mxiy2UdZddlmZddlZddlmZddlmZmZddl m Z ddl m Z m Z ddlmZdd lmZmZdd lmZdd lmZdd lmZmZdd lmZmZddlmZmZm Z ddl!m"Z"m#Z#ddl$m%Z%ddl&m'Z'ddl(m)Z)ddl*m+Z+er0ddl,m-Z-ddl.m/Z/ddl0m1Z1ddl2m3Z3ddl4m5Z5ddl6m7Z7ddlm8Z8ddl9m:Z:ee;Zde=d<d Z?de=d!<e>d"Z@de=d#<d$ZAde=d%<e>d&ZBde=d'<e>d(ZCde=d)<e>d*ZDde=d+<e>d,ZEde=d-<e?d.ZFde=d/<e@d0ZGde=d1<eAd2ZHde=d3<e>d4ZIde=d5<d6ZJde=d7<dEdFd8ZKdGd9ZLdGd:ZM dHd;ZNdId<ZO dId=ZPdId>ZQdJd?ZR dKd@ZS dLdAZT dMdBZU dNdCZV dOdDZWy)Pz(Route handlers for the Starlette server.) annotationsN)Path) TYPE_CHECKINGFinal)quote)config file_util) get_logger) MediaFileKindMediaFileStorageError)get_extension_for_mimetype)UploadedFileRec)MAX_APP_STATIC_FILE_SIZESAFE_APP_STATIC_FILE_EXTENSIONS)build_safe_abspathguess_content_type) _DEFAULT_ALLOWED_MESSAGE_ORIGINSallow_all_cross_origin_requestsis_allowed_origin)get_urlis_xsrf_enabled)starlette_app_utils)validate_xsrf_token)XSRF_COOKIE_NAME)StatsRequestHandler)RequestResponse) BaseRoute)BaseComponentRegistry)BidiComponentManager)Runtime)MemoryMediaFileStorage)MemoryUploadedFileManagerr_LOGGER_stcoreBASE_ROUTE_COREmediaBASE_ROUTE_MEDIAz /upload_fileBASE_ROUTE_UPLOAD_FILE componentBASE_ROUTE_COMPONENTz/health _ROUTE_HEALTHz/script-health-check_ROUTE_SCRIPT_HEALTHz/metrics_ROUTE_METRICSz /host-config_ROUTE_HOST_CONFIGz/{file_id:path} _ROUTE_MEDIAz/{session_id}/{file_id}_ROUTE_UPLOAD_FILEz /{path:path}_ROUTE_COMPONENTS_V1z/bidi-components/{path:path}_ROUTE_COMPONENTS_V2zapp/static/{path:path}_ROUTE_APP_STATICcZddlm}||ntjdxsd}|||S)aPrepend the base URL path to a route path. Parameters ---------- path The route path to prepend the base URL to (e.g., "_stcore/health"). base_url Optional explicit base URL. If None, uses the configured server.baseUrlPath. If an empty string, no base URL is prepended. Returns ------- str The full route path with base URL prepended (e.g., "/myapp/_stcore/health"). r) make_url_pathzserver.baseUrlPath)streamlit.url_utilr7r get_option)pathbase_urlr7bases f/home/htdocs/ttos/venv/lib/python3.12/site-packages/streamlit/web/server/starlette/starlette_routes.py _with_baser?_s; 1(f.?.?@T.U   t $$cKtrd|jd<y|jjd}|rt|r||jd<yyyw)aSet CORS headers on a response based on configuration. Configures the Access-Control-Allow-Origin header according to the following rules: - If CORS is disabled or in development mode: allows all origins ("*") - Otherwise: only allows origins that match the configured allowlist Parameters ---------- request The incoming Starlette request (used to read the Origin header). response The outgoing Starlette response to set headers on. *Access-Control-Allow-OriginNOrigin)rheadersgetr)requestresponseorigins r>_set_cors_headersrJwsY'(:=67 __  *F #F+:@67,vsAAc tsy|jjt}d}d}|rt j |\}}t j ||}t|t|ttjdy)aEnsure that the XSRF cookie is set on the response. This function manages XSRF (Cross-Site Request Forgery) token generation and cookie setting to maintain compatibility with Tornado's implementation. If an existing valid XSRF cookie is present, its token bytes and timestamp are preserved. Otherwise, a new token is generated. The cookie is only set if XSRF protection is enabled in the configuration. The Secure flag is added when SSL is configured. Note: The XSRF cookie intentionally does NOT have the HttpOnly flag. This is