streamlit-nightly 1.43.2.dev20250307__py3-none-any.whl

streamlit/web/cli.py

@@ -0,0 +1,369 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""A script which is run when the Streamlit package is executed."""
+
+from __future__ import annotations
+
+import os
+import sys
+from typing import TYPE_CHECKING, Any, Callable, TypeVar
+
+# We cannot lazy-load click here because its used via decorators.
+import click
+
+import streamlit.runtime.caching as caching
+import streamlit.web.bootstrap as bootstrap
+from streamlit import config as _config
+from streamlit.runtime.credentials import Credentials, check_credentials
+from streamlit.web.cache_storage_manager_config import (
+    create_default_cache_storage_manager,
+)
+
+if TYPE_CHECKING:
+    from streamlit.config_option import ConfigOption
+
+ACCEPTED_FILE_EXTENSIONS = ("py", "py3")
+
+LOG_LEVELS = ("error", "warning", "info", "debug")
+
+
+def _convert_config_option_to_click_option(
+    config_option: ConfigOption,
+) -> dict[str, Any]:
+    """Composes given config option options as options for click lib."""
+    option = f"--{config_option.key}"
+    param = config_option.key.replace(".", "_")
+    description = config_option.description
+    if config_option.deprecated:
+        if description is None:
+            description = ""
+        description += (
+            f"\n {config_option.deprecation_text} - {config_option.expiration_date}"
+        )
+
+    return {
+        "param": param,
+        "description": description,
+        "type": config_option.type,
+        "option": option,
+        "envvar": config_option.env_var,
+        "multiple": config_option.multiple,
+    }
+
+
+def _make_sensitive_option_callback(config_option: ConfigOption):
+    def callback(_ctx: click.Context, _param: click.Parameter, cli_value) -> None:
+        if cli_value is None:
+            return None
+        raise SystemExit(
+            f"Setting {config_option.key!r} option using the CLI flag is not allowed. "
+            f"Set this option in the configuration file or environment "
+            f"variable: {config_option.env_var!r}"
+        )
+
+    return callback
+
+
+F = TypeVar("F", bound=Callable[..., Any])
+
+
+def configurator_options(func: F) -> F:
+    """Decorator that adds config param keys to click dynamically."""
+    for _, value in reversed(_config._config_options_template.items()):
+        parsed_parameter = _convert_config_option_to_click_option(value)
+        if value.sensitive:
+            # Display a warning if the user tries to set sensitive
+            # options using the CLI and exit with non-zero code.
+            click_option_kwargs = {
+                "expose_value": False,
+                "hidden": True,
+                "is_eager": True,
+                "callback": _make_sensitive_option_callback(value),
+            }
+        else:
+            click_option_kwargs = {
+                "show_envvar": True,
+                "envvar": parsed_parameter["envvar"],
+            }
+        config_option = click.option(
+            parsed_parameter["option"],
+            parsed_parameter["param"],
+            help=parsed_parameter["description"],
+            type=parsed_parameter["type"],
+            multiple=parsed_parameter["multiple"],
+            **click_option_kwargs,
+        )
+        func = config_option(func)
+    return func
+
+
+def _download_remote(main_script_path: str, url_path: str) -> None:
+    """Fetch remote file at url_path to main_script_path"""
+    import requests
+
+    with open(main_script_path, "wb") as fp:
+        try:
+            resp = requests.get(url_path)
+            resp.raise_for_status()
+            fp.write(resp.content)
