base-api-utils 1.1.117.dev3__tar.gz → 1.1.117.dev4__tar.gz

{base_api_utils-1.1.117.dev3/src/base_api_utils.egg-info → base_api_utils-1.1.117.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: base-api-utils
-Version: 1.1.117.dev3
+Version: 1.1.117.dev4
 Summary: Django Rest Framework micro services common utilities
 Author-email: Román Gutierrez <roman@tipit.net>, Sebastian Marcet <sebastian@tipit.net>
 Project-URL: Homepage, https://github.com/fntechgit/base-api-utils

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.117.dev4}/pyproject.toml

@@ -7,7 +7,7 @@ where = ["src"]
 
 [project]
 name = "base-api-utils"
-version = "1.1.117.dev3"
+version = "1.1.117.dev4"
 dependencies = [
     "boto3",
     "celery",

base_api_utils-1.1.117.dev4/src/base_api_utils/__init__.py

@@ -0,0 +1,11 @@
+def __getattr__(name: str):
+    # Lazy import: loading private_tasks_admin_patterns eagerly chains through
+    # views → tasks_result_view → @extend_schema → DEFAULT_SCHEMA_CLASS,
+    # which causes a circular import when any consumer of this package is
+    # itself imported as DEFAULT_SCHEMA_CLASS (e.g. a custom AutoSchema
+    # subclass that inherits from base_api_utils.utils.CustomAutoSchema).
+    if name == "private_tasks_admin_patterns":
+        from .urls import private_tasks_admin_patterns
+
+        return private_tasks_admin_patterns
+    raise AttributeError(f"module 'base_api_utils' has no attribute {name!r}")

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.117.dev4}/src/base_api_utils/serializers/v2/abstract_serializer.py

@@ -133,6 +133,16 @@ class AbstractSerializer:
         # here and let the deeper constraints apply at child serializers.
         has_explicit_leaf = any(not subtree for subtree in ft.values())
         if not has_explicit_leaf:
+            af = self._merged_allowed_fields()
+            if af is not None:
+                allowed_keep = (
+                    set(af)
+                    | set(ctx.get("expand_tree", {}).keys())
+                    | set(ctx.get("relations_tree", {}).keys())
+                )
+                for k in list(fields.keys()):
+                    if k not in allowed_keep:
+                        fields.pop(k, None)
             return fields
         keep = (
             set(ft.keys())

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.117.dev4/src/base_api_utils.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: base-api-utils
-Version: 1.1.117.dev3
+Version: 1.1.117.dev4
 Summary: Django Rest Framework micro services common utilities
 Author-email: Román Gutierrez <roman@tipit.net>, Sebastian Marcet <sebastian@tipit.net>
 Project-URL: Homepage, https://github.com/fntechgit/base-api-utils

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.117.dev4}/tests/test_lazy_imports.py

@@ -56,3 +56,37 @@ class TestExpandQuerysetOptimizationMixinImports:
 
         # query_params should NOT be loaded at module level
         assert "base_api_utils.serializers.v2.query_params" not in sys.modules
+
+
+@pytest.mark.unit
+class TestBaseApiUtilsInitLazyImport:
+    """Regression: importing base_api_utils must NOT eagerly load
+    urls → views → tasks_result_view → @extend_schema → DEFAULT_SCHEMA_CLASS.
+    That chain causes a circular import when base_api_utils is imported by
+    a custom AutoSchema subclass that is itself registered as DEFAULT_SCHEMA_CLASS.
+
+    private_tasks_admin_patterns must be accessible but only materialised on
+    first attribute access, not at package-import time.
+    """
+
+    def test_import_base_api_utils_does_not_load_views(self):
+        """Importing the package must not pull in views/tasks_result_view."""
+        for key in list(sys.modules):
+            if key.startswith("base_api_utils"):
+                del sys.modules[key]
+
+        _base_dir = Path(__file__).resolve().parent.parent / "src" / "base_api_utils"
+        _load_module("base_api_utils", _base_dir / "__init__.py")
+
+        assert "base_api_utils.views" not in sys.modules
+        assert "base_api_utils.views.tasks_result_view" not in sys.modules
+        assert "base_api_utils.urls" not in sys.modules
+
+    def test_private_tasks_admin_patterns_accessible_via_getattr(self):
+        """private_tasks_admin_patterns is reachable even with the lazy import."""
+        import base_api_utils  # noqa: F401 — confirm attribute exists when accessed
+        # We can't resolve the attribute without Django apps ready (Django model
+        # registration); confirming the __getattr__ path exists is sufficient here.
+        assert hasattr(type(sys.modules["base_api_utils"]), "__getattr__") or callable(
+            getattr(sys.modules["base_api_utils"], "__getattr__", None)
+        )

