Merge branch csp into 3.x

Add APIHandler

IPython/html/base/handlers.py

@@ -1,528 +1,553 b''
 """Base Tornado handlers for the notebook server."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 
 import functools
 import json
 import logging
 import os
 import re
 import sys
 import traceback
 try:
     # py3
     from http.client import responses
 except ImportError:
     from httplib import responses
 
 from jinja2 import TemplateNotFound
 from tornado import web
 
 from tornado import gen
 from tornado.log import app_log
 
 
 import IPython
 from IPython.utils.sysinfo import get_sys_info
 
 from IPython.config import Application
 from IPython.utils.path import filefind
 from IPython.utils.py3compat import string_types
 from IPython.html.utils import is_hidden, url_path_join, url_escape
 
 from IPython.html.services.security import csp_report_uri
 
 #-----------------------------------------------------------------------------
 # Top-level handlers
 #-----------------------------------------------------------------------------
 non_alphanum = re.compile(r'[^A-Za-z0-9]')
 
 sys_info = json.dumps(get_sys_info())
 
 class AuthenticatedHandler(web.RequestHandler):
     """A RequestHandler with an authenticated user."""
 
+    @property
+    def content_security_policy(self):
+        """The default Content-Security-Policy header
+        
+        Can be overridden by defining Content-Security-Policy in settings['headers']
+        """
+        return '; '.join([
+            "frame-ancestors 'self'",
+            # Make sure the report-uri is relative to the base_url
+            "report-uri " + url_path_join(self.base_url, csp_report_uri),
+        ])
+
     def set_default_headers(self):
         headers = self.settings.get('headers', {})
 
         if "Content-Security-Policy" not in headers:
-            headers["Content-Security-Policy"] = (
-                    "frame-ancestors 'self'; "
-                    # Make sure the report-uri is relative to the base_url
-                    "report-uri " + url_path_join(self.base_url, csp_report_uri) + ";"
-            )
+            headers["Content-Security-Policy"] = self.content_security_policy
 
         # Allow for overriding headers
         for header_name,value in headers.items() :
             try:
                 self.set_header(header_name, value)
             except Exception as e:
                 # tornado raise Exception (not a subclass)
                 # if method is unsupported (websocket and Access-Control-Allow-Origin
                 # for example, so just ignore)
                 self.log.debug(e)
     
     def clear_login_cookie(self):
         self.clear_cookie(self.cookie_name)
     
     def get_current_user(self):
         if self.login_handler is None:
             return 'anonymous'
         return self.login_handler.get_user(self)
 
     @property
     def cookie_name(self):
         default_cookie_name = non_alphanum.sub('-', 'username-{}'.format(
             self.request.host
         ))
         return self.settings.get('cookie_name', default_cookie_name)
     
     @property
     def logged_in(self):
         """Is a user currently logged in?"""
         user = self.get_current_user()
         return (user and not user == 'anonymous')
 
     @property
     def login_handler(self):
         """Return the login handler for this application, if any."""
         return self.settings.get('login_handler_class', None)
 
     @property
     def login_available(self):
         """May a user proceed to log in?
 
         This returns True if login capability is available, irrespective of
         whether the user is already logged in or not.
 
         """
         if self.login_handler is None:
             return False
         return bool(self.login_handler.login_available(self.settings))
 
 
 class IPythonHandler(AuthenticatedHandler):
     """IPython-specific extensions to authenticated handling
     
     Mostly property shortcuts to IPython-specific settings.
     """
     
     @property
     def config(self):
         return self.settings.get('config', None)
     
     @property
     def log(self):
         """use the IPython log by default, falling back on tornado's logger"""
         if Application.initialized():
             return Application.instance().log
         else:
             return app_log
 
     @property
     def jinja_template_vars(self):
         """User-supplied values to supply to jinja templates."""
         return self.settings.get('jinja_template_vars', {})
     
     #---------------------------------------------------------------
     # URLs
     #---------------------------------------------------------------
     
     @property
     def version_hash(self):
         """The version hash to use for cache hints for static files"""
         return self.settings.get('version_hash', '')
     
     @property
     def mathjax_url(self):
         return self.settings.get('mathjax_url', '')
     
     @property
     def base_url(self):
         return self.settings.get('base_url', '/')
 
     @property
     def default_url(self):
         return self.settings.get('default_url', '')
 
     @property
     def ws_url(self):
         return self.settings.get('websocket_url', '')
 
     @property
     def contents_js_source(self):
         self.log.debug("Using contents: %s", self.settings.get('contents_js_source',
             'services/contents'))
         return self.settings.get('contents_js_source', 'services/contents')
     
     #---------------------------------------------------------------
     # Manager objects
     #---------------------------------------------------------------
     
     @property
     def kernel_manager(self):
         return self.settings['kernel_manager']
 
     @property
     def contents_manager(self):
         return self.settings['contents_manager']
     
     @property
     def cluster_manager(self):
         return self.settings['cluster_manager']
     
     @property
     def session_manager(self):
         return self.settings['session_manager']
     
     @property
     def terminal_manager(self):
         return self.settings['terminal_manager']
     
     @property
     def kernel_spec_manager(self):
         return self.settings['kernel_spec_manager']
 
     @property
     def config_manager(self):
         return self.settings['config_manager']
 
     #---------------------------------------------------------------
     # CORS
     #---------------------------------------------------------------
     
     @property
     def allow_origin(self):
         """Normal Access-Control-Allow-Origin"""
         return self.settings.get('allow_origin', '')
     
     @property
     def allow_origin_pat(self):
         """Regular expression version of allow_origin"""
         return self.settings.get('allow_origin_pat', None)
     
     @property
     def allow_credentials(self):
         """Whether to set Access-Control-Allow-Credentials"""
         return self.settings.get('allow_credentials', False)
     
     def set_default_headers(self):
         """Add CORS headers, if defined"""
         super(IPythonHandler, self).set_default_headers()
         if self.allow_origin:
             self.set_header("Access-Control-Allow-Origin", self.allow_origin)
         elif self.allow_origin_pat:
             origin = self.get_origin()
             if origin and self.allow_origin_pat.match(origin):
                 self.set_header("Access-Control-Allow-Origin", origin)
         if self.allow_credentials:
             self.set_header("Access-Control-Allow-Credentials", 'true')
     
     def get_origin(self):
         # Handle WebSocket Origin naming convention differences
         # The difference between version 8 and 13 is that in 8 the
         # client sends a "Sec-Websocket-Origin" header and in 13 it's
         # simply "Origin".
         if "Origin" in self.request.headers:
             origin = self.request.headers.get("Origin")
         else:
             origin = self.request.headers.get("Sec-Websocket-Origin", None)
         return origin
     
     #---------------------------------------------------------------
     # template rendering
     #---------------------------------------------------------------
     
     def get_template(self, name):
         """Return the jinja template object for a given name"""
         return self.settings['jinja2_env'].get_template(name)
     
     def render_template(self, name, **ns):
         ns.update(self.template_namespace)
         template = self.get_template(name)
         return template.render(**ns)
     
     @property
     def template_namespace(self):
         return dict(
             base_url=self.base_url,
             default_url=self.default_url,
             ws_url=self.ws_url,
             logged_in=self.logged_in,
             login_available=self.login_available,
             static_url=self.static_url,
             sys_info=sys_info,
             contents_js_source=self.contents_js_source,
             version_hash=self.version_hash,
             **self.jinja_template_vars
         )
     
     def get_json_body(self):
         """Return the body of the request as JSON data."""
         if not self.request.body:
             return None
         # Do we need to call body.decode('utf-8') here?
         body = self.request.body.strip().decode(u'utf-8')
         try:
             model = json.loads(body)
         except Exception:
             self.log.debug("Bad JSON: %r", body)
             self.log.error("Couldn't parse JSON", exc_info=True)
             raise web.HTTPError(400, u'Invalid JSON in body of request')
         return model
 
     def write_error(self, status_code, **kwargs):
         """render custom error pages"""
         exc_info = kwargs.get('exc_info')
         message = ''
         status_message = responses.get(status_code, 'Unknown HTTP Error')
         if exc_info:
             exception = exc_info[1]
             # get the custom message, if defined
             try:
                 message = exception.log_message % exception.args
             except Exception:
                 pass
             
             # construct the custom reason, if defined
             reason = getattr(exception, 'reason', '')
             if reason:
                 status_message = reason
         
         # build template namespace
         ns = dict(
             status_code=status_code,
             status_message=status_message,
             message=message,
             exception=exception,
         )
         
         self.set_header('Content-Type', 'text/html')
         # render the template
         try:
             html = self.render_template('%s.html' % status_code, **ns)
         except TemplateNotFound:
             self.log.debug("No template for %d", status_code)
             html = self.render_template('error.html', **ns)
         
         self.write(html)
         
 
+class APIHandler(IPythonHandler):
+    """Base class for API handlers"""
+    
+    @property
+    def content_security_policy(self):
+        csp = '; '.join([
+                super(APIHandler, self).content_security_policy,
+                "default-src 'none'",
+            ])
+        return csp
+    
+    def finish(self, *args, **kwargs):
+        self.set_header('Content-Type', 'application/json')
+        return super(APIHandler, self).finish(*args, **kwargs)
+
 
 class Template404(IPythonHandler):
     """Render our 404 template"""
     def prepare(self):
         raise web.HTTPError(404)
 
 
 class AuthenticatedFileHandler(IPythonHandler, web.StaticFileHandler):
     """static files should only be accessible when logged in"""
 
     @web.authenticated
     def get(self, path):
         if os.path.splitext(path)[1] == '.ipynb':
             name = path.rsplit('/', 1)[-1]
             self.set_header('Content-Type', 'application/json')
             self.set_header('Content-Disposition','attachment; filename="%s"' % name)
         
         return web.StaticFileHandler.get(self, path)
     
     def set_headers(self):
         super(AuthenticatedFileHandler, self).set_headers()
         # disable browser caching, rely on 304 replies for savings
         if "v" not in self.request.arguments:
             self.add_header("Cache-Control", "no-cache")
     
     def compute_etag(self):
         return None
     
     def validate_absolute_path(self, root, absolute_path):
         """Validate and return the absolute path.
         
         Requires tornado 3.1
         
         Adding to tornado's own handling, forbids the serving of hidden files.
         """
         abs_path = super(AuthenticatedFileHandler, self).validate_absolute_path(root, absolute_path)
         abs_root = os.path.abspath(root)
         if is_hidden(abs_path, abs_root):
             self.log.info("Refusing to serve hidden file, via 404 Error")
             raise web.HTTPError(404)
         return abs_path
 
 
 def json_errors(method):
     """Decorate methods with this to return GitHub style JSON errors.
     
     This should be used on any JSON API on any handler method that can raise HTTPErrors.
     
     This will grab the latest HTTPError exception using sys.exc_info
     and then:
     
     1. Set the HTTP status code based on the HTTPError
     2. Create and return a JSON body with a message field describing
        the error in a human readable form.
     """
     @functools.wraps(method)
     @gen.coroutine
     def wrapper(self, *args, **kwargs):
         try:
             result = yield gen.maybe_future(method(self, *args, **kwargs))
         except web.HTTPError as e:
+            self.set_header('Content-Type', 'application/json')
             status = e.status_code
             message = e.log_message
             self.log.warn(message)
             self.set_status(e.status_code)
             reply = dict(message=message, reason=e.reason)
             self.finish(json.dumps(reply))
         except Exception:
+            self.set_header('Content-Type', 'application/json')
             self.log.error("Unhandled error in API request", exc_info=True)
             status = 500
             message = "Unknown server error"
             t, value, tb = sys.exc_info()
             self.set_status(status)
             tb_text = ''.join(traceback.format_exception(t, value, tb))
             reply = dict(message=message, reason=None, traceback=tb_text)
             self.finish(json.dumps(reply))
         else:
             # FIXME: can use regular return in generators in py3
             raise gen.Return(result)
     return wrapper
 
 
 
 #-----------------------------------------------------------------------------
 # File handler
 #-----------------------------------------------------------------------------
 
 # to minimize subclass changes:
 HTTPError = web.HTTPError
 
-class FileFindHandler(web.StaticFileHandler):
+class FileFindHandler(IPythonHandler, web.StaticFileHandler):
     """subclass of StaticFileHandler for serving files from a search path"""
     
     # cache search results, don't search for files more than once
     _static_paths = {}
     
     def set_headers(self):
         super(FileFindHandler, self).set_headers()
         # disable browser caching, rely on 304 replies for savings
         if "v" not in self.request.arguments or \
                 any(self.request.path.startswith(path) for path in self.no_cache_paths):
             self.set_header("Cache-Control", "no-cache")
     
     def initialize(self, path, default_filename=None, no_cache_paths=None):
         self.no_cache_paths = no_cache_paths or []
         
         if isinstance(path, string_types):
             path = [path]
         
         self.root = tuple(
             os.path.abspath(os.path.expanduser(p)) + os.sep for p in path
         )
         self.default_filename = default_filename
     
     def compute_etag(self):
         return None
     
     @classmethod
     def get_absolute_path(cls, roots, path):
         """locate a file to serve on our static file search path"""
         with cls._lock:
             if path in cls._static_paths:
                 return cls._static_paths[path]
             try:
                 abspath = os.path.abspath(filefind(path, roots))
             except IOError:
                 # IOError means not found
                 return ''
             
             cls._static_paths[path] = abspath
             return abspath
     
     def validate_absolute_path(self, root, absolute_path):
         """check if the file should be served (raises 404, 403, etc.)"""
         if absolute_path == '':
             raise web.HTTPError(404)
         
         for root in self.root:
             if (absolute_path + os.sep).startswith(root):
                 break
         
         return super(FileFindHandler, self).validate_absolute_path(root, absolute_path)
 
 
-class ApiVersionHandler(IPythonHandler):
+class APIVersionHandler(APIHandler):
 
     @json_errors
     def get(self):
         # not authenticated, so give as few info as possible
         self.finish(json.dumps({"version":IPython.__version__}))
 
 
 class TrailingSlashHandler(web.RequestHandler):
     """Simple redirect handler that strips trailing slashes
     
     This should be the first, highest priority handler.
     """
     
     def get(self):
         self.redirect(self.request.uri.rstrip('/'))
     
     post = put = get
 
 
 class FilesRedirectHandler(IPythonHandler):
     """Handler for redirecting relative URLs to the /files/ handler"""
     
     @staticmethod
     def redirect_to_files(self, path):
         """make redirect logic a reusable static method
         
         so it can be called from other handlers.
         """
         cm = self.contents_manager
         if cm.dir_exists(path):
             # it's a *directory*, redirect to /tree
             url = url_path_join(self.base_url, 'tree', path)
         else:
             orig_path = path
             # otherwise, redirect to /files
             parts = path.split('/')
 
             if not cm.file_exists(path=path) and 'files' in parts:
                 # redirect without files/ iff it would 404
                 # this preserves pre-2.0-style 'files/' links
                 self.log.warn("Deprecated files/ URL: %s", orig_path)
                 parts.remove('files')
                 path = '/'.join(parts)
 
             if not cm.file_exists(path=path):
                 raise web.HTTPError(404)
 
             url = url_path_join(self.base_url, 'files', path)
         url = url_escape(url)
         self.log.debug("Redirecting %s to %s", self.request.path, url)
         self.redirect(url)
     
     def get(self, path=''):
         return self.redirect_to_files(self, path)
 
 
 #-----------------------------------------------------------------------------
 # URL pattern fragments for re-use
 #-----------------------------------------------------------------------------
 
 # path matches any number of `/foo[/bar...]` or just `/` or ''
 path_regex = r"(?P<path>(?:(?:/[^/]+)+|/?))"
 
 #-----------------------------------------------------------------------------
 # URL to handler mappings
 #-----------------------------------------------------------------------------
 
 
 default_handlers = [
     (r".*/", TrailingSlashHandler),
-    (r"api", ApiVersionHandler)
+    (r"api", APIVersionHandler)
 ]

IPython/html/services/clusters/handlers.py

@@ -1,59 +1,59 b''
 """Tornado handlers for cluster web service."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 
 import json
 
 from tornado import web
 
-from ...base.handlers import IPythonHandler
+from ...base.handlers import APIHandler
 
 #-----------------------------------------------------------------------------
 # Cluster handlers
 #-----------------------------------------------------------------------------
 
 
-class MainClusterHandler(IPythonHandler):
+class MainClusterHandler(APIHandler):
 
     @web.authenticated
     def get(self):
         self.finish(json.dumps(self.cluster_manager.list_profiles()))
 
 
-class ClusterProfileHandler(IPythonHandler):
+class ClusterProfileHandler(APIHandler):
 
     @web.authenticated
     def get(self, profile):
         self.finish(json.dumps(self.cluster_manager.profile_info(profile)))
 
 
-class ClusterActionHandler(IPythonHandler):
+class ClusterActionHandler(APIHandler):
 
     @web.authenticated
     def post(self, profile, action):
         cm = self.cluster_manager
         if action == 'start':
             n = self.get_argument('n', default=None)
             if not n:
                 data = cm.start_cluster(profile)
             else:
                 data = cm.start_cluster(profile, int(n))
         if action == 'stop':
             data = cm.stop_cluster(profile)
         self.finish(json.dumps(data))
 
 
 #-----------------------------------------------------------------------------
 # URL to handler mappings
 #-----------------------------------------------------------------------------
 
 
 _cluster_action_regex = r"(?P<action>start|stop)"
 _profile_regex = r"(?P<profile>[^\/]+)" # there is almost no text that is invalid
 
 default_handlers = [
     (r"/clusters", MainClusterHandler),
     (r"/clusters/%s/%s" % (_profile_regex, _cluster_action_regex), ClusterActionHandler),
     (r"/clusters/%s" % _profile_regex, ClusterProfileHandler),
 ]

IPython/html/services/config/handlers.py

@@ -1,44 +1,44 b''
 """Tornado handlers for frontend config storage."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 import json
 import os
 import io
 import errno
 from tornado import web
 
 from IPython.utils.py3compat import PY3
-from ...base.handlers import IPythonHandler, json_errors
+from ...base.handlers import APIHandler, json_errors
 
-class ConfigHandler(IPythonHandler):
+class ConfigHandler(APIHandler):
     SUPPORTED_METHODS = ('GET', 'PUT', 'PATCH')
 
     @web.authenticated
     @json_errors
     def get(self, section_name):
         self.set_header("Content-Type", 'application/json')
         self.finish(json.dumps(self.config_manager.get(section_name)))
 
     @web.authenticated
     @json_errors
     def put(self, section_name):
         data = self.get_json_body()  # Will raise 400 if content is not valid JSON
         self.config_manager.set(section_name, data)
         self.set_status(204)
 
     @web.authenticated
     @json_errors
     def patch(self, section_name):
         new_data = self.get_json_body()
         section = self.config_manager.update(section_name, new_data)
         self.finish(json.dumps(section))
 
 
 # URL to handler mappings
 
 section_name_regex = r"(?P<section_name>\w+)"
 
 default_handlers = [
     (r"/api/config/%s" % section_name_regex, ConfigHandler),
 ]

IPython/html/services/contents/handlers.py

@@ -1,342 +1,342 b''
 """Tornado handlers for the contents web service."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 
 import json
 
 from tornado import gen, web
 
 from IPython.html.utils import url_path_join, url_escape
 from IPython.utils.jsonutil import date_default
 
 from IPython.html.base.handlers import (
-    IPythonHandler, json_errors, path_regex,
+    IPythonHandler, APIHandler, json_errors, path_regex,
 )
 
 
 def sort_key(model):
     """key function for case-insensitive sort by name and type"""
     iname = model['name'].lower()
     type_key = {
         'directory' : '0',
         'notebook'  : '1',
         'file'      : '2',
     }.get(model['type'], '9')
     return u'%s%s' % (type_key, iname)
 
 
 def validate_model(model, expect_content):
     """
     Validate a model returned by a ContentsManager method.
 
     If expect_content is True, then we expect non-null entries for 'content'
     and 'format'.
     """
     required_keys = {
         "name",
         "path",
         "type",
         "writable",
         "created",
         "last_modified",
         "mimetype",
         "content",
         "format",
     }
     missing = required_keys - set(model.keys())
     if missing:
         raise web.HTTPError(
             500,
             u"Missing Model Keys: {missing}".format(missing=missing),
         )
 
     maybe_none_keys = ['content', 'format']
     if model['type'] == 'file':
         # mimetype should be populated only for file models
         maybe_none_keys.append('mimetype')
     if expect_content:
         errors = [key for key in maybe_none_keys if model[key] is None]
         if errors:
             raise web.HTTPError(
                 500,
                 u"Keys unexpectedly None: {keys}".format(keys=errors),
             )
     else:
         errors = {
             key: model[key]
             for key in maybe_none_keys
             if model[key] is not None
         }
         if errors:
             raise web.HTTPError(
                 500,
                 u"Keys unexpectedly not None: {keys}".format(keys=errors),
             )
 
 
-class ContentsHandler(IPythonHandler):
+class ContentsHandler(APIHandler):
 
     SUPPORTED_METHODS = (u'GET', u'PUT', u'PATCH', u'POST', u'DELETE')
 
     def location_url(self, path):
         """Return the full URL location of a file.
 
         Parameters
         ----------
         path : unicode
             The API path of the file, such as "foo/bar.txt".
         """
         return url_escape(url_path_join(
             self.base_url, 'api', 'contents', path
         ))
 
     def _finish_model(self, model, location=True):
         """Finish a JSON request with a model, setting relevant headers, etc."""
         if location:
             location = self.location_url(model['path'])
             self.set_header('Location', location)
         self.set_header('Last-Modified', model['last_modified'])
         self.set_header('Content-Type', 'application/json')
         self.finish(json.dumps(model, default=date_default))
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def get(self, path=''):
         """Return a model for a file or directory.
 
         A directory model contains a list of models (without content)
         of the files and directories it contains.
         """
         path = path or ''
         type = self.get_query_argument('type', default=None)
         if type not in {None, 'directory', 'file', 'notebook'}:
             raise web.HTTPError(400, u'Type %r is invalid' % type)
 
         format = self.get_query_argument('format', default=None)
         if format not in {None, 'text', 'base64'}:
             raise web.HTTPError(400, u'Format %r is invalid' % format)
         content = self.get_query_argument('content', default='1')
         if content not in {'0', '1'}:
             raise web.HTTPError(400, u'Content %r is invalid' % content)
         content = int(content)
         
         model = yield gen.maybe_future(self.contents_manager.get(
             path=path, type=type, format=format, content=content,
         ))
         if model['type'] == 'directory' and content:
             # group listing by type, then by name (case-insensitive)
             # FIXME: sorting should be done in the frontends
             model['content'].sort(key=sort_key)
         validate_model(model, expect_content=content)
         self._finish_model(model, location=False)
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def patch(self, path=''):
         """PATCH renames a file or directory without re-uploading content."""
         cm = self.contents_manager
         model = self.get_json_body()
         if model is None:
             raise web.HTTPError(400, u'JSON body missing')
         model = yield gen.maybe_future(cm.update(model, path))
         validate_model(model, expect_content=False)
         self._finish_model(model)
     
     @gen.coroutine
     def _copy(self, copy_from, copy_to=None):
         """Copy a file, optionally specifying a target directory."""
         self.log.info(u"Copying {copy_from} to {copy_to}".format(
             copy_from=copy_from,
             copy_to=copy_to or '',
         ))
         model = yield gen.maybe_future(self.contents_manager.copy(copy_from, copy_to))
         self.set_status(201)
         validate_model(model, expect_content=False)
         self._finish_model(model)
 
     @gen.coroutine
     def _upload(self, model, path):
         """Handle upload of a new file to path"""
         self.log.info(u"Uploading file to %s", path)
         model = yield gen.maybe_future(self.contents_manager.new(model, path))
         self.set_status(201)
         validate_model(model, expect_content=False)
         self._finish_model(model)
     
     @gen.coroutine
     def _new_untitled(self, path, type='', ext=''):
         """Create a new, empty untitled entity"""
         self.log.info(u"Creating new %s in %s", type or 'file', path)
         model = yield gen.maybe_future(self.contents_manager.new_untitled(path=path, type=type, ext=ext))
         self.set_status(201)
         validate_model(model, expect_content=False)
         self._finish_model(model)
     
     @gen.coroutine
     def _save(self, model, path):
         """Save an existing file."""
         self.log.info(u"Saving file at %s", path)
         model = yield gen.maybe_future(self.contents_manager.save(model, path))
         validate_model(model, expect_content=False)
         self._finish_model(model)
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def post(self, path=''):
         """Create a new file in the specified path.
 
         POST creates new files. The server always decides on the name.
 
         POST /api/contents/path
           New untitled, empty file or directory.
         POST /api/contents/path
           with body {"copy_from" : "/path/to/OtherNotebook.ipynb"}
           New copy of OtherNotebook in path
         """
 
         cm = self.contents_manager
 
         if cm.file_exists(path):
             raise web.HTTPError(400, "Cannot POST to files, use PUT instead.")
 
         if not cm.dir_exists(path):
             raise web.HTTPError(404, "No such directory: %s" % path)
 
         model = self.get_json_body()
 
         if model is not None:
             copy_from = model.get('copy_from')
             ext = model.get('ext', '')
             type = model.get('type', '')
             if copy_from:
                 yield self._copy(copy_from, path)
             else:
                 yield self._new_untitled(path, type=type, ext=ext)
         else:
             yield self._new_untitled(path)
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def put(self, path=''):
         """Saves the file in the location specified by name and path.
 
         PUT is very similar to POST, but the requester specifies the name,
         whereas with POST, the server picks the name.
 
         PUT /api/contents/path/Name.ipynb
           Save notebook at ``path/Name.ipynb``. Notebook structure is specified
           in `content` key of JSON request body. If content is not specified,
           create a new empty notebook.
         """
         model = self.get_json_body()
         if model:
             if model.get('copy_from'):
                 raise web.HTTPError(400, "Cannot copy with PUT, only POST")
             exists = yield gen.maybe_future(self.contents_manager.file_exists(path))
             if exists:
                 yield gen.maybe_future(self._save(model, path))
             else:
                 yield gen.maybe_future(self._upload(model, path))
         else:
             yield gen.maybe_future(self._new_untitled(path))
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def delete(self, path=''):
         """delete a file in the given path"""
         cm = self.contents_manager
         self.log.warn('delete %s', path)
         yield gen.maybe_future(cm.delete(path))
         self.set_status(204)
         self.finish()
 
 
-class CheckpointsHandler(IPythonHandler):
+class CheckpointsHandler(APIHandler):
 
     SUPPORTED_METHODS = ('GET', 'POST')
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def get(self, path=''):
         """get lists checkpoints for a file"""
         cm = self.contents_manager
         checkpoints = yield gen.maybe_future(cm.list_checkpoints(path))
         data = json.dumps(checkpoints, default=date_default)
         self.finish(data)
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def post(self, path=''):
         """post creates a new checkpoint"""
         cm = self.contents_manager
         checkpoint = yield gen.maybe_future(cm.create_checkpoint(path))
         data = json.dumps(checkpoint, default=date_default)
         location = url_path_join(self.base_url, 'api/contents',
             path, 'checkpoints', checkpoint['id'])
         self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(data)
 
 
-class ModifyCheckpointsHandler(IPythonHandler):
+class ModifyCheckpointsHandler(APIHandler):
 
     SUPPORTED_METHODS = ('POST', 'DELETE')
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def post(self, path, checkpoint_id):
         """post restores a file from a checkpoint"""
         cm = self.contents_manager
         yield gen.maybe_future(cm.restore_checkpoint(checkpoint_id, path))
         self.set_status(204)
         self.finish()
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def delete(self, path, checkpoint_id):
         """delete clears a checkpoint for a given file"""
         cm = self.contents_manager
         yield gen.maybe_future(cm.delete_checkpoint(checkpoint_id, path))
         self.set_status(204)
         self.finish()
 
 
 class NotebooksRedirectHandler(IPythonHandler):
     """Redirect /api/notebooks to /api/contents"""
     SUPPORTED_METHODS = ('GET', 'PUT', 'PATCH', 'POST', 'DELETE')
 
     def get(self, path):
         self.log.warn("/api/notebooks is deprecated, use /api/contents")
         self.redirect(url_path_join(
             self.base_url,
             'api/contents',
             path
         ))
 
     put = patch = post = delete = get
 
 
 #-----------------------------------------------------------------------------
 # URL to handler mappings
 #-----------------------------------------------------------------------------
 
 
 _checkpoint_id_regex = r"(?P<checkpoint_id>[\w-]+)"
 
 default_handlers = [
     (r"/api/contents%s/checkpoints" % path_regex, CheckpointsHandler),
     (r"/api/contents%s/checkpoints/%s" % (path_regex, _checkpoint_id_regex),
         ModifyCheckpointsHandler),
     (r"/api/contents%s" % path_regex, ContentsHandler),
     (r"/api/notebooks/?(.*)", NotebooksRedirectHandler),
 ]

IPython/html/services/kernels/handlers.py

@@ -1,288 +1,288 b''
 """Tornado handlers for kernels."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 
 import json
 import logging
 from tornado import gen, web
 from tornado.concurrent import Future
 from tornado.ioloop import IOLoop
 
 from IPython.utils.jsonutil import date_default
 from IPython.utils.py3compat import cast_unicode
 from IPython.html.utils import url_path_join, url_escape
 
-from ...base.handlers import IPythonHandler, json_errors
+from ...base.handlers import IPythonHandler, APIHandler, json_errors
 from ...base.zmqhandlers import AuthenticatedZMQStreamHandler, deserialize_binary_message
 
 from IPython.core.release import kernel_protocol_version
 
-class MainKernelHandler(IPythonHandler):
+class MainKernelHandler(APIHandler):
 
     @web.authenticated
     @json_errors
     def get(self):
         km = self.kernel_manager
         self.finish(json.dumps(km.list_kernels()))
 
     @web.authenticated
     @json_errors
     def post(self):
         km = self.kernel_manager
         model = self.get_json_body()
         if model is None:
             model = {
                 'name': km.default_kernel_name
             }
         else:
             model.setdefault('name', km.default_kernel_name)
 
         kernel_id = km.start_kernel(kernel_name=model['name'])
         model = km.kernel_model(kernel_id)
         location = url_path_join(self.base_url, 'api', 'kernels', kernel_id)
         self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(json.dumps(model))
 
 
-class KernelHandler(IPythonHandler):
+class KernelHandler(APIHandler):
 
     SUPPORTED_METHODS = ('DELETE', 'GET')
 
     @web.authenticated
     @json_errors
     def get(self, kernel_id):
         km = self.kernel_manager
         km._check_kernel_id(kernel_id)
         model = km.kernel_model(kernel_id)
         self.finish(json.dumps(model))
 
     @web.authenticated
     @json_errors
     def delete(self, kernel_id):
         km = self.kernel_manager
         km.shutdown_kernel(kernel_id)
         self.set_status(204)
         self.finish()
 
 
-class KernelActionHandler(IPythonHandler):
+class KernelActionHandler(APIHandler):
 
     @web.authenticated
     @json_errors
     def post(self, kernel_id, action):
         km = self.kernel_manager
         if action == 'interrupt':
             km.interrupt_kernel(kernel_id)
             self.set_status(204)
         if action == 'restart':
             km.restart_kernel(kernel_id)
             model = km.kernel_model(kernel_id)
             self.set_header('Location', '{0}api/kernels/{1}'.format(self.base_url, kernel_id))
             self.write(json.dumps(model))
         self.finish()
 
 
 class ZMQChannelsHandler(AuthenticatedZMQStreamHandler):
     
     @property
     def kernel_info_timeout(self):
         return self.settings.get('kernel_info_timeout', 10)
     
     def __repr__(self):
         return "%s(%s)" % (self.__class__.__name__, getattr(self, 'kernel_id', 'uninitialized'))
     
     def create_stream(self):
         km = self.kernel_manager
         identity = self.session.bsession
         for channel in ('shell', 'iopub', 'stdin'):
             meth = getattr(km, 'connect_' + channel)
             self.channels[channel] = stream = meth(self.kernel_id, identity=identity)
             stream.channel = channel
         km.add_restart_callback(self.kernel_id, self.on_kernel_restarted)
         km.add_restart_callback(self.kernel_id, self.on_restart_failed, 'dead')
     
     def request_kernel_info(self):
         """send a request for kernel_info"""
         km = self.kernel_manager
         kernel = km.get_kernel(self.kernel_id)
         try:
             # check for previous request
             future = kernel._kernel_info_future
         except AttributeError:
             self.log.debug("Requesting kernel info from %s", self.kernel_id)
             # Create a kernel_info channel to query the kernel protocol version.
             # This channel will be closed after the kernel_info reply is received.
             if self.kernel_info_channel is None:
                 self.kernel_info_channel = km.connect_shell(self.kernel_id)
             self.kernel_info_channel.on_recv(self._handle_kernel_info_reply)
             self.session.send(self.kernel_info_channel, "kernel_info_request")
             # store the future on the kernel, so only one request is sent
             kernel._kernel_info_future = self._kernel_info_future
         else:
             if not future.done():
                 self.log.debug("Waiting for pending kernel_info request")
             future.add_done_callback(lambda f: self._finish_kernel_info(f.result()))
         return self._kernel_info_future
     
     def _handle_kernel_info_reply(self, msg):
         """process the kernel_info_reply
         
         enabling msg spec adaptation, if necessary
         """
         idents,msg = self.session.feed_identities(msg)
         try:
             msg = self.session.deserialize(msg)
         except:
             self.log.error("Bad kernel_info reply", exc_info=True)
             self._kernel_info_future.set_result({})
             return
         else:
             info = msg['content']
             self.log.debug("Received kernel info: %s", info)
             if msg['msg_type'] != 'kernel_info_reply' or 'protocol_version' not in info:
                 self.log.error("Kernel info request failed, assuming current %s", info)
                 info = {}
             self._finish_kernel_info(info)
         
         # close the kernel_info channel, we don't need it anymore
         if self.kernel_info_channel:
             self.kernel_info_channel.close()
         self.kernel_info_channel = None
     
     def _finish_kernel_info(self, info):
         """Finish handling kernel_info reply
         
         Set up protocol adaptation, if needed,
         and signal that connection can continue.
         """
         protocol_version = info.get('protocol_version', kernel_protocol_version)
         if protocol_version != kernel_protocol_version:
             self.session.adapt_version = int(protocol_version.split('.')[0])
             self.log.info("Adapting to protocol v%s for kernel %s", protocol_version, self.kernel_id)
         if not self._kernel_info_future.done():
             self._kernel_info_future.set_result(info)
     
     def initialize(self):
         super(ZMQChannelsHandler, self).initialize()
         self.zmq_stream = None
         self.channels = {}
         self.kernel_id = None
         self.kernel_info_channel = None
         self._kernel_info_future = Future()
     
     @gen.coroutine
     def pre_get(self):
         # authenticate first
         super(ZMQChannelsHandler, self).pre_get()
         # then request kernel info, waiting up to a certain time before giving up.
         # We don't want to wait forever, because browsers don't take it well when
         # servers never respond to websocket connection requests.
         kernel = self.kernel_manager.get_kernel(self.kernel_id)
         self.session.key = kernel.session.key
         future = self.request_kernel_info()
         
         def give_up():
             """Don't wait forever for the kernel to reply"""
             if future.done():
                 return
             self.log.warn("Timeout waiting for kernel_info reply from %s", self.kernel_id)
             future.set_result({})
         loop = IOLoop.current()
         loop.add_timeout(loop.time() + self.kernel_info_timeout, give_up)
         # actually wait for it
         yield future
     
     @gen.coroutine
     def get(self, kernel_id):
         self.kernel_id = cast_unicode(kernel_id, 'ascii')
         yield super(ZMQChannelsHandler, self).get(kernel_id=kernel_id)
     
     def open(self, kernel_id):
         super(ZMQChannelsHandler, self).open()
         try:
             self.create_stream()
         except web.HTTPError as e:
             self.log.error("Error opening stream: %s", e)
             # WebSockets don't response to traditional error codes so we
             # close the connection.
             for channel, stream in self.channels.items():
                 if not stream.closed():
                     stream.close()
             self.close()
         else:
             for channel, stream in self.channels.items():
                 stream.on_recv_stream(self._on_zmq_reply)
 
     def on_message(self, msg):
         if not self.channels:
             # already closed, ignore the message
             self.log.debug("Received message on closed websocket %r", msg)
             return
         if isinstance(msg, bytes):
             msg = deserialize_binary_message(msg)
         else:
             msg = json.loads(msg)
         channel = msg.pop('channel', None)
         if channel is None:
             self.log.warn("No channel specified, assuming shell: %s", msg)
             channel = 'shell'
         if channel not in self.channels:
             self.log.warn("No such channel: %r", channel)
             return
         stream = self.channels[channel]
         self.session.send(stream, msg)
 
     def on_close(self):
         km = self.kernel_manager
         if self.kernel_id in km:
             km.remove_restart_callback(
                 self.kernel_id, self.on_kernel_restarted,
             )
             km.remove_restart_callback(
                 self.kernel_id, self.on_restart_failed, 'dead',
             )
         # This method can be called twice, once by self.kernel_died and once
         # from the WebSocket close event. If the WebSocket connection is
         # closed before the ZMQ streams are setup, they could be None.
         for channel, stream in self.channels.items():
             if stream is not None and not stream.closed():
                 stream.on_recv(None)
                 # close the socket directly, don't wait for the stream
                 socket = stream.socket
                 stream.close()
                 socket.close()
         
         self.channels = {}
 
     def _send_status_message(self, status):
         msg = self.session.msg("status",
             {'execution_state': status}
         )
         msg['channel'] = 'iopub'
         self.write_message(json.dumps(msg, default=date_default))
 
     def on_kernel_restarted(self):
         logging.warn("kernel %s restarted", self.kernel_id)
         self._send_status_message('restarting')
 
     def on_restart_failed(self):
         logging.error("kernel %s restarted failed!", self.kernel_id)
         self._send_status_message('dead')
 
 
 #-----------------------------------------------------------------------------
 # URL to handler mappings
 #-----------------------------------------------------------------------------
 
 
 _kernel_id_regex = r"(?P<kernel_id>\w+-\w+-\w+-\w+-\w+)"
 _kernel_action_regex = r"(?P<action>restart|interrupt)"
 
 default_handlers = [
     (r"/api/kernels", MainKernelHandler),
     (r"/api/kernels/%s" % _kernel_id_regex, KernelHandler),
     (r"/api/kernels/%s/%s" % (_kernel_id_regex, _kernel_action_regex), KernelActionHandler),
     (r"/api/kernels/%s/channels" % _kernel_id_regex, ZMQChannelsHandler),
 ]

IPython/html/services/kernels/tests/test_kernels_api.py

@@ -1,139 +1,141 b''
 """Test the kernels service API."""
 
 import json
 import requests
 
 from IPython.html.utils import url_path_join
 from IPython.html.tests.launchnotebook import NotebookTestBase, assert_http_error
 
 class KernelAPI(object):
     """Wrapper for kernel REST API requests"""
     def __init__(self, base_url):
         self.base_url = base_url
 
     def _req(self, verb, path, body=None):
         response = requests.request(verb,
                 url_path_join(self.base_url, 'api/kernels', path), data=body)
 
         if 400 <= response.status_code < 600:
             try:
                 response.reason = response.json()['message']
             except:
                 pass
         response.raise_for_status()
 
         return response
 
     def list(self):
         return self._req('GET', '')
 
     def get(self, id):
         return self._req('GET', id)
 
     def start(self, name='python'):
         body = json.dumps({'name': name})
         return self._req('POST', '', body)
 
     def shutdown(self, id):
         return self._req('DELETE', id)
 
     def interrupt(self, id):
         return self._req('POST', url_path_join(id, 'interrupt'))
 
     def restart(self, id):
         return self._req('POST', url_path_join(id, 'restart'))
 
 class KernelAPITest(NotebookTestBase):
     """Test the kernels web service API"""
     def setUp(self):
         self.kern_api = KernelAPI(self.base_url())
 
     def tearDown(self):
         for k in self.kern_api.list().json():
             self.kern_api.shutdown(k['id'])
 
     def test__no_kernels(self):
         """Make sure there are no kernels running at the start"""
         kernels = self.kern_api.list().json()
         self.assertEqual(kernels, [])
 
     def test_default_kernel(self):
         # POST request
         r = self.kern_api._req('POST', '')
         kern1 = r.json()
         self.assertEqual(r.headers['location'], '/api/kernels/' + kern1['id'])
         self.assertEqual(r.status_code, 201)
         self.assertIsInstance(kern1, dict)
 
         self.assertEqual(r.headers['Content-Security-Policy'], (
                             "frame-ancestors 'self'; "
                             "report-uri /api/security/csp-report;"
+                            "default-src 'none'"
         ))
 
     def test_main_kernel_handler(self):
         # POST request
         r = self.kern_api.start()
         kern1 = r.json()
         self.assertEqual(r.headers['location'], '/api/kernels/' + kern1['id'])
         self.assertEqual(r.status_code, 201)
         self.assertIsInstance(kern1, dict)
 
         self.assertEqual(r.headers['Content-Security-Policy'], (
                             "frame-ancestors 'self'; "
                             "report-uri /api/security/csp-report;"
+                            "default-src 'none'"
         ))
 
         # GET request
         r = self.kern_api.list()
         self.assertEqual(r.status_code, 200)
         assert isinstance(r.json(), list)
         self.assertEqual(r.json()[0]['id'], kern1['id'])
         self.assertEqual(r.json()[0]['name'], kern1['name'])
 
         # create another kernel and check that they both are added to the
         # list of kernels from a GET request
         kern2 = self.kern_api.start().json()
         assert isinstance(kern2, dict)
         r = self.kern_api.list()
         kernels = r.json()
         self.assertEqual(r.status_code, 200)
         assert isinstance(kernels, list)
         self.assertEqual(len(kernels), 2)
 
         # Interrupt a kernel
         r = self.kern_api.interrupt(kern2['id'])
         self.assertEqual(r.status_code, 204)
 
         # Restart a kernel
         r = self.kern_api.restart(kern2['id'])
         self.assertEqual(r.headers['Location'], '/api/kernels/'+kern2['id'])
         rekern = r.json()
         self.assertEqual(rekern['id'], kern2['id'])
         self.assertEqual(rekern['name'], kern2['name'])
 
     def test_kernel_handler(self):
         # GET kernel with given id
         kid = self.kern_api.start().json()['id']
         r = self.kern_api.get(kid)
         kern1 = r.json()
         self.assertEqual(r.status_code, 200)
         assert isinstance(kern1, dict)
         self.assertIn('id', kern1)
         self.assertEqual(kern1['id'], kid)
 
         # Request a bad kernel id and check that a JSON
         # message is returned!
         bad_id = '111-111-111-111-111'
         with assert_http_error(404, 'Kernel does not exist: ' + bad_id):
             self.kern_api.get(bad_id)
 
         # DELETE kernel with id
         r = self.kern_api.shutdown(kid)
         self.assertEqual(r.status_code, 204)
         kernels = self.kern_api.list().json()
         self.assertEqual(kernels, [])
 
         # Request to delete a non-existent kernel id
         bad_id = '111-111-111-111-111'
         with assert_http_error(404, 'Kernel does not exist: ' + bad_id):
             self.kern_api.shutdown(bad_id)

IPython/html/services/kernelspecs/handlers.py

@@ -1,86 +1,86 b''
 """Tornado handlers for kernel specifications."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 
 import glob
 import json
 import os
 pjoin = os.path.join
 
 from tornado import web
 
-from ...base.handlers import IPythonHandler, json_errors
+from ...base.handlers import APIHandler, json_errors
 from ...utils import url_path_join
 
 def kernelspec_model(handler, name):
     """Load a KernelSpec by name and return the REST API model"""
     ksm = handler.kernel_spec_manager
     spec = ksm.get_kernel_spec(name)
     d = {'name': name}
     d['spec'] = spec.to_dict()
     d['resources'] = resources = {}
     resource_dir = spec.resource_dir
     for resource in ['kernel.js', 'kernel.css']:
         if os.path.exists(pjoin(resource_dir, resource)):
             resources[resource] = url_path_join(
                 handler.base_url,
                 'kernelspecs',
                 name,
                 resource
             )
     for logo_file in glob.glob(pjoin(resource_dir, 'logo-*')):
         fname = os.path.basename(logo_file)
         no_ext, _ = os.path.splitext(fname)
         resources[no_ext] = url_path_join(
             handler.base_url,
             'kernelspecs',
             name,
             fname
         )
     return d
 
-class MainKernelSpecHandler(IPythonHandler):
+class MainKernelSpecHandler(APIHandler):
     SUPPORTED_METHODS = ('GET',)
 
     @web.authenticated
     @json_errors
     def get(self):
         ksm = self.kernel_spec_manager
         km = self.kernel_manager
         model = {}
         model['default'] = km.default_kernel_name
         model['kernelspecs'] = specs = {}
         for kernel_name in ksm.find_kernel_specs():
             try:
                 d = kernelspec_model(self, kernel_name)
             except Exception:
                 self.log.error("Failed to load kernel spec: '%s'", kernel_name, exc_info=True)
                 continue
             specs[kernel_name] = d
         self.set_header("Content-Type", 'application/json')
         self.finish(json.dumps(model))
 
 
-class KernelSpecHandler(IPythonHandler):
+class KernelSpecHandler(APIHandler):
     SUPPORTED_METHODS = ('GET',)
 
     @web.authenticated
     @json_errors
     def get(self, kernel_name):
         try:
             model = kernelspec_model(self, kernel_name)
         except KeyError:
             raise web.HTTPError(404, u'Kernel spec %s not found' % kernel_name)
         self.set_header("Content-Type", 'application/json')
         self.finish(json.dumps(model))
 
 
 # URL to handler mappings
 
 kernel_name_regex = r"(?P<kernel_name>\w+)"
 
 default_handlers = [
     (r"/api/kernelspecs", MainKernelSpecHandler),
     (r"/api/kernelspecs/%s" % kernel_name_regex, KernelSpecHandler),
 ]

IPython/html/services/nbconvert/handlers.py

@@ -1,26 +1,26 b''
 import json
 
 from tornado import web
 
-from ...base.handlers import IPythonHandler, json_errors
+from ...base.handlers import APIHandler, json_errors
 
-class NbconvertRootHandler(IPythonHandler):
+class NbconvertRootHandler(APIHandler):
     SUPPORTED_METHODS = ('GET',)
 
