Forms with Flask-WTF

@app.route("/books/new", methods=["GET", "POST"])
def new_book():
    form = BookForm()
    if form.validate_on_submit():
        BOOKS.append({"title": form.title.data, "isbn": form.isbn.data, "pages": form.pages.data})
        flash("Book saved.")
        return redirect(url_for("new_book"))  # Post/Redirect/Get
    status = 422 if form.errors else 200
    return render_template_string(PAGE, form=form), status

PAGE = """
{% macro render_field(field) %}
  <div class="field{% if field.errors %} has-error{% endif %}">
    {{ field.label }}
    {{ field(**kwargs) }}
    {% for message in field.errors %}<span class="error">{{ message }}</span>{% endfor %}
  </div>
{% endmacro %}
<form method="post" novalidate>
  {{ form.hidden_tag() }}
  {{ render_field(form.title) }}
  {{ render_field(form.isbn, placeholder="9780441172719") }}
  {{ render_field(form.pages, min=1) }}
  {{ render_field(form.summary, rows=4) }}
  {{ render_field(form.in_stock) }}
  {{ form.submit() }}
</form>
"""

import re


def csrf_token_from(html: str) -> str:
    return re.search(r'name="csrf_token"[^>]*value="([^"]+)"', html).group(1)


with app.test_client() as client:
    page = client.get("/books/new")
    token = csrf_token_from(page.get_data(as_text=True))

    bad = client.post("/books/new", data={"csrf_token": token, "title": "Dune", "isbn": "123", "pages": "x"})
    html = bad.get_data(as_text=True)
    print(bad.status_code, "Enter 13 digits" in html, 'value="Dune"' in html)

    missing = client.post("/books/new", data={"title": "Dune", "isbn": "9780441172719", "pages": "412"})
    print(missing.status_code, "The CSRF token is missing." in missing.get_data(as_text=True))

    good = client.post(
        "/books/new",
        data={"csrf_token": token, "title": "Dune", "isbn": "9780441172719", "pages": "412"},
    )
    print(good.status_code, good.headers["Location"], BOOKS)

from wtforms.validators import ValidationError


class ReviewForm(FlaskForm):
    reviewer = StringField("Your name", validators=[InputRequired(), Length(max=60)])
    rating = IntegerField("Rating", validators=[InputRequired(), NumberRange(min=1, max=5)])
    comment = TextAreaField("Comment", validators=[Length(max=1000)])

    def validate_comment(self, field):
        if self.rating.data is not None and self.rating.data <= 2 and len(field.data or "") < 20:
            raise ValidationError("Please explain a low rating in at least 20 characters.")


def banned_words(form, field):
    if "spoiler" in (field.data or "").lower():
        raise ValidationError("No spoilers, please.")


with app.test_request_context("/", method="POST"):
    data = MultiDict({"reviewer": "Ana", "rating": "1", "comment": "meh"})
    form = ReviewForm(formdata=data, meta={"csrf": False})
    print(form.validate(), form.errors)

    form = ReviewForm(formdata=data, meta={"csrf": False})
    print(form.validate(extra_validators={"comment": [banned_words]}), form.errors)

    form = ReviewForm(
        formdata=MultiDict({"reviewer": "Ana", "rating": "5", "comment": "A spoiler follows"}),
        meta={"csrf": False},
    )
    print(form.validate(extra_validators={"comment": [banned_words]}), form.errors)

from wtforms import FieldList, FormField, SelectField
from wtforms.validators import DataRequired


class TimestampedMixin:
    notes = TextAreaField("Internal notes", validators=[Optional(), Length(max=500)])


class AuthorForm(FlaskForm):
    class Meta:
        csrf = False  # nested forms must not carry their own CSRF token

    name = StringField("Name", validators=[InputRequired(), Length(max=80)])
    born = IntegerField("Born", validators=[Optional(), NumberRange(min=1000, max=2100)])


class FullBookForm(TimestampedMixin, BookForm):
    language = SelectField("Language", choices=[("en", "English"), ("es", "Spanish")])
    authors = FieldList(FormField(AuthorForm), min_entries=1, max_entries=5)


with app.test_request_context("/", method="POST"):
    print([f.name for f in FullBookForm(formdata=None, meta={"csrf": False})])
    data = MultiDict(
        {
            "title": "Good Omens", "isbn": "9780060853983", "pages": "384", "language": "en",
            "authors-0-name": "Terry Pratchett", "authors-0-born": "1948",
            "authors-1-name": "Neil Gaiman", "authors-1-born": "x",
        }
    )
    form = FullBookForm(formdata=data, meta={"csrf": False})
    print(form.validate())
    print(form.errors)
    print([a.form.name.data for a in form.authors])

def isbn13(form, field):
    digits = field.data or ""
    if len(digits) != 13 or not digits.isdecimal():
        raise ValidationError("An ISBN-13 has exactly 13 digits.")
    total = sum(int(d) * (1 if i % 2 == 0 else 3) for i, d in enumerate(digits[:12]))
    if (10 - total % 10) % 10 != int(digits[12]):
        raise ValidationError("The ISBN check digit is wrong.")


