Metadata-Version: 2.4
Name: splent_framework
Version: 1.19.0
Summary: SPLENT-FRAMEWORK is a set of libraries for agile product development within SPLENT.
Author-email: DiversoLab <diversolab@us.es>
License-Expression: LGPL-3.0-or-later
Project-URL: Homepage, https://github.com/diverso-lab/splent_framework
Project-URL: Issues, https://github.com/diverso-lab/splent_framework/issues
Requires-Python: >=3.13
Description-Content-Type: text/markdown
License-File: COPYING
License-File: COPYING.LESSER
Requires-Dist: python-dotenv==1.0.1
Requires-Dist: sqlalchemy==2.0.37
Requires-Dist: flask==3.1.0
Requires-Dist: flask_sqlalchemy==3.1.1
Requires-Dist: flask_migrate==4.1.0
Requires-Dist: flask_session==0.8.0
Requires-Dist: flask_mail==0.10.0
Requires-Dist: flask_login==0.6.3
Requires-Dist: flask_wtf==1.2.2
Requires-Dist: redis==5.2.1
Requires-Dist: pymysql==1.1.1
Requires-Dist: psutil==6.1.1
Requires-Dist: pytz==2024.2
Requires-Dist: flask-babel==4.0.0
Requires-Dist: markdown-it-py[linkify]>=3.0
Requires-Dist: mdit-py-plugins>=0.4
Requires-Dist: nh3>=0.2
Requires-Dist: pygments>=2.17
Provides-Extra: dev
Requires-Dist: pytest>=8.3; extra == "dev"
Requires-Dist: pytest-cov>=6.0; extra == "dev"
Requires-Dist: Faker>=33.0; extra == "dev"
Dynamic: license-file

# SPLENT Framework

Core library for building modular, feature-driven Flask applications using Software Product Line principles.

## Quick start

```python
from splent_framework import create_splent_app

app = create_splent_app(__name__, config_name="development")
```

## Production defaults

A product built with `create_splent_app` gets these without any code. Each
one is a variable in the deployment's `.env`. The header and asset settings
can also be fixed in the product's `config.py`, which then wins over the
`.env`. For `SPLENT_COOKIE_SECURE` and `MAX_CONTENT_LENGTH` the `.env` wins
over the product and over any feature's `inject_config`, because only the
deployment knows whether it runs over HTTPS and how large its uploads are.
The factory applies both again after the features load.

| Variable | Default | What it does |
| --- | --- | --- |
| `SPLENT_TRUSTED_PROXIES` | `0` | Number of reverse proxies in front of the app. Set it to `1` behind a TLS proxy (nginx, Caddy, Traefik) so the app sees the client address and the `https` the proxy was reached on, builds `https://` links and sends HSTS. Leave it at `0` when the app port is reachable without the proxy. |
| `SPLENT_COOKIE_SECURE` | `auto` | Session and remember-me cookies are always HttpOnly and SameSite=Lax. Left unset, every cookie is Secure when the request arrived over HTTPS, directly or through a trusted proxy, so behind TLS set `SPLENT_TRUSTED_PROXIES`. `true` forces Secure, `false` never sets it. |
| `MAX_CONTENT_LENGTH` | `16M` | Largest request body. Bigger ones get 413, as JSON for a client that sent or asked for JSON. Accepts bytes or `K`, `M`, `G`, and `0` for no limit. |
| `SPLENT_SECURITY_HEADERS` | `true` | `nosniff`, `X-Frame-Options`, `Referrer-Policy`, `Permissions-Policy` and `Cache-Control: no-store` for signed-in users. `false` leaves them all to the proxy. |
| `SPLENT_FRAME_OPTIONS` | `SAMEORIGIN` | `DENY`, or `off` to send nothing. |
| `SPLENT_REFERRER_POLICY` | `strict-origin-when-cross-origin` | Any Referrer-Policy value. |
| `SPLENT_PERMISSIONS_POLICY` | camera, microphone, geolocation, payment and USB off | The whole Permissions-Policy value. Embedded maps lose their location button under the default; allow geolocation here if a product needs it. |
| `SPLENT_NO_STORE_SIGNED_IN` | `true` | `Cache-Control: no-store` on pages for a signed-in user. |
| `SPLENT_HSTS_MAX_AGE` | `31536000` | Sent only over HTTPS. `0` turns HSTS off. |
| `SPLENT_HSTS_INCLUDE_SUBDOMAINS`, `SPLENT_HSTS_PRELOAD` | `false` | The optional HSTS directives. |
| `SPLENT_CONTENT_SECURITY_POLICY` | none | A Content-Security-Policy to send. Opt in, since existing templates use inline scripts. |
| `SPLENT_CSP_REPORT_ONLY` | `false` | Send that policy as `Content-Security-Policy-Report-Only` to try it first. |
| `SPLENT_ASSET_MAX_AGE` | `31536000` | How long a versioned asset (`?v=<mtime>`) may be cached. `0` turns it off. |
| `SPLENT_ASSET_VERSIONING` | `true` | Add `?v=<mtime>` to the asset URLs `url_for` builds. |

Database connections are pinged when they leave the pool and recycled after
an hour (`SQLALCHEMY_ENGINE_OPTIONS`), so a database restart or MariaDB's
eight hour `wait_timeout` never reaches a visitor as a 500. A product changes
them in its `config.py`.

## Requirements

- Python 3.13+
- Flask 3.1+
- SQLAlchemy 2.0+

## Documentation

Full docs, tutorials, and architecture reference at **[docs.splent.io](https://docs.splent.io)**

## License

splent_framework is free software under the GNU Lesser General Public
License, version 3 or any later version (LGPL-3.0-or-later). See
`COPYING.LESSER`, and `COPYING` for the GNU General Public License it builds
on. A product built on the framework can carry any license of its own choice.