{base_api_utils-1.1.117.dev3 → base_api_utils-1.1.117.dev4}/tests/test_v2_abstract_serializer.py

@@ -140,3 +140,61 @@ class TestFilterLocalFieldsEmptyOrMissing:
         fields = {"id": object(), "name": object()}
         result = s._filter_local_fields(fields)
         assert set(result.keys()) == {"id", "name"}
+
+
+@pytest.mark.unit
+class TestFilterLocalFieldsAllowedFieldsWithNavigation:
+    """Regression (Copilot r3229018506): navigation-only fields_tree must still
+    respect allowed_fields defined on a subclass, not expose every DRF field."""
+
+    def _make(self, fields_tree, allowed_fields_list=None, expand_tree=None, relations_tree=None):
+        class _Serializer(AbstractSerializer):
+            pass
+        if allowed_fields_list is not None:
+            _Serializer.allowed_fields = allowed_fields_list
+        s = object.__new__(_Serializer)
+        s._original_context = {
+            "fields_tree": fields_tree,
+            "expand_tree": expand_tree or {},
+            "relations_tree": relations_tree or {},
+        }
+        return s
+
+    def test_navigation_only_respects_allowed_fields(self):
+        """?fields=sample_configuration_types.id on a serializer with restricted
+        allowed_fields must not expose fields outside the allowed set."""
+        s = self._make(
+            fields_tree={"sample_configuration_types": {"id": {}}},
+            allowed_fields_list=["id", "name", "sample_configuration_types"],
+        )
+        fields = {
+            "id": object(),
+            "name": object(),
+            "sample_configuration_types": object(),
+            "internal_notes": object(),
+            "draft_flag": object(),
+        }
+        result = s._filter_local_fields(fields)
+        assert set(result.keys()) == {"id", "name", "sample_configuration_types"}
+
+    def test_navigation_key_not_in_allowed_fields_is_stripped(self):
+        """A navigation key absent from allowed_fields is dropped when
+        allowed_fields is configured and no scalar leaf exists at this level."""
+        s = self._make(
+            fields_tree={"foo": {"bar": {}}},
+            allowed_fields_list=["id", "name"],
+        )
+        fields = {"id": object(), "name": object(), "foo": object(), "secret": object()}
+        result = s._filter_local_fields(fields)
+        assert set(result.keys()) == {"id", "name"}
+
+    def test_navigation_only_without_allowed_fields_returns_all(self):
+        """When allowed_fields is None, navigation-only fields_tree preserves
+        all fields — existing behaviour for unrestricted serializers unchanged."""
+        s = self._make(
+            fields_tree={"foo": {"bar": {}}},
+            allowed_fields_list=None,
+        )
+        fields = {"id": object(), "name": object(), "foo": object()}
+        result = s._filter_local_fields(fields)
+        assert set(result.keys()) == {"id", "name", "foo"}

base_api_utils-1.1.117.dev3/src/base_api_utils/__init__.py

@@ -1 +0,0 @@
-from .urls import private_tasks_admin_patterns  # noqa: F401