SPLENT Framework
Core library for building modular, feature-driven Flask applications using Software Product Line principles.
Quick start
from splent_framework import create_splent_app
app = create_splent_app(__name__, config_name="development")
Production defaults
A product built with create_splent_app gets these without any code. Each
one is a variable in the deployment's .env. The header and asset settings
can also be fixed in the product's config.py, which then wins over the
.env. For SPLENT_COOKIE_SECURE and MAX_CONTENT_LENGTH the .env wins
over the product and over any feature's inject_config, because only the
deployment knows whether it runs over HTTPS and how large its uploads are.
The factory applies both again after the features load.
| Variable | Default | What it does |
|---|---|---|
SPLENT_TRUSTED_PROXIES |
0 |
Number of reverse proxies in front of the app. Set it to 1 behind a TLS proxy (nginx, Caddy, Traefik) so the app sees the client address and the https the proxy was reached on, builds https:// links and sends HSTS. Leave it at 0 when the app port is reachable without the proxy. |
SPLENT_COOKIE_SECURE |
auto |
Session and remember-me cookies are always HttpOnly and SameSite=Lax. Left unset, every cookie is Secure when the request arrived over HTTPS, directly or through a trusted proxy, so behind TLS set SPLENT_TRUSTED_PROXIES. true forces Secure, false never sets it. |
MAX_CONTENT_LENGTH |
16M |
Largest request body. Bigger ones get 413, as JSON for a client that sent or asked for JSON. Accepts bytes or K, M, G, and 0 for no limit. |
SPLENT_SECURITY_HEADERS |
true |
nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cache-Control: no-store for signed-in users. false leaves them all to the proxy. |
SPLENT_FRAME_OPTIONS |
SAMEORIGIN |
DENY, or off to send nothing. |
SPLENT_REFERRER_POLICY |
strict-origin-when-cross-origin |
Any Referrer-Policy value. |
SPLENT_PERMISSIONS_POLICY |
camera, microphone, geolocation, payment and USB off | The whole Permissions-Policy value. Embedded maps lose their location button under the default; allow geolocation here if a product needs it. |
SPLENT_NO_STORE_SIGNED_IN |
true |
Cache-Control: no-store on pages for a signed-in user. |
SPLENT_HSTS_MAX_AGE |
31536000 |
Sent only over HTTPS. 0 turns HSTS off. |
SPLENT_HSTS_INCLUDE_SUBDOMAINS, SPLENT_HSTS_PRELOAD |
false |
The optional HSTS directives. |
SPLENT_CONTENT_SECURITY_POLICY |
none | A Content-Security-Policy to send. Opt in, since existing templates use inline scripts. |
SPLENT_CSP_REPORT_ONLY |
false |
Send that policy as Content-Security-Policy-Report-Only to try it first. |
SPLENT_ASSET_MAX_AGE |
31536000 |
How long a versioned asset (?v=<mtime>) may be cached. 0 turns it off. |
SPLENT_ASSET_VERSIONING |
true |
Add ?v=<mtime> to the asset URLs url_for builds. |
Database connections are pinged when they leave the pool and recycled after
an hour (SQLALCHEMY_ENGINE_OPTIONS), so a database restart or MariaDB's
eight hour wait_timeout never reaches a visitor as a 500. A product changes
them in its config.py.
Requirements
- Python 3.13+
- Flask 3.1+
- SQLAlchemy 2.0+
Documentation
Full docs, tutorials, and architecture reference at docs.splent.io
License
splent_framework is free software under the GNU Lesser General Public
License, version 3 or any later version (LGPL-3.0-or-later). See
COPYING.LESSER, and COPYING for the GNU General Public License it builds
on. A product built on the framework can carry any license of its own choice.
Metadata
Release files for splent-framework 1.19.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| splent_framework-1.19.0.tar.gz | 283.8 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| splent_framework-1.19.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 457.5 kB
Release files / splent_framework-1.19.0.tar.gz
| Download URL | splent_framework-1.19.0.tar.gz |
|---|---|
| Size | 283.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9c82f5923780d8e5b0a47d8eab4a02cd32446725744dfd5ecc40202305da039b
|
|
BLAKE2b-256 checksum How to use checksums |
cbd85b740cfede0b0102e1fdaab307a3248c5e22cf8d63512b2f1fc0627e47e3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.13
|
Release files / splent_framework-1.19.0-py3-none-any.whl
| Download URL | splent_framework-1.19.0-py3-none-any.whl |
|---|---|
| Size | 173.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
0d51041d508a6afc49bd111231b961906964e6ae8a14debe07b96064c87760f8
|
|
BLAKE2b-256 checksum How to use checksums |
04eedf0fdf0454091db853b591d480d68b0780a927898f3e8eb19a6843ea8127
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.13
|
Security for splent-framework 1.19.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
