streamlit-data-editor-plus 0.1.0__py3-none-any.whl

streamlit/web/server/component_request_handler.py

@@ -0,0 +1,107 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2026)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Final, cast
+
+import tornado.web
+
+import streamlit.web.server.routes
+from streamlit.logger import get_logger
+from streamlit.web.server.component_file_utils import (
+    build_safe_abspath,
+    guess_content_type,
+)
+
+if TYPE_CHECKING:
+    from streamlit.components.types.base_component_registry import BaseComponentRegistry
+
+_LOGGER: Final = get_logger(__name__)
+
+
+class ComponentRequestHandler(tornado.web.RequestHandler):
+    def initialize(self, registry: BaseComponentRegistry) -> None:
+        self._registry = registry
+
+    def get(self, path: str) -> None:
+        parts = path.split("/")
+        component_name = parts[0]
+        component_root = self._registry.get_component_path(component_name)
+        if component_root is None:
+            self.write("not found")
+            self.set_status(404)
+            return
+
+        # Build a safe absolute path within the component root
+        filename = "/".join(parts[1:])
+        abspath = build_safe_abspath(component_root, filename)
+        if abspath is None:
+            self.write("Bad Request")
+            self.set_status(400)
+            return
+        try:
+            with open(abspath, "rb") as file:
+                contents = file.read()
+        except OSError:
+            sanitized_abspath = abspath.replace("\n", "").replace("\r", "")
+            _LOGGER.exception(
+                "ComponentRequestHandler: GET %s read error", sanitized_abspath
+            )
+            self.write("read error")
+            self.set_status(404)
+            return
+
+        self.write(contents)
+        self.set_header("Content-Type", self.get_content_type(abspath))
+
+        self.set_extra_headers(path)
+
+    def set_extra_headers(self, path: str) -> None:
+        """Disable cache for HTML files.
+
+        Other assets like JS and CSS are suffixed with their hash, so they can
+        be cached indefinitely.
+        """
+        is_index_url = len(path) == 0
+
+        if is_index_url or path.endswith(".html"):
+            self.set_header("Cache-Control", "no-cache")
+        else:
+            self.set_header("Cache-Control", "public")
+
+    def set_default_headers(self) -> None:
+        if streamlit.web.server.routes.allow_all_cross_origin_requests():
+            self.set_header("Access-Control-Allow-Origin", "*")
+        elif streamlit.web.server.routes.is_allowed_origin(
+            origin := self.request.headers.get("Origin")
+        ):
+            self.set_header("Access-Control-Allow-Origin", cast("str", origin))
+
+    def options(self) -> None:
+        """/OPTIONS handler for preflight CORS checks."""
+        self.set_status(204)
+        self.finish()
+
+    @staticmethod
+    def get_content_type(abspath: str) -> str:
+        """Returns the ``Content-Type`` header to be used for this request.
+        From tornado.web.StaticFileHandler.
+        """
+        return guess_content_type(abspath)
+
+    @staticmethod
+    def get_url(file_id: str) -> str:
+        """Return the URL for a component file with the given ID."""
+        return f"components/{file_id}"

streamlit/web/server/media_file_handler.py

@@ -0,0 +1,148 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2026)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+from typing import Any, cast
+from urllib.parse import quote
+
+import tornado.web
+
+from streamlit.logger import get_logger
+from streamlit.runtime.media_file_storage import MediaFileKind, MediaFileStorageError
+from streamlit.runtime.memory_media_file_storage import (
+    MemoryMediaFileStorage,
+    get_extension_for_mimetype,
+)
+from streamlit.web.server import allow_all_cross_origin_requests, is_allowed_origin
+
+_LOGGER = get_logger(__name__)
+
+
+class MediaFileHandler(tornado.web.StaticFileHandler):
+    _storage: MemoryMediaFileStorage
+
+    @classmethod
+    def initialize_storage(cls, storage: MemoryMediaFileStorage) -> None:
+        """Set the MemoryMediaFileStorage object used by instances of this
+        handler. Must be called on server startup.
+        """
+        # This is a class method, rather than an instance method, because
+        # `get_content()` is a class method and needs to access the storage
+        # instance.
+        cls._storage = storage
+
+    def set_default_headers(self) -> None:
+        if allow_all_cross_origin_requests():
+            self.set_header("Access-Control-Allow-Origin", "*")
+        elif is_allowed_origin(origin := self.request.headers.get("Origin")):
+            self.set_header("Access-Control-Allow-Origin", cast("str", origin))
+
+    def set_extra_headers(self, path: str) -> None:
+        """Add Content-Disposition header for downloadable files.
+
+        Set header value to "attachment" indicating that file should be saved
+        locally instead of displaying inline in browser.
