GeneralManager 0.89.0__tar.gz → 0.89.1__tar.gz

{generalmanager-0.89.0/src/GeneralManager.egg-info → generalmanager-0.89.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.89.0
+Version: 0.89.1
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.89.0 → generalmanager-0.89.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "GeneralManager"
-version = "0.89.0"
+version = "0.89.1"
 description = "Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching."
 readme = "README.md"
 authors = [{ name = "Tim Kleindick", email = "tkleindick@yahoo.de" }]

{generalmanager-0.89.0 → generalmanager-0.89.1/src/GeneralManager.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GeneralManager
-Version: 0.89.0
+Version: 0.89.1
 Summary: Modular Django-based data management framework with ORM, GraphQL, fine-grained permissions, rule validation, calculations and caching.
 Author-email: Tim Kleindick <tkleindick@yahoo.de>
 License: MIT License

{generalmanager-0.89.0 → generalmanager-0.89.1}/src/general_manager/api/graphql_query_permissions.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from collections.abc import Iterable
 from dataclasses import dataclass, field
 from inspect import getattr_static
-from typing import TYPE_CHECKING, cast
+from typing import TYPE_CHECKING
 
 from graphql import GraphQLError
 
@@ -412,6 +412,7 @@ def authorize_query_fields(
     from general_manager.api.graphql_resolvers import (
         can_read_instance,
         check_read_permission,
+        relation_id_alias_target_fields,
     )
 
     normalized = set()
@@ -518,20 +519,10 @@ def authorize_query_fields(
                 raise GraphQLError(_RELATION_ERROR)
             if not can_read_instance(value, info):
                 raise QueryRelationPermissionError()
-            from django.db import models
-            from general_manager.interface.orm_interface import OrmInterfaceBase
-
-            orm_interface = cast(
-                type[OrmInterfaceBase[models.Model]], instance.Interface
-            )
-            foreign_key = orm_interface._model._meta.get_field(relation)
-            target_field = getattr(foreign_key, "target_field", None)
-            if not isinstance(target_field, models.Field):
+            target_names = relation_id_alias_target_fields(instance.Interface, relation)
+            if not target_names:
                 raise GraphQLError(_RELATION_ERROR)
-            target_names = {target_field.name}
-            if target_field.primary_key:
-                target_names.add("id")
-            for target_name in sorted(target_names):
+            for target_name in target_names:
                 check(value, (target_name,))
         if not rest and not (native_node and native_node.children):
             return

{generalmanager-0.89.0 → generalmanager-0.89.1}/src/general_manager/api/graphql_resolvers.py

@@ -86,6 +86,7 @@ from general_manager.utils.executable_contract import (
 
 if TYPE_CHECKING:
     from graphene import ResolveInfo as GraphQLResolveInfo
+    from general_manager.interface.base_interface import InterfaceBase
     from general_manager.api.graphql_errors import (
         GraphQLResolveInfo as ReadPermissionInfo,
     )
@@ -1355,6 +1356,29 @@ def relation_id_alias_field(
     return relation_field
 
 
+def relation_id_alias_target_fields(
+    interface: type[InterfaceBase], relation_field: str
+) -> tuple[str, ...]:
+    """Return the target field names protected by a native ORM alias."""
+    from django.core.exceptions import FieldDoesNotExist
+    from django.db import models
+    from general_manager.interface.orm_interface import OrmInterfaceBase
+
+    if not safe_issubclass(interface, OrmInterfaceBase):
+        return ()
+    orm_interface = cast(type[OrmInterfaceBase[models.Model]], interface)
+    try:
+        foreign_key = orm_interface._model._meta.get_field(relation_field)
+    except FieldDoesNotExist:
+        return ()
+    target_field = getattr(foreign_key, "target_field", None)
+    if not isinstance(target_field, models.Field):
+        return ()
+    if target_field.primary_key and target_field.name != "id":
+        return tuple(sorted((target_field.name, "id")))
+    return (target_field.name,)
+
+
 def _unwrap_optional_annotation(annotation: object) -> object:
     origin = get_origin(annotation)
     if origin is Annotated:

{generalmanager-0.89.0 → generalmanager-0.89.1}/src/general_manager/search/authorization.py

@@ -35,7 +35,11 @@ def analyze_search_projection(
 ) -> SearchProjectionAuthorization:
     """Inspect definitions once, without evaluating a permission or property."""
     from general_manager.api.graphql_relations import resolve_general_manager_type
-    from general_manager.api.graphql_resolvers import relation_id_alias_field
+    from general_manager.api.graphql_resolvers import (
+        relation_id_alias_field,
+        relation_id_alias_target_fields,
+    )
+    from general_manager.api.graphql_value_contract import _manager_source
     from general_manager.permission.manager_based_permission import (
         additional_local_read_permission,
     )
@@ -87,9 +91,31 @@ def analyze_search_projection(
             if alias is not None:
                 inspect_permission(owner, alias, frozenset())
                 has_relations = True
-                # The alias target leaf is checked at runtime; retain the
-                # thorough path until its complete field policy is known.
-                reasons.add("relation identity alias")
+                target = resolve_general_manager_type(
+                    owner.Interface.get_attribute_types()[alias].get("type"), registry
+                )
+                target_fields = relation_id_alias_target_fields(owner.Interface, alias)
+                if (
+                    target is None
+                    or not target_fields
+                    or not _manager_source(owner, alias)
+                ):
+                    reasons.add("unknown relation identity target")
+                    continue
+                for target_field in target_fields:
+                    known, _ = source_field_annotation(target, target_field)
+                    if (
+                        not known
+                        or relation_id_alias_field(
+                            target, target_field, native_source=True
+                        )
+                        is not None
+                    ):
+                        reasons.add("unknown relation identity target")
+                    else:
+                        inspect_permission(target, target_field, frozenset())
+                # Retain the exact alias path for the runtime target-row check.
+                continue
             _, annotation = source_field_annotation(owner, field)
             target = resolve_general_manager_type(annotation, registry)
             if target is not None: