first commit

.venv/Lib/site-packages/streamlit/server/__init__.py

@@ -0,0 +1,13 @@
+# Copyright 2018-2022 Streamlit Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

.venv/Lib/site-packages/streamlit/server/routes.py

@@ -0,0 +1,290 @@
+# Copyright 2018-2022 Streamlit Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import json
+
+import tornado.web
+from urllib.parse import quote, unquote_plus
+
+from streamlit import config
+from streamlit.logger import get_logger
+from streamlit.server.server_util import serialize_forward_msg
+from streamlit.string_util import generate_download_filename_from_title
+from streamlit.in_memory_file_manager import _get_extension_for_mimetype
+from streamlit.in_memory_file_manager import in_memory_file_manager
+from streamlit.in_memory_file_manager import FILE_TYPE_DOWNLOADABLE
+
+LOGGER = get_logger(__name__)
+
+
+def allow_cross_origin_requests():
+    """True if cross-origin requests are allowed.
+
+    We only allow cross-origin requests when CORS protection has been disabled
+    with server.enableCORS=False or if using the Node server. When using the
+    Node server, we have a dev and prod port, which count as two origins.
+
+    """
+    return not config.get_option("server.enableCORS") or config.get_option(
+        "global.developmentMode"
+    )
+
+
+class StaticFileHandler(tornado.web.StaticFileHandler):
+    def set_extra_headers(self, path):
+        """Disable cache for HTML files.
+
+        Other assets like JS and CSS are suffixed with their hash, so they can
+        be cached indefinitely.
+        """
+        is_index_url = len(path) == 0
+
+        if is_index_url or path.endswith(".html"):
+            self.set_header("Cache-Control", "no-cache")
+        else:
+            self.set_header("Cache-Control", "public")
+
+
+class AssetsFileHandler(tornado.web.StaticFileHandler):
+    # CORS protection should be disabled as we need access
+    # to this endpoint from the inner iframe.
+    def set_default_headers(self):
+        self.set_header("Access-Control-Allow-Origin", "*")
+
+
+class AddSlashHandler(tornado.web.RequestHandler):
+    @tornado.web.addslash
+    def get(self):
+        pass
+
+
+class MediaFileHandler(tornado.web.StaticFileHandler):
+    def set_default_headers(self):
+        if allow_cross_origin_requests():
+            self.set_header("Access-Control-Allow-Origin", "*")
+
+    def set_extra_headers(self, path: str) -> None:
+        """Add Content-Disposition header for downloadable files.
+
+        Set header value to "attachment" indicating that file should be saved
+        locally instead of displaying inline in browser.
+
+        We also set filename to specify filename for  downloaded file.
+        Used for serve downloadable files, like files stored
+        via st.download_button widget
+        """
+        in_memory_file = in_memory_file_manager.get(path)
+
+        if in_memory_file and in_memory_file.file_type == FILE_TYPE_DOWNLOADABLE:
+            file_name = in_memory_file.file_name
+
+            if not file_name:
+                title = self.get_argument("title", "", True)
+                title = unquote_plus(title)
+                filename = generate_download_filename_from_title(title)
+                file_name = (
+                    f"{filename}{_get_extension_for_mimetype(in_memory_file.mimetype)}"
+                )
+
+            try:
+                file_name.encode("ascii")
+                file_expr = 'filename="{}"'.format(file_name)
+            except UnicodeEncodeError:
+                file_expr = "filename*=utf-8''{}".format(quote(file_name))
+
+            self.set_header("Content-Disposition", f"attachment; {file_expr}")
+
+    # Overriding StaticFileHandler to use the InMemoryFileManager
+    #
+    # From the Torndado docs:
+    # To replace all interaction with the filesystem (e.g. to serve
+    # static content from a database), override `get_content`,
+    # `get_content_size`, `get_modified_time`, `get_absolute_path`, and
+    # `validate_absolute_path`.
+    def validate_absolute_path(self, root, absolute_path):
+        try:
+            in_memory_file_manager.get(absolute_path)
+        except KeyError:
+            LOGGER.error("InMemoryFileManager: Missing file %s" % absolute_path)
+            raise tornado.web.HTTPError(404, "not found")
+
+        return absolute_path
+
+    def get_content_size(self):
+        abspath = self.absolute_path
+        if abspath is None:
+            return 0
+
+        in_memory_file = in_memory_file_manager.get(abspath)
+        return in_memory_file.content_size
+
+    def get_modified_time(self):
+        # We do not track last modified time, but this can be improved to
+        # allow caching among files in the InMemoryFileManager
+        return None
+
+    @classmethod
+    def get_absolute_path(cls, root, path):
+        # All files are stored in memory, so the absolute path is just the
+        # path itself. In the MediaFileHandler, it's just the filename
+        return path
+
+    @classmethod
+    def get_content(cls, abspath, start=None, end=None):
+        LOGGER.debug("MediaFileHandler: GET %s" % abspath)
+
+        try:
+            # abspath is the hash as used `get_absolute_path`
+            in_memory_file = in_memory_file_manager.get(abspath)
+        except:
+            LOGGER.error("InMemoryFileManager: Missing file %s" % abspath)
+            return
+
+        LOGGER.debug(
+            "InMemoryFileManager: Sending %s file %s"
+            % (in_memory_file.mimetype, abspath)
+        )
+
+        # If there is no start and end, just return the full content
+        if start is None and end is None:
+            return in_memory_file.content
+
+        if start is None:
+            start = 0
+        if end is None:
+            end = len(in_memory_file.content)
+
+        # content is bytes that work just by slicing supplied by start and end
+        return in_memory_file.content[start:end]
+
+
+class _SpecialRequestHandler(tornado.web.RequestHandler):
+    """Superclass for "special" endpoints, like /healthz."""