+
+        We also set filename to specify the filename for downloaded files.
+        Used for serving downloadable files, like files stored via the
+        `st.download_button` widget.
+        """
+        media_file = self._storage.get_file(path)
+
+        if media_file and media_file.kind == MediaFileKind.DOWNLOADABLE:
+            filename = media_file.filename
+
+            if not filename:
+                filename = f"streamlit_download{get_extension_for_mimetype(media_file.mimetype)}"
+
+            try:
+                # Check that the value can be encoded in latin1. Latin1 is
+                # the default encoding for headers.
+                filename.encode("latin1")
+                file_expr = f'filename="{filename}"'
+            except UnicodeEncodeError:
+                # RFC5987 syntax.
+                # See: https://datatracker.ietf.org/doc/html/rfc5987
+                file_expr = f"filename*=utf-8''{quote(filename)}"
+
+            self.set_header("Content-Disposition", f"attachment; {file_expr}")
+
+    # Overriding StaticFileHandler to use the MediaFileManager
+    #
+    # From the Tornado docs:
+    # To replace all interaction with the filesystem (e.g. to serve
+    # static content from a database), override `get_content`,
+    # `get_content_size`, `get_modified_time`, `get_absolute_path`, and
+    # `validate_absolute_path`.
+    def validate_absolute_path(
+        self,
+        root: str,  # noqa: ARG002
+        absolute_path: str,
+    ) -> str:
+        try:
+            self._storage.get_file(absolute_path)
+        except MediaFileStorageError:
+            _LOGGER.exception("MediaFileHandler: Missing file %s", absolute_path)
+            raise tornado.web.HTTPError(404, "not found")
+
+        return absolute_path
+
+    def get_content_size(self) -> int:
+        abspath = self.absolute_path
+        if abspath is None:
+            return 0
+
+        media_file = self._storage.get_file(abspath)
+        return media_file.content_size
+
+    def get_modified_time(self) -> None:
+        # We do not track last modified time, but this can be improved to
+        # allow caching among files in the MediaFileManager
+        return None
+
+    @classmethod
+    def get_absolute_path(cls, root: str, path: str) -> str:  # noqa: ARG003
+        # All files are stored in memory, so the absolute path is just the
+        # path itself. In the MediaFileHandler, it's just the filename
+        return path
+
+    @classmethod
+    def get_content(
+        cls, abspath: str, start: int | None = None, end: int | None = None
+    ) -> Any:
+        _LOGGER.debug("MediaFileHandler: GET %s", abspath)
+
+        try:
+            # abspath is the hash as used `get_absolute_path`
+            media_file = cls._storage.get_file(abspath)
+        except Exception:
+            _LOGGER.exception("MediaFileHandler: Missing file %s", abspath)
+            return None
+
+        _LOGGER.debug(
+            "MediaFileHandler: Sending %s file %s", media_file.mimetype, abspath
+        )
+
+        # If there is no start and end, just return the full content
+        if start is None and end is None:
+            return media_file.content
+
+        if start is None:
+            start = 0
+        if end is None:
+            end = len(media_file.content)
+
+        # content is bytes that work just by slicing supplied by start and end
+        return media_file.content[start:end]

streamlit/web/server/oauth_authlib_routes.py

@@ -0,0 +1,314 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2026)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+from __future__ import annotations
+
+import json
+from typing import Any, Final, cast
+
+import tornado.web
+
+from streamlit.auth_util import (
+    AuthCache,
+    build_logout_url,
+    clear_cookie_and_chunks,
+    decode_provider_token,
+    generate_default_provider_section,
+    get_cookie_with_chunks,
+    get_origin_from_redirect_uri,
+    get_redirect_uri,
+    get_secrets_auth_section,
+    get_validated_redirect_uri,
+    set_cookie_with_chunks,
+)
+from streamlit.errors import StreamlitAuthError
+from streamlit.logger import get_logger
+from streamlit.url_util import make_url_path
+from streamlit.web.server.oidc_mixin import TornadoOAuth, TornadoOAuth2App
+from streamlit.web.server.server_util import AUTH_COOKIE_NAME, TOKENS_COOKIE_NAME
+
+_LOGGER: Final = get_logger(__name__)
+
+auth_cache = AuthCache()
+
+
+def create_oauth_client(provider: str) -> tuple[TornadoOAuth2App, str]:
+    """Create an OAuth client for the given provider based on secrets.toml configuration."""
