migrate from flask to quart.

also remove all flaskiness from static file serving.
and reference all vendored scripts on the base tempĺate for simplicity.

lnbits/app.py

@@ -1,27 +1,28 @@
 import importlib
 
-from flask import Flask, g
-from flask_assets import Bundle  # type: ignore
-from flask_cors import CORS  # type: ignore
-from flask_talisman import Talisman  # type: ignore
-from werkzeug.middleware.proxy_fix import ProxyFix
+from quart import Quart, g
+from quart_cors import cors  # type: ignore
+from quart_compress import Compress  # type: ignore
+from secure import SecureHeaders  # type: ignore
 
-from .commands import flask_migrate
+from .commands import db_migrate
 from .core import core_app
 from .db import open_db
-from .ext import assets, compress
 from .helpers import get_valid_extensions
 
+secure_headers = SecureHeaders(hsts=False)
 
-def create_app(config_object="lnbits.settings") -> Flask:
-    """Create application factory, as explained here: http://flask.pocoo.org/docs/patterns/appfactories/.
+
+def create_app(config_object="lnbits.settings") -> Quart:
+    """Create application factory.
     :param config_object: The configuration object to use.
     """
-    app = Flask(__name__, static_folder="static")
-    app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1, x_host=1)  # type: ignore
+    app = Quart(__name__, static_folder="static")
     app.config.from_object(config_object)
 
-    register_flask_extensions(app)
+    cors(app)
+    Compress(app)
+
     register_blueprints(app)
     register_filters(app)
     register_commands(app)
@@ -44,35 +45,11 @@ def register_blueprints(app) -> None:
 
 def register_commands(app):
     """Register Click commands."""
-    app.cli.add_command(flask_migrate)
-
-
-def register_flask_extensions(app):
-    """Register Flask extensions."""
-    """If possible we use the .init_app() option so that Blueprints can also use extensions."""
-    CORS(app)
-    Talisman(
-        app,
-        force_https=app.config["FORCE_HTTPS"],
-        content_security_policy={
-            "default-src": [
-                "'self'",
-                "'unsafe-eval'",
-                "'unsafe-inline'",
-                "blob:",
-                "api.opennode.co",
-            ]
-        },
-    )
-
-    assets.init_app(app)
-    assets.register("base_css", Bundle("scss/base.scss", filters="pyscss", output="css/base.css"))
-    compress.init_app(app)
+    app.cli.add_command(db_migrate)
 
 
 def register_filters(app):
     """Jinja filters."""
-    app.jinja_env.globals["DEBUG"] = app.config["DEBUG"]
     app.jinja_env.globals["EXTENSIONS"] = get_valid_extensions()
     app.jinja_env.globals["SITE_TITLE"] = app.config["LNBITS_SITE_TITLE"]
 
@@ -81,9 +58,14 @@ def register_request_hooks(app):
     """Open the core db for each request so everything happens in a big transaction"""
 
     @app.before_request
-    def before_request():
+    async def before_request():
         g.db = open_db()
 
+    @app.after_request
+    async def set_secure_headers(response):
+        secure_headers.quart(response)
+        return response
+
     @app.teardown_request
-    def after_request(exc):
+    async def after_request(exc):
         g.db.__exit__(type(exc), exc, None)