+
+    def set_default_headers(self):
+        self.set_header("Cache-Control", "no-cache")
+        if allow_cross_origin_requests():
+            self.set_header("Access-Control-Allow-Origin", "*")
+
+    def options(self):
+        """/OPTIONS handler for preflight CORS checks.
+
+        When a browser is making a CORS request, it may sometimes first
+        send an OPTIONS request, to check whether the server understands the
+        CORS protocol. This is optional, and doesn't happen for every request
+        or in every browser. If an OPTIONS request does get sent, and is not
+        then handled by the server, the browser will fail the underlying
+        request.
+
+        The proper way to handle this is to send a 204 response ("no content")
+        with the CORS headers attached. (These headers are automatically added
+        to every outgoing response, including OPTIONS responses,
+        via set_default_headers().)
+
+        See https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
+        """
+        self.set_status(204)
+        self.finish()
+
+
+class HealthHandler(_SpecialRequestHandler):
+    def initialize(self, callback):
+        """Initialize the handler
+
+        Parameters
+        ----------
+        callback : callable
+            A function that returns True if the server is healthy
+
+        """
+        self._callback = callback
+
+    async def get(self):
+        ok, msg = await self._callback()
+        if ok:
+            self.write(msg)
+            self.set_status(200)
+
+            # Tornado will set the _xsrf cookie automatically for the page on
+            # request for the document. However, if the server is reset and
+            # server.enableXsrfProtection is updated, the browser does not reload the document.
+            # Manually setting the cookie on /healthz since it is pinged when the
+            # browser is disconnected from the server.
+            if config.get_option("server.enableXsrfProtection"):
+                self.set_cookie("_xsrf", self.xsrf_token)
+
+        else:
+            # 503 = SERVICE_UNAVAILABLE
+            self.set_status(503)
+            self.write(msg)
+
+
+class DebugHandler(_SpecialRequestHandler):
+    def initialize(self, server):
+        self._server = server
+
+    def get(self):
+        self.add_header("Cache-Control", "no-cache")
+        self.write(
+            "<code><pre>%s</pre><code>" % json.dumps(self._server.get_debug(), indent=2)
+        )
+
+
+class MessageCacheHandler(tornado.web.RequestHandler):
+    """Returns ForwardMsgs from our MessageCache"""
+
+    def initialize(self, cache):
+        """Initializes the handler.
+
+        Parameters
+        ----------
+        cache : MessageCache
+
+        """
+        self._cache = cache
+
+    def set_default_headers(self):
+        if allow_cross_origin_requests():
+            self.set_header("Access-Control-Allow-Origin", "*")
+
+    def get(self):
+        msg_hash = self.get_argument("hash", None)
+        if msg_hash is None:
+            # Hash is missing! This is a malformed request.
+            LOGGER.error(
+                "HTTP request for cached message is " "missing the hash attribute."
+            )
+            self.set_status(404)
+            raise tornado.web.Finish()
+
+        message = self._cache.get_message(msg_hash)
+        if message is None:
+            # Message not in our cache.
+            LOGGER.error(
+                "HTTP request for cached message could not be fulfilled. "
+                "No such message: %s" % msg_hash
+            )
+            self.set_status(404)
+            raise tornado.web.Finish()
+
+        LOGGER.debug("MessageCache HIT [hash=%s]" % msg_hash)
+        msg_str = serialize_forward_msg(message)
+        self.set_header("Content-Type", "application/octet-stream")
+        self.write(msg_str)
+        self.set_status(200)
+
+    def options(self):
+        """/OPTIONS handler for preflight CORS checks."""
+        self.set_status(204)
+        self.finish()

.venv/Lib/site-packages/streamlit/server/server.py

@@ -0,0 +1,793 @@
+# Copyright 2018-2022 Streamlit Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import asyncio
+import logging
+import os
+import socket
+import sys
+import errno
+import time
+import traceback
+import click
+from enum import Enum
+from typing import (
+    Any,
+    Dict,
+    Optional,
+    Tuple,
+    Callable,
+    Awaitable,
+    Generator,
+    List,
+)
+
+import tornado.concurrent
+import tornado.gen
+import tornado.ioloop
+import tornado.locks
+import tornado.netutil
+import tornado.web
+import tornado.websocket
+from tornado.websocket import WebSocketHandler
+from tornado.httpserver import HTTPServer
+from tornado.ioloop import IOLoop
+
+from streamlit import config
+from streamlit import file_util
+from streamlit import util
+from streamlit.caching import get_memo_stats_provider, get_singleton_stats_provider
+from streamlit.config_option import ConfigOption
+from streamlit.forward_msg_cache import ForwardMsgCache
+from streamlit.forward_msg_cache import create_reference_msg
+from streamlit.forward_msg_cache import populate_hash_if_needed
+from streamlit.in_memory_file_manager import in_memory_file_manager
+from streamlit.legacy_caching.caching import _mem_caches
+from streamlit.app_session import AppSession
+from streamlit.stats import StatsHandler, StatsManager
+from streamlit.uploaded_file_manager import UploadedFileManager
+from streamlit.logger import get_logger
+from streamlit.components.v1.components import ComponentRegistry
+from streamlit.components.v1.components import ComponentRequestHandler
+from streamlit.proto.BackMsg_pb2 import BackMsg
+from streamlit.proto.ForwardMsg_pb2 import ForwardMsg
+from streamlit.server.upload_file_request_handler import (
+    UploadFileRequestHandler,
+    UPLOAD_FILE_ROUTE,
+)
+
+from streamlit.session_data import SessionData
+from streamlit.state import (
+    SCRIPT_RUN_WITHOUT_ERRORS_KEY,
+    SessionStateStatProvider,
+)
+from streamlit.server.routes import AddSlashHandler
+from streamlit.server.routes import AssetsFileHandler
+from streamlit.server.routes import DebugHandler
+from streamlit.server.routes import HealthHandler
+from streamlit.server.routes import MediaFileHandler
+from streamlit.server.routes import MessageCacheHandler
+from streamlit.server.routes import StaticFileHandler
+from streamlit.server.server_util import is_cacheable_msg
+from streamlit.server.server_util import is_url_from_allowed_origins
+from streamlit.server.server_util import make_url_path_regex
+from streamlit.server.server_util import serialize_forward_msg
+from streamlit.server.server_util import get_max_message_size_bytes
+from streamlit.watcher import LocalSourcesWatcher
+
+
+LOGGER = get_logger(__name__)
+
+TORNADO_SETTINGS = {
+    # Gzip HTTP responses.
