streamlit-nightly 1.41.2.dev20241227__py2.py3-none-any.whl → 1.41.2.dev20250124__py2.py3-none-any.whl

streamlit/web/server/oidc_mixin.py

@@ -0,0 +1,108 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import tornado.web
+from authlib.integrations.base_client import (  # type: ignore[import-untyped]
+    BaseApp,
+    BaseOAuth,
+    OAuth2Mixin,
+    OAuthError,
+    OpenIDMixin,
+)
+from authlib.integrations.requests_client import (  # type: ignore[import-untyped]
+    OAuth2Session,
+)
+
+from streamlit.web.server.authlib_tornado_integration import TornadoIntegration
+
+
+class TornadoOAuth2App(OAuth2Mixin, OpenIDMixin, BaseApp):  # type: ignore[misc]
+    client_cls = OAuth2Session
+
+    def load_server_metadata(self):
+        """We enforce S256 code challenge method if it is supported by the server."""
+        result = super().load_server_metadata()
+        if "S256" in result.get("code_challenge_methods_supported", []):
+            self.client_kwargs["code_challenge_method"] = "S256"
+        return result
+
+    def authorize_redirect(
+        self, request_handler: tornado.web.RequestHandler, redirect_uri=None, **kwargs
+    ):
+        """Create a HTTP Redirect for Authorization Endpoint.
+
+        :param request_handler: HTTP request instance from Tornado.
+        :param redirect_uri: Callback or redirect URI for authorization.
+        :param kwargs: Extra parameters to include.
+        :return: A HTTP redirect response.
+        """
+        auth_context = self.create_authorization_url(redirect_uri, **kwargs)
+        self._save_authorize_data(redirect_uri=redirect_uri, **auth_context)
+        request_handler.redirect(auth_context["url"], status=302)
+
+    def authorize_access_token(
+        self, request_handler: tornado.web.RequestHandler, **kwargs
+    ):
+        """
+        :param request_handler: HTTP request instance from Tornado.
+        :return: A token dict.
+        """
+        error = request_handler.get_argument("error", None)
+        if error:
+            description = request_handler.get_argument("error_description", None)
+            raise OAuthError(error=error, description=description)
+
+        params = {
+            "code": request_handler.get_argument("code"),
+            "state": request_handler.get_argument("state"),
+        }
+
+        assert self.framework.cache is not None
+        session = None
+
+        claims_options = kwargs.pop("claims_options", None)
+        state_data = self.framework.get_state_data(session, params.get("state"))
+        self.framework.clear_state_data(session, params.get("state"))
+        params = self._format_state_params(state_data, params)
+        token = self.fetch_access_token(**params, **kwargs)
+
+        if "id_token" in token and "nonce" in state_data:
+            userinfo = self.parse_id_token(
+                token, nonce=state_data["nonce"], claims_options=claims_options
+            )
+            token = {**token, "userinfo": userinfo}
+        return token
+
+    def _save_authorize_data(self, **kwargs):
+        """Authlib underlying uses the concept of "session" to store state data.
+        In Tornado, we don't have a session, so we use the framework's cache option.
+        """
+        state = kwargs.pop("state", None)
+        if state:
+            assert self.framework.cache is not None
+            session = None
+            self.framework.set_state_data(session, state, kwargs)
+        else:
+            raise RuntimeError("Missing state value")
+
+
+class TornadoOAuth(BaseOAuth):  # type: ignore[misc]
+    oauth2_client_cls = TornadoOAuth2App
+    framework_integration_cls = TornadoIntegration
+
+    def __init__(self, config=None, cache=None, fetch_token=None, update_token=None):
+        super().__init__(
+            cache=cache, fetch_token=fetch_token, update_token=update_token
+        )
+        self.config = config

streamlit/web/server/routes.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,7 +22,10 @@ import tornado.web
 from streamlit import config, file_util
 from streamlit.logger import get_logger
 from streamlit.runtime.runtime_util import serialize_forward_msg
-from streamlit.web.server.server_util import emit_endpoint_deprecation_notice
+from streamlit.web.server.server_util import (
+    emit_endpoint_deprecation_notice,
+    is_xsrf_enabled,
+)
 
 _LOGGER: Final = get_logger(__name__)
 
@@ -58,7 +61,6 @@ class StaticFileHandler(tornado.web.StaticFileHandler):
         be cached indefinitely.
         """
         is_index_url = len(path) == 0
-
         if is_index_url or path.endswith(".html"):
             self.set_header("Cache-Control", "no-cache")
         else:
@@ -173,7 +175,7 @@ class HealthHandler(_SpecialRequestHandler):
             # server.enableXsrfProtection is updated, the browser does not reload the document.
             # Manually setting the cookie on /healthz since it is pinged when the
             # browser is disconnected from the server.
-            if config.get_option("server.enableXsrfProtection"):
+            if is_xsrf_enabled():
                 cookie_kwargs = self.settings.get("xsrf_cookie_kwargs", {})
                 self.set_cookie(
                     self.settings.get("xsrf_cookie_name", "_streamlit_xsrf"),

streamlit/web/server/server.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@ import tornado.websocket
 from tornado.httpserver import HTTPServer
 
 from streamlit import cli_util, config, file_util, util
+from streamlit.auth_util import is_authlib_installed
 from streamlit.config_option import ConfigOption
 from streamlit.logger import get_logger
 from streamlit.runtime import Runtime, RuntimeConfig, RuntimeState
@@ -52,7 +53,12 @@ from streamlit.web.server.routes import (
     RemoveSlashHandler,
     StaticFileHandler,
 )
-from streamlit.web.server.server_util import DEVELOPMENT_PORT, make_url_path_regex
+from streamlit.web.server.server_util import (
+    DEVELOPMENT_PORT,
+    get_cookie_secret,
+    is_xsrf_enabled,
+    make_url_path_regex,
+)
 from streamlit.web.server.stats_request_handler import StatsRequestHandler
 from streamlit.web.server.upload_file_request_handler import UploadFileRequestHandler
 
@@ -96,6 +102,10 @@ SCRIPT_HEALTH_CHECK_ENDPOINT: Final = (
     r"(?:script-health-check|_stcore/script-health-check)"
 )
 
+OAUTH2_CALLBACK_ENDPOINT: Final = "/oauth2callback"
+AUTH_LOGIN_ENDPOINT: Final = "/auth/login"
+AUTH_LOGOUT_ENDPOINT: Final = "/auth/logout"
+
 
 class RetriesExceeded(Exception):
     pass
@@ -370,6 +380,33 @@ class Server:
                 ]
             )
 
+        if is_authlib_installed():
+            from streamlit.web.server.oauth_authlib_routes import (
+                AuthCallbackHandler,
+                AuthLoginHandler,
+                AuthLogoutHandler,
+            )
+
+            routes.extend(
+                [
+                    (
+                        make_url_path_regex(base, OAUTH2_CALLBACK_ENDPOINT),
+                        AuthCallbackHandler,
+                        {"base_url": base},
+                    ),
+                    (
+                        make_url_path_regex(base, AUTH_LOGIN_ENDPOINT),
+                        AuthLoginHandler,
+                        {"base_url": base},
+                    ),
+                    (
+                        make_url_path_regex(base, AUTH_LOGOUT_ENDPOINT),
+                        AuthLogoutHandler,
+                        {"base_url": base},
+                    ),
+                ]
+            )
+
         if config.get_option("global.developmentMode"):
             _LOGGER.debug("Serving static content from the Node dev server")
         else:
@@ -410,8 +447,8 @@ class Server:
 
         return tornado.web.Application(
             routes,
-            cookie_secret=config.get_option("server.cookieSecret"),
-            xsrf_cookies=config.get_option("server.enableXsrfProtection"),
+            cookie_secret=get_cookie_secret(),
+            xsrf_cookies=is_xsrf_enabled(),
             # Set the websocket message size. The default value is too low.
             websocket_max_message_size=get_max_message_size_bytes(),
             **TORNADO_SETTINGS,  # type: ignore[arg-type]

streamlit/web/server/server_util.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ from typing import TYPE_CHECKING, Final, Literal
 from urllib.parse import urljoin
 
 from streamlit import config, net_util, url_util
+from streamlit.runtime.secrets import secrets_singleton
 
 if TYPE_CHECKING:
     from tornado.web import RequestHandler
@@ -27,6 +28,8 @@ if TYPE_CHECKING:
 # The port reserved for internal development.
 DEVELOPMENT_PORT: Final = 3000
 
