+
+def _require_empty_dest(dest: Path) -> None:
+    """Raise if ``dest`` is an existing non-empty directory — never clobber files."""
+    if dest.exists() and any(dest.iterdir()):
+        raise FileExistsError(
+            f"Destination {dest} already exists and is non-empty. "
+            "Choose a new path or remove the contents first."
+        )
+    dest.mkdir(parents=True, exist_ok=True)
+
+
+def _resolve_template_root(subdir: str, override: Path | None) -> Path:
+    """Return the scaffold template root, either from package data or an override."""
+    if override is not None:
+        return Path(override)
+    return Path(str(importlib.resources.files(_TEMPLATES_PACKAGE) / subdir))
+
+
+def _apply_template_files(
+    src_root: Path,
+    dest: Path,
+    substitutions: Mapping[str, str],
+    *,
+    path_rewrites: Mapping[str, str] | None = None,
+) -> None:
+    """Copy every file under ``src_root`` to ``dest``, applying substitutions.
+
+    Files ending in ``.tpl`` are read as text, placeholders replaced, and
+    written without the suffix. Every other file is copied verbatim. If
+    ``path_rewrites`` is given, each key is replaced by its value anywhere
+    in relative paths (used by :func:`create_module` to rename the
+    ``__PACKAGE__`` directory placeholder).
+    """
+    for src in _iter_template_files(src_root):
+        rel_str = str(src.relative_to(src_root))
+        for old, new in (path_rewrites or {}).items():
+            rel_str = rel_str.replace(old, new)
+        rel_str = rel_str.removesuffix(".tpl")
+        target = dest / rel_str
+        target.parent.mkdir(parents=True, exist_ok=True)
+
+        if src.suffix == ".tpl":
+            text = src.read_text(encoding="utf-8")
+            for placeholder, value in substitutions.items():
+                text = text.replace(placeholder, value)
+            target.write_text(text, encoding="utf-8")
+        else:
+            shutil.copy2(src, target)
+
+
+def create_host(
+    dest: Path,
+    name: str,
+    modules: Sequence[str],
+    template_root: Path | None = None,
+) -> Path:
+    """Materialize a SimpleModule host scaffold at ``dest``.
+
+    Modules listed in ``modules`` become PyPI dependencies in the scaffolded
+    ``pyproject.toml`` (e.g. ``"simple_module_products>=0.1,<1.0"``). Raises
+    :class:`FileExistsError` if ``dest`` is an existing non-empty directory.
+    """
+    dest = Path(dest)
+    _require_empty_dest(dest)
+
+    module_dep_lines = "\n".join(f'    "{_module_to_pypi_name(m)}>=0.1,<1.0",' for m in modules)
+    _apply_template_files(
+        _resolve_template_root("host", template_root),
+        dest,
+        {"{{HOST_NAME}}": name, "{{MODULE_DEPS}}": module_dep_lines},
+    )
+
+    logger.info(
+        "Scaffolded host '%s' at %s (modules: %s)", name, dest, ", ".join(modules) or "<none>"
+    )
+    return dest
+
+
+def _to_snake_case(name: str) -> str:
+    """'MyFeature' / 'my-feature' / 'My Feature' -> 'my_feature'."""
+    s = re.sub(r"(?<!^)(?=[A-Z])", "_", name)
+    s = re.sub(r"[\s\-]+", "_", s)
+    return s.lower()
+
+
+def _to_kebab_case(name: str) -> str:
+    """'MyFeature' / 'my_feature' -> 'my-feature' (used as the PyPI slug)."""
+    return _to_snake_case(name).replace("_", "-")
+
+
+def _to_pascal_case(name: str) -> str:
+    """'my-feature' / 'my_feature' -> 'MyFeature' (the display name in Meta)."""
+    snake = _to_snake_case(name)
+    return "".join(part.capitalize() for part in snake.split("_") if part)
+
+
+def create_module(
+    dest: Path,
+    name: str,
+    template_root: Path | None = None,
+) -> Path:
+    """Materialize a publishable module package at ``dest``.
+
+    ``name`` is accepted in any case style (``MyFeature``, ``my-feature``,
+    ``my_feature``) and normalized to three forms:
+
+    * ``MODULE_NAME``  — ``PascalCase``, appears in ``Meta(name=...)``
+    * ``MODULE_SLUG``  — ``kebab-case``, used in the PyPI distribution name
+    * ``PACKAGE_NAME`` — ``snake_case``, the importable Python package and
+      the entry_point key
+    """
+    dest = Path(dest)
+    _require_empty_dest(dest)
+
+    display_name = _to_pascal_case(name)
+    slug = _to_kebab_case(name)