     @web.authenticated
     @json_errors
     def get(self):
         try:
             from IPython.nbconvert.exporters.export import exporter_map
         except ImportError as e:
             raise web.HTTPError(500, "Could not import nbconvert: %s" % e)
         res = {}
         for format, exporter in exporter_map.items():
             res[format] = info = {}
             info['output_mimetype'] = exporter.output_mimetype
 
         self.finish(json.dumps(res))
 
 default_handlers = [
     (r"/api/nbconvert", NbconvertRootHandler),
 ]
  No newline at end of file

IPython/html/services/security/handlers.py

@@ -1,23 +1,23 b''
 """Tornado handlers for security logging."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 
 from tornado import gen, web
 
-from ...base.handlers import IPythonHandler, json_errors
+from ...base.handlers import APIHandler, json_errors
 from . import csp_report_uri
 
-class CSPReportHandler(IPythonHandler):
+class CSPReportHandler(APIHandler):
     '''Accepts a content security policy violation report'''
     @web.authenticated
     @json_errors
     def post(self):
         '''Log a content security policy violation report'''
         csp_report = self.get_json_body()
         self.log.warn("Content security violation: %s",
                       self.request.body.decode('utf8', 'replace'))
 
 default_handlers = [
     (csp_report_uri, CSPReportHandler)
 ]

IPython/html/services/sessions/handlers.py

@@ -1,122 +1,122 b''
 """Tornado handlers for the sessions web service."""
 
 # Copyright (c) IPython Development Team.
 # Distributed under the terms of the Modified BSD License.
 
 import json
 
 from tornado import web
 
-from ...base.handlers import IPythonHandler, json_errors
+from ...base.handlers import APIHandler, json_errors
 from IPython.utils.jsonutil import date_default
 from IPython.html.utils import url_path_join, url_escape
 from IPython.kernel.kernelspec import NoSuchKernel
 
 
-class SessionRootHandler(IPythonHandler):
+class SessionRootHandler(APIHandler):
 
     @web.authenticated
     @json_errors
     def get(self):
         # Return a list of running sessions
         sm = self.session_manager
         sessions = sm.list_sessions()
         self.finish(json.dumps(sessions, default=date_default))
 
     @web.authenticated
     @json_errors
     def post(self):
         # Creates a new session
         #(unless a session already exists for the named nb)
         sm = self.session_manager
         cm = self.contents_manager
         km = self.kernel_manager
 
         model = self.get_json_body()
         if model is None:
             raise web.HTTPError(400, "No JSON data provided")
         try:
             path = model['notebook']['path']
         except KeyError:
             raise web.HTTPError(400, "Missing field in JSON data: notebook.path")
         try:
             kernel_name = model['kernel']['name']
         except KeyError:
             self.log.debug("No kernel name specified, using default kernel")
             kernel_name = None
 
         # Check to see if session exists
         if sm.session_exists(path=path):
             model = sm.get_session(path=path)
         else:
             try:
                 model = sm.create_session(path=path, kernel_name=kernel_name)
             except NoSuchKernel:
                 msg = ("The '%s' kernel is not available. Please pick another "
                        "suitable kernel instead, or install that kernel." % kernel_name)
                 status_msg = '%s not found' % kernel_name
                 self.log.warn('Kernel not found: %s' % kernel_name)
                 self.set_status(501)
                 self.finish(json.dumps(dict(message=msg, short_message=status_msg)))
                 return
 
         location = url_path_join(self.base_url, 'api', 'sessions', model['id'])
         self.set_header('Location', url_escape(location))
         self.set_status(201)
         self.finish(json.dumps(model, default=date_default))
 
-class SessionHandler(IPythonHandler):
+class SessionHandler(APIHandler):
 
     SUPPORTED_METHODS = ('GET', 'PATCH', 'DELETE')
 
     @web.authenticated
     @json_errors
     def get(self, session_id):
         # Returns the JSON model for a single session
         sm = self.session_manager
         model = sm.get_session(session_id=session_id)
         self.finish(json.dumps(model, default=date_default))
 
     @web.authenticated
     @json_errors
     def patch(self, session_id):
         # Currently, this handler is strictly for renaming notebooks
         sm = self.session_manager
         model = self.get_json_body()
         if model is None:
             raise web.HTTPError(400, "No JSON data provided")
         changes = {}
         if 'notebook' in model:
             notebook = model['notebook']
             if 'path' in notebook:
                 changes['path'] = notebook['path']
 
         sm.update_session(session_id, **changes)
         model = sm.get_session(session_id=session_id)
         self.finish(json.dumps(model, default=date_default))
 
     @web.authenticated
     @json_errors
     def delete(self, session_id):
         # Deletes the session with given session_id
         sm = self.session_manager
         try:
             sm.delete_session(session_id)
         except KeyError:
             # the kernel was deleted but the session wasn't!
             raise web.HTTPError(410, "Kernel deleted before session")
         self.set_status(204)
         self.finish()
 
 
 #-----------------------------------------------------------------------------
 # URL to handler mappings
 #-----------------------------------------------------------------------------
 
 _session_id_regex = r"(?P<session_id>\w+-\w+-\w+-\w+-\w+)"
 
 default_handlers = [
     (r"/api/sessions/%s" % _session_id_regex, SessionHandler),
     (r"/api/sessions",  SessionRootHandler)
 ]
 

IPython/html/terminal/api_handlers.py

@@ -1,44 +1,44 b''
 import json
 from tornado import web, gen
-from ..base.handlers import IPythonHandler, json_errors
+from ..base.handlers import APIHandler, json_errors
 from ..utils import url_path_join
 
-class TerminalRootHandler(IPythonHandler):
+class TerminalRootHandler(APIHandler):
     @web.authenticated
     @json_errors
     def get(self):
         tm = self.terminal_manager
         terms = [{'name': name} for name in tm.terminals]
         self.finish(json.dumps(terms))
 
     @web.authenticated
     @json_errors
     def post(self):
         """POST /terminals creates a new terminal and redirects to it"""
         name, _ = self.terminal_manager.new_named_terminal()
         self.finish(json.dumps({'name': name}))
 
 
-class TerminalHandler(IPythonHandler):
+class TerminalHandler(APIHandler):
     SUPPORTED_METHODS = ('GET', 'DELETE')
 
     @web.authenticated
     @json_errors
     def get(self, name):
         tm = self.terminal_manager
         if name in tm.terminals:
             self.finish(json.dumps({'name': name}))
         else:
             raise web.HTTPError(404, "Terminal not found: %r" % name)
 
     @web.authenticated
     @json_errors
     @gen.coroutine
     def delete(self, name):
         tm = self.terminal_manager
         if name in tm.terminals:
             yield tm.terminate(name, force=True)
             self.set_status(204)
             self.finish()
         else:
             raise web.HTTPError(404, "Terminal not found: %r" % name)