SPLENT Framework
Core library for building modular, feature-driven Flask applications using Software Product Line principles.
Quick start
from splent_framework import create_splent_app
app = create_splent_app(__name__, config_name="development")
Production defaults
A product built with create_splent_app gets these without any code. Each
one is a variable in the deployment's .env. The header and asset settings
can also be fixed in the product's config.py, which then wins over the
.env. For SPLENT_COOKIE_SECURE and MAX_CONTENT_LENGTH the .env wins
over the product and over any feature's inject_config, because only the
deployment knows whether it runs over HTTPS and how large its uploads are.
The factory applies both again after the features load.
| Variable | Default | What it does |
|---|---|---|
SPLENT_TRUSTED_PROXIES |
0 |
Number of reverse proxies in front of the app. Set it to 1 behind a TLS proxy (nginx, Caddy, Traefik) so the app sees the client address and the https the proxy was reached on, builds https:// links and sends HSTS. Leave it at 0 when the app port is reachable without the proxy. |
SPLENT_COOKIE_SECURE |
auto |
Session and remember-me cookies are always HttpOnly and SameSite=Lax. Left unset, every cookie is Secure when the request arrived over HTTPS, directly or through a trusted proxy, so behind TLS set SPLENT_TRUSTED_PROXIES. true forces Secure, false never sets it. |
MAX_CONTENT_LENGTH |
16M |
Largest request body. Bigger ones get 413, as JSON for a client that sent or asked for JSON. Accepts bytes or K, M, G, and 0 for no limit. |
SPLENT_SECURITY_HEADERS |
true |
nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cache-Control: no-store for signed-in users. false leaves them all to the proxy. |
SPLENT_FRAME_OPTIONS |
SAMEORIGIN |
DENY, or off to send nothing. |
SPLENT_REFERRER_POLICY |
strict-origin-when-cross-origin |
Any Referrer-Policy value. |
SPLENT_PERMISSIONS_POLICY |
camera, microphone, geolocation, payment and USB off | The whole Permissions-Policy value. Embedded maps lose their location button under the default; allow geolocation here if a product needs it. |
SPLENT_NO_STORE_SIGNED_IN |
true |
Cache-Control: no-store on pages for a signed-in user. |
SPLENT_HSTS_MAX_AGE |
31536000 |
Sent only over HTTPS. 0 turns HSTS off. |
SPLENT_HSTS_INCLUDE_SUBDOMAINS, SPLENT_HSTS_PRELOAD |
false |
The optional HSTS directives. |
SPLENT_CONTENT_SECURITY_POLICY |
none | A Content-Security-Policy to send. Opt in, since existing templates use inline scripts. |
SPLENT_CSP_REPORT_ONLY |
false |
Send that policy as Content-Security-Policy-Report-Only to try it first. |
SPLENT_ASSET_MAX_AGE |
31536000 |
How long a versioned asset (?v=<mtime>) may be cached. 0 turns it off. |
SPLENT_ASSET_VERSIONING |
true |
Add ?v=<mtime> to the asset URLs url_for builds. |
Database connections are pinged when they leave the pool and recycled after
an hour (SQLALCHEMY_ENGINE_OPTIONS), so a database restart or MariaDB's
eight hour wait_timeout never reaches a visitor as a 500. A product changes
them in its config.py.
Requirements
- Python 3.13+
- Flask 3.1+
- SQLAlchemy 2.0+
Documentation
Full docs, tutorials, and architecture reference at docs.splent.io
License
Creative Commons CC BY 4.0 - SPLENT - Diverso Lab
Metadata
Release files for splent-framework 1.18.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| splent_framework-1.18.1.tar.gz | 269.6 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| splent_framework-1.18.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 429.8 kB
Release files / splent_framework-1.18.1.tar.gz
| Download URL | splent_framework-1.18.1.tar.gz |
|---|---|
| Size | 269.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
2da57ca80e83e950931fa74a48da94b6028675d5c94c40ca48cfef37c3dc804d
|
|
BLAKE2b-256 checksum How to use checksums |
f4ef2f04f6483962b51583bd439a852b6c6cda5f520cccbf0460522aa6b8715f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.13
|
Release files / splent_framework-1.18.1-py3-none-any.whl
| Download URL | splent_framework-1.18.1-py3-none-any.whl |
|---|---|
| Size | 160.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
889a9a76ea8db53b372aa6121388aa46c411abaf14dff1d7d0299c5003e021c9
|
|
BLAKE2b-256 checksum How to use checksums |
7a228f78b67356526699de95899595172fc4f68e57e13a9340c2423a4ab8ef97
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.13
|
Security for splent-framework 1.18.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