+    package_name = _to_snake_case(name)
+
+    _apply_template_files(
+        _resolve_template_root("module", template_root),
+        dest,
+        substitutions={
+            "{{MODULE_NAME}}": display_name,
+            "{{MODULE_SLUG}}": slug,
+            "{{PACKAGE_NAME}}": package_name,
+        },
+        path_rewrites={_PACKAGE_PATH_TOKEN: package_name},
+    )
+
+    logger.info("Scaffolded module '%s' at %s (package: %s)", display_name, dest, package_name)
+    return dest
+
+
+# ---------------------------------------------------------------
+# create_app_project — used by `sm new` / `simple-module new`
+# ---------------------------------------------------------------
+
+_FRAMEWORK_VERSION = "0.0.1"
+
+_APP_PY_DEPS = [
+    f"simple_module_hosting=={_FRAMEWORK_VERSION}",
+    f"simple_module_users=={_FRAMEWORK_VERSION}",
+    f"simple_module_dashboard=={_FRAMEWORK_VERSION}",
+    f"simple_module_permissions=={_FRAMEWORK_VERSION}",
+]
+_APP_PY_DEV_DEPS = [f"simple_module_testing=={_FRAMEWORK_VERSION}", "pytest>=8.0"]
+
+_APP_NPM_DEPS = {
+    "@simple-module-py/ui": _FRAMEWORK_VERSION,
+    "@simple-module-py/i18n": _FRAMEWORK_VERSION,
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "@inertiajs/react": "^1.0.0",
+}
+_APP_NPM_DEV_DEPS = {
+    "@simple-module-py/tsconfig": _FRAMEWORK_VERSION,
+    "@vitejs/plugin-react": "^5.0.0",
+    "typescript": "^5.6.0",
+    "vite": "^8.0.0",
+}
+
+
+def create_app_project(
+    target: Path,
+    *,
+    name: str,
+    db: str = "sqlite",
+    tenancy: bool = False,
+) -> None:
+    """Greenfield ``simple-module new`` scaffold.
+
+    Wraps :func:`create_host` with opinionated pre-wired modules (users +
+    dashboard + permissions), generates a secret, picks a DB URL, and rewrites
+    the generated package.json / pyproject.toml to pin exact framework
+    versions.
+    """
+    if target.exists() and any(target.iterdir()):
+        raise FileExistsError(
+            f"Destination {target} already exists and is non-empty; "
+            "choose a new path or remove its contents first."
+        )
+
+    create_host(target, name=name, modules=["users", "dashboard", "permissions"])
+
+    env_path = target / ".env.example"
+    env_text = env_path.read_text(encoding="utf-8") if env_path.exists() else ""
+    env_text = _set_env_key(env_text, "SM_SECRET_KEY", _secrets.token_urlsafe(32))
+    env_text = _set_env_key(env_text, "SM_DATABASE_URL", _db_url(db, _to_kebab_case(name)))
+    env_text = _set_env_key(env_text, "SM_MULTI_TENANT", "true" if tenancy else "false")
+    env_path.write_text(env_text, encoding="utf-8")
+
+    pyproject = target / "pyproject.toml"
+    if pyproject.exists():
+        text = pyproject.read_text(encoding="utf-8")
+        text = _inject_py_deps(text, _APP_PY_DEPS, _APP_PY_DEV_DEPS)
+        pyproject.write_text(text, encoding="utf-8")
+
+    pkg_path = target / "package.json"
+    if pkg_path.exists():
+        data = _json.loads(pkg_path.read_text(encoding="utf-8"))
+    else:
+        data = {"name": _to_kebab_case(name), "private": True, "type": "module"}
+    data.setdefault("dependencies", {}).update(_APP_NPM_DEPS)
+    data.setdefault("devDependencies", {}).update(_APP_NPM_DEV_DEPS)
+    pkg_path.write_text(_json.dumps(data, indent=2) + "\n", encoding="utf-8")
+
+
+def _set_env_key(text: str, key: str, value: str) -> str:
+    lines = text.splitlines()
+    prefix = f"{key}="
+    out = [ln for ln in lines if not ln.startswith(prefix)]
+    out.append(f"{key}={value}")
+    return "\n".join(out) + "\n"
+
+
+def _db_url(db: str, slug: str) -> str:
+    if db == "postgres":
+        return f"postgresql+asyncpg://postgres:postgres@localhost:5432/{slug}"
+    return "sqlite+aiosqlite:///./app.db"
+
+
+def _inject_py_deps(text: str, deps: list[str], dev_deps: list[str]) -> str:
+    """Replace project.dependencies + dependency-groups.dev in a pyproject.toml."""
+    import tomlkit
+
+    doc = tomlkit.parse(text)
+    project = doc.setdefault("project", tomlkit.table())
+    project["dependencies"] = list(deps)
+    groups = doc.setdefault("dependency-groups", tomlkit.table())
+    groups["dev"] = list(dev_deps)
+    return tomlkit.dumps(doc)

simple_module_hosting/settings.py

@@ -0,0 +1,10 @@
+"""Back-compat shim — prefer BootstrapSettings + HostSettings directly."""
+
+from __future__ import annotations
+
+from simple_module_hosting.bootstrap_settings import BootstrapSettings
+from simple_module_hosting.host_settings import HostSettings
+
+
+class Settings(HostSettings, BootstrapSettings):
+    """Combined bootstrap + host settings for legacy import sites."""

simple_module_hosting/templates/host/.env.example

@@ -0,0 +1,20 @@
+# Database — defaults to a local SQLite file.
+# For PostgreSQL use: postgresql+asyncpg://user:pass@host:5432/dbname
+SM_DATABASE_URL=sqlite+aiosqlite:///./app.db
+
+# Environment: development | production
+SM_ENVIRONMENT=development
+
+# Secret key for session middleware — change before deploying.
+SM_SECRET_KEY=change-me-in-production
+
+# Vite dev server URL (only used in development).
+SM_VITE_DEV_URL=http://localhost:5050
+
+# Optional: JSON array to restrict which installed modules load at boot.
+# SM_MODULES_ENABLED=["Auth","Products"]
+
+# First-boot admin seed (optional). Only applied when the users table is empty.
+# Leave unset and use `uv run sm-users create-admin` instead if you prefer.
+# SM_USERS_BOOTSTRAP_EMAIL=admin@example.com
+# SM_USERS_BOOTSTRAP_PASSWORD=changeme

simple_module_hosting/templates/host/.gitignore

@@ -0,0 +1,19 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+
+uv.lock
+
+node_modules/
+
+.env
+
+*.db
+*.sqlite3
+
+static/dist/
+
+# Auto-generated by the host at boot / `sm gen-pages`.
+client_app/modules.manifest.json
+client_app/modules.generated.ts

simple_module_hosting/templates/host/Makefile

@@ -0,0 +1,24 @@
+.PHONY: install dev dev-api dev-ui build migrate gen-pages
+
+install:
+	uv sync
+	cd client_app && npm install
+
+dev: gen-pages
+	@echo "Starting API and UI dev servers..."
+	$(MAKE) -j2 dev-api dev-ui
+
+dev-api:
+	uv run uvicorn main:app --reload --port 8000
+
+dev-ui:
+	cd client_app && npm run dev
+
+build:
+	cd client_app && npm run build
+
+migrate:
+	uv run alembic upgrade head
+
+gen-pages:
+	uv run sm gen-pages --host-dir=client_app

simple_module_hosting/templates/host/README.md.tpl

@@ -0,0 +1,59 @@
+# {{HOST_NAME}}
+
+A SimpleModule host application, generated by `sm create-host`.
+
+## Quick start
+
+```bash
+# Install Python deps (framework + any modules listed in pyproject.toml)
+uv sync
+
+# Copy example env and adjust
+cp .env.example .env
+
+# First time only — initialize the migration history for the modules you
+# picked. Inspect the generated file, then apply it.
+alembic revision --autogenerate -m "initial schema"
+alembic upgrade head
+
+# Run the API
+python main.py
+```
+
+Dev UI + API together (when you have a `client_app/` alongside this file):
+
+```bash
+make dev    # if you ship a Makefile; otherwise run vite + uvicorn in two shells
+```
+
+## Adding a module
+
+```bash
+# 1) install the module package (e.g. from PyPI)
+uv add simple_module_my_module
+
+# 2) generate & apply the migration (new tables + any schema changes)
+alembic revision --autogenerate -m "add my-module"
+alembic upgrade head
+
+# 3) restart the host — the module's routes, menu items, permissions,
+#    feature flags, events, and health checks register automatically
+```
+
+## Disabling a module without uninstalling it
+
+Set `SM_MODULES_ENABLED` to a JSON array of the modules you want loaded:
+
+```
+SM_MODULES_ENABLED=["Auth","Products"]
+```
+
+Unlisted modules stay installed (so the existing DB schema is untouched)
+but don't contribute any routes, registries, or lifecycle work.
+
+## Upgrading the framework
+
+Modules declare `requires_framework` in their `Meta`. If a module can't
+work with your installed `simple_module_core` version, the host refuses
+to boot with `FrameworkVersionError` listing the offending modules.
+Upgrade or pin as appropriate.

simple_module_hosting/templates/host/alembic.ini

@@ -0,0 +1,36 @@
+[alembic]
+script_location = migrations
+sqlalchemy.url =
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARN
+handlers = console
+
+[logger_sqlalchemy]
+level = WARN
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S

simple_module_hosting/templates/host/client_app/app.tsx

@@ -0,0 +1,16 @@
+import { createInertiaApp } from '@inertiajs/react';
+import { createRoot } from 'react-dom/client';
+import { resolvePage } from './pages';
+
+createInertiaApp({
+  resolve: async (name) => {
+    return await resolvePage(name);
+  },
+  setup({ el, App, props }) {
+    createRoot(el).render(<App {...props} />);
+  },
+  progress: {
+    color: '#4B5563',
+    delay: 150,
+  },
+});

simple_module_hosting/templates/host/client_app/main.tsx

@@ -0,0 +1,2 @@
+import './styles.css';
+import './app';

simple_module_hosting/templates/host/client_app/package.json.tpl

@@ -0,0 +1,23 @@
+{
+  "name": "{{HOST_NAME}}-client-app",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "tsc && vite build",
+    "preview": "vite preview"
+  },
+  "dependencies": {
+    "@inertiajs/react": "^2.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^5.0.0",
+    "typescript": "^5.7.0",
+    "vite": "^6.0.0"
+  }
+}

