streamlit-nightly 1.41.2.dev20250106__py2.py3-none-any.whl → 1.41.2.dev20250108__py2.py3-none-any.whl

streamlit/web/server/oauth_authlib_routes.py

@@ -0,0 +1,176 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+from __future__ import annotations
+
+import json
+from typing import Any
+from urllib.parse import urlparse
+
+import tornado.web
+
+from streamlit.auth_util import (
+    AuthCache,
+    decode_provider_token,
+    generate_default_provider_section,
+    get_secrets_auth_section,
+)
+from streamlit.errors import StreamlitAuthError
+from streamlit.url_util import make_url_path
+from streamlit.web.server.oidc_mixin import TornadoOAuth, TornadoOAuth2App
+from streamlit.web.server.server_util import AUTH_COOKIE_NAME
+
+auth_cache = AuthCache()
+
+
+def create_oauth_client(provider: str) -> tuple[TornadoOAuth2App, str]:
+    """Create an OAuth client for the given provider based on secrets.toml configuration."""
+    auth_section = get_secrets_auth_section()
+    if auth_section:
+        redirect_uri = auth_section.get("redirect_uri", None)
+        config = auth_section.to_dict()
+    else:
+        config = {}
+        redirect_uri = "/"
+
+    provider_section = config.setdefault(provider, {})
+
+    if not provider_section and provider == "default":
+        provider_section = generate_default_provider_section(auth_section)
+        config["default"] = provider_section
+
+    provider_client_kwargs = provider_section.setdefault("client_kwargs", {})
+    if "scope" not in provider_client_kwargs:
+        provider_client_kwargs["scope"] = "openid email profile"
+    if "prompt" not in provider_client_kwargs:
+        provider_client_kwargs["prompt"] = "select_account"
+
+    oauth = TornadoOAuth(config, cache=auth_cache)
+    oauth.register(provider)
+    return oauth.create_client(provider), redirect_uri
+
+
+class AuthHandlerMixin(tornado.web.RequestHandler):
+    """Mixin for handling auth cookies. Added for compatibility with Tornado < 6.3.0."""
+
+    def initialize(self, base_url: str) -> None:
+        self.base_url = base_url
+
+    def redirect_to_base(self) -> None:
+        self.redirect(make_url_path(self.base_url, "/"))
+
+    def set_auth_cookie(self, user_info: dict[str, Any]) -> None:
+        serialized_cookie_value = json.dumps(user_info)
+        try:
+            # We don't specify Tornado secure flag here because it leads to missing cookie on Safari.
+            # The OIDC flow should work only on secure context anyway (localhost or HTTPS),
+            # so specifying the secure flag here will not add anything in terms of security.
+            self.set_signed_cookie(
+                AUTH_COOKIE_NAME,
+                serialized_cookie_value,
+                httpOnly=True,
+            )
+        except AttributeError:
+            self.set_secure_cookie(
+                AUTH_COOKIE_NAME,
+                serialized_cookie_value,
+                httponly=True,
+            )
+
+    def clear_auth_cookie(self) -> None:
+        self.clear_cookie(AUTH_COOKIE_NAME)
+
+
+class AuthLoginHandler(AuthHandlerMixin, tornado.web.RequestHandler):
+    async def get(self):
+        """Redirect to the OAuth provider login page."""
+        provider = self._parse_provider_token()
+        if provider is None:
+            self.redirect_to_base()
+            return
+
+        client, redirect_uri = create_oauth_client(provider)
+        try:
+            client.authorize_redirect(self, redirect_uri)
+        except Exception as e:
+            self.send_error(400, reason=str(e))
+
+    def _parse_provider_token(self) -> str | None:
+        provider_token = self.get_argument("provider", None)
+        try:
+            if provider_token is None:
+                raise StreamlitAuthError("Missing provider token")
+            payload = decode_provider_token(provider_token)
+        except StreamlitAuthError:
+            return None
+
+        return payload["provider"]
+
+
+class AuthLogoutHandler(AuthHandlerMixin, tornado.web.RequestHandler):
+    def get(self):
+        self.clear_auth_cookie()
+        self.redirect_to_base()
+
+
+class AuthCallbackHandler(AuthHandlerMixin, tornado.web.RequestHandler):
+    async def get(self):
+        provider = self._get_provider_by_state()
+        origin = self._get_origin_from_secrets()
+        if origin is None:
+            self.redirect_to_base()
+            return
+
+        error = self.get_argument("error", None)
+        if error:
+            self.redirect_to_base()
+            return
+
+        if provider is None:
+            self.redirect_to_base()
+            return
+
+        client, _ = create_oauth_client(provider)
+        token = client.authorize_access_token(self)
+        user = token.get("userinfo")
+
+        cookie_value = dict(user, origin=origin, is_logged_in=True)
+        if user:
+            self.set_auth_cookie(cookie_value)
+        self.redirect_to_base()
+
+    def _get_provider_by_state(self) -> str | None:
+        state_code_from_url = self.get_argument("state")
+        current_cache_keys = list(auth_cache.get_dict().keys())
+        state_provider_mapping = {}
+        for key in current_cache_keys:
+            _, _, recorded_provider, code = key.split("_")
+            state_provider_mapping[code] = recorded_provider
+
+        provider: str | None = state_provider_mapping.get(state_code_from_url, None)
+        return provider
+
+    def _get_origin_from_secrets(self) -> str | None:
+        redirect_uri = None
+        auth_section = get_secrets_auth_section()
+        if auth_section:
+            redirect_uri = auth_section.get("redirect_uri", None)
+
+        if not redirect_uri:
+            return None
+
+        redirect_uri_parsed = urlparse(redirect_uri)
+        origin_from_redirect_uri: str = (
+            redirect_uri_parsed.scheme + "://" + redirect_uri_parsed.netloc
+        )
+        return origin_from_redirect_uri