required for the double-submit cookie pattern: JavaScript reads the cookie value and includes it in the X-Xsrftoken request header, which the server then compares against the cookie value to validate requests. Parameters ---------- request The incoming Starlette request (used to read existing XSRF cookie). response The outgoing Starlette response to set the cookie on. Nzserver.sslCertFile)secure) rcookiesrFrrdecode_xsrf_token_stringgenerate_xsrf_token_string_set_unquoted_cookieboolrr:)rGrH raw_cookie token_bytes timestamp cookie_values r>_ensure_xsrf_cookierVs.  $$%56J $K I!4!M!M "  Y 'AAYLF%%&:;< r@cdj|d|ddg|rdgng}|djd}|jDcgc]I\}}|jdk(r-|jj |js||fK}}}|j d|jdf||_ycc}}w) aiSet a cookie without URL-encoding or quoting the value. Starlette's standard set_cookie() method URL-encodes special characters (like `|`) in cookie values. This function bypasses that encoding to maintain compatibility with Tornado's cookie format, which is required for XSRF tokens that use the format "2|mask|token|timestamp". If a cookie with the same name already exists, it is replaced. Cookie flags set: - Path=/: Available to all paths - SameSite=Lax: Protects against CSRF while allowing top-level navigations - Secure (conditional): Added when SSL is configured HttpOnly is intentionally NOT set for XSRF cookies because JavaScript must read the cookie value to include it in request headers (double-submit pattern). This matches Tornado's behavior. Parameters ---------- response The Starlette response to set the cookie on. cookie_name The name of the cookie. cookie_value The raw cookie value (will not be URL-encoded or quoted). secure Whether to add the Secure flag (should be True when using HTTPS). z; =zPath=/z SameSite=LaxSecurezlatin-1s set-cookieN)joinencode raw_headerslower startswithappend) rH cookie_namerUrL header_value key_prefixnamevaluefiltered_headerss r>rPrPsJ99m1\N +   #xj  L =")))4J$//3 D% JJLM ) (()9)9);< u 33]L,?,? ,JKL+H3sAB?cddlmmddlm}d fd }d fd }|t t ||ddg|t t ||d ggS) aJCreate health check route handlers for /_stcore/health. The health endpoint returns 200 OK when the runtime is ready to accept browser connections, or 503 Service Unavailable otherwise. This is used by load balancers and orchestration systems to determine service readiness. Parameters ---------- runtime The Streamlit runtime instance to check health status. base_url Optional base URL path prefix for the routes. Returns ------- list[BaseRoute] List of Starlette Route objects for GET, HEAD, and OPTIONS methods. rPlainTextResponserRoutecKjd{\}}|rdnd}||}d|jd<t||d{t|||S7H7wNi status_codeno-cache Cache-Control)is_ready_for_browser_connectionrErJrVrGokmessagestatusrHrhruntimes r>_health_endpointz.create_health_routes.._health_endpointsi#CCC G$W&A,6)222GX. D 3s!A A5A  A A A clKd}d|jd<t||d{|S7wNrnrprqrErJrGrHrs r>_health_optionsz-create_health_routes.._health_options;,,6)222 3 (424GETHEADmethodsOPTIONSrGrreturnrhrGrrr)starlette.responsesrhrstarlette.routingrjr?r-)rwr<rjrxr~rhrs` @@r>create_health_routesrsZ&@'  }h / FO  }h / K  r@cddlmmddlm}d fd }d fd }|t t ||ddg|t t ||d ggS) z*Create script health check route handlers.rrgricKjd{\}}|rdnd}||}d|jd<t||d{t|||S7H7wrl)does_script_run_without_errorrErJrVrss r>_script_health_endpointz._script_health_endpoint4sl#AACC G$W&A,6)222GX. D 3s!A$A 5A$ A"A$"A$clKd}d|jd<t||d{|S7wrzr|r}s r>_script_health_optionsz;create_script_health_routes.._script_health_options=rrrrrrrr)rrhrrrjr?r.)rwr<rjrrrhrs` @@r>create_script_health_routesr-s\@'  +X 6 #FO  +X 6 "K  r@cddlmmddlm}d fd }d fd }|t t ||dg|t t ||dggS) zCreate metrics route handlers.rrgricK|jjd} jj|r|nd}|jj dd}d|vr.t j|j}|d}nt j|}|d}t||d{|S7w)Nfamilies) family_namesAcceptr8zapplication/x-protobuf media_typezapplication/openmetrics-text) query_paramsgetlist stats_mgr get_statsrErFr_stats_to_protoSerializeToString_stats_to_textrJ) rGrequested_familiesstatsacceptpayloadrHtextrhrrws r>_metrics_endpointz0create_metrics_routes.._metrics_endpointVs$1199*E!!++/A+t, $$Xr2 #v -)99%@RRTG4LMH&55e_metrics_optionsz/create_metrics_routes.._metrics_optionsgsM,;I78;C78222 3s7AAArrrr)rrhrrrjr?r/)rwr<rjrrrhrs` @@r>create_metrics_routesrQsU?'"  ~x 0 G  ~x 0 K  r@c^ddlmddlm}dfd }|t t ||dggS)z"Create host config route handlers.r) JSONResponseric Ktt}tjdrd|vr|j d|ddddddd}t ||d{d|j d<|S7w)Nzglobal.developmentModezhttp://localhostFr8)allowedOriginsuseExternalAuthTokenenableCustomParentMessagesenforceDownloadInNewTab metricsUrlblockErrorDialogsresourceCrossOriginModerprq)listrrr:r_rJrE)rGallowedrHrs r>_host_config_endpointz8create_host_config_routes.._host_config_endpoints78   6 7"'1 NN- .")(-.3+0 %*+/    222,6) 3sAA4A2A4rr)rGrrr)rrrrjr?r0)r<rjrrs @r>create_host_config_routesr|s50'0  )8 4 !G  r@cddlmddlmddlm}d fd }d fd }|t t||ddg |t t||d g gS) aCreate media file route handlers for /media/{file_id}. Serves media files (images, audio, video) stored by st.image, st.audio, st.video, and st.download_button. Supports HTTP range requests for streaming media playback. Parameters ---------- media_storage The media file storage backend. base_url Optional base URL path prefix for the routes. Returns ------- list[BaseRoute] List of Starlette Route objects for GET, HEAD, and OPTIONS methods. r HTTPExceptionrricPK|jd} j|}i}|jtj k(rF|j }|sdt|j} |jdd|d}d ||d <d |d <|j}t|}d} |jjd} | rJ t!j"| |\} } d} || | dz}d| d| d||d<t't||d<nt'||d<|| |jxsd|} t)|| d{| S#t$r}dd|d}~wwxYw#t$rd t|}YwxYw#t$$rdddd|iwxYw7]w)Nfile_idFile not foundrodetailstreamlit_downloadlatin1z filename=""zfilename*=utf-8''z attachment; zContent-Dispositionbytesz Accept-Rangesrmrangeiz Invalid rangez Content-Rangezbytes */)rorrEzbytes -/zContent-Length text/plain)rorrE) path_paramsget_filer kindr DOWNLOADABLEfilenamer mimetyper[UnicodeEncodeErrorrcontentlenrErFrparse_range_header ValueErrorstrrJ)rGr media_fileexcrEr dispositionrcontent_lengthro range_header range_start range_endrHrr media_storages r>_media_endpointz,create_media_routes.._media_endpoints%%i0 S&//8J#% ??m88 8!**H(1*2E2EFGI D) *8*A6 02BC O $),CL(9G$ %(+N(;G$ % #!**:l    222k% SC8HIs R S& D 1%/1BC  D  # #*,8H.IJ * 3srF&E AF&+E)AF&FA'F&F$F& E& E!!E&&F&)FF&FF&F!!F&cNKd}t||d{|S7wNr{rnrJr}s r>_media_optionsz+create_media_routes.._media_options+,222 3 %#%rrrrr)starlette.exceptionsrrrrrjr?r1)rr<rjrrrrs` @@r>create_media_routesrs]*3,':x  |X . FO   |X . K   r@c& ddlm ddlmddlmddlm}dfd dd d fd }d fd }d fd }|tt||d g |tt||d g |tt||dg gS)awCreate file upload route handlers for /_stcore/upload_file/{session_id}/{file_id}. Handles file uploads from st.file_uploader widgets. Supports PUT for uploading files and DELETE for removing them. XSRF protection is enforced when enabled. Parameters ---------- runtime The Streamlit runtime instance (used to validate session IDs). upload_mgr The uploaded file manager to store/retrieve files. base_url Optional base URL path prefix for the routes. Returns ------- list[BaseRoute] List of Starlette Route objects for PUT, DELETE, and OPTIONS methods. r) UploadFilerrrictsy|jjd}|jjt}t ||s ddy)zValidate XSRF token for non-safe HTTP methods. Raises HTTPException with 403 if XSRF is enabled and validation fails. This mirrors Tornado's automatic XSRF protection for non-GET requests. Nz X-XsrftokenzXSRF token missing or invalidr)rrErFrMrr)rG xsrf_header xsrf_cookiers r> _check_xsrfz)create_upload_routes.._check_xsrf'sT  oo))-8 oo))*:; "; <C8WX X=r@c:Kd|jd<d|jd<trYttjd|jd<d|jd<d|jd <d |jd <yt ||d{y7w) NzPUT, OPTIONS, DELETEr Content-Typerzbrowser.serverAddressrCzX-Xsrftoken, Content-TyperDVarytruez Access-Control-Allow-Credentials)rErrrr:rJ)rGrHs r>_set_upload_headersz1create_upload_routes.._set_upload_headers6s;Q78;I78  >E!!"9:?H  : ;,   ; <(0H  V $CIH  ? @#GX6 6 6sBBBBcHKd}||d{|S7wr)rGrHrrs r>_upload_optionsz-create_upload_routes.._upload_optionsEs+,!'8444 5s " "c K||jd}|jd}j|s  ddtjddzdz}|jj d}|r t ||kDr  d d  |jd {}|jDcgc]}t| s|}}t|d k7r ddt||d} |jd {} |jjt| |kDr  d d j|t!||j"xsd|j$xsd|  d} || d {| S#t$r  dd wxYw7cc}w7#|jjwxYw7Fw)zUpload a file to the server. session_idrizInvalid session_idrzserver.maxUploadSizeizcontent-lengthizFile too largezInvalid Content-Length headerNrzExpected 1 file, but got rr8zapplication/octet-stream)rrctypedata)rfiler{rn)ris_active_sessionrr:rErFintrformvalues isinstancerreadrcloseadd_filerr content_type)rGrrmax_size_bytesrrrduploadsuploadrrHrrrrrrw upload_mgrs r> _upload_putz)create_upload_routes.._upload_putJs G((6 %%i0((4C8LM M   4 5   ~&7'C@PQQ8\\^#&*kkmUUz%7T5UU w<1 *CCL>(R   &D KK    t9~ %C8HI I! __*((F,F   ,!'8444K # #,K  $U' KK    5syA:G'>F%G'*F<+G'F?F?+G'GGGBG'G%G'%F99G'?G'GG""G'cK||jd}|jd}j||d}||d{|S7w)zDelete a file from the server.rr)rrr{rnN)r remove_file)rGrrrHrrrr s r>_upload_deletez,create_upload_routes.._upload_deletesh G((6 %%i0*gF,!'8444 5sAAAAPUTrDELETEr)rGrrNonerGrrHrrrr) starlette.datastructuresrrrrrrrjr?r2) rwr r<rjrr rrrrrrs `` @@@@@r>create_upload_routesr s042,' Y 7 ::x    )8 4 G  )8 4 J  )8 4 K  r@cddlddlmddlmddlm}d fd }d fd }|tt||dg |tt||d g gS) z'Create custom component route handlers.rNrrricK|jd}|jdd}t|dk(s|ds  dd|d}t|d k(r|dnd }j|}|  ddt ||}|  d d  j |d d{4d{}|j d{}dddd{ t|} t|| d{|r|jdrd| jd<| Sd| jd<| S777t7f#1d{7swYvxYw#t$r}  dd| d} ~ wwxYw7rw)Nr;rr)maxsplitrrzComponent not foundrr8r Forbiddenrb read errorrr.htmlrprqpublic) rsplitrget_component_pathr open_filerOSErrorrrJendswithrE)rGr;partscomponent_namercomponent_rootabspathrrrrHrranyiocomponent_registrys r>_component_endpointz4create_component_routes.._component_endpoints""6* 3 + u:?%(C8MN Nq"5zQ58B+>>~N  !C8MN N%^X> ?C D D O"__Wd;; ) )t!YY[( ) ) D5G5PQ2228,,W50:H  _ -19H  _ -< )( ) ) ) ) OC E3 N O 3sBE5E(D:)E1D<2E5E D> E EEE"E5E39E5:E<E>EEEE EE E0 E++E00E5cNKd}t||d{|S7wrrr}s r>_component_optionsz3create_component_routes.._component_optionsrrrrrr) r)rrrrrrjr?r3)r*r<rjr+r-rrr)s` @@@r>create_component_routesr.se2,'!!F  +X 6 G  +X 6 K  r@cddlddlmmddlm}d fd }d fd }|t t||dg|t t||d ggS) z.Create bidirectional component route handlers.rNrgricKd fd }jd}|jd}|r|dnd}|s|ddd{Sj||ddd{Sj|}||ddd{Sdj |dd}|r|j dr|ddd{St ||}||d d d{Stjj|r|ddd{S j|d d{4d{}|jd{} dddd{  t!|} t#| d{|j drd| j$d<| Sd| j$d<| S7x7Y787777777t#1d{7swYxYw#t$rM|jd djd d} tjd| |ddd{7cYSwxYw7w)NcPK||}t|d{|S7w)Nrnr)bodyrorHrhrGs r>_text_responsezVcreate_bidi_component_routes.._bidi_component_endpoint.._text_responses-(;GH#GX6 6 6O 7s &$&r;rrr8z not foundrr forbiddenrr  z&Error reading bidi component asset: %srrrrprqr)r2rrorrrh)rr rFr!rZr$rosr;isdirr"rr#replacer% exceptionrrJrE)rGr3r;r%r&r'rr(rrsanitized_abspathrHrhrr)bidi_component_managers` r>_bidi_component_endpointz>create_bidi_component_routes.._bidi_component_endpointsF  ""6* 3%*q' S99 9 ! % %n 5 =' S99 9/BB>R  !' S99 988E!"I&8,,S1' S99 9$^X> ?' S99 9 77== !' S99 9 ;"__Wd;; ) )t!YY[( ) )D5G5PQ222   W %0:H  _ -19H  _ -M::::::< )( ) ) ) ) ; 'b 9 A A$ K    8:K ( c::: :  ; 3s?IF;!I%F>&#I G 7IGI G!/IG IG(+G ,G(4G 5G(8G G G G(GG(!"II8I>IIII I G( G(GG(G%G G%!G((A H>5H86H>;I=H>>IcNKd}t||d{|S7wrrr}s r>_bidi_component_optionsz=create_bidi_component_routes.._bidi_component_optionsrrrrrr)r)rrhrrrjr?r4)r<r<rjr=r?rhrr)s` @@@r>create_bidi_component_routesr@sb?'00d  +X 6 $G  +X 6 #K  r@c"ddlmddlmmddlm}|r2tjjtj|ndd fd }d fd }|tt||dg |tt||d g gS) z.Create app static serving file route handlers.rr) FileResponserriNc.Ks dd|jjdd}t|}| ddtjj |rtjj |r ddtjj|tkDr ddt|jj}d}|tvrd}||}d |jd <d |jd <|Sw) Nrrrr;r8zFile is too largerrrBrCnosniffzX-Content-Type-Options)rrFrr7r;existsr8getsizerrsuffixr]rrE) rG relative_path safe_pathextrrHrBrapp_static_roots r>_app_static_endpointz>create_app_static_serving_routes.._app_static_endpoint@sC8HI I++//; & F  C8HI Iww~~i(BGGMM),DC8HI I 77??9 %(@ @*  9o$$**, 5 5%J jA:=675>12sDDc|Kd}d|jd<d|jd<d|jd<|Sw) Nr{rnrBrCrrrr)rE)_requestrHrs r>_app_static_optionsz=create_app_static_serving_routes.._app_static_options\sI,:=67;I78;I78s9<rrrr)rNrrr)rrrrBrrrjr7r;realpathr get_app_static_dirr?r5) main_script_pathr<rjrLrOrBrrrKs @@@@r> create_app_static_serving_routesrS2s3:'  556FGH  8  (( 3 G  (( 3 K  r@)N)r;rr< str | Nonerrr) rHrr`rrUrrLrQrr)rwr"r<rTrlist[BaseRoute])r<rTrrU)rr#r<rTrrU)rwr"r r$r<rTrrU)r*r r<rTrrU)r<r!r<rTrrU)rRrTr<rTrrU)X__doc__ __future__rr7pathlibrtypingrr urllib.parser streamlitrr streamlit.loggerr $streamlit.runtime.media_file_storager r +streamlit.runtime.memory_media_file_storager 'streamlit.runtime.uploaded_file_managerr,streamlit.web.server.app_static_file_handlerrr)streamlit.web.server.component_file_utilsrrstreamlit.web.server.routesrrr streamlit.web.server.server_utilrrstreamlit.web.server.starletter2streamlit.web.server.starlette.starlette_app_utilsr6streamlit.web.server.starlette.starlette_server_configr*streamlit.web.server.stats_request_handlerrstarlette.requestsrrrrr2streamlit.components.types.base_component_registryr )streamlit.components.v2.component_managerr!streamlit.runtimer"r#.streamlit.runtime.memory_uploaded_file_managerr$__name__r%__annotations__r'r)r*r,r-r.r/r0r1r2r3r4r5r?rJrVrPrrrrrrr.r@rSrr@r>ros/" '''URC F>RSJ*,+XN)RXH%%#"!%!#2"3< @@)e)**'2 u2!0 11EFeF++844 //|<E<***;< e<566QRER"6 6nEeE!0 11OPeP453%0A.-`9,9,9,9,  9,  9,x0f! ! *!!H(V"Jf)f5?ffRY Y)YY Yx<-<9C<<~J0J