+    auth_section = get_secrets_auth_section()
+    if auth_section:
+        redirect_uri = get_redirect_uri(auth_section) or "/"
+        config = auth_section.to_dict()
+    else:
+        config = {}
+        redirect_uri = "/"
+
+    provider_section = config.setdefault(provider, {})
+
+    if not provider_section and provider == "default":
+        provider_section = generate_default_provider_section(auth_section)
+        config["default"] = provider_section
+
+    provider_client_kwargs = provider_section.setdefault("client_kwargs", {})
+    if "scope" not in provider_client_kwargs:
+        provider_client_kwargs["scope"] = "openid email profile"
+    if "prompt" not in provider_client_kwargs:
+        provider_client_kwargs["prompt"] = "select_account"
+
+    oauth = TornadoOAuth(config, cache=auth_cache)
+    oauth.register(provider)
+    return oauth.create_client(provider), redirect_uri  # type: ignore[no-untyped-call]
+
+
+class AuthHandlerMixin(tornado.web.RequestHandler):
+    """Mixin for handling auth cookies. Added for compatibility with Tornado < 6.3.0."""
+
+    def initialize(self, base_url: str) -> None:
+        self.base_url = base_url
+
+    def redirect_to_base(self) -> None:
+        self.redirect(make_url_path(self.base_url, "/"))
+
+    def set_auth_cookie(
+        self, user_info: dict[str, Any], tokens: dict[str, Any]
+    ) -> None:
+        set_cookie_with_chunks(
+            self._set_single_cookie,
+            self._create_signed_value,
+            AUTH_COOKIE_NAME,
+            user_info,
+        )
+        set_cookie_with_chunks(
+            self._set_single_cookie,
+            self._create_signed_value,
+            TOKENS_COOKIE_NAME,
+            tokens,
+        )
+
+    def _set_single_cookie(self, cookie_name: str, value: str) -> None:
+        """Set a single cookie."""
+        try:
+            # We don't specify Tornado secure flag here because it leads to missing cookie on Safari.
+            # The OIDC flow should work only on secure context anyway (localhost or HTTPS),
+            # so specifying the secure flag here will not add anything in terms of security.
+            self.set_signed_cookie(
+                cookie_name,
+                value,
+                httpOnly=True,
+            )
+        except AttributeError:
+            self.set_secure_cookie(
+                cookie_name,
+                value,
+                httponly=True,
+            )
+
+    def _create_signed_value(self, cookie_name: str, value: str) -> bytes:
+        """Create a signed cookie value."""
+        try:
+            return self.create_signed_value(cookie_name, value)
+        except AttributeError:
+            # Default to the older method for compatibility with Tornado < 6.3.0
+            return cast("bytes", self.create_secure_cookie_value(cookie_name, value))  # type: ignore[attr-defined]
+
+    def _get_signed_cookie(self, cookie_name: str) -> bytes | None:
+        """Get a signed cookie."""
+        try:
+            return cast("bytes", self.get_signed_cookie(cookie_name))
+        except AttributeError:
+            # Default to the older method for compatibility with Tornado < 6.3.0
+            return cast("bytes", self.get_secure_cookie(cookie_name))
+        except Exception:
+            # Handle cases where cookie_secret is not configured or other errors
+            return None
+
+    def clear_auth_cookie(self) -> None:
+        """Clear auth cookies, including any split cookie chunks."""
+        clear_cookie_and_chunks(
+            self._get_signed_cookie,
+            self.clear_cookie,
+            AUTH_COOKIE_NAME,
+        )
+        clear_cookie_and_chunks(
+            self._get_signed_cookie,
+            self.clear_cookie,
+            TOKENS_COOKIE_NAME,
+        )
+
+
+class AuthLoginHandler(AuthHandlerMixin, tornado.web.RequestHandler):
+    async def get(self) -> None:
+        """Redirect to the OAuth provider login page."""
+        provider = self._parse_provider_token()
+        if provider is None:
+            self.redirect_to_base()
+            return
+
+        client, redirect_uri = create_oauth_client(provider)
+        try:
+            client.authorize_redirect(self, redirect_uri)
+        except Exception as e:
+            self.send_error(400, reason=str(e))
+
+    def _parse_provider_token(self) -> str | None:
+        provider_token = self.get_argument("provider", None)
+        if provider_token is None:
+            return None
+        try:
+            payload = decode_provider_token(provider_token)
+        except StreamlitAuthError:
+            return None
+
+        return payload["provider"]
+
+
+class AuthLogoutHandler(AuthHandlerMixin, tornado.web.RequestHandler):
+    def get(self) -> None:
+        self.clear_auth_cookie()
+
+        provider_logout_url = self._get_provider_logout_url()
+        if provider_logout_url:
+            self.redirect(provider_logout_url)
+        else:
+            self.redirect_to_base()
+
+    def _get_provider_logout_url(self) -> str | None:
+        """Get the OAuth provider's logout URL from OIDC metadata."""
+        cookie_value = get_cookie_with_chunks(self._get_signed_cookie, AUTH_COOKIE_NAME)
+
+        if not cookie_value:
+            return None
+
+        try:
+            user_info = json.loads(cookie_value)
+            provider = user_info.get("provider")
+            if not provider:
+                return None
+
+            client, _ = create_oauth_client(provider)
+
+            metadata = client.load_server_metadata()
+            end_session_endpoint = metadata.get("end_session_endpoint")
+
+            if not end_session_endpoint:
+                _LOGGER.info("No end_session_endpoint found for provider %s", provider)
+                return None
+
+            # Use redirect_uri (i.e. /oauth2callback) for post_logout_redirect_uri
+            # This is safer than redirecting to root as some providers seem to
+            # require url to be in a whitelist /oauth2callback should be whitelisted
+            redirect_uri = get_validated_redirect_uri()
+            if redirect_uri is None:
+                _LOGGER.info("Redirect url could not be determined")
+                return None
+
+            # Get id_token_hint from tokens cookie if available
+            id_token: str | None = None
+            tokens_cookie_value = get_cookie_with_chunks(
+                self._get_signed_cookie, TOKENS_COOKIE_NAME
+            )
+            if tokens_cookie_value:
+                try:
+                    tokens = json.loads(tokens_cookie_value)
+                    id_token = tokens.get("id_token")
+                except (json.JSONDecodeError, TypeError):
+                    _LOGGER.exception("Error, invalid tokens cookie value.")
+                    return None
+
+            return build_logout_url(
+                end_session_endpoint=end_session_endpoint,
+                client_id=client.client_id,
+                post_logout_redirect_uri=redirect_uri,
+                id_token=id_token,
+            )
+
+        except Exception as e:
+            _LOGGER.warning("Failed to get provider logout URL: %s", e)
+            return None
+
+
+class AuthCallbackHandler(AuthHandlerMixin, tornado.web.RequestHandler):
+    async def get(self) -> None:
+        provider = self._get_provider_by_state()
+        if provider is None:
+            # This could be a logout redirect (no state parameter) or invalid state
+            # In both cases, redirect to base
+            self.redirect_to_base()
+            return
+
+        origin = self._get_origin_from_secrets()
+        if origin is None:
+            _LOGGER.error(
+                "Error, misconfigured origin for `redirect_uri` in secrets.",
+            )
+            self.redirect_to_base()
+            return
+
+        error = self.get_argument("error", None)
+        if error:
+            error_description = self.get_argument("error_description", None)
+            sanitized_error = error.replace("\n", "").replace("\r", "")
+            sanitized_error_description = (
+                error_description.replace("\n", "").replace("\r", "")
+                if error_description
+                else None
+            )
+            _LOGGER.error(
+                "Error during authentication: %s. Error description: %s",
+                sanitized_error,
+                sanitized_error_description,
+            )
+            self.redirect_to_base()
+            return
+
+        client, _ = create_oauth_client(provider)
+        token = client.authorize_access_token(self)
+        user = cast("dict[str, Any]", token.get("userinfo"))
+
+        cookie_value = dict(user, origin=origin, is_logged_in=True, provider=provider)
+        tokens = {k: token[k] for k in ["id_token", "access_token"] if k in token}
+
+        if user:
+            self.set_auth_cookie(cookie_value, tokens)
+            # Keep tokens in a separate cookie to avoid hitting the size limit
+        else:
+            _LOGGER.error("Error, missing user info.")
+        self.redirect_to_base()
+
+    def _get_provider_by_state(self) -> str | None:
+        state_code_from_url = self.get_argument("state", None)
+        if state_code_from_url is None:
+            return None
+
+        current_cache_keys = list(auth_cache.get_dict().keys())
+        state_provider_mapping = {}
+        for key in current_cache_keys:
+            # Authlib stores OAuth state in the cache using keys in the format:
+            # "_state_{provider}_{state_code}" (e.g., "_state_google_abc123").
+            #
+            # Note: This split assumes no underscores in provider names or state codes.
+            # This is safe because: (1) provider names with underscores are explicitly
+            # blocked in validate_auth_credentials() in auth_util.py, and (2) Authlib's
+            # generate_token() uses only alphanumeric characters (a-zA-Z0-9) for state
+            # codes. See auth_util.py for the underscore validation.
+            try:
+                _, _, recorded_provider, code = key.split("_")
+            except ValueError:
+                # Skip cache keys that don't match the expected 4-part format.
+                continue
+            state_provider_mapping[code] = recorded_provider
+
+        provider: str | None = state_provider_mapping.get(state_code_from_url)
+        return provider
+
+    def _get_origin_from_secrets(self) -> str | None:
+        return get_origin_from_redirect_uri()