Do not serialize passwords

Author: schloerke

shiny/input_handler.py

@@ -1,16 +1,18 @@
 from __future__ import annotations
 
-__all__ = ("input_handlers",)
-
 from datetime import date, datetime, timezone
 from typing import TYPE_CHECKING, Any, Callable, Dict
 
+from .bookmark import serializer_unserializable
+
 if TYPE_CHECKING:
     from .session import Session
 
 from .module import ResolvedId
 from .types import ActionButtonValue
 
+__all__ = ("input_handlers",)
+
 InputHandlerType = Callable[[Any, ResolvedId, "Session"], Any]
 
 
@@ -91,6 +93,10 @@ def _(value, name, session):
     return "mypackage.intify";
 }
 ```
+
+See Also
+--------
+* :class:`~shiny.session.Inputs`'s `.set_serializer(info: InputSerializerInfo)` method for determining how an object can be serialized for bookmarking.
 """
 
 
@@ -150,15 +156,50 @@ def _(value: str, name: ResolvedId, session: Session) -> str:
     return value
 
 
-# TODO: implement when we have bookmarking
-# TODO: Barret: Input handler for passwords
 @input_handlers.add("shiny.password")
 def _(value: str, name: ResolvedId, session: Session) -> str:
+    # Never bookmark passwords
+    session.input.set_serializer(name, serializer_unserializable)
+
     return value
 
 
-# TODO: implement when we have bookmarking
-# TODO: Barret: Input handler for file inputs
 @input_handlers.add("shiny.file")
 def _(value: Any, name: ResolvedId, session: Session) -> Any:
+
+    # This function is only used when restoring a Shiny ui.input_file.
+    # When a file is uploaded the usual way, it takes a different code path and won't
+    # hit this function.
+    if value is None:
+        return None
+
+    # TODO: Barret: Input handler for file inputs
+
+    # # The data will be a named list of lists; convert to a data frame.
+    # val <- as.data.frame(lapply(val, unlist), stringsAsFactors = FALSE)
+
+    # # `val$datapath` should be a filename without a path, for security reasons.
+    # if (basename(val$datapath) != val$datapath) {
+    #   stop("Invalid '/' found in file input path.")
+    # }
+
+    # # Prepend the persistent dir
+    # oldfile <- file.path(getCurrentRestoreContext()$dir, val$datapath)
+
+    # # Copy the original file to a new temp dir, so that a restored session can't
+    # # modify the original.
+    # newdir <- file.path(tempdir(), createUniqueId(12))
+    # dir.create(newdir)
+    # val$datapath <- file.path(newdir, val$datapath)
+    # file.copy(oldfile, val$datapath)
+
+    # # Need to mark this input value with the correct serializer. When a file is
+    # # uploaded the usual way (instead of being restored), this occurs in
+    # # session$`@uploadEnd`.
+    # setSerializer(name, serializerFileInput)
+
+    # snapshotPreprocessInput(name, snapshotPreprocessorFileInput)
+
+    # val
+
     return value