Bloomerp 1.0.0.dev12__tar.gz → 1.0.0.dev14__tar.gz

{bloomerp-1.0.0.dev12 → bloomerp-1.0.0.dev14}/Bloomerp.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Bloomerp
-Version: 1.0.0.dev12
+Version: 1.0.0.dev14
 Summary: Bloomerp is an open-source Business Management Software framework that lets you create fully functional business management applications just by defining your Django database models.
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown

{bloomerp-1.0.0.dev12 → bloomerp-1.0.0.dev14}/Bloomerp.egg-info/SOURCES.txt

@@ -803,6 +803,7 @@ bloomerp/views/access_control/policy_list.py
 bloomerp/views/access_control/update.py
 bloomerp/views/api/__init__.py
 bloomerp/views/api/access_control.py
+bloomerp/views/api/auth.py
 bloomerp/views/api/workflow_webhook.py
 bloomerp/views/api/sql/__init__.py
 bloomerp/views/api/sql/accessible_tables.py

{bloomerp-1.0.0.dev12 → bloomerp-1.0.0.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Bloomerp
-Version: 1.0.0.dev12
+Version: 1.0.0.dev14
 Summary: Bloomerp is an open-source Business Management Software framework that lets you create fully functional business management applications just by defining your Django database models.
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown

bloomerp-1.0.0.dev14/bloomerp/config/definition.py

@@ -0,0 +1,83 @@
+from typing import Literal, Optional
+
+from pydantic import BaseModel, Field
+
+
+class SessionAuthSettings(BaseModel):
+    enabled: bool = True
+    login_identifier: Literal["username", "email", "custom"] = "username"
+    custom_identifier_field: str | None = None
+    user_fields: list[str] = Field(
+        default_factory=lambda: ["id", "username", "email", "first_name", "last_name"]
+    )
+
+    def get_identifier_field_name(self) -> str:
+        if self.login_identifier == "custom":
+            return str(self.custom_identifier_field or "identifier")
+        return self.login_identifier
+
+
+class BearerAuthSettings(BaseModel):
+    enabled: bool = False
+
+
+class ApiKeyAuthSettings(BaseModel):
+    enabled: bool = False
+    header_name: str = "X-API-Key"
+
+
+class AuthorizationAuthSettings(BaseModel):
+    enabled: bool = False
+
+
+class CustomAuthSettings(BaseModel):
+    enabled: bool = False
+    name: str = "custom"
+
+
+class BloomerpAuthSettings(BaseModel):
+    session: SessionAuthSettings = Field(default_factory=SessionAuthSettings)
+    bearer: BearerAuthSettings = Field(default_factory=BearerAuthSettings)
+    api_key: ApiKeyAuthSettings = Field(default_factory=ApiKeyAuthSettings)
+    authorization: AuthorizationAuthSettings = Field(default_factory=AuthorizationAuthSettings)
+    custom: CustomAuthSettings = Field(default_factory=CustomAuthSettings)
+
+    def enabled_strategy_types(self) -> list[str]:
+        strategies: list[tuple[str, bool]] = [
+            ("session", self.session.enabled),
+            ("bearer", self.bearer.enabled),
+            ("apiKey", self.api_key.enabled),
+            ("authorization", self.authorization.enabled),
+            ("custom", self.custom.enabled),
+        ]
+        return [strategy_type for strategy_type, enabled in strategies if enabled]
+
+    def is_strategy_enabled(self, strategy_type: str) -> bool:
+        return strategy_type in self.enabled_strategy_types()
+
+class BloomerpConfig(BaseModel):
+    """
+    Configuration class to be set on the settings. This contains all the necessary configurable settings for bloomerp.
+
+    Settings are:
+    - **auto_generate_api_endpoints** : whether to automatically generate API endpoints for all models. If True, API endpoints will be generated for all models in the application. If False, no API endpoints will be generated. If None, API endpoints will be generated for all models that do not have a custom API endpoint defined. Note that this can be overridden on a per model basis by setting the `auto_generate_api_endpoint` attribute on the model's configuration.
+    - **vite_dev_server_url**: the URL of the Vite development server. This is used for hot module replacement (HMR) during development. The default value is 'http://localhost:5173'. This setting is only used if BLOOMERP_VITE_DEV_SERVER_URL is not set in the settings.
+
+    Usage (in settings.py)
+    ```python
+    from bloomerp.config.definition import BloomerpConfig
+
+    bloomerp_config = BloomerpConfig(
+        ...
+    )
+    ```
+    """
+
+    auto_generate_api_endpoints : bool = True
+
+    vite_dev_server_url : Optional[str] = 'http://localhost:5173'
+
+    auth: BloomerpAuthSettings = Field(default_factory=BloomerpAuthSettings)
+    
+
+