class UniqueIn:
    """Reject a value that is already present in the collection returned by ``source()``."""

    def __init__(self, source, message=None):
        self.source = source
        self.message = message

    def __call__(self, form, field):
        if field.data in {item["title"] for item in self.source()}:
            raise ValidationError(self.message or "This title is already on the shelf.")


class CheckedBookForm(BookForm):
    isbn = StringField("ISBN-13", validators=[InputRequired(), isbn13])
    title = StringField(
        "Title", validators=[InputRequired(), Length(max=120), UniqueIn(lambda: BOOKS)]
    )


for isbn in ("9780441172719", "9780441172710"):
    with app.test_request_context("/", method="POST"):
        form = CheckedBookForm(
            formdata=MultiDict({"title": "Dune", "isbn": isbn, "pages": "412"}), meta={"csrf": False}
        )
        print(isbn, form.validate(), form.errors)

from wtforms import Field
from wtforms.widgets import TextInput


class TagListField(Field):
    """Comma separated text in the browser, list[str] in Python."""

    widget = TextInput()

    def _value(self):
        return ", ".join(self.data) if self.data else ""

    def process_formdata(self, valuelist):
        if valuelist:
            tags = [t.strip().lower() for t in valuelist[0].split(",")]
            self.data = sorted({t for t in tags if t})
        else:
            self.data = []


class TaggedBookForm(FlaskForm):
    tags = TagListField("Tags", validators=[Length(max=5, message="At most five tags.")])


with app.test_request_context("/", method="POST"):
    form = TaggedBookForm(formdata=MultiDict({"tags": "Sci-Fi, dune, sci-fi , classic"}), meta={"csrf": False})
    print(form.validate(), form.tags.data, form.tags())

from markupsafe import Markup
from wtforms.widgets import html_params


class RatingWidget:
    """Render 1..max as radio buttons inside a fieldset."""

    def __init__(self, max_stars: int = 5):
        self.max_stars = max_stars

    def __call__(self, field, **kwargs):
        kwargs.setdefault("id", field.id)
        parts = [f"<fieldset {html_params(id=kwargs['id'], class_='rating')}>"]
        for value in range(1, self.max_stars + 1):
            attrs = html_params(type="radio", name=field.name, value=value, id=f"{field.id}-{value}")
            checked = " checked" if field.data == value else ""
            parts.append(f'<label><input {attrs}{checked}> {value}</label>')
        parts.append("</fieldset>")
        return Markup("".join(parts))


class StarReviewForm(FlaskForm):
    rating = IntegerField("Rating", widget=RatingWidget(), validators=[InputRequired(), NumberRange(1, 5)])


with app.test_request_context("/", method="POST"):
    form = StarReviewForm(formdata=MultiDict({"rating": "4"}), meta={"csrf": False})
    print(form.validate())
    print(form.rating())

from flask import jsonify
from flask_wtf.csrf import CSRFError, CSRFProtect, generate_csrf, validate_csrf

csrf_app = Flask("csrf_demo")
csrf_app.config["SECRET_KEY"] = os.environ.get("BOOKSHELF_SECRET_KEY") or secrets.token_hex(32)
csrf = CSRFProtect(csrf_app)

PAGE_WITH_SCRIPT = """
<!doctype html>
<head>{{ csrf_meta_tag() }}</head>
<body>
<script>
  const token = document.querySelector('meta[name="csrf-token"]').content;
  fetch("/api/like", {method: "POST", headers: {"X-CSRFToken": token, "Content-Type": "application/json"},
                      body: JSON.stringify({book: 1})});
</script>
</body>
"""


@csrf_app.get("/")
def index():
    return render_template_string(PAGE_WITH_SCRIPT)


@csrf_app.post("/api/like")
def like():
    return jsonify(liked=True)


@csrf_app.post("/webhooks/printer")
@csrf.exempt  # called by a server, authenticated with a signature instead of a cookie
def printer_webhook():
    return jsonify(ok=True)


@csrf_app.errorhandler(CSRFError)
def csrf_failed(error):
    return jsonify(error="csrf", reason=error.description), 400


with csrf_app.test_client() as client:
    html = client.get("/").get_data(as_text=True)
    meta_token = re.search(r'<meta name="csrf-token" content="([^"]+)"', html).group(1)

    print(client.post("/api/like", json={"book": 1}).get_json())
    print(client.post("/api/like", json={"book": 1}, headers={"X-CSRFToken": meta_token}).get_json())
    print(client.post("/webhooks/printer", json={}).get_json())
    print(client.post("/api/like", json={"book": 1}, headers={"X-CSRFToken": "forged"}).get_json())