bazis 2.3.0__tar.gz → 2.3.2__tar.gz

{bazis-2.3.0 → bazis-2.3.2}/.github/workflows/release.yml

@@ -42,9 +42,12 @@ jobs:
             echo "::error::Tag v$VERSION already exists"
             exit 1
           fi
-          LAST_TAG=$(git tag --list 'v*' --sort=-v:refname | head -n 1)
+          # versionsort.suffix: a pre-release (v2.4.0-rc1) sorts before its release (v2.4.0)
+          LAST_TAG=$(git -c versionsort.suffix=- tag --list 'v*' --sort=-v:refname | head -n 1)
           echo "Last release: ${LAST_TAG:-none}, new release: v$VERSION"
-          if [ -n "$LAST_TAG" ] && [ "$(printf '%s\n%s\n' "${LAST_TAG#v}" "$VERSION" | sort -V | tail -n 1)" != "$VERSION" ]; then
+          # sort -V orders "~" before anything, as versionsort.suffix does with "-"
+          NEWEST=$(printf '%s\n%s\n' "${LAST_TAG#v}" "$VERSION" | sed 's/-/~/' | sort -V | tail -n 1)
+          if [ -n "$LAST_TAG" ] && [ "$NEWEST" != "${VERSION/-/\~}" ]; then
             echo "::error::Version $VERSION is not newer than $LAST_TAG"
             exit 1
           fi

{bazis-2.3.0 → bazis-2.3.2}/CLAUDE.md

@@ -43,3 +43,30 @@ Claude Code sessions cannot push tags. Release through the **Release** workflow
 
 Pick the version by semver: breaking changes (settings renamed or required, dependency
 removed, behavior changed) bump the minor version while the project is below 3.0.
+
+## The Bazis packages
+
+The framework is split into packages in separate repositories of `ecofuture-tech`, each with
+its own `CLAUDE.md`, Tests and Release workflows. Release them in dependency order (CI of a
+package installs its Bazis dependencies from PyPI):
+
+1. `bazis` → `bazis-test-utils`
+2. `bazis-users`, `bazis-ws`, `bazis-bulk`, `bazis-uploadable`
+3. `bazis-author`, `bazis-authing` (users) → `bazis-permit` (users, author for its tests)
+4. `bazis-statusy` (permit), `bazis-bg` (author)
+5. `bazis-async-background` (ws, Kafka) → `bazis-async-request`
+
+A package requires the versions of Bazis and of the sibling packages whose API or behavior it
+relies on (for example a security fix it builds on); new releases of the other packages do
+not raise the floors.
+
+Security boundaries that span packages:
+
+- Every way of changing an object must go through the checks of an update: the
+  relationships endpoints (`JsonapiRouteBase.relationships_change`) accept only the
+  relations of the update schema and call `hook_before/after_relationships_change`, which
+  bazis-permit uses.
+- Session JWTs (bazis-users) require `exp` and `sub`; on HTTP a token without `exp` (the
+  store token of bazis-authing) is anonymous, bazis-ws rejects it.
+- Anonymous WebSocket channels (bazis-ws) live under `user_ws:anon:`; bazis-async-background
+  resolves channels with the same functions.

{bazis-2.3.0 → bazis-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazis
-Version: 2.3.0
+Version: 2.3.2
 Summary: A JsonAPI framework based on Django + FastAPI + Pydantic.
 Author-email: Ilya Kharyn <ilya.tt07@gmail.com>
 Maintainer-email: Ilya Kharyn <ilya.tt07@gmail.com>
@@ -47,7 +47,7 @@ Requires-Dist: gunicorn>=23
 Requires-Dist: itsdangerous>=2.2
 Requires-Dist: jsonref>=1.1
 Provides-Extra: test
-Requires-Dist: bazis-test-utils>=2.2.0; extra == "test"
+Requires-Dist: bazis-test-utils>=2.3.0; extra == "test"
 Provides-Extra: dev
 Requires-Dist: ruff; extra == "dev"
 Dynamic: license-file

{bazis-2.3.0 → bazis-2.3.2}/bazis/core/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.3.0'
-__version_tuple__ = version_tuple = (2, 3, 0)
+__version__ = version = '2.3.2'
+__version_tuple__ = version_tuple = (2, 3, 2)
 
-__commit_id__ = commit_id = 'ga081a2388'
+__commit_id__ = commit_id = 'g4710cec49'

{bazis-2.3.0 → bazis-2.3.2}/bazis/core/routes_abstract/context.py

@@ -88,7 +88,7 @@ class RouteParams:
 class RouteContext:
     """
     An object of this class is a proxy wrapper for the route function.
-    After a method becomes a route through one of the http\_... decorators,
+    After a method becomes a route through one of the http_... decorators,
     accessing it returns a RouteContext object.
     This object stores references to the original method, routing parameters,
     the endpoint function, and the route's local storage.

bazis-2.3.2/bazis/core/routes_abstract/jsonapi/cache.py

@@ -0,0 +1,25 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from pydantic import BaseModel
+
+
+def with_cache_openapi_schema(schema: type[BaseModel], lang: str = None) -> dict:
+    """
+    Returns the OpenAPI (JSON) schema of a Pydantic model. Not cached: the schemas
+    themselves are cached (see `bazis.core.schemas.cache`).
+
+    Tags: RAG
+    """
+    return schema.model_json_schema()

{bazis-2.3.0 → bazis-2.3.2}/bazis/core/routes_abstract/jsonapi/route_base.py

@@ -32,6 +32,7 @@ from fastapi.responses import Response
 from pydantic import BaseModel, ValidationError
 
 from bazis.core.errors import (
+    JsonApi403Exception,
     JsonApiBazisError,
     JsonApiBazisException,
     JsonApiHttpException,
@@ -503,13 +504,7 @@ class JsonapiRouteBase(InitialRouteBase):
         Handles the HTTP POST request to add relationships.
         """
         if relationships_data.data:
-            self.relationships_service.apply_relationship_action(
-                action='add',
-                model=self.model,
-                item_id=item_id,
-                related_field_name=related_field_name,
-                relationships_data=relationships_data,
-            )
+            self.relationships_change('add', item_id, related_field_name, relationships_data)
         return Response(status_code=204)
 
     @http_patch(
@@ -528,13 +523,7 @@ class JsonapiRouteBase(InitialRouteBase):
         """
         Handles the HTTP PATCH request to update relationships.
         """
-        self.relationships_service.apply_relationship_action(
-            action='set',
-            model=self.model,
-            item_id=item_id,
-            related_field_name=related_field_name,
-            relationships_data=relationships_data,
-        )
+        self.relationships_change('set', item_id, related_field_name, relationships_data)
         return Response(status_code=204)
 
     @http_delete(
@@ -554,13 +543,7 @@ class JsonapiRouteBase(InitialRouteBase):
         Handles the HTTP DELETE request to remove relationships.
         """
         if relationships_data.data:
-            self.relationships_service.apply_relationship_action(
-                action='remove',
-                model=self.model,
-                item_id=item_id,
-                related_field_name=related_field_name,
-                relationships_data=relationships_data,
-            )
+            self.relationships_change('remove', item_id, related_field_name, relationships_data)
         return Response(status_code=204)
 
     @http_delete('/{item_id}/', inject_tags=[CrudApiAction.DESTROY], status_code=204)
@@ -717,6 +700,129 @@ class JsonapiRouteBase(InitialRouteBase):
         self.item.only_fields = only_fields
         return self.item
 