+    "compress_response": True,
+    # Ping every 1s to keep WS alive.
+    # 2021.06.22: this value was previously 20s, and was causing
+    # connection instability for a small number of users. This smaller
+    # ping_interval fixes that instability.
+    # https://github.com/streamlit/streamlit/issues/3196
+    "websocket_ping_interval": 1,
+    # If we don't get a ping response within 30s, the connection
+    # is timed out.
+    "websocket_ping_timeout": 30,
+}
+
+# When server.port is not available it will look for the next available port
+# up to MAX_PORT_SEARCH_RETRIES.
+MAX_PORT_SEARCH_RETRIES = 100
+
+# When server.address starts with this prefix, the server will bind
+# to an unix socket.
+UNIX_SOCKET_PREFIX = "unix://"
+
+# Wait for the script run result for 60s and if no result is available give up
+SCRIPT_RUN_CHECK_TIMEOUT = 60
+
+
+class SessionInfo:
+    """Type stored in our _session_info_by_id dict.
+
+    For each AppSession, the server tracks that session's
+    script_run_count. This is used to track the age of messages in
+    the ForwardMsgCache.
+    """
+
+    def __init__(self, ws: WebSocketHandler, session: AppSession):
+        """Initialize a SessionInfo instance.
+
+        Parameters
+        ----------
+        session : AppSession
+            The AppSession object.
+        ws : _BrowserWebSocketHandler
+            The websocket corresponding to this session.
+        """
+        self.session = session
+        self.ws = ws
+        self.script_run_count = 0
+
+    def __repr__(self) -> str:
+        return util.repr_(self)
+
+
+class State(Enum):
+    INITIAL = "INITIAL"
+    WAITING_FOR_FIRST_BROWSER = "WAITING_FOR_FIRST_BROWSER"
+    ONE_OR_MORE_BROWSERS_CONNECTED = "ONE_OR_MORE_BROWSERS_CONNECTED"
+    NO_BROWSERS_CONNECTED = "NO_BROWSERS_CONNECTED"
+    STOPPING = "STOPPING"
+    STOPPED = "STOPPED"
+
+
+class RetriesExceeded(Exception):
+    pass
+
+
+def server_port_is_manually_set() -> bool:
+    return config.is_manually_set("server.port")
+
+
+def server_address_is_unix_socket() -> bool:
+    address = config.get_option("server.address")
+    return address is not None and address.startswith(UNIX_SOCKET_PREFIX)
+
+
+def start_listening(app: tornado.web.Application) -> None:
+    """Makes the server start listening at the configured port.
+
+    In case the port is already taken it tries listening to the next available
+    port.  It will error after MAX_PORT_SEARCH_RETRIES attempts.
+
+    """
+
+    http_server = HTTPServer(
+        app, max_buffer_size=config.get_option("server.maxUploadSize") * 1024 * 1024
+    )
+
+    if server_address_is_unix_socket():
+        start_listening_unix_socket(http_server)
+    else:
+        start_listening_tcp_socket(http_server)
+
+
+def start_listening_unix_socket(http_server: HTTPServer) -> None:
+    address = config.get_option("server.address")
+    file_name = os.path.expanduser(address[len(UNIX_SOCKET_PREFIX) :])
+
+    unix_socket = tornado.netutil.bind_unix_socket(file_name)
+    http_server.add_socket(unix_socket)
+
+
+def start_listening_tcp_socket(http_server: HTTPServer) -> None:
+    call_count = 0
+
+    port = None
+    while call_count < MAX_PORT_SEARCH_RETRIES:
+        address = config.get_option("server.address")
+        port = config.get_option("server.port")
+
+        try:
+            http_server.listen(port, address)
+            break  # It worked! So let's break out of the loop.
+
+        except (OSError, socket.error) as e:
+            if e.errno == errno.EADDRINUSE:
+                if server_port_is_manually_set():
+                    LOGGER.error("Port %s is already in use", port)
+                    sys.exit(1)
+                else:
+                    LOGGER.debug(
+                        "Port %s already in use, trying to use the next one.", port
+                    )
+                    port += 1
+                    # Save port 3000 because it is used for the development
+                    # server in the front end.
+                    if port == 3000:
+                        port += 1
+
+                    config.set_option(
+                        "server.port", port, ConfigOption.STREAMLIT_DEFINITION
+                    )
+                    call_count += 1
+            else:
+                raise
+
+    if call_count >= MAX_PORT_SEARCH_RETRIES:
+        raise RetriesExceeded(
+            f"Cannot start Streamlit server. Port {port} is already in use, and "
+            f"Streamlit was unable to find a free port after {MAX_PORT_SEARCH_RETRIES} attempts.",
+        )
+
+
+class Server:
+    _singleton: Optional["Server"] = None
+
+    @classmethod
+    def get_current(cls) -> "Server":
+        """
+        Returns
+        -------
+        Server
+            The singleton Server object.
+        """
+        if Server._singleton is None:
+            raise RuntimeError("Server has not been initialized yet")
+
+        return Server._singleton
+
+    def __init__(
+        self, ioloop: IOLoop, main_script_path: str, command_line: Optional[str]
+    ):
+        """Create the server. It won't be started yet."""
