@cursor review

Summary

This PR introduces the experimental App class (streamlit.starlette.App), enabling Streamlit applications to run as standard ASGI apps. This allows for integration with uvicorn, custom middleware, and other ASGI frameworks like FastAPI. The PR also includes:

• AST-based discovery logic in the CLI (discover_asgi_app) to automatically detect and run st.App instances.
• A new starlette_routes module implementing Streamlit's core endpoints using Starlette.
• Refactoring of bootstrap.py to support the ASGI execution mode.
• Comprehensive unit tests and a basic E2E test.

Code Quality

The code quality is excellent.

• Modularity: The new App class is well-isolated and properly interacts with the existing Runtime. The separation between the App definition, route handling, and server logic is clear.
• Typing: Type hints are used consistently throughout the new files.
• Readability: The code is well-documented with docstrings explaining the purpose of the new classes and functions.
• Safety: The discover_asgi_app uses ast.parse instead of executing code, which is the correct and safe approach for static analysis.

Test Coverage

Test coverage is robust:

• Unit Tests: lib/tests/streamlit/web/server/starlette/starlette_app_test.py covers the App lifecycle, configuration, route validation, and integration with the TestClient. lib/tests/streamlit/web/server/app_discovery_test.py covers the AST parsing logic thoroughly, including edge cases.
• E2E Tests: e2e_playwright/asgi_app.py provides a smoke test ensuring the app runs without console errors in the browser.

Backwards Compatibility

The changes are backwards compatible:

• The new functionality is experimental and opt-in (via st.App).
• The standard streamlit run command continues to work as expected for existing scripts.
• The discover_asgi_app mechanism falls back to the traditional execution mode if no App instance is found.

Security & Risk

• XSRF & CORS: The new starlette_routes.py correctly implements XSRF protection and CORS header generation, mirroring the behavior of the Tornado implementation.
• Path Traversal: The component routes use build_safe_abspath to prevent directory traversal attacks.
• Input Validation: The App class validates user-provided routes to prevent conflicts with reserved Streamlit paths.

Recommendations

1. File Upload Memory Usage: In lib/streamlit/web/server/starlette/starlette_routes.py, the _upload_put handler reads the entire file content into memory (await upload.read()). While this matches the MemoryUploadedFileManager backend, ensure this aligns with the intended memory usage profile for the ASGI mode, especially for large file uploads (up to server.maxUploadSize).
2. Documentation: Since this is an experimental feature, ensure it is marked as such in the public documentation when released. The code docstrings already include appropriate warnings.

Verdict

APPROVED: The PR implements a significant new feature with high code quality, strong test coverage, and careful attention to existing patterns and security requirements.

Nice work @lukasmasuch