SPLENT Framework
Core library for building modular, feature-driven Flask applications using Software Product Line principles.
Quick start
from splent_framework import create_splent_app
app = create_splent_app(__name__, config_name="development")
Production defaults
A product built with create_splent_app gets these without any code. Each
one is a variable in the deployment's .env. The header and asset settings
can also be fixed in the product's config.py, which then wins over the
.env. For SPLENT_COOKIE_SECURE and MAX_CONTENT_LENGTH the .env wins
over the product and over any feature's inject_config, because only the
deployment knows whether it runs over HTTPS and how large its uploads are.
The factory applies both again after the features load.
| Variable | Default | What it does |
|---|---|---|
SPLENT_TRUSTED_PROXIES |
0 |
Number of reverse proxies in front of the app. Set it to 1 behind a TLS proxy (nginx, Caddy, Traefik) so the app sees the client address and the https the proxy was reached on, builds https:// links and sends HSTS. Leave it at 0 when the app port is reachable without the proxy. |
SPLENT_COOKIE_SECURE |
auto |
Session and remember-me cookies are always HttpOnly and SameSite=Lax. Left unset, every cookie is Secure when the request arrived over HTTPS, directly or through a trusted proxy, so behind TLS set SPLENT_TRUSTED_PROXIES. true forces Secure, false never sets it. |
MAX_CONTENT_LENGTH |
16M |
Largest request body. Bigger ones get 413, as JSON for a client that sent or asked for JSON. Accepts bytes or K, M, G, and 0 for no limit. |
SPLENT_SECURITY_HEADERS |
true |
nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cache-Control: no-store for signed-in users. false leaves them all to the proxy. |
SPLENT_FRAME_OPTIONS |
SAMEORIGIN |
DENY, or off to send nothing. |
SPLENT_REFERRER_POLICY |
strict-origin-when-cross-origin |
Any Referrer-Policy value. |
SPLENT_PERMISSIONS_POLICY |
camera, microphone, geolocation, payment and USB off | The whole Permissions-Policy value. Embedded maps lose their location button under the default; allow geolocation here if a product needs it. |
SPLENT_NO_STORE_SIGNED_IN |
true |
Cache-Control: no-store on pages for a signed-in user. |
SPLENT_HSTS_MAX_AGE |
31536000 |
Sent only over HTTPS. 0 turns HSTS off. |
SPLENT_HSTS_INCLUDE_SUBDOMAINS, SPLENT_HSTS_PRELOAD |
false |
The optional HSTS directives. |
SPLENT_CONTENT_SECURITY_POLICY |
none | A Content-Security-Policy to send. Opt in, since existing templates use inline scripts. |
SPLENT_CSP_REPORT_ONLY |
false |
Send that policy as Content-Security-Policy-Report-Only to try it first. |
SPLENT_ASSET_MAX_AGE |
31536000 |
How long a versioned asset (?v=<mtime>) may be cached. 0 turns it off. |
SPLENT_ASSET_VERSIONING |
true |
Add ?v=<mtime> to the asset URLs url_for builds. |
Database connections are pinged when they leave the pool and recycled after
an hour (SQLALCHEMY_ENGINE_OPTIONS), so a database restart or MariaDB's
eight hour wait_timeout never reaches a visitor as a 500. A product changes
them in its config.py.
Requirements
- Python 3.13+
- Flask 3.1+
- SQLAlchemy 2.0+
Documentation
Full docs, tutorials, and architecture reference at docs.splent.io
License
splent_framework is free software under the GNU Lesser General Public
License, version 3 or any later version (LGPL-3.0-or-later). See
COPYING.LESSER, and COPYING for the GNU General Public License it builds
on. A product built on the framework can carry any license of its own choice.
Metadata
Release files for splent-framework 1.20.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| splent_framework-1.20.0.tar.gz | 326.9 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| splent_framework-1.20.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 523.4 kB
Release files / splent_framework-1.20.0.tar.gz
| Download URL | splent_framework-1.20.0.tar.gz |
|---|---|
| Size | 326.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b017c3358fffa5ae29c76a295a23365fc5b43e2b8012f4663aa8482b15cb698c
|
|
BLAKE2b-256 checksum How to use checksums |
f91d68b8b169639d04f85895fb08b2c4119af31d6ade5ec32f02413508915cee
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.13
|
Release files / splent_framework-1.20.0-py3-none-any.whl
| Download URL | splent_framework-1.20.0-py3-none-any.whl |
|---|---|
| Size | 196.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
f94b0153d57b12091ce2cbd95e03b04ea295229d8a1d44e8de3ab981640b8f52
|
|
BLAKE2b-256 checksum How to use checksums |
6fc383d3a81bccc9cf91441204f43e3871ea293a6322f9949578265e3506becf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.13
|
Security for splent-framework 1.20.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