+        if Server._singleton is not None:
+            raise RuntimeError("Server already initialized. Use .get_current() instead")
+
+        Server._singleton = self
+
+        _set_tornado_log_levels()
+
+        self._ioloop = ioloop
+        self._main_script_path = main_script_path
+        self._command_line = command_line if command_line is not None else ""
+
+        # Mapping of AppSession.id -> SessionInfo.
+        self._session_info_by_id: Dict[str, SessionInfo] = {}
+
+        self._must_stop = tornado.locks.Event()
+        self._state = State.INITIAL
+        self._message_cache = ForwardMsgCache()
+        self._uploaded_file_mgr = UploadedFileManager()
+        self._uploaded_file_mgr.on_files_updated.connect(self.on_files_updated)
+        self._session_data: Optional[SessionData] = None
+        self._has_connection = tornado.locks.Condition()
+        self._need_send_data = tornado.locks.Event()
+
+        # StatsManager
+        self._stats_mgr = StatsManager()
+        self._stats_mgr.register_provider(get_memo_stats_provider())
+        self._stats_mgr.register_provider(get_singleton_stats_provider())
+        self._stats_mgr.register_provider(_mem_caches)
+        self._stats_mgr.register_provider(self._message_cache)
+        self._stats_mgr.register_provider(in_memory_file_manager)
+        self._stats_mgr.register_provider(self._uploaded_file_mgr)
+        self._stats_mgr.register_provider(
+            SessionStateStatProvider(self._session_info_by_id)
+        )
+
+    def __repr__(self) -> str:
+        return util.repr_(self)
+
+    @property
+    def main_script_path(self) -> str:
+        return self._main_script_path
+
+    def get_session_by_id(self, session_id: str) -> Optional[AppSession]:
+        """Return the AppSession corresponding to the given id, or None if
+        no such session exists."""
+        session_info = self._get_session_info(session_id)
+        if session_info is None:
+            return None
+
+        return session_info.session
+
+    def on_files_updated(self, session_id: str) -> None:
+        """Event handler for UploadedFileManager.on_file_added.
+        Ensures that uploaded files from stale sessions get deleted.
+        """
+        session_info = self._get_session_info(session_id)
+        if session_info is None:
+            # If an uploaded file doesn't belong to an existing session,
+            # remove it so it doesn't stick around forever.
+            self._uploaded_file_mgr.remove_session_files(session_id)
+
+    def _get_session_info(self, session_id: str) -> Optional[SessionInfo]:
+        """Return the SessionInfo with the given id, or None if no such
+        session exists.
+
+        """
+        return self._session_info_by_id.get(session_id, None)
+
+    def start(self, on_started: Callable[["Server"], Any]) -> None:
+        """Start the server.
+
+        Parameters
+        ----------
+        on_started : callable
+            A callback that will be called when the server's run-loop
+            has started, and the server is ready to begin receiving clients.
+
+        """
+        if self._state != State.INITIAL:
+            raise RuntimeError("Server has already been started")
+
+        LOGGER.debug("Starting server...")
+
+        app = self._create_app()
+        start_listening(app)
+
+        port = config.get_option("server.port")
+
+        LOGGER.debug("Server started on port %s", port)
+
+        self._ioloop.spawn_callback(self._loop_coroutine, on_started)
+
+    def _create_app(self) -> tornado.web.Application:
+        """Create our tornado web app."""
+        base = config.get_option("server.baseUrlPath")
+
+        routes: List[Any] = [
+            (
+                make_url_path_regex(base, "stream"),
+                _BrowserWebSocketHandler,
+                dict(server=self),
+            ),
+            (
+                make_url_path_regex(base, "healthz"),
+                HealthHandler,
+                dict(callback=lambda: self.is_ready_for_browser_connection),
+            ),
+            (make_url_path_regex(base, "debugz"), DebugHandler, dict(server=self)),
+            (
+                make_url_path_regex(base, "message"),
+                MessageCacheHandler,
+                dict(cache=self._message_cache),
+            ),
+            (
+                make_url_path_regex(base, "st-metrics"),
+                StatsHandler,
+                dict(stats_manager=self._stats_mgr),
+            ),
+            (
+                make_url_path_regex(
+                    base,
+                    UPLOAD_FILE_ROUTE,
+                ),
+                UploadFileRequestHandler,
+                dict(
+                    file_mgr=self._uploaded_file_mgr,
+                    get_session_info=self._get_session_info,
+                ),
+            ),
+            (
+                make_url_path_regex(base, "assets/(.*)"),
+                AssetsFileHandler,
+                {"path": "%s/" % file_util.get_assets_dir()},
+            ),
+            (make_url_path_regex(base, "media/(.*)"), MediaFileHandler, {"path": ""}),
+            (
+                make_url_path_regex(base, "component/(.*)"),
+                ComponentRequestHandler,
+                dict(registry=ComponentRegistry.instance()),
+            ),
+        ]
+
+        if config.get_option("server.scriptHealthCheckEnabled"):
+            routes.extend(
+                [
+                    (
+                        make_url_path_regex(base, "script-health-check"),
+                        HealthHandler,
+                        dict(callback=lambda: self.does_script_run_without_error()),
+                    )
+                ]
+            )
+
+        if config.get_option("global.developmentMode"):
+            LOGGER.debug("Serving static content from the Node dev server")
+        else:
+            static_path = file_util.get_static_dir()
+            LOGGER.debug("Serving static content from %s", static_path)
+
+            routes.extend(
+                [
+                    (
+                        make_url_path_regex(base, "(.*)"),
+                        StaticFileHandler,
+                        {"path": "%s/" % static_path, "default_filename": "index.html"},
+                    ),
+                    (make_url_path_regex(base, trailing_slash=False), AddSlashHandler),
+                ]
+            )
+
+        return tornado.web.Application(
+            routes,
+            cookie_secret=config.get_option("server.cookieSecret"),
+            xsrf_cookies=config.get_option("server.enableXsrfProtection"),
+            # Set the websocket message size. The default value is too low.
+            websocket_max_message_size=get_max_message_size_bytes(),
+            **TORNADO_SETTINGS,  # type: ignore[arg-type]
+        )
+
+    def _set_state(self, new_state: State) -> None:
+        LOGGER.debug("Server state: %s -> %s" % (self._state, new_state))
+        self._state = new_state
+
+    @property
+    async def is_ready_for_browser_connection(self) -> Tuple[bool, str]:
+        if self._state not in (State.INITIAL, State.STOPPING, State.STOPPED):
+            return True, "ok"
+
+        return False, "unavailable"
+
+    async def does_script_run_without_error(self) -> Tuple[bool, str]:
+        """Load and execute the app's script to verify it runs without an error.
+
+        Returns
+        -------
+        (True, "ok") if the script completes without error, or (False, err_msg)
+        if the script raises an exception.
+        """
+        session_data = SessionData(self._main_script_path, self._command_line)
+        local_sources_watcher = LocalSourcesWatcher(session_data)
+        session = AppSession(
+            ioloop=self._ioloop,
+            session_data=session_data,
+            uploaded_file_manager=self._uploaded_file_mgr,
+            message_enqueued_callback=self._enqueued_some_message,
+            local_sources_watcher=local_sources_watcher,
+        )
+
+        try:
+            session.request_rerun(None)
+
+            now = time.perf_counter()
+            while (
+                SCRIPT_RUN_WITHOUT_ERRORS_KEY not in session.session_state
+                and (time.perf_counter() - now) < SCRIPT_RUN_CHECK_TIMEOUT
+            ):
+                await tornado.gen.sleep(0.1)
+
+            if SCRIPT_RUN_WITHOUT_ERRORS_KEY not in session.session_state:
+                return False, "timeout"
+
+            ok = session.session_state[SCRIPT_RUN_WITHOUT_ERRORS_KEY]
+            msg = "ok" if ok else "error"
+
+            return ok, msg
+        finally:
+            session.shutdown()
+
+    @property
+    def browser_is_connected(self) -> bool:
+        return self._state == State.ONE_OR_MORE_BROWSERS_CONNECTED
+
+    @property
+    def is_running_hello(self) -> bool:
+        from streamlit.hello import hello
+
+        return self._main_script_path == hello.__file__
+
+    @tornado.gen.coroutine
+    def _loop_coroutine(
+        self, on_started: Optional[Callable[["Server"], Any]] = None
+    ) -> Generator[Any, None, None]:
+        try:
+            if self._state == State.INITIAL:
+                self._set_state(State.WAITING_FOR_FIRST_BROWSER)
+            elif self._state == State.ONE_OR_MORE_BROWSERS_CONNECTED:
+                pass
+            else:
+                raise RuntimeError("Bad server state at start: %s" % self._state)
+
+            if on_started is not None:
+                on_started(self)
+
+            while not self._must_stop.is_set():
+
+                if self._state == State.WAITING_FOR_FIRST_BROWSER:
+                    yield tornado.gen.convert_yielded(
+                        asyncio.wait(
+                            [self._must_stop.wait(), self._has_connection.wait()],
+                            return_when=asyncio.FIRST_COMPLETED,
+                        )
+                    )
+
+                elif self._state == State.ONE_OR_MORE_BROWSERS_CONNECTED:
+                    self._need_send_data.clear()
+
+                    # Shallow-clone our sessions into a list, so we can iterate
+                    # over it and not worry about whether it's being changed
+                    # outside this coroutine.
+                    session_infos = list(self._session_info_by_id.values())
+
+                    for session_info in session_infos:
+                        msg_list = session_info.session.flush_browser_queue()
+                        for msg in msg_list:
+                            try:
+                                self._send_message(session_info, msg)
+                            except tornado.websocket.WebSocketClosedError:
+                                self._close_app_session(session_info.session.id)
+                            yield
+                        yield
+                    yield tornado.gen.sleep(0.01)
+
+                elif self._state == State.NO_BROWSERS_CONNECTED:
+                    yield tornado.gen.convert_yielded(
+                        asyncio.wait(
+                            [self._must_stop.wait(), self._has_connection.wait()],
+                            return_when=asyncio.FIRST_COMPLETED,
+                        )
+                    )
+
+                else:
+                    # Break out of the thread loop if we encounter any other state.
+                    break
+
+                yield tornado.gen.convert_yielded(
+                    asyncio.wait(
+                        [self._must_stop.wait(), self._need_send_data.wait()],
+                        return_when=asyncio.FIRST_COMPLETED,
+                    )
+                )
+
+            # Shut down all AppSessions
+            for session_info in list(self._session_info_by_id.values()):
+                session_info.session.shutdown()
+
+            self._set_state(State.STOPPED)
+
+        except Exception:
+            # Can't just re-raise here because co-routines use Tornado
+            # exceptions for control flow, which appears to swallow the reraised
+            # exception.
+            traceback.print_exc()
+            LOGGER.info(
+                """
+Please report this bug at https://github.com/streamlit/streamlit/issues.
+"""
+            )
+
+        finally:
+            self._on_stopped()
+
+    def _send_message(self, session_info: SessionInfo, msg: ForwardMsg) -> None:
+        """Send a message to a client.
+
+        If the client is likely to have already cached the message, we may
+        instead send a "reference" message that contains only the hash of the
+        message.
+
+        Parameters
+        ----------
+        session_info : SessionInfo
+            The SessionInfo associated with websocket
+        msg : ForwardMsg
+            The message to send to the client
+
+        """
+        msg.metadata.cacheable = is_cacheable_msg(msg)
+        msg_to_send = msg
+        if msg.metadata.cacheable:
+            populate_hash_if_needed(msg)
+
+            if self._message_cache.has_message_reference(
+                msg, session_info.session, session_info.script_run_count
+            ):
+                # This session has probably cached this message. Send
+                # a reference instead.