streamlit/web/server/oidc_mixin.py

@@ -0,0 +1,108 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import tornado.web
+from authlib.integrations.base_client import (  # type: ignore[import-untyped]
+    BaseApp,
+    BaseOAuth,
+    OAuth2Mixin,
+    OAuthError,
+    OpenIDMixin,
+)
+from authlib.integrations.requests_client import (  # type: ignore[import-untyped]
+    OAuth2Session,
+)
+
+from streamlit.web.server.authlib_tornado_integration import TornadoIntegration
+
+
+class TornadoOAuth2App(OAuth2Mixin, OpenIDMixin, BaseApp):  # type: ignore[misc]
+    client_cls = OAuth2Session
+
+    def load_server_metadata(self):
+        """We enforce S256 code challenge method if it is supported by the server."""
+        result = super().load_server_metadata()
+        if "S256" in result.get("code_challenge_methods_supported", []):
+            self.client_kwargs["code_challenge_method"] = "S256"
+        return result
+
+    def authorize_redirect(
+        self, request_handler: tornado.web.RequestHandler, redirect_uri=None, **kwargs
+    ):
+        """Create a HTTP Redirect for Authorization Endpoint.
+
+        :param request_handler: HTTP request instance from Tornado.
+        :param redirect_uri: Callback or redirect URI for authorization.
+        :param kwargs: Extra parameters to include.
+        :return: A HTTP redirect response.
+        """
+        auth_context = self.create_authorization_url(redirect_uri, **kwargs)
+        self._save_authorize_data(redirect_uri=redirect_uri, **auth_context)
+        request_handler.redirect(auth_context["url"], status=302)
+
+    def authorize_access_token(
+        self, request_handler: tornado.web.RequestHandler, **kwargs
+    ):
+        """
+        :param request_handler: HTTP request instance from Tornado.
+        :return: A token dict.
+        """
+        error = request_handler.get_argument("error", None)
+        if error:
+            description = request_handler.get_argument("error_description", None)
+            raise OAuthError(error=error, description=description)
+
+        params = {
+            "code": request_handler.get_argument("code"),
+            "state": request_handler.get_argument("state"),
+        }
+
+        assert self.framework.cache is not None
+        session = None
+
+        claims_options = kwargs.pop("claims_options", None)
+        state_data = self.framework.get_state_data(session, params.get("state"))
+        self.framework.clear_state_data(session, params.get("state"))
+        params = self._format_state_params(state_data, params)
+        token = self.fetch_access_token(**params, **kwargs)
+
+        if "id_token" in token and "nonce" in state_data:
+            userinfo = self.parse_id_token(
+                token, nonce=state_data["nonce"], claims_options=claims_options
+            )
+            token = {**token, "userinfo": userinfo}
+        return token
+
+    def _save_authorize_data(self, **kwargs):
+        """Authlib underlying uses the concept of "session" to store state data.
+        In Tornado, we don't have a session, so we use the framework's cache option.
+        """
+        state = kwargs.pop("state", None)
+        if state:
+            assert self.framework.cache is not None
+            session = None
+            self.framework.set_state_data(session, state, kwargs)
+        else:
+            raise RuntimeError("Missing state value")
+
+
+class TornadoOAuth(BaseOAuth):  # type: ignore[misc]
+    oauth2_client_cls = TornadoOAuth2App
+    framework_integration_cls = TornadoIntegration
+
+    def __init__(self, config=None, cache=None, fetch_token=None, update_token=None):
+        super().__init__(
+            cache=cache, fetch_token=fetch_token, update_token=update_token
+        )
+        self.config = config