simple_module_hosting/templates/host/client_app/pages/Error.tsx

@@ -0,0 +1,13 @@
+type ErrorProps = {
+  status: number;
+  message?: string;
+};
+
+export default function Error({ status, message }: ErrorProps) {
+  return (
+    <main style={{ padding: '2rem', maxWidth: '40rem', margin: '0 auto' }}>
+      <h1>{status}</h1>
+      <p>{message || 'Something went wrong.'}</p>
+    </main>
+  );
+}

simple_module_hosting/templates/host/client_app/pages.ts

@@ -0,0 +1,47 @@
+/**
+ * Inertia page resolver.
+ *
+ * Module pages are discovered via a generated file (modules.generated.ts)
+ * emitted by the Python host at boot, or manually via `sm gen-pages`. Each
+ * installed module contributes an import.meta.glob() call with an absolute
+ * path, so pages shipped inside pip-installed module wheels resolve.
+ *
+ * Host-level pages live in client_app/pages/{PageName}.tsx and are
+ * registered under just "{PageName}" (e.g. "Error").
+ */
+
+import { moduleGlobs } from './modules.generated';
+
+type PageModule = { default: React.ComponentType<Record<string, unknown>> };
+type PageLoader = () => Promise<PageModule>;
+
+const hostPages = import.meta.glob<PageModule>('./pages/*.tsx');
+
+const pages: Record<string, PageLoader> = {};
+
+for (const [moduleName, globEntries] of Object.entries(moduleGlobs)) {
+  for (const [filePath, loader] of Object.entries(globEntries)) {
+    const match = filePath.match(/\/pages\/(\w+)\.tsx$/);
+    if (match) {
+      pages[`${moduleName}/${match[1]}`] = loader;
+    }
+  }
+}
+
+for (const [filePath, loader] of Object.entries(hostPages)) {
+  const match = filePath.match(/\.\/pages\/(\w+)\.tsx$/);
+  if (match) {
+    pages[match[1]] = loader;
+  }
+}
+
+export async function resolvePage(
+  name: string,
+): Promise<React.ComponentType<Record<string, unknown>>> {
+  const loader = pages[name];
+  if (!loader) {
+    throw new Error(`Page "${name}" not found. Available pages: ${Object.keys(pages).join(', ')}`);
+  }
+  const module = await loader();
+  return module.default;
+}

simple_module_hosting/templates/host/client_app/styles.css

@@ -0,0 +1,7 @@
+body {
+  margin: 0;
+  font-family:
+    system-ui,
+    -apple-system,
+    sans-serif;
+}

simple_module_hosting/templates/host/client_app/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "types": ["vite/client", "node"],
+    "allowImportingTsExtensions": false
+  },
+  "include": ["**/*.ts", "**/*.tsx"]
+}

simple_module_hosting/templates/host/client_app/vite.config.ts

@@ -0,0 +1,39 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import react from '@vitejs/plugin-react';
+import { defineConfig } from 'vite';
+
+const projectRoot = path.resolve(__dirname, '..');
+
+// Load the module pages manifest written by the Python host at boot.
+// Each entry points at an absolute pages/ directory — typically inside a
+// pip-installed module wheel. Vite needs these in server.fs.allow so the
+// dev server can read files outside the host root.
+const manifestPath = path.resolve(__dirname, 'modules.manifest.json');
+const moduleFsAllow: string[] = [];
+if (fs.existsSync(manifestPath)) {
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8')) as Record<string, string>;
+  for (const pagesDir of Object.values(manifest)) {
+    moduleFsAllow.push(path.dirname(pagesDir));
+  }
+}
+
+export default defineConfig({
+  plugins: [react()],
+  root: __dirname,
+  build: {
+    outDir: '../static/dist',
+    manifest: true,
+    rollupOptions: {
+      input: path.resolve(__dirname, 'main.tsx'),
+    },
+  },
+  server: {
+    port: 5050,
+    strictPort: true,
+    origin: 'http://localhost:5050',
+    fs: {
+      allow: [projectRoot, ...moduleFsAllow],
+    },
+  },
+});