+                LOGGER.debug("Sending cached message ref (hash=%s)" % msg.hash)
+                msg_to_send = create_reference_msg(msg)
+
+            # Cache the message so it can be referenced in the future.
+            # If the message is already cached, this will reset its
+            # age.
+            LOGGER.debug("Caching message (hash=%s)" % msg.hash)
+            self._message_cache.add_message(
+                msg, session_info.session, session_info.script_run_count
+            )
+
+        # If this was a `script_finished` message, we increment the
+        # script_run_count for this session, and update the cache
+        if (
+            msg.WhichOneof("type") == "script_finished"
+            and msg.script_finished == ForwardMsg.FINISHED_SUCCESSFULLY
+        ):
+            LOGGER.debug(
+                "Script run finished successfully; "
+                "removing expired entries from MessageCache "
+                "(max_age=%s)",
+                config.get_option("global.maxCachedMessageAge"),
+            )
+            session_info.script_run_count += 1
+            self._message_cache.remove_expired_session_entries(
+                session_info.session, session_info.script_run_count
+            )
+
+        # Ship it off!
+        session_info.ws.write_message(serialize_forward_msg(msg_to_send), binary=True)
+
+    def _enqueued_some_message(self) -> None:
+        self._ioloop.add_callback(self._need_send_data.set)
+
+    def stop(self, from_signal=False) -> None:
+        click.secho("  Stopping...", fg="blue")
+        self._set_state(State.STOPPING)
+        if from_signal:
+            self._ioloop.add_callback_from_signal(self._must_stop.set)
+        else:
+            self._ioloop.add_callback(self._must_stop.set)
+
+    def _on_stopped(self) -> None:
+        """Called when our runloop is exiting, to shut down the ioloop.
+        This will end our process.
+
+        (Tests can patch this method out, to prevent the test's ioloop
+        from being shutdown.)
+        """
+        self._ioloop.stop()
+
+    def _create_app_session(self, ws: WebSocketHandler) -> AppSession:
+        """Register a connected browser with the server.
+
+        Parameters
+        ----------
+        ws : _BrowserWebSocketHandler
+            The newly-connected websocket handler.
+
+        Returns
+        -------
+        AppSession
+            The newly-created AppSession for this browser connection.
+
+        """
+        session_data = SessionData(self._main_script_path, self._command_line)
+        local_sources_watcher = LocalSourcesWatcher(session_data)
+        session = AppSession(
+            ioloop=self._ioloop,
+            session_data=session_data,
+            uploaded_file_manager=self._uploaded_file_mgr,
+            message_enqueued_callback=self._enqueued_some_message,
+            local_sources_watcher=local_sources_watcher,
+        )
+
+        LOGGER.debug(
+            "Created new session for ws %s. Session ID: %s", id(ws), session.id
+        )
+
+        assert (
+            session.id not in self._session_info_by_id
+        ), f"session.id '{session.id}' registered multiple times!"
+
+        self._session_info_by_id[session.id] = SessionInfo(ws, session)
+        self._set_state(State.ONE_OR_MORE_BROWSERS_CONNECTED)
+        self._has_connection.notify_all()
+
+        return session
+
+    def _close_app_session(self, session_id: str) -> None:
+        """Shutdown and remove a AppSession.
+
+        This function may be called multiple times for the same session,
+        which is not an error. (Subsequent calls just no-op.)
+
+        Parameters
+        ----------
+        session_id : str
+            The AppSession's id string.
+        """
+        if session_id in self._session_info_by_id:
+            session_info = self._session_info_by_id[session_id]
+            del self._session_info_by_id[session_id]
+            session_info.session.shutdown()
+
+        if len(self._session_info_by_id) == 0:
+            self._set_state(State.NO_BROWSERS_CONNECTED)
+
+
+class _BrowserWebSocketHandler(WebSocketHandler):
+    """Handles a WebSocket connection from the browser"""
+
+    def initialize(self, server: Server) -> None:
+        self._server = server
+        self._session: Optional[AppSession] = None
+        # The XSRF cookie is normally set when xsrf_form_html is used, but in a pure-Javascript application
+        # that does not use any regular forms we just need to read the self.xsrf_token manually to set the
+        # cookie as a side effect.
+        # See https://www.tornadoweb.org/en/stable/guide/security.html#cross-site-request-forgery-protection
+        # for more details.
+        if config.get_option("server.enableXsrfProtection"):
+            _ = self.xsrf_token
+
+    def check_origin(self, origin: str) -> bool:
+        """Set up CORS."""
+        return super().check_origin(origin) or is_url_from_allowed_origins(origin)
+
+    def open(self, *args, **kwargs) -> Optional[Awaitable[None]]:
+        self._session = self._server._create_app_session(self)
+        return None
+
+    def on_close(self) -> None:
+        if not self._session:
+            return
+        self._server._close_app_session(self._session.id)
+        self._session = None
+
+    def get_compression_options(self) -> Optional[Dict[Any, Any]]:
+        """Enable WebSocket compression.
+
+        Returning an empty dict enables websocket compression. Returning
+        None disables it.
+
+        (See the docstring in the parent class.)
+        """
+        if config.get_option("server.enableWebsocketCompression"):
+            return {}
+        return None
+
+    @tornado.gen.coroutine
+    def on_message(self, payload: bytes) -> None:
+        if not self._session:
+            return
+
+        msg = BackMsg()
+
+        try:
+            msg.ParseFromString(payload)
+            msg_type = msg.WhichOneof("type")
+
+            LOGGER.debug("Received the following back message:\n%s", msg)
+
+            if msg_type == "rerun_script":
+                self._session.handle_rerun_script_request(msg.rerun_script)
+            elif msg_type == "load_git_info":
+                self._session.handle_git_information_request()
+            elif msg_type == "clear_cache":
+                self._session.handle_clear_cache_request()
+            elif msg_type == "set_run_on_save":
+                self._session.handle_set_run_on_save_request(msg.set_run_on_save)
+            elif msg_type == "stop_script":
+                self._session.handle_stop_script_request()
+            elif msg_type == "close_connection":
+                if config.get_option("global.developmentMode"):
+                    Server.get_current().stop()
+                else:
+                    LOGGER.warning(
+                        "Client tried to close connection when "
+                        "not in development mode"
+                    )
+            else:
+                LOGGER.warning('No handler for "%s"', msg_type)
+
+        except BaseException as e:
+            LOGGER.error(e)
+            self._session.handle_backmsg_exception(e)
+
+
+def _set_tornado_log_levels() -> None:
+    if not config.get_option("global.developmentMode"):
+        # Hide logs unless they're super important.
+        # Example of stuff we don't care about: 404 about .js.map files.
+        logging.getLogger("tornado.access").setLevel(logging.ERROR)
+        logging.getLogger("tornado.application").setLevel(logging.ERROR)
+        logging.getLogger("tornado.general").setLevel(logging.ERROR)

.venv/Lib/site-packages/streamlit/server/server_util.py

@@ -0,0 +1,155 @@
+# Copyright 2018-2022 Streamlit Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Server related utility functions"""
+
+from typing import Optional, Any
+
+from streamlit import config
+from streamlit import net_util
+from streamlit import url_util
+from streamlit.forward_msg_cache import populate_hash_if_needed
+from streamlit.proto.ForwardMsg_pb2 import ForwardMsg
+from streamlit.errors import MarkdownFormattedException
+
+
+class MessageSizeError(MarkdownFormattedException):
+    """Exception raised when a websocket message is larger than the configured limit."""
+
+    def __init__(self, failed_msg_str: Any):
+        msg = self._get_message(failed_msg_str)
+        super(MessageSizeError, self).__init__(msg)
+
+    def _get_message(self, failed_msg_str: Any) -> str:
+        # This needs to have zero indentation otherwise the markdown will render incorrectly.
+        return (
+            (
+                """
+**Data of size {message_size_mb:.1f} MB exceeds the message size limit of {message_size_limit_mb} MB.**
+
+This is often caused by a large chart or dataframe. Please decrease the amount of data sent
+to the browser, or increase the limit by setting the config option `server.maxMessageSize`.
+[Click here to learn more about config options](https://docs.streamlit.io/library/advanced-features/configuration#set-configuration-options).
+
+_Note that increasing the limit may lead to long loading times and large memory consumption
+of the client's browser and the Streamlit server._
+"""
+            )
+            .format(
+                message_size_mb=len(failed_msg_str) / 1e6,
+                message_size_limit_mb=(get_max_message_size_bytes() / 1e6),
+            )
+            .strip("\n")
+        )
+
+
+def is_cacheable_msg(msg: ForwardMsg) -> bool:
+    """True if the given message qualifies for caching."""
+    if msg.WhichOneof("type") in {"ref_hash", "initialize"}:
+        # Some message types never get cached
+        return False
+    return msg.ByteSize() >= int(config.get_option("global.minCachedMessageSize"))
+
+
+def serialize_forward_msg(msg: ForwardMsg) -> bytes:
+    """Serialize a ForwardMsg to send to a client.
+
+    If the message is too large, it will be converted to an exception message
+    instead.
+    """
+    populate_hash_if_needed(msg)
+    msg_str = msg.SerializeToString()
+
+    if len(msg_str) > get_max_message_size_bytes():
+        import streamlit.elements.exception as exception
+
+        # Overwrite the offending ForwardMsg.delta with an error to display.
+        # This assumes that the size limit wasn't exceeded due to metadata.
+        exception.marshall(msg.delta.new_element.exception, MessageSizeError(msg_str))
+        msg_str = msg.SerializeToString()
+
+    return msg_str
+
+
+def is_url_from_allowed_origins(url: str) -> bool:
+    """Return True if URL is from allowed origins (for CORS purpose).
+
+    Allowed origins:
+    1. localhost
+    2. The internal and external IP addresses of the machine where this
+       function was called from.
+
+    If `server.enableCORS` is False, this allows all origins.
+    """
+    if not config.get_option("server.enableCORS"):
+        # Allow everything when CORS is disabled.
+        return True
+
+    hostname = url_util.get_hostname(url)
+
+    allowed_domains = [  # List[Union[str, Callable[[], Optional[str]]]]
+        # Check localhost first.
+        "localhost",
+        "0.0.0.0",
+        "127.0.0.1",
+        # Try to avoid making unecessary HTTP requests by checking if the user
+        # manually specified a server address.
+        _get_server_address_if_manually_set,
+        # Then try the options that depend on HTTP requests or opening sockets.
+        net_util.get_internal_ip,
+        net_util.get_external_ip,
+    ]
+
+    for allowed_domain in allowed_domains:
+        if callable(allowed_domain):
+            allowed_domain = allowed_domain()
+
+        if allowed_domain is None:
+            continue
+
+        if hostname == allowed_domain:
+            return True
+
+    return False
+
+
+# This needs to be initialized lazily to avoid calling config.get_option() and
+# thus initializing config options when this file is first imported.
+_max_message_size_bytes = None
+
+
+def get_max_message_size_bytes() -> int:
+    """Returns the max websocket message size in bytes.
+
+    This will lazyload the value from the config and store it in the global symbol table.
+    """
+    global _max_message_size_bytes
+
+    if _max_message_size_bytes is None:
+        _max_message_size_bytes = config.get_option("server.maxMessageSize") * int(1e6)
+
+    return _max_message_size_bytes  # type: ignore
+
+
+def _get_server_address_if_manually_set() -> Optional[str]:
+    if config.is_manually_set("browser.serverAddress"):
+        return url_util.get_hostname(config.get_option("browser.serverAddress"))
+    return None
+
+
+def make_url_path_regex(*path, **kwargs) -> str:
+    """Get a regex of the form ^/foo/bar/baz/?$ for a path (foo, bar, baz)."""