streamlit/web/server/routes.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,7 +22,10 @@ import tornado.web
 from streamlit import config, file_util
 from streamlit.logger import get_logger
 from streamlit.runtime.runtime_util import serialize_forward_msg
-from streamlit.web.server.server_util import emit_endpoint_deprecation_notice
+from streamlit.web.server.server_util import (
+    emit_endpoint_deprecation_notice,
+    is_xsrf_enabled,
+)
 
 _LOGGER: Final = get_logger(__name__)
 
@@ -58,7 +61,6 @@ class StaticFileHandler(tornado.web.StaticFileHandler):
         be cached indefinitely.
         """
         is_index_url = len(path) == 0
-
         if is_index_url or path.endswith(".html"):
             self.set_header("Cache-Control", "no-cache")
         else:
@@ -173,7 +175,7 @@ class HealthHandler(_SpecialRequestHandler):
             # server.enableXsrfProtection is updated, the browser does not reload the document.
             # Manually setting the cookie on /healthz since it is pinged when the
             # browser is disconnected from the server.
-            if config.get_option("server.enableXsrfProtection"):
+            if is_xsrf_enabled():
                 cookie_kwargs = self.settings.get("xsrf_cookie_kwargs", {})
                 self.set_cookie(
                     self.settings.get("xsrf_cookie_name", "_streamlit_xsrf"),

streamlit/web/server/server.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@ import tornado.websocket
 from tornado.httpserver import HTTPServer
 
 from streamlit import cli_util, config, file_util, util
+from streamlit.auth_util import is_authlib_installed
 from streamlit.config_option import ConfigOption
 from streamlit.logger import get_logger
 from streamlit.runtime import Runtime, RuntimeConfig, RuntimeState
@@ -52,7 +53,12 @@ from streamlit.web.server.routes import (
     RemoveSlashHandler,
     StaticFileHandler,
 )
-from streamlit.web.server.server_util import DEVELOPMENT_PORT, make_url_path_regex
+from streamlit.web.server.server_util import (
+    DEVELOPMENT_PORT,
+    get_cookie_secret,
+    is_xsrf_enabled,
+    make_url_path_regex,
+)
 from streamlit.web.server.stats_request_handler import StatsRequestHandler
 from streamlit.web.server.upload_file_request_handler import UploadFileRequestHandler
 
@@ -96,6 +102,10 @@ SCRIPT_HEALTH_CHECK_ENDPOINT: Final = (
     r"(?:script-health-check|_stcore/script-health-check)"
 )
 
+OAUTH2_CALLBACK_ENDPOINT: Final = "/oauth2callback"
+AUTH_LOGIN_ENDPOINT: Final = "/auth/login"
+AUTH_LOGOUT_ENDPOINT: Final = "/auth/logout"
+
 
 class RetriesExceeded(Exception):
     pass
@@ -370,6 +380,33 @@ class Server:
                 ]
             )
 
+        if is_authlib_installed():
+            from streamlit.web.server.oauth_authlib_routes import (
+                AuthCallbackHandler,
+                AuthLoginHandler,
+                AuthLogoutHandler,
+            )
+
+            routes.extend(
+                [
+                    (
+                        make_url_path_regex(base, OAUTH2_CALLBACK_ENDPOINT),
+                        AuthCallbackHandler,
+                        {"base_url": base},
+                    ),
+                    (
+                        make_url_path_regex(base, AUTH_LOGIN_ENDPOINT),
+                        AuthLoginHandler,
+                        {"base_url": base},
+                    ),
+                    (
+                        make_url_path_regex(base, AUTH_LOGOUT_ENDPOINT),
+                        AuthLogoutHandler,
+                        {"base_url": base},
+                    ),
+                ]
+            )
+
         if config.get_option("global.developmentMode"):
             _LOGGER.debug("Serving static content from the Node dev server")
         else:
@@ -410,8 +447,8 @@ class Server:
 
         return tornado.web.Application(
             routes,
-            cookie_secret=config.get_option("server.cookieSecret"),
-            xsrf_cookies=config.get_option("server.enableXsrfProtection"),
+            cookie_secret=get_cookie_secret(),
+            xsrf_cookies=is_xsrf_enabled(),
             # Set the websocket message size. The default value is too low.
             websocket_max_message_size=get_max_message_size_bytes(),
             **TORNADO_SETTINGS,  # type: ignore[arg-type]

streamlit/web/server/server_util.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ from typing import TYPE_CHECKING, Final, Literal
 from urllib.parse import urljoin
 
 from streamlit import config, net_util, url_util
+from streamlit.runtime.secrets import secrets_singleton
 
 if TYPE_CHECKING:
     from tornado.web import RequestHandler
@@ -27,6 +28,8 @@ if TYPE_CHECKING:
 # The port reserved for internal development.
 DEVELOPMENT_PORT: Final = 3000
 
+AUTH_COOKIE_NAME: Final = "_streamlit_user"
+
 
 def is_url_from_allowed_origins(url: str) -> bool:
     """Return True if URL is from allowed origins (for CORS purpose).
@@ -70,6 +73,27 @@ def is_url_from_allowed_origins(url: str) -> bool:
     return False
 
 
+def get_cookie_secret() -> str:
+    """Get the cookie secret.
+
+    If the user has not set a cookie secret, we generate a random one.
+    """
+    cookie_secret: str = config.get_option("server.cookieSecret")
+    if secrets_singleton.load_if_toml_exists():
+        auth_section = secrets_singleton.get("auth")
+        if auth_section:
+            cookie_secret = auth_section.get("cookie_secret", cookie_secret)
+    return cookie_secret
+
+
+def is_xsrf_enabled():
+    csrf_enabled = config.get_option("server.enableXsrfProtection")
+    if not csrf_enabled and secrets_singleton.load_if_toml_exists():
+        auth_section = secrets_singleton.get("auth", None)
+        csrf_enabled = csrf_enabled or auth_section is not None
+    return csrf_enabled
+
+
 def _get_server_address_if_manually_set() -> str | None:
     if config.is_manually_set("browser.serverAddress"):
         return url_util.get_hostname(config.get_option("browser.serverAddress"))

streamlit/web/server/stats_request_handler.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

streamlit/web/server/upload_file_request_handler.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ import tornado.web
 from streamlit import config
 from streamlit.runtime.uploaded_file_manager import UploadedFileRec
 from streamlit.web.server import routes, server_util
+from streamlit.web.server.server_util import is_xsrf_enabled
 
 if TYPE_CHECKING:
     from streamlit.runtime.memory_uploaded_file_manager import MemoryUploadedFileManager
@@ -51,7 +52,7 @@ class UploadFileRequestHandler(tornado.web.RequestHandler):
     def set_default_headers(self):
         self.set_header("Access-Control-Allow-Methods", "PUT, OPTIONS, DELETE")
         self.set_header("Access-Control-Allow-Headers", "Content-Type")
-        if config.get_option("server.enableXsrfProtection"):
+        if is_xsrf_enabled():
             self.set_header(
                 "Access-Control-Allow-Origin",
                 server_util.get_url(config.get_option("browser.serverAddress")),

streamlit/web/server/websocket_headers.py

@@ -1,4 +1,4 @@
-# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

{streamlit_nightly-1.41.2.dev20250106.data → streamlit_nightly-1.41.2.dev20250108.data}/scripts/streamlit.cmd

@@ -1,4 +1,4 @@
-rem Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2024)
+rem Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
 rem
 rem Licensed under the Apache License, Version 2.0 (the "License");
 rem you may not use this file except in compliance with the License.

{streamlit_nightly-1.41.2.dev20250106.dist-info → streamlit_nightly-1.41.2.dev20250108.dist-info}/METADATA

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: streamlit-nightly
-Version: 1.41.2.dev20250106
+Version: 1.41.2.dev20250108
 Summary: A faster way to build and share data apps
 Home-page: https://streamlit.io
 Author: Snowflake Inc
@@ -53,6 +53,18 @@ Requires-Dist: tornado<7,>=6.0.3
 Provides-Extra: snowflake
 Requires-Dist: snowflake-snowpark-python[modin]>=1.17.0; python_version < "3.12" and extra == "snowflake"
 Requires-Dist: snowflake-connector-python>=2.8.0; python_version < "3.12" and extra == "snowflake"
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license
+Dynamic: project-url
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
 
 <br>