GeneralManager 0.86.3__tar.gz → 0.86.5__tar.gz

{generalmanager-0.86.3/src/GeneralManager.egg-info → generalmanager-0.86.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.86.3
+Version: 0.86.5
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.86.3 → generalmanager-0.86.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "GeneralManager"
-version = "0.86.3"
+version = "0.86.5"
 description = "Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching."
 readme = "README.md"
 authors = [{ name = "Tim Kleindick", email = "tkleindick@yahoo.de" }]

{generalmanager-0.86.3 → generalmanager-0.86.5/src/GeneralManager.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.86.3
+Version: 0.86.5
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.86.3 → generalmanager-0.86.5}/src/general_manager/interface/requests.py

@@ -5,19 +5,22 @@ from __future__ import annotations
 from abc import ABC, abstractmethod
 import base64
 from dataclasses import dataclass, field
+from email.message import Message
 import json
 import random
 from types import MappingProxyType
 import time
 from urllib.error import HTTPError, URLError
 from urllib.parse import quote, urlencode, urlsplit
-from urllib.request import Request as UrlRequest, urlopen as stdlib_urlopen
+from urllib.request import HTTPRedirectHandler, Request as UrlRequest, build_opener
 from uuid import uuid4
 from typing import (
     Callable,
+    IO,
     Iterable,
     Literal,
     Mapping,
+    NoReturn,
     Protocol,
     TypeVar,
     TypedDict,
@@ -1893,12 +1896,42 @@ def map_request_transport_error(
     return mapped
 
 
+class _NoRedirectHandler(HTTPRedirectHandler):
+    """Leave redirect responses to the normal HTTP error handling path."""
+
+    def http_error_302(
+        self,
+        req: UrlRequest,
+        fp: IO[bytes],
+        code: int,
+        msg: str,
+        headers: Message,
+    ) -> NoReturn:
+        # Reject before urllib parses Location, preserving malformed responses too.
+        raise HTTPError(req.full_url, code, msg, headers, fp)
+
+    http_error_301 = http_error_302
+    http_error_303 = http_error_302
+    http_error_307 = http_error_302
+    http_error_308 = http_error_302
+
+
 class UrllibRequestTransport(SharedRequestTransport):
     """First-party JSON transport backed by Python's stdlib HTTP client.
 
     The transport supports absolute HTTP(S) URLs, JSON request bodies, decoded
     JSON object/list responses, operation-level timeout overrides, and HTTP
-    status mapping through `RequestTransportStatusError`.
+    status mapping through `RequestTransportStatusError`. The default opener
+    rejects redirects, including same-origin redirects, instead of forwarding
+    credentials or accessing response-controlled destinations. An injected
+    `urlopen` callable is responsible for its own redirect policy.
+
+    The default opener does not inherit handlers registered globally with
+    `urllib.request.install_opener`; environment proxy settings still apply.
+    For custom TLS contexts or explicit proxy handlers, build an opener with
+    those handlers plus redirect rejection and pass its `open` method as
+    `urlopen`. Reject 301/302/303/307/308 before parsing `Location` to preserve
+    the upstream status and headers even when that header is malformed.
     """
 
     def __init__(
@@ -1907,7 +1940,9 @@ class UrllibRequestTransport(SharedRequestTransport):
         urlopen: UrlopenCallable | None = None,
         json_dumps: Callable[[object], str] | None = None,
     ) -> None:
-        self._urlopen = urlopen or stdlib_urlopen
+        self._urlopen = urlopen or cast(
+            UrlopenCallable, build_opener(_NoRedirectHandler()).open
+        )
         self._json_dumps = json_dumps or json.dumps
 
     def send(

{generalmanager-0.86.3 → generalmanager-0.86.5}/src/general_manager/permission/manager_based_permission.py

@@ -220,6 +220,20 @@ class _ConfiguredManagerPermission(BasePermission):
             return None
 
         basis_object = getattr(self.instance, __based_on__, notExistent)
+        normalized_basis = False
+        if (
+            isinstance(self.instance, PermissionDataManager)
+            and isinstance(self.instance.permission_data, dict)
+            and self.instance.manager is not None
+            and f"{__based_on__}_id" in self.instance.permission_data
+        ):
+            field_type = self.instance.manager.Interface.get_field_type(__based_on__)
+            if isinstance(field_type, type) and issubclass(field_type, GeneralManager):
+                # Match ORM payload normalization: the last relation alias wins.
+                for key, value in self.instance.permission_data.items():
+                    if key in (__based_on__, f"{__based_on__}_id"):
+                        basis_object = value
+                        normalized_basis = key != __based_on__
         if (
             basis_object is not None
             and basis_object is not notExistent
@@ -232,6 +246,24 @@ class _ConfiguredManagerPermission(BasePermission):
                 if isinstance(basis_object, dict):
                     basis_object = field_type(**basis_object)
                 else:
+                    if normalized_basis:
+                        from django.db.models import ForeignKey
+                        from general_manager.interface.orm_interface import (
+                            OrmInterfaceBase,
+                        )
+
+                        interface = self.instance.manager.Interface
+                        if issubclass(interface, OrmInterfaceBase):
+                            relation = interface._model._meta.get_field(__based_on__)
+                            if (
+                                isinstance(relation, ForeignKey)
+                                and not relation.target_field.primary_key
+                            ):
+                                # A normalized FK value can target a unique non-PK field.
+                                related = relation.related_model._default_manager.get(
+                                    **{relation.target_field.name: basis_object}
+                                )
+                                basis_object = related.pk
                     basis_object = field_type(id=basis_object)
         if basis_object is notExistent:
             if self._is_class_context:

{generalmanager-0.86.3 → generalmanager-0.86.5}/src/general_manager/permission/permission_data_manager.py

@@ -110,7 +110,11 @@ class PermissionDataManager(Generic[GeneralManagerData]):
         Returns:
             Wrapper exposing the merged permission state.
         """
-        merged_data: dict[str, object] = {**dict(base_data), **update_data}
+        # Keep explicit updates after existing state, including relation aliases.
+        merged_data: dict[str, object] = {
+            key: value for key, value in base_data if key not in update_data
+        }
+        merged_data.update(update_data)
         return cls(merged_data, base_data.__class__)
 
     @property