xlwings-server 1.1.0__py3-none-any.whl

xlwings_server/routers/root.py

@@ -0,0 +1,16 @@
+import logging
+
+from fastapi import APIRouter
+
+from ..config import settings
+
+router = APIRouter(prefix=settings.app_path)
+
+logger = logging.getLogger(__name__)
+
+
+# Endpoints
+@router.get("/")
+async def root():
+    # This endpoint could be used for a health check
+    return {"status": "ok"}

xlwings_server/routers/socketio.py

@@ -0,0 +1,69 @@
+import logging
+
+import socketio
+import xlwings as xw
+
+# Try to import custom modules from project directory first (CLI/Azure mode)
+# Fall back to package location (tests/package mode)
+try:
+    import custom_functions
+except ModuleNotFoundError:
+    import xlwings_server.custom_functions as custom_functions
+
+from xlwings_server.config import PROJECT_DIR, settings
+from xlwings_server.dependencies import authenticate
+from xlwings_server.models import CurrentUser
+
+logger = logging.getLogger(__name__)
+
+if settings.socketio_message_queue_url:
+    client_manager = socketio.AsyncRedisManager(
+        settings.socketio_message_queue_url, write_only=not settings.socketio_server_app
+    )
+else:
+    client_manager = None
+
+
+sio = socketio.AsyncServer(
+    async_mode="asgi",
+    client_manager=client_manager,
+    cors_allowed_origins=(
+        settings.cors_allow_origins[0]
+        if len(settings.cors_allow_origins) == 1
+        else settings.cors_allow_origins
+    ),
+)
+
+
+@sio.on("connect")
+async def connect(sid, environ, auth):
+    if settings.environment == "dev" and settings.enable_hotreload:
+        from .. import hotreload
+
+        logging.getLogger("watchfiles").setLevel(logging.ERROR)
+        await hotreload.start_browser_reload_watcher(sio=sio, directory=PROJECT_DIR)
+    token_string = auth.get("token")
+    provider = auth.get("provider")
+    try:
+        current_user = await authenticate(token_string, auth_provider=provider)
+        await sio.save_session(sid, {"current_user": current_user})
+        logger.info(f"Socket.io: connect {sid}")
+        logger.info(f"Socket.io: User authenticated {current_user.name}")
+    except Exception as e:
+        logger.info(f"Socket.io: authentication failed for sid {sid}: {repr(e)}")
+        await sio.disconnect(sid)
+
+
+@sio.on("disconnect")
+async def disconnect(sid):
+    await xw.server.sio_disconnect(sid)
+
+
+@sio.on("xlwings:function-call")
+async def sio_function_call(sid, data):
+    session = await sio.get_session(sid)
+    current_user = session["current_user"]
+    logger.info(f"""Function "{data['func_name']}" called by {current_user.name}""")
+    await xw.server.sio_custom_function_call(
+        sid, data, custom_functions, current_user, sio, {CurrentUser: current_user}
+    )

xlwings_server/routers/taskpane.py

@@ -0,0 +1,12 @@
+from fastapi import APIRouter, Request
+
+from ..config import settings
+from ..templates import TemplateResponse
+
+router = APIRouter(prefix=settings.app_path)
+
+
+@router.get("/taskpane")
+@router.get("/taskpane.html")
+async def taskpane(request: Request):
+    return TemplateResponse(request=request, name=settings.taskpane_html)

xlwings_server/routers/xlwings.py

@@ -0,0 +1,197 @@
+import contextvars
+import inspect
+import logging
+from pathlib import Path
+from textwrap import dedent
+
+import xlwings as xw
+import xlwings.server
+from fastapi import APIRouter, Body, Header, Request, Response
+
+# Try to import custom modules from project directory first (CLI/Azure mode)
+# Fall back to package location (tests/package mode)
+try:
+    import custom_functions
+except ModuleNotFoundError:
+    import xlwings_server.custom_functions as custom_functions
+
+try:
+    import custom_scripts
+except ModuleNotFoundError:
+    import xlwings_server.custom_scripts as custom_scripts
+
+from xlwings_server import dependencies as dep
+from xlwings_server.config import PACKAGE_DIR, settings
+from xlwings_server.models import CurrentUser
+from xlwings_server.templates import TemplateResponse
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix=f"{settings.app_path}/xlwings")
+
+
+def sanitize_log_input(input_string: str) -> str:
+    """Replaces newline and carriage return characters to prevent log injection."""
+    if not isinstance(input_string, str):
+        input_string = str(input_string)
+    return input_string.replace("\n", "\\n").replace("\r", "\\r")
+
+
+@router.get("/alert")
+async def alert(
+    request: Request, prompt: str, title: str, buttons: str, mode: str, callback: str
+):
+    """Boilerplate required by book.app.alert() and to show unhandled exceptions"""
+    return TemplateResponse(
+        request=request,
+        name="xlwings_alert.html",
+        context={
+            "prompt": prompt,
+            "title": title,
+            "buttons": buttons,
+            "mode": mode,
+            "callback": callback,
+            "settings": settings,
+        },
+    )
+
+
+@router.get("/custom-functions-meta")
+@router.get("/custom-functions-meta.json")
+async def custom_functions_meta():
+    return xlwings.server.custom_functions_meta(
+        custom_functions, typehinted_params_to_exclude=[CurrentUser]
+    )
+
+
+@router.get("/custom-functions-code")
+@router.get("/custom-functions-code.js")
+async def custom_functions_code():
+    custom_functions_call_path = f"{settings.app_path}/xlwings/custom-functions-call"
+    js = (
+        PACKAGE_DIR / "static" / "js" / "core" / "custom-functions-code.js"
+    ).read_text()
+    # format string would require to double all curly braces
+    js = js.replace("placeholder_xlwings_version", xw.__version__).replace(
+        "placeholder_custom_functions_call_path", custom_functions_call_path
+    )
+    for name, obj in inspect.getmembers(custom_functions):
+        if hasattr(obj, "__xlfunc__"):
+            xlfunc = obj.__xlfunc__
+            func_name = xlfunc["name"]
+            streaming = "true" if inspect.isasyncgenfunction(obj) else "false"
+            js += dedent(
+                f"""\
+            async function {func_name}() {{
+                let args = ["{func_name}", {streaming}]
+                args.push.apply(args, arguments);
+                return await base.apply(null, args);
+            }}
+            CustomFunctions.associate("{func_name.upper()}", {func_name});
+            """
+            )
+    return Response(
+        content=js,
+        media_type="text/javascript",
+    )
+
+
+# ContextVars
+socketio_id_context = contextvars.ContextVar("socketio_id_context")
+caller_address_context = contextvars.ContextVar("caller_address_context")
+redis_client_context = contextvars.ContextVar("redis_client_context")
+
+
+@router.post("/custom-functions-call")
+async def custom_functions_call(
+    current_user: dep.User,
+    redis_client: dep.RedisClient,
+    data: dict = Body,
+    sid: str | None = Header(default=None),
+):
+    # Replace newline and carriage return characters to prevent log injection
+    safe_func_name = sanitize_log_input(data["func_name"])
+    safe_user_name = sanitize_log_input(current_user.name)
+    logger.info(f"""Function "{safe_func_name}" called by {safe_user_name}""")
+    socketio_id_context.set(sid)  # For utils.trigger_script()
+    caller_address_context.set(data["caller_address"])  # For ObjectCache converter
+    redis_client_context.set(redis_client)  # For ObjectCache converter
+
+    rv = await xlwings.server.custom_functions_call(
+        data,
+        custom_functions,
+        current_user,
+        typehint_to_value={CurrentUser: current_user},
+    )
+    return {"result": rv}
+
+
+@router.post("/custom-scripts-call/{script_name}")
+async def custom_scripts_call(script_name: str, book: dep.Book, current_user: dep.User):
+    # Replace newline and carriage return characters to prevent log injection
+    safe_script_name = sanitize_log_input(script_name)
+    safe_user_name = sanitize_log_input(current_user.name)
+    logger.info(f"""Script "{safe_script_name}" called by {safe_user_name}""")
+    book = await xlwings.server.custom_scripts_call(
+        custom_scripts,
+        script_name,
+        current_user,
+        typehint_to_value={CurrentUser: current_user, xw.Book: book},
+    )
+    return book.json()
+
+
+@router.get("/custom-scripts-meta")
+@router.get("/custom-scripts-meta.json")
+async def custom_scripts_meta():
+    return xlwings.server.custom_scripts_meta(custom_scripts)
+
+
+if settings.enable_wasm:
+
+    @router.get("/pyodide.json")
+    async def get_pyodide_config():
+        # requirements.txt
+        packages = (
+            Path(settings.project_dir / "wasm" / "requirements.txt")
+            .read_text()
+            .splitlines()
+        )
+        packages = [
+            pkg.replace("/static", settings.static_url_path).strip()
+            for pkg in packages
+            if pkg.strip()
+        ]
+
+        # Files
+        def scan_directory(
+            base_dir: Path, dir_name: str, prepend_dir_name: bool = False
+        ) -> dict:
+            dir_path = Path(settings.project_dir / dir_name)
+            files = {}
+            if dir_path.exists():
+                for file_path in dir_path.rglob("*"):
+                    if (
+                        file_path.is_file()
+                        and file_path.suffix != ".pyc"
+                        and file_path.name != "requirements.txt"
+                    ):
+                        relative_path = file_path.relative_to(dir_path)
+                        files[
+                            f"{settings.static_url_path.replace('static', dir_name)}/{relative_path}"
+                        ] = (
+                            f"./{dir_name}/{relative_path}"
+                            if prepend_dir_name
+                            else f"./{relative_path}"
+                        )
+            return files
+
+        # Scan all directories
+        files = {}
+        files.update(scan_directory(settings.project_dir, "wasm"))
+        for directory in ["custom_functions", "custom_scripts"]:
+            files.update(
+                scan_directory(settings.project_dir, directory, prepend_dir_name=True)
+            )
+        response = {"packages": packages, "files": files}
+        return response

xlwings_server/security_headers.json

@@ -0,0 +1,53 @@
+{
+  "last_update_utc": "2024-09-02 21:54:45",
+  "headers": [
+    {
+      "name": "Cache-Control",
+      "value": "no-store, max-age=0"
+    },
+    {
+      "name": "Clear-Site-Data",
+      "value": "\"cache\",\"cookies\",\"storage\""
+    },
+    {
+      "name": "Content-Security-Policy",
+      "value": "default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content"
+    },
+    {
+      "name": "Cross-Origin-Embedder-Policy",
+      "value": "require-corp"
+    },
+    {
+      "name": "Cross-Origin-Opener-Policy",
+      "value": "same-origin"
+    },
+    {
+      "name": "Cross-Origin-Resource-Policy",
+      "value": "same-origin"
+    },
+    {
+      "name": "Permissions-Policy",
+      "value": "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=()"
+    },
+    {
+      "name": "Referrer-Policy",
+      "value": "no-referrer"
+    },
+    {
+      "name": "Strict-Transport-Security",
+      "value": "max-age=31536000; includeSubDomains"
+    },
+    {
+      "name": "X-Content-Type-Options",
+      "value": "nosniff"
+    },
+    {
+      "name": "X-Frame-Options",
+      "value": "deny"
+    },
+    {
+      "name": "X-Permitted-Cross-Domain-Policies",
+      "value": "none"
+    }
+  ]
+}

xlwings_server/serializers/__init__.py

@@ -0,0 +1,25 @@
+import json
+
+from . import (
+    default_serializer,
+    dictionary_serializer,
+    numpy_serializer,
+    pandas_serializer,
+)
+from .framework import Serializer, custom_encoder, serializers
+
+
+def serialize(obj, serializer_name="default"):
+    serializer = serializers.get(type(obj), serializers.get(serializer_name))
+    if serializer is None:
+        raise ValueError(f"No serializer registered for object of type {type(obj)}")
+    return json.dumps(serializer.serialize(obj), default=custom_encoder)
+
+
+def deserialize(payload, serializer_name="default"):
+    payload = json.loads(payload)
+    serializer_name = payload.get("serializer", serializer_name)
+    serializer = serializers.get(serializer_name)
+    if serializer is None:
+        raise ValueError(f"No serializer registered with name '{serializer_name}'")
+    return serializer.deserialize(payload)

xlwings_server/serializers/default_serializer.py

@@ -0,0 +1,19 @@
+from .framework import Serializer, custom_decoder
+
+
+class DefaultSerializer(Serializer):
+    name = "default"
+
+    @classmethod
+    def serialize(cls, obj):
+        return {
+            "data": obj,
+            "serializer": cls.name,
+        }
+
+    @classmethod
+    def deserialize(cls, payload):
+        return custom_decoder(payload["data"])
+
+
+DefaultSerializer.register()

xlwings_server/serializers/dictionary_serializer.py

@@ -0,0 +1,25 @@
+from .framework import Serializer, custom_decoder
+
+
+class DictionarySerializer(Serializer):
+    name = "custom_dict_serializer"
+
+    @classmethod
+    def serialize(cls, obj):
+        # Convert dictionary with non-string keys (e.g., datetime) to a list of
+        # [key, value] pairs
+        items = [[k, v] for k, v in obj.items()]
+        return {
+            "data": items,
+            "serializer": cls.name,
+        }
+
+    @classmethod
+    def deserialize(cls, payload):
+        # Convert back from list of pairs to dictionary
+        items = payload["data"]
+        return {custom_decoder(k): custom_decoder(v) for k, v in items}
+
+
+# Register the serializer for dict type
+DictionarySerializer.register(dict)

xlwings_server/serializers/framework.py

@@ -0,0 +1,50 @@
+import datetime as dt
+
+# Registry, holding type or serializer_name vs. serializer combinations
+serializers = {}
+
+
+# Base class
+class Serializer:
+    @classmethod
+    def serialize(cls, obj):
+        raise NotImplementedError()
+
+    @classmethod
+    def deserialize(cls, payload):
+        raise NotImplementedError()
+
+    @classmethod
+    def register(cls, *types):
+        serializers[cls.name] = cls
+        for type in types:
+            serializers[type] = cls
+
+
+# Custom encoders/decoders
+def custom_encoder(obj):
+    if isinstance(obj, dt.datetime):
+        return obj.isoformat()
+    valid_types = tuple(cls for cls in serializers.keys() if isinstance(cls, type))
+    if isinstance(obj, valid_types):
+        serializer = serializers.get(type(obj))
+        if serializer:
+            return serializer.serialize(obj)
+    raise TypeError(f"Object of type {type(obj)} is not JSON serializable")
+
+
+def custom_decoder(obj):
+    if isinstance(obj, list):
+        return [custom_decoder(item) for item in obj]
+    elif isinstance(obj, dict):
+        serializer = serializers.get(obj.get("serializer"))
+        if serializer:
+            return serializer.deserialize(obj)
+        return {key: custom_decoder(value) for key, value in obj.items()}
+    elif isinstance(obj, str):
+        try:
+            return dt.datetime.fromisoformat(obj)
+        except ValueError:
+            return obj
+    else:
+        return obj

xlwings_server/serializers/numpy_serializer.py

@@ -0,0 +1,26 @@
+try:
+    import numpy as np
+except ImportError:
+    np = None
+
+from .framework import Serializer
+
+if np:
+
+    class NumpyArraySerializer(Serializer):
+        name = "np.array"
+
+        @classmethod
+        def serialize(cls, arr: np.ndarray):
+            return {
+                "serializer": cls.name,
+                "data": arr.tolist(),
+                "dtype": str(arr.dtype),
+            }
+
+        @classmethod
+        def deserialize(cls, payload):
+            arr = np.array(payload["data"], dtype=payload["dtype"])
+            return arr
+
+    NumpyArraySerializer.register(np.array, np.ndarray)

xlwings_server/serializers/pandas_serializer.py

@@ -0,0 +1,95 @@
+import uuid
+from io import StringIO
+
+try:
+    import pandas as pd
+except ImportError:
+    pd = None
+
+from .framework import Serializer
+
+if pd:
+
+    class PandasDataFrameSerializer(Serializer):
+        name = "pd.DataFrame"
+
+        @classmethod
+        def serialize(cls, df):
+            serialized = {"serializer": cls.name}
+
+            if isinstance(df.index, pd.MultiIndex):
+                df = df.copy()
+                index_names = df.index.names
+                # Index names are often None
+                temp_names = [
+                    f"_idx_{uuid.uuid4().hex[:8]}" for _ in range(len(df.index.names))
+                ]
+                index_mapping = {
+                    temp: orig for temp, orig in zip(temp_names, index_names)
+                }
+                df.index.names = temp_names
+                df = df.reset_index()
+                serialized.update(
+                    {
+                        "is_multi_index": True,
+                        "index_mapping": index_mapping,
+                    }
+                )
+
+            serialized.update(
+                {
+                    "serializer": cls.name,
+                    "data": df.to_json(date_format="iso"),
+                    "dtypes": {col: str(dtype) for col, dtype in df.dtypes.items()},
+                }
+            )
+
+            # Preserve DatetimeIndex frequency if it exists
+            if isinstance(df.index, pd.DatetimeIndex) and df.index.freq is not None:
+                serialized["index_freq"] = df.index.freq.freqstr
+
+            return serialized
+
+        @classmethod
+        def deserialize(cls, payload):
+            df = pd.read_json(StringIO(payload["data"]))
+
+            # Standard column type conversion
+            for col, dtype in payload["dtypes"].items():
+                df[col] = df[col].astype(dtype)
+
+            # Handle MultiIndex reconstruction
+            if payload.get("is_multi_index"):
+                index_mapping = payload["index_mapping"]
+                # Convert temporary columns back to index with original names
+                index_cols = list(index_mapping.keys())
+                df = df.set_index(index_cols)
+                # Restore original index names
+                df.index.names = list(index_mapping.values())
+
+            # Restore DatetimeIndex frequency if it was saved
+            if isinstance(df.index, pd.DatetimeIndex) and "index_freq" in payload:
+                df.index.freq = pd.tseries.frequencies.to_offset(payload["index_freq"])
+
+            return df
+
+    PandasDataFrameSerializer.register(pd.DataFrame)
+
+    class PandasSeriesSerializer(Serializer):
+        name = "pd.Series"
+
+        @classmethod
+        def serialize(cls, series):
+            return {
+                "serializer": cls.name,
+                "data": series.to_json(date_format="iso"),
+                "dtype": str(series.dtype),
+            }
+
+        @classmethod
+        def deserialize(cls, payload):
+            series = pd.read_json(StringIO(payload["data"]), typ="series")
+            series = series.astype(payload["dtype"])
+            return series
+
+    PandasSeriesSerializer.register(pd.Series)

xlwings_server/static/css/core.css

@@ -0,0 +1,28 @@
+/**
+ * These are styles required by core functionality of xlwings Server.
+ * For your own CSS, use style.css instead.
+*/
+
+/* htmx IndicatorStyles */
+.htmx-indicator {
+  opacity: 0;
+}
+.htmx-request .htmx-indicator {
+  opacity: 1;
+  transition: opacity 200ms ease-in;
+}
+.htmx-request.htmx-indicator {
+  opacity: 1;
+  transition: opacity 200ms ease-in;
+}
+
+/* Alpine.js */
+[x-cloak] {
+  /* https://alpinejs.dev/directives/cloak */
+  display: none !important;
+}
+
+/* Custom */
+.z-index-1000 {
+  z-index: 1000;
+}

xlwings_server/static/js/auth.js

@@ -0,0 +1,13 @@
+globalThis.getAuth = async function () {
+  if (config.authProviders.includes("entraid")) {
+    const token = await xlwings.getAccessToken();
+    return {
+      token: token,
+      provider: "entraid",
+    };
+  }
+  return {
+    token: "",
+    provider: "",
+  };
+};

xlwings_server/static/js/config.js

@@ -0,0 +1,4 @@
+// Config
+// https://developer.mozilla.org/en-US/docs/Web/HTML/Element/script#embedding_data_in_html
+const configElement = document.getElementById("config");
+const config = configElement ? JSON.parse(configElement.textContent) : null;

xlwings_server/static/js/core/alpinejs-csp-boilerplate.js

@@ -0,0 +1,11 @@
+const alpineComponents = {};
+
+document.addEventListener("alpine:init", () => {
+  for (let name in alpineComponents) {
+    Alpine.data(name, () => alpineComponents[name]);
+  }
+});
+
+function registerAlpineComponent(name, obj) {
+  alpineComponents[name] = obj;
+}

xlwings_server/static/js/core/bootstrap-customizations.js

@@ -0,0 +1,7 @@
+// Alerts
+document.body.addEventListener("close.bs.alert", function (event) {
+  // Prevents alerts from being removed from the DOM when closed so they can be reused
+  event.preventDefault();
+  event.target.classList.add("d-none");
+  return false;
+});