+        except requests.exceptions.RequestException as e:
+            raise click.BadParameter(f"Unable to fetch {url_path}.\n{e}")
+
+
+@click.group(context_settings={"auto_envvar_prefix": "STREAMLIT"})
+@click.option("--log_level", show_default=True, type=click.Choice(LOG_LEVELS))
+@click.version_option(prog_name="Streamlit")
+def main(log_level="info"):
+    """Try out a demo with:
+
+        $ streamlit hello
+
+    Or use the line below to run your own script:
+
+        $ streamlit run your_script.py
+    """
+
+    if log_level:
+        from streamlit.logger import get_logger
+
+        LOGGER = get_logger(__name__)
+        LOGGER.warning(
+            "Setting the log level using the --log_level flag is unsupported."
+            "\nUse the --logger.level flag (after your streamlit command) instead."
+        )
+
+
+@main.command("help")
+def help():
+    """Print this help message."""
+    # We use _get_command_line_as_string to run some error checks but don't do
+    # anything with its return value.
+    _get_command_line_as_string()
+
+    assert len(sys.argv) == 2  # This is always true, but let's assert anyway.
+
+    # Pretend user typed 'streamlit --help' instead of 'streamlit help'.
+    sys.argv[1] = "--help"
+    main(prog_name="streamlit")
+
+
+@main.command("version")
+def main_version():
+    """Print Streamlit's version number."""
+    # Pretend user typed 'streamlit --version' instead of 'streamlit version'
+    import sys
+
+    # We use _get_command_line_as_string to run some error checks but don't do
+    # anything with its return value.
+    _get_command_line_as_string()
+
+    assert len(sys.argv) == 2  # This is always true, but let's assert anyway.
+    sys.argv[1] = "--version"
+    main()
+
+
+@main.command("docs")
+def main_docs():
+    """Show help in browser."""
+    click.echo("Showing help page in browser...")
+    from streamlit import cli_util
+
+    cli_util.open_browser("https://docs.streamlit.io")
+
+
+@main.command("hello")
+@configurator_options
+def main_hello(**kwargs):
+    """Runs the Hello World script."""
+    from streamlit.hello import streamlit_app
+
+    bootstrap.load_config_options(flag_options=kwargs)
+    filename = streamlit_app.__file__
+    _main_run(filename, flag_options=kwargs)
+
+
+@main.command("run")
+@configurator_options
+@click.argument("target", required=True, envvar="STREAMLIT_RUN_TARGET")
+@click.argument("args", nargs=-1)
+def main_run(target: str, args=None, **kwargs):
+    """Run a Python script, piping stderr to Streamlit.
+
+    The script can be local or it can be an url. In the latter case, Streamlit
+    will download the script to a temporary file and runs this file.
+
+    """
+    from streamlit import url_util
+
+    bootstrap.load_config_options(flag_options=kwargs)
+
+    _, extension = os.path.splitext(target)
+    if extension[1:] not in ACCEPTED_FILE_EXTENSIONS:
+        if extension[1:] == "":
+            raise click.BadArgumentUsage(
+                "Streamlit requires raw Python (.py) files, but the provided file has no extension.\nFor more information, please see https://docs.streamlit.io"
+            )
+        else:
+            raise click.BadArgumentUsage(
+                f"Streamlit requires raw Python (.py) files, not {extension}.\nFor more information, please see https://docs.streamlit.io"
+            )
+
+    if url_util.is_url(target):
+        from streamlit.temporary_directory import TemporaryDirectory
+
+        with TemporaryDirectory() as temp_dir:
+            from urllib.parse import urlparse
+
+            path = urlparse(target).path
+            main_script_path = os.path.join(
+                temp_dir, path.strip("/").rsplit("/", 1)[-1]
+            )
+            # if this is a GitHub/Gist blob url, convert to a raw URL first.
+            target = url_util.process_gitblob_url(target)
+            _download_remote(main_script_path, target)
+            _main_run(main_script_path, args, flag_options=kwargs)
+    else:
+        if not os.path.exists(target):
+            raise click.BadParameter(f"File does not exist: {target}")
+        _main_run(target, args, flag_options=kwargs)
+
+
+def _get_command_line_as_string() -> str | None:
+    import subprocess
+
+    parent = click.get_current_context().parent
+    if parent is None:
+        return None
+
+    if "streamlit.cli" in parent.command_path:
+        raise RuntimeError(
+            "Running streamlit via `python -m streamlit.cli <command>` is"
+            " unsupported. Please use `python -m streamlit <command>` instead."
+        )
+
+    cmd_line_as_list = [parent.command_path]
+    cmd_line_as_list.extend(sys.argv[1:])
+    return subprocess.list2cmdline(cmd_line_as_list)
+
+
+def _main_run(
+    file,
+    args: list[str] | None = None,
+    flag_options: dict[str, Any] | None = None,
+) -> None:
+    if args is None:
+        args = []
+
+    if flag_options is None:
+        flag_options = {}
+
+    is_hello = _get_command_line_as_string() == "streamlit hello"
+
+    check_credentials()
+
+    bootstrap.run(file, is_hello, args, flag_options)
+
+
+# SUBCOMMAND: cache
+
+
+@main.group("cache")
+def cache():
+    """Manage the Streamlit cache."""
+    pass
+
+
+@cache.command("clear")
+def cache_clear():
+    """Clear st.cache_data and st.cache_resource caches."""
+
+    # in this `streamlit cache clear` cli command we cannot use the
+    # `cache_storage_manager from runtime (since runtime is not initialized)
+    # so we create a new cache_storage_manager instance that used in runtime,
+    # and call clear_all() method for it.
+    # This will not remove the in-memory cache.
+    cache_storage_manager = create_default_cache_storage_manager()
+    cache_storage_manager.clear_all()
+    caching.cache_resource.clear()
+
+
+# SUBCOMMAND: config
+
+
+@main.group("config")
+def config():
+    """Manage Streamlit's config settings."""
+    pass
+
+
+@config.command("show")
+@configurator_options
+def config_show(**kwargs):
+    """Show all of Streamlit's config settings."""
+
+    bootstrap.load_config_options(flag_options=kwargs)
+
+    _config.show_config()
+
+
+# SUBCOMMAND: activate
+
+
+@main.group("activate", invoke_without_command=True)
+@click.pass_context
+def activate(ctx):
+    """Activate Streamlit by entering your email."""
+    if not ctx.invoked_subcommand:
+        Credentials.get_current().activate()
+
+
+@activate.command("reset")
+def activate_reset():
+    """Reset Activation Credentials."""
+    Credentials.get_current().reset()
+
+
+# SUBCOMMAND: test
+
+
+@main.group("test", hidden=True)
+def test():
+    """Internal-only commands used for testing.
+
+    These commands are not included in the output of `streamlit help`.
+    """
+    pass
+
+
+@test.command("prog_name")
+def test_prog_name():
+    """Assert that the program name is set to `streamlit test`.
+
+    This is used by our cli-smoke-tests to verify that the program name is set
+    to `streamlit ...` whether the streamlit binary is invoked directly or via
+    `python -m streamlit ...`.
+    """
+    # We use _get_command_line_as_string to run some error checks but don't do
+    # anything with its return value.
+    _get_command_line_as_string()
+
+    parent = click.get_current_context().parent
+
+    assert parent is not None
+    assert parent.command_path == "streamlit test"
+
+
+if __name__ == "__main__":
+    main()

streamlit/web/server/__init__.py

@@ -0,0 +1,26 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from streamlit.web.server.component_request_handler import ComponentRequestHandler
+from streamlit.web.server.routes import allow_cross_origin_requests
+from streamlit.web.server.server import Server, server_address_is_unix_socket
+from streamlit.web.server.stats_request_handler import StatsRequestHandler
+
+__all__ = [
+    "ComponentRequestHandler",
+    "allow_cross_origin_requests",
+    "Server",
+    "server_address_is_unix_socket",
+    "StatsRequestHandler",
+]

streamlit/web/server/app_static_file_handler.py

@@ -0,0 +1,93 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Final
+
+import tornado.web
+
+from streamlit.logger import get_logger
+
+_LOGGER: Final = get_logger(__name__)
+
+# We agreed on these limitations for the initial release of static file sharing,
+# based on security concerns from the SiS and Community Cloud teams
+# The maximum possible size of single serving static file.
+MAX_APP_STATIC_FILE_SIZE = 200 * 1024 * 1024  # 200 MB
+# The list of file extensions that we serve with the corresponding Content-Type header.
+# All files with other extensions will be served with Content-Type: text/plain
+SAFE_APP_STATIC_FILE_EXTENSIONS = (
+    # Common image types:
+    ".jpg",
+    ".jpeg",
+    ".png",
+    ".gif",
+    ".webp",
+    # Common font types:
+    ".otf",
+    ".ttf",
+    ".woff",
+    ".woff2",
+    # Other types:
+    ".pdf",
+    ".xml",
+    ".json",
+)
+
+
+class AppStaticFileHandler(tornado.web.StaticFileHandler):
+    def initialize(self, path: str, default_filename: str | None = None) -> None:
+        super().initialize(path, default_filename)
+
+    def validate_absolute_path(self, root: str, absolute_path: str) -> str | None:
+        full_path = os.path.abspath(absolute_path)
+
+        ret_val = super().validate_absolute_path(root, absolute_path)
+
+        if os.path.isdir(full_path):
+            # we don't want to serve directories, and serve only files
+            raise tornado.web.HTTPError(404)
+
+        if os.path.commonpath([full_path, root]) != root:
+            # Don't allow misbehaving clients to break out of the static files directory
+            _LOGGER.warning(
+                "Serving files outside of the static directory is not supported"
+            )
+            raise tornado.web.HTTPError(404)
+
+        if (
+            os.path.exists(full_path)
+            and os.path.getsize(full_path) > MAX_APP_STATIC_FILE_SIZE
+        ):
+            raise tornado.web.HTTPError(
+                404,
+                "File is too large, its size should not exceed "
+                f"{MAX_APP_STATIC_FILE_SIZE} bytes",
+                reason="File is too large",
+            )
+
+        return ret_val
+
+    def set_default_headers(self):
+        # CORS protection is disabled because we need access to this endpoint
+        # from the inner iframe.
+        self.set_header("Access-Control-Allow-Origin", "*")
+
+    def set_extra_headers(self, path: str) -> None:
+        if Path(path).suffix not in SAFE_APP_STATIC_FILE_EXTENSIONS:
+            self.set_header("Content-Type", "text/plain")
+        self.set_header("X-Content-Type-Options", "nosniff")

streamlit/web/server/authlib_tornado_integration.py

@@ -0,0 +1,60 @@
+# Copyright (c) Streamlit Inc. (2018-2022) Snowflake Inc. (2022-2025)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from authlib.integrations.base_client import (  # type: ignore[import-untyped]
+    FrameworkIntegration,
+)
+
+from streamlit.runtime.secrets import AttrDict
+
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+
+    from streamlit.web.server.oidc_mixin import TornadoOAuth
+
+
+class TornadoIntegration(FrameworkIntegration):  # type: ignore[misc]
+    def update_token(self, token, refresh_token=None, access_token=None):
+        """We do not support access token refresh, since we obtain and operate only on
+        identity tokens. We override this method explicitly to implement all abstract
+        methods of base class.
+        """
+
+    @staticmethod
+    def load_config(
+        oauth: TornadoOAuth, name: str, params: Sequence[str]
+    ) -> dict[str, Any]:
+        """Configure Authlib integration with provider parameters
+        specified in secrets.toml
+        """
+
+        # oauth.config here is an auth section from secrets.toml
+        # We parse it here to transform nested AttrDict (for client_kwargs value)
+        # to dict so Authlib can work with it under the hood.
+        if not oauth.config:
+            return {}
+
+        prepared_config = {}
+        for key in params:
+            value = oauth.config.get(name, {}).get(key, None)
+            if isinstance(value, AttrDict):
+                # We want to modify client_kwargs further after loading server metadata
+                value = value.to_dict()
+            if value is not None:
+                prepared_config[key] = value
+        return prepared_config