+AUTH_COOKIE_NAME: Final = "_streamlit_user"
+
 
 def is_url_from_allowed_origins(url: str) -> bool:
     """Return True if URL is from allowed origins (for CORS purpose).
@@ -70,6 +73,27 @@ def is_url_from_allowed_origins(url: str) -> bool:
     return False
 
 
+def get_cookie_secret() -> str:
+    """Get the cookie secret.
+
+    If the user has not set a cookie secret, we generate a random one.
+    """
+    cookie_secret: str = config.get_option("server.cookieSecret")
+    if secrets_singleton.load_if_toml_exists():
+        auth_section = secrets_singleton.get("auth")
+        if auth_section:
+            cookie_secret = auth_section.get("cookie_secret", cookie_secret)
+    return cookie_secret
+
+
+def is_xsrf_enabled():
+    csrf_enabled = config.get_option("server.enableXsrfProtection")
+    if not csrf_enabled and secrets_singleton.load_if_toml_exists():
+        auth_section = secrets_singleton.get("auth", None)
+        csrf_enabled = csrf_enabled or auth_section is not None
+    return csrf_enabled
+
+
 def _get_server_address_if_manually_set() -> str | None:
     if config.is_manually_set("browser.serverAddress"):
         return url_util.get_hostname(config.get_option("browser.serverAddress"))

streamlit/web/server/stats_request_handler.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

streamlit/web/server/upload_file_request_handler.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ import tornado.web
 from streamlit import config
 from streamlit.runtime.uploaded_file_manager import UploadedFileRec
 from streamlit.web.server import routes, server_util
+from streamlit.web.server.server_util import is_xsrf_enabled
 
 if TYPE_CHECKING:
     from streamlit.runtime.memory_uploaded_file_manager import MemoryUploadedFileManager
@@ -51,7 +52,7 @@ class UploadFileRequestHandler(tornado.web.RequestHandler):
     def set_default_headers(self):
         self.set_header("Access-Control-Allow-Methods", "PUT, OPTIONS, DELETE")
         self.set_header("Access-Control-Allow-Headers", "Content-Type")
-        if config.get_option("server.enableXsrfProtection"):
+        if is_xsrf_enabled():
             self.set_header(
                 "Access-Control-Allow-Origin",
                 server_util.get_url(config.get_option("browser.serverAddress")),

streamlit/web/server/websocket_headers.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

{streamlit_nightly-1.41.2.dev20241227.data → streamlit_nightly-1.41.2.dev20250124.data}/scripts/streamlit.cmd

@@ -1,4 +1,4 @@
-rem Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+rem Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 rem
 rem Licensed under the Apache License, Version 2.0 (the "License");
 rem you may not use this file except in compliance with the License.

{streamlit_nightly-1.41.2.dev20241227.dist-info → streamlit_nightly-1.41.2.dev20250124.dist-info}/METADATA

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: streamlit-nightly
-Version: 1.41.2.dev20241227
+Version: 1.41.2.dev20250124
 Summary: A faster way to build and share data apps
 Home-page: https://streamlit.io
 Author: Snowflake Inc
@@ -45,14 +45,26 @@ Requires-Dist: requests<3,>=2.27
 Requires-Dist: rich<14,>=10.14.0
 Requires-Dist: tenacity<10,>=8.1.0
 Requires-Dist: toml<2,>=0.10.1
-Requires-Dist: typing-extensions<5,>=4.3.0
+Requires-Dist: typing-extensions<5,>=4.4.0
 Requires-Dist: watchdog<7,>=2.1.5; platform_system != "Darwin"
 Requires-Dist: gitpython!=3.1.19,<4,>=3.0.7
 Requires-Dist: pydeck<1,>=0.8.0b4
 Requires-Dist: tornado<7,>=6.0.3
 Provides-Extra: snowflake
 Requires-Dist: snowflake-snowpark-python[modin]>=1.17.0; python_version < "3.12" and extra == "snowflake"
-Requires-Dist: snowflake-connector-python>=2.8.0; python_version < "3.12" and extra == "snowflake"
+Requires-Dist: snowflake-connector-python>=3.3.0; python_version < "3.12" and extra == "snowflake"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: project-url
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 <br>