+    def relationships_change(
+        self,
+        action: str,
+        item_id: str,
+        related_field_name: str,
+        relationships_data: RelationshipData,
+    ):
+        """
+        Changes a relationship of an item (the relationships endpoints) with the same
+        checks as an update of the item: the item is taken through the route, the
+        relationship must be writable in the update schema of the route (for this user),
+        the `filter:` restrictions of the field apply, and the hooks
+        `hook_before_relationships_change` / `hook_after_relationships_change` run inside
+        the transaction.
+        """
+        with transaction.atomic(savepoint=False):
+            self.set_api_action(CrudApiAction.UPDATE)
+            item = self.set_item(str(item_id).strip())
+
+            data = self.relationships_validate(item, related_field_name, relationships_data)
+            self.relationships_restricts_check(item, data, related_field_name, action)
+
+            self.hook_before_relationships_change(item, data, related_field_name, action)
+            self.relationships_service.apply_relationship_action(
+                action=action,
+                model=self.model,
+                item_id=str(item.pk),
+                related_field_name=related_field_name,
+                relationships_data=relationships_data,
+            )
+            item.refresh_from_db()
+            self.hook_after_relationships_change(item, data, related_field_name, action)
+
+    def relationships_validate(
+        self, item: JsonApiMixin, related_field_name: str, relationships_data: RelationshipData
+    ) -> JsonApiDataSchema:
+        """
+        Validates the relationship data with the update schema of the route and returns
+        the validated item data. Fails with 403 if the relationship is not writable.
+        """
+        schema = self.schemas.get(CrudApiAction.UPDATE)
+        if schema is None:
+            raise JsonApi403Exception()
+
+        item_raw = {
+            'data': {
+                'id': str(item.pk),
+                'type': self.model.get_resource_label(),
+                'bs:action': CrudAccessAction.CHANGE.value,
+                'relationships': {
+                    related_field_name: relationships_data.model_dump(mode='json'),
+                },
+            }
+        }
+        try:
+            item_data = schema.model_validate(item_raw)
+        except ValidationError as e:
+            raise RequestValidationError(e.errors(), body=item_raw) from e
+
+        relationships = item_data.data.relationships
+        if relationships is None or related_field_name not in type(relationships).model_fields:
+            raise JsonApiBazisException(
+                JsonApiBazisError(
+                    detail=f'The relationship {related_field_name} cannot be changed',
+                    loc=('path', 'related_field_name'),
+                    code='ERR_RELATIONSHIP_READONLY',
+                    title='Relationship is read-only',
+                    status=403,
+                ),
+                status=403,
+            )
+        return item_data.data
+
+    def relationships_restricts_check(
+        self, item: JsonApiMixin, data: JsonApiDataSchema, related_field_name: str, action: str
+    ):
+        """
+        Applies the `filter:` restrictions of the field: the objects the action links and
+        unlinks must match them (an update keeps the linked objects that do not match).
+        """
+        field_info = item.get_fields_info().relations[related_field_name]
+        value = data.relationships.model_dump(exclude_unset=True)[related_field_name]
+        rel_model = field_info.related_model
+
+        if field_info.to_many:
+            # normalized as the primary keys of the database (e.g. a UUID in upper case)
+            ids = {
+                str(self.relationships_service._parse_id(it['id'], rel_model))
+                for it in (value.get('data') or [])
+            }
+            if action == 'set':
+                current = getattr(item, related_field_name).values_list('pk', flat=True)
+                ids ^= {str(pk) for pk in current}
+            if not ids:
+                return
+            touched = {'data': [{'id': pk} for pk in ids]}
+            allowed = data.check_restrict_m2m(related_field_name, touched, rel_model)
+            allowed_ids = {str(pk) for pk in allowed.values_list('pk', flat=True)}
+            if ids - allowed_ids:
+                raise JsonApi403Exception()
+        else:
+            f_pk = None if action == 'remove' else (value.get('data') or {}).get('id')
+            if not data.check_restrict_rel(related_field_name, f_pk, rel_model, instance=item):
+                raise JsonApi403Exception()
+
+    def hook_before_relationships_change(
+        self, item: JsonApiMixin, data: JsonApiDataSchema, related_field_name: str, action: str
+    ):
+        """
+        Hook method called before a relationship of the item is changed through the
+        relationships endpoints. Can be overridden to add custom checks.
+        """
+        pass
+
+    def hook_after_relationships_change(
+        self, item: JsonApiMixin, data: JsonApiDataSchema, related_field_name: str, action: str
+    ):
+        """
+        Hook method called after a relationship of the item is changed through the
+        relationships endpoints (inside the transaction).
+        """
+        pass
+
     def hook_before_create(self, item: JsonApiMixin):
         """
         Hook method called before creating an item. Can be overridden to add custom

{bazis-2.3.0 → bazis-2.3.2}/bazis/core/schemas/cache.py

@@ -33,30 +33,18 @@ from typing import Any
 from pydantic import BaseModel
 
 
-__all__ = [
-    'DEFAULT_SCHEMA_CACHE_TTL',
-    'SCHEMAS_CACHE',
-    'TTLCache',
-    'get_schema_cache_ttl',
-    'get_schema_from_cache',
-    'set_schema_to_cache',
-]
-
-DEFAULT_SCHEMA_CACHE_TTL = 3600
-
-
 def get_schema_cache_ttl() -> float:
     """
     Returns the idle lifetime of the cached schemas in seconds from the settings.
     """
     from django.conf import settings
 
-    return getattr(settings, 'BAZIS_SCHEMA_CACHE_TTL', DEFAULT_SCHEMA_CACHE_TTL)
+    return settings.BAZIS_SCHEMA_CACHE_TTL
 
 
 class TTLCache:
     """
-    Thread-safe dictionary-like cache that evicts entries not accessed for the TTL.
+    Thread-safe cache that evicts entries not accessed for the TTL.
 
     :param ttl: Idle lifetime in seconds, or a callable returning it; 0 disables eviction.
     :param on_evict: Optional callback called with the key and value of an evicted entry.
@@ -91,30 +79,11 @@ class TTLCache:
             self._data[key] = (value, now)
             return value
 
-    def __getitem__(self, key: str) -> Any:
-        marker = object()
-        value = self.get(key, marker)
-        if value is marker:
-            raise KeyError(key)
-        return value
-
     def __setitem__(self, key: str, value: Any) -> None:
         with self._lock:
             self._data[key] = (value, time.monotonic())
             self._sweep()
 
-    def __contains__(self, key: str) -> bool:
-        marker = object()
-        return self.get(key, marker) is not marker
-
-    def __len__(self) -> int:
-        return len(self._data)
-
-    def clear(self) -> None:
-        with self._lock:
-            for key in list(self._data):
-                self._evict(key)
-
     def _evict(self, key: str) -> None:
         value, _ = self._data.pop(key)
         if self._on_evict:

{bazis-2.3.0 → bazis-2.3.2}/bazis/core/schemas/schemas.py

@@ -81,7 +81,7 @@ class JsonApiDataSchema(BaseModel):
                 restrict_q = QueryToOrm(restricts, f_model).q
                 # if a value was previously set in the relation and the user has no access to it,
                 # then the action is not allowed
-                if instance and (rel_val := getattr(instance, f_name)):
+                if instance and (rel_val := getattr(instance, f_name, None)):
                     if not f_model.objects.filter(restrict_q & Q(pk=rel_val.pk)).exists():
                         return False
 

{bazis-2.3.0 → bazis-2.3.2}/bazis/core/schemas/validators.py

@@ -20,8 +20,6 @@ from pydantic import (
     ValidationInfo,
 )
 
-from typing_extensions import deprecated
-
 from bazis.core.models_abstract import InitialBase
 
 from .utils import get_types
@@ -55,9 +53,6 @@ def not_blank_validator(cls: type[BaseModel], v: Any, field: ValidationInfo):
     return v
 
 
-@deprecated(
-    'disabled because there are transition-type operations that require mandatory fields, which may well be read-only'
-)
 def readonly_validator(cls: type[BaseModel], values: Any):
     """
     Validator to remove read-only fields from the values if the schema action does

{bazis-2.3.0 → bazis-2.3.2}/bazis.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazis
-Version: 2.3.0
+Version: 2.3.2
 Summary: A JsonAPI framework based on Django + FastAPI + Pydantic.
 Author-email: Ilya Kharyn <ilya.tt07@gmail.com>
 Maintainer-email: Ilya Kharyn <ilya.tt07@gmail.com>
@@ -47,7 +47,7 @@ Requires-Dist: gunicorn>=23
 Requires-Dist: itsdangerous>=2.2
 Requires-Dist: jsonref>=1.1
 Provides-Extra: test
-Requires-Dist: bazis-test-utils>=2.2.0; extra == "test"
+Requires-Dist: bazis-test-utils>=2.3.0; extra == "test"
 Provides-Extra: dev
 Requires-Dist: ruff; extra == "dev"
 Dynamic: license-file

{bazis-2.3.0 → bazis-2.3.2}/bazis.egg-info/SOURCES.txt

@@ -125,6 +125,8 @@ docs/_templates/custom-class-template.rst
 docs/_templates/custom-module-template.rst
 docs/releases/2.2.9.md
 docs/releases/2.3.0.md
+docs/releases/2.3.1.md
+docs/releases/2.3.2.md
 sample/generate_local_test_data.py
 sample/main.py
 sample/manage.py
@@ -185,6 +187,7 @@ tests/conftest.py
 tests/factories.py
 tests/test_core_config.py
 tests/test_models.py
+tests/test_relationships_access.py
 tests/test_routes_add.py
 tests/test_routes_change.py
 tests/test_routes_core.py

{bazis-2.3.0 → bazis-2.3.2}/bazis.egg-info/requires.txt

@@ -29,4 +29,4 @@ jsonref>=1.1
 ruff
 
 [test]
-bazis-test-utils>=2.2.0
+bazis-test-utils>=2.3.0

{bazis-2.3.0 → bazis-2.3.2}/bazis.egg-info/scm_file_list.json

@@ -109,6 +109,8 @@
     "docs/relationships.rst",
     "docs/releases/2.2.9.md",
     "docs/releases/2.3.0.md",
+    "docs/releases/2.3.1.md",
+    "docs/releases/2.3.2.md",
     "docs/requirements.txt",
     "docs/response_models.rst",
     "docs/routes.rst",
@@ -179,6 +181,7 @@
     "tests/factories.py",
     "tests/test_core_config.py",
     "tests/test_models.py",
+    "tests/test_relationships_access.py",
     "tests/test_routes_add.py",
     "tests/test_routes_change.py",
     "tests/test_routes_core.py",

bazis-2.3.2/bazis.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "2.3.2",
+  "distance": 0,
+  "node": "g4710cec4942971cfb3ea5b49042c0cc142a664a5",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-10-01"
+}

bazis-2.3.2/docs/releases/2.3.1.md

@@ -0,0 +1,29 @@
+# Bazis 2.3.1
+
+## Security
+
+- **The relationships endpoints changed any relation of any object.**
+  `POST/PATCH/DELETE /{id}/relationships/{name}` loaded the object directly from the model
+  and changed the relation named in the URL, without the checks of an update: the route
+  queryset, the update schema of the route (which relations are exposed and writable),
+  the `filter:` restrictions of the fields, and the checks of permission routes. For
+  example, any authenticated user could add himself to Django groups with all permissions
+  (`/users/user/<id>/relationships/groups`), and in projects with bazis-permit assign
+  himself any role or change objects he cannot change.
+
+  The endpoints now take the object through the route and accept only the relations of
+  the update schema of the route (for the current user); other names fail with 403 and
+  `ERR_RELATIONSHIP_READONLY`. The `filter:` restrictions apply to added and set objects,
+  and the change runs in a transaction between the new hooks
+  `hook_before_relationships_change` and `hook_after_relationships_change`, which
+  bazis-permit 2.3 uses for its checks. Unknown relation names fail with 403 instead
+  of 500.
+
+  A project that changed relations through these endpoints which its routes do not expose
+  must add them to the update schema of the route (`fields` for `CrudApiAction.UPDATE`).
+
+## Fixes
+
+- `readonly_validator` was marked as deprecated while the schema builders use it, which
+  emitted a `DeprecationWarning` on every validated request.
+- An invalid escape sequence in a docstring emitted a `SyntaxWarning` on import.

bazis-2.3.2/docs/releases/2.3.2.md

@@ -0,0 +1,27 @@
+# Bazis 2.3.2
+
+## Security
+
+- **The relationships endpoints did not apply the `filter:` restrictions to the unlinked
+  objects** (2.3.1 checked only the added and set ones). `DELETE /{id}/relationships/{name}`
+  removed objects the user may not touch, `PATCH` unlinked the objects left out of the
+  list, and `DELETE` of a to-one relation cleared a value the user could not change with an
+  update. Every object an action links or unlinks must now match the restrictions;
+  otherwise the request fails with 403. The objects a `PATCH` keeps are not checked.
+  (An update of the item keeps the linked objects that do not match the restrictions; the
+  relationships `PATCH` refuses to unlink them.)
+
+## Changes
+
+- Ids of missing objects in a relationships request fail with 403 (since 2.3.1 for `POST` and
+  `PATCH`, now also for `DELETE`); malformed ids fail with 400.
+- A response to a request with `include` is validated with the response schema of the
+  resource for every action, not only for retrieve (since 2.3.0).
+- `with_cache_openapi_schema` no longer stores the schemas it returns: the cache was never
+  read and only held memory. `TTLCache` keeps only the methods the schema cache uses.
+
+## Release
+
+- The Release workflow refused a release after its pre-release (`2.4.0` after
+  `2.4.0-rc1`): the versions are now compared with pre-releases before releases.
+- The `test` extra requires bazis-test-utils 2.3.

{bazis-2.3.0 → bazis-2.3.2}/pyproject.toml

@@ -64,7 +64,7 @@ dependencies = [
 
 [project.optional-dependencies]
 test = [
-    "bazis-test-utils>=2.2.0"
+    "bazis-test-utils>=2.3.0"
 ]
 dev = [
     "ruff",

{bazis-2.3.0 → bazis-2.3.2}/sample/entity/routes.py

@@ -17,6 +17,7 @@ from django.apps import apps
 from sample.route_mixins import ContextTestRouteMixin
 
 from bazis.core.routes_abstract.jsonapi import JsonapiRouteBase
+from bazis.core.schemas.enums import CrudApiAction
 from bazis.core.schemas.fields import SchemaField, SchemaFields
 
 
@@ -73,6 +74,13 @@ class ParentEntityRouteSet(JsonapiRouteBase):
                 ),
             },
         ),
+        # writable through the relationships endpoints in the tests
+        CrudApiAction.UPDATE: SchemaFields(
+            include={
+                'extended_entity_null': None,
+                'dependent_entities_null': None,
+            },
+        ),
     }
 
 

bazis-2.3.2/tests/test_relationships_access.py

@@ -0,0 +1,72 @@
+# Copyright 2026 EcoFuture Technology Services LLC and contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""
+The relationships endpoints change only the relationships the update schema of the route
+exposes, with the checks of an update.
+"""
+
+import json
+
+import pytest
+from bazis_test_utils.utils import get_api_client
+
+from tests import factories
+
+
+@pytest.mark.django_db(transaction=True)
+def test_relationship_not_in_schema_is_rejected(sample_app):
+    child = factories.ChildEntityFactory.create()
+    other_child = factories.ChildEntityFactory.create()
+    protected = factories.WithProtectedEntityFactory.create(child=other_child)
+    payload = {'data': [{'type': 'entity.with_protected_entity', 'id': str(protected.id)}]}
+    url = f'/api/v1/entity/child_entity/{child.id}/relationships/withprotectedentity_set'
+
+    client = get_api_client(sample_app)
+    for method in ('POST', 'PATCH', 'DELETE'):
+        response = client.client.request(method, url, headers=client.headers, json=payload)
+        assert response.status_code == 403, method
+        assert response.json()['errors'][0]['code'] == 'ERR_RELATIONSHIP_READONLY'
+
+    protected.refresh_from_db()
+    assert protected.child_id == other_child.id
+
+
+@pytest.mark.django_db(transaction=True)
+def test_unknown_relationship_is_rejected(sample_app):
+    child = factories.ChildEntityFactory.create()
+    response = get_api_client(sample_app).patch(
+        f'/api/v1/entity/child_entity/{child.id}/relationships/unknown',
+        data=json.dumps({'data': []}),
+    )
+    assert response.status_code == 403
+
+
+@pytest.mark.django_db(transaction=True)
+def test_relationship_of_missing_item(sample_app):
+    response = get_api_client(sample_app).patch(
+        '/api/v1/entity/child_entity/9b657232-4178-4d7f-8b0c-e8ab16f2b309/relationships/parent_entities',
+        data=json.dumps({'data': []}),
+    )
+    assert response.status_code == 404
+
+
+@pytest.mark.django_db(transaction=True)
+def test_relationship_of_invalid_type_is_rejected(sample_app):
+    child = factories.ChildEntityFactory.create()
+    response = get_api_client(sample_app).patch(
+        f'/api/v1/entity/child_entity/{child.id}/relationships/parent_entities',
+        data=json.dumps({'data': {'type': 'entity.parent_entity', 'id': 'not-a-list'}}),
+    )
+    assert response.status_code == 422

{bazis-2.3.0 → bazis-2.3.2}/tests/test_schema_cache.py

@@ -48,9 +48,8 @@ def test_ttl_cache_evicts_idle_entries(monkeypatch):
     # adding entries sweeps expired ones at most once per TTL
     clock.now += 11
     cache['c'] = 3
-    assert 'a' not in cache._data
+    assert list(cache._data) == ['c']
     assert evicted == ['b', 'a']
-    assert len(cache) == 1
 
 
 def test_ttl_cache_zero_ttl_never_evicts(monkeypatch):
@@ -61,8 +60,8 @@ def test_ttl_cache_zero_ttl_never_evicts(monkeypatch):
     cache['a'] = 1
     clock.now += 10**9
     cache['b'] = 2
-    assert cache['a'] == 1
-    assert len(cache) == 2
+    assert cache.get('a') == 1
+    assert list(cache._data) == ['a', 'b']
 
 
 def test_evicted_schema_is_removed_from_module(monkeypatch):