+    path = [x.strip("/") for x in path if x]  # Filter out falsy components.
+    path_format = r"^/%s/?$" if kwargs.get("trailing_slash", True) else r"^/%s$"
+    return path_format % "/".join(path)

.venv/Lib/site-packages/streamlit/server/upload_file_request_handler.py

@@ -0,0 +1,163 @@
+# Copyright 2018-2022 Streamlit Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from typing import Any, Callable, Dict, List
+
+import tornado.httputil
+import tornado.web
+from streamlit import session_data
+
+from streamlit.uploaded_file_manager import UploadedFileRec, UploadedFileManager
+from streamlit import config
+from streamlit.logger import get_logger
+from streamlit.server import routes
+
+# /upload_file/(optional session id)/(optional widget id)
+UPLOAD_FILE_ROUTE = "/upload_file/?(?P<session_id>[^/]*)?/?(?P<widget_id>[^/]*)?"
+LOGGER = get_logger(__name__)
+
+
+class UploadFileRequestHandler(tornado.web.RequestHandler):
+    """
+    Implements the POST /upload_file endpoint.
+    """
+
+    def initialize(
+        self, file_mgr: UploadedFileManager, get_session_info: Callable[[str], Any]
+    ):
+        """
+        Parameters
+        ----------
+        file_mgr : UploadedFileManager
+            The server's singleton UploadedFileManager. All file uploads
+            go here.
+        get_session_info: Server.get_session_info. Used to validate session IDs
+        """
+        self._file_mgr = file_mgr
+        self._get_session_info = get_session_info
+
+    def _is_valid_session_id(self, session_id: str) -> bool:
+        """True if the given session_id refers to an active session."""
+        return self._get_session_info(session_id) is not None
+
+    def set_default_headers(self):
+        self.set_header("Access-Control-Allow-Methods", "POST, OPTIONS")
+        self.set_header("Access-Control-Allow-Headers", "Content-Type")
+        if config.get_option("server.enableXsrfProtection"):
+            self.set_header(
+                "Access-Control-Allow-Origin",
+                session_data.get_url(config.get_option("browser.serverAddress")),
+            )
+            self.set_header("Access-Control-Allow-Headers", "X-Xsrftoken, Content-Type")
+            self.set_header("Vary", "Origin")
+            self.set_header("Access-Control-Allow-Credentials", "true")
+        elif routes.allow_cross_origin_requests():
+            self.set_header("Access-Control-Allow-Origin", "*")
+
+    def options(self, **kwargs):
+        """/OPTIONS handler for preflight CORS checks.
+
+        When a browser is making a CORS request, it may sometimes first
+        send an OPTIONS request, to check whether the server understands the
+        CORS protocol. This is optional, and doesn't happen for every request
+        or in every browser. If an OPTIONS request does get sent, and is not
+        then handled by the server, the browser will fail the underlying
+        request.
+
+        The proper way to handle this is to send a 204 response ("no content")
+        with the CORS headers attached. (These headers are automatically added
+        to every outgoing response, including OPTIONS responses,
+        via set_default_headers().)
+
+        See https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
+        """
+        self.set_status(204)
+        self.finish()
+
+    @staticmethod
+    def _require_arg(args: Dict[str, List[bytes]], name: str) -> str:
+        """Return the value of the argument with the given name.
+
+        A human-readable exception will be raised if the argument doesn't
+        exist. This will be used as the body for the error response returned
+        from the request.
+        """
+        try:
+            arg = args[name]
+        except KeyError:
+            raise Exception(f"Missing '{name}'")
+
+        if len(arg) != 1:
+            raise Exception(f"Expected 1 '{name}' arg, but got {len(arg)}")
+
+        # Convert bytes to string
+        return arg[0].decode("utf-8")
+
+    def post(self, **kwargs):
+        """Receive an uploaded file and add it to our UploadedFileManager.
+        Return the file's ID, so that the client can refer to it."""
+        args: Dict[str, List[bytes]] = {}
+        files: Dict[str, List[Any]] = {}
+
+        tornado.httputil.parse_body_arguments(
+            content_type=self.request.headers["Content-Type"],
+            body=self.request.body,
+            arguments=args,
+            files=files,
+        )
+
+        try:
+            session_id = self._require_arg(args, "sessionId")
+            widget_id = self._require_arg(args, "widgetId")
+            if not self._is_valid_session_id(session_id):
+                raise Exception(f"Invalid session_id: '{session_id}'")
+
+        except Exception as e:
+            self.send_error(400, reason=str(e))
+            return
+
+        LOGGER.debug(
+            f"{len(files)} file(s) received for session {session_id} widget {widget_id}"
+        )
+
+        # Create an UploadedFile object for each file.
+        # We assign an initial, invalid file_id to each file in this loop.
+        # The file_mgr will assign unique file IDs and return in `add_file`,
+        # below.
+        uploaded_files: List[UploadedFileRec] = []
+        for _, flist in files.items():
+            for file in flist:
+                uploaded_files.append(
+                    UploadedFileRec(
+                        id=0,
+                        name=file["filename"],
+                        type=file["content_type"],
+                        data=file["body"],
+                    )
+                )
+
+        if len(uploaded_files) != 1:
+            self.send_error(
+                400, reason=f"Expected 1 file, but got {len(uploaded_files)}"
+            )
+            return
+
+        added_file = self._file_mgr.add_file(
+            session_id=session_id, widget_id=widget_id, file=uploaded_files[0]
+        )
+
+        # Return the file_id to the client. (The client will parse
+        # the string back to an int.)
+        self.write(str(added_file.id))
+        self.set_status(200)