{bloomerp-1.0.0.dev12 → bloomerp-1.0.0.dev14}/bloomerp/models/definition.py

@@ -19,12 +19,88 @@ class ApiFilterRule(BaseModel):
 
 
 class PublicAccessRule(BaseModel):
-    actions: list[Literal["list", "read"]] = Field(
+    """A public access rule defines in which cases objects can be accessed via the
+    auto generated API without authentication.
+
+    For example, we might want to expose a `BlogPost` model publicly so that
+    anonymous users can list and read published posts, while drafts remain
+    private. That would look something like this:
+    ```python
+    rule = PublicAccessRule(
+        field_actions={
+            "title": ["list", "read"],
+            "slug": ["list", "read"],
+            "summary": ["list", "read"],
+            "content": ["read"],
+        },
+        row_actions=["list", "read"],
+        filters=[
+            ApiFilterRule(
+                field="status",
+                operator="equals",
+                value="published",
+            )
+        ],
+    )
+    ```
+    In the above case, anonymous users are able to list and read blog posts
+    whose `status == "published"`, while only the configured fields are exposed
+    for each action.
+
+    In the case that we want to expose a narrower public listing than the public
+    detail view, that would look something like this:
+    ```python
+    rule = PublicAccessRule(
+        field_actions={
+            "title": ["list", "read"],
+            "slug": ["list", "read"],
+            "summary": ["list"],
+            "content": ["read"],
+        },
+        row_actions=["list", "read"],
+        filters=[
+            ApiFilterRule(
+                field="is_archived",
+                operator="not_equals",
+                value=True,
+            )
+        ],
+    )
+    ```
+    In the above case, anonymous users can still list and read the object, but
+    the list response is limited to `title`, `slug`, and `summary`, while the
+    read response can additionally include `content`. The filter ensures that
+    archived objects stay out of the public API.
+    """
+    row_actions: list[Literal["list", "read"]] = Field(
         default_factory=lambda: ["list", "read"]
     )
-    fields: list[str] | Literal["__all__"] = "__all__"
+    field_actions: dict[str | Literal["__all__"], list[Literal["list", "read"]] | Literal["__all__"]] = Field(
+        default_factory=lambda: {"__all__": "__all__"}
+    )
     filters: list[ApiFilterRule] = Field(default_factory=list)
 
+    def get_row_actions(self) -> list[str]:
+        return list(self.row_actions)
+
+    def get_accessible_fields(self, action: str) -> set[str] | None:
+        normalized_action = str(action or "").strip().lower()
+        wildcard_actions = self.field_actions.get("__all__")
+        if wildcard_actions == "__all__" or (
+            isinstance(wildcard_actions, list) and normalized_action in wildcard_actions
+        ):
+            return None
+
+        allowed_fields: set[str] = set()
+        for field_name, actions in self.field_actions.items():
+            if field_name == "__all__":
+                continue
+            if actions == "__all__" or (
+                isinstance(actions, list) and normalized_action in actions
+            ):
+                allowed_fields.add(field_name)
+        return allowed_fields
+
 class UserAccessRule(BaseModel):
     """A user access rule defines in which cases users can access an object via the api. The through field serves as the entry point for the user access definition. Note that user access rules only apply to the auto generated API's.
 
@@ -73,18 +149,20 @@ class ApiSettings(BaseModel):
         - enable_auto_generation: defines whether API endpoints are autogenerated for this model. Defaults to False
         - public_access: defines read/list exceptions for public API access
         - user_access: defines exceptions for public API access
+        - public_access_for_authenticated_fallback: whether there should be a fallback to potential public access if the user can't/fails to authenticate
     """
 
     enable_auto_generation: bool = False
     public_access: list[PublicAccessRule] = Field(default_factory=list)
     user_access:list[UserAccessRule] = Field(default_factory=list)
+    public_access_for_authenticated_fallback: bool = True
 
     def get_public_access_rules(self, action: str) -> list[PublicAccessRule]:
         normalized_action = str(action or "").strip().lower()
         return [
             rule
             for rule in self.public_access
-            if normalized_action in rule.actions
+            if normalized_action in rule.get_row_actions()
         ]
 
     def get_user_access_rules(self, action: str) -> list[UserAccessRule]:

{bloomerp-1.0.0.dev12 → bloomerp-1.0.0.dev14}/bloomerp/sdk/base.py

@@ -5,8 +5,10 @@ from dataclasses import asdict, dataclass
 from pathlib import Path
 
 from django.apps import apps
+from django.conf import settings
 from django.db import models
 
+from bloomerp.config.definition import BloomerpConfig
 from bloomerp.models.application_field import ApplicationField
 from bloomerp.models.definition import BloomerpModelConfig
 from bloomerp.utils.models import model_name_plural_underline
@@ -36,6 +38,8 @@ class SdkModelDefinition:
     pk_type: str
     python_pk_type: str
     fields: list[SdkFieldDefinition]
+    capabilities: dict
+    public_access: dict
 
 
 class BaseSdkGenerator(ABC):
@@ -88,6 +92,15 @@ class BaseSdkGenerator(ABC):
     def get_model_definitions(self) -> list[SdkModelDefinition]:
         return [self.build_model_definition(model) for model in self.get_api_models()]
 
+    def get_bloomerp_config(self) -> BloomerpConfig:
+        config = getattr(settings, "BLOOMERP_CONFIG", None)
+        if isinstance(config, BloomerpConfig):
+            return config
+        return BloomerpConfig()
+
+    def get_enabled_auth_strategy_types(self) -> list[str]:
+        return self.get_bloomerp_config().auth.enabled_strategy_types()
+
     def get_api_models(self) -> list[type[models.Model]]:
         api_models: list[type[models.Model]] = []
         for model in apps.get_models():
@@ -104,6 +117,8 @@ class BaseSdkGenerator(ABC):
         return api_models
 
     def build_model_definition(self, model: type[models.Model]) -> SdkModelDefinition:
+        config = getattr(model, "bloomerp_config", None)
+        public_access = self.build_public_access_metadata(config)
         return SdkModelDefinition(
             class_name=model.__name__,
             variable_name=self.to_camel_case(model_name_plural_underline(model)),
@@ -111,6 +126,15 @@ class BaseSdkGenerator(ABC):
             pk_type=self.get_ts_type_for_field(model._meta.pk),
             python_pk_type=self.get_python_type_for_field(model._meta.pk),
             fields=self.get_field_definitions(model),
+            capabilities={
+                "list": True,
+                "retrieve": True,
+                "create": True,
+                "update": True,
+                "partialUpdate": True,
+                "destroy": True,
+            },
+            public_access=public_access,
         )
 
     def get_field_definitions(self, model: type[models.Model]) -> list[SdkFieldDefinition]:
@@ -256,6 +280,38 @@ class BaseSdkGenerator(ABC):
             "tsType": payload["ts_type"],
         }
 
+    def build_public_access_metadata(self, config: BloomerpModelConfig | None) -> dict:
+        list_fields = self.get_public_accessible_fields(config, "list")
+        read_fields = self.get_public_accessible_fields(config, "read")
+        return {
+            "listAllowed": bool(config and config.get_public_access_rules("list")),
+            "readAllowed": bool(config and config.get_public_access_rules("read")),
+            "listFields": list_fields,
+            "readFields": read_fields,
+            "authenticatedFallbackEnabled": bool(
+                getattr(getattr(config, "api_settings", None), "public_access_for_authenticated_fallback", True)
+            ),
+        }
+
+    def get_public_accessible_fields(
+        self, config: BloomerpModelConfig | None, action: str
+    ) -> list[str] | None:
+        if config is None:
+            return []
+
+        rules = config.get_public_access_rules(action)
+        if not rules:
+            return []
+
+        allowed_fields: set[str] = set()
+        for rule in rules:
+            rule_fields = rule.get_accessible_fields(action)
+            if rule_fields is None:
+                return None
+            allowed_fields.update(rule_fields)
+
+        return sorted(allowed_fields)
+
     def to_camel_case(self, value: str) -> str:
         parts = [part for part in value.replace("-", "_").split("_") if part]
         if not parts: