bd-editor 0.1.0__tar.gz

bd_editor-0.1.0/Agents.md

@@ -0,0 +1,87 @@
+# Agent and contributor guide
+
+## Project boundaries
+
+BD-Editor is an installable Django application, distributed as `bd-editor` and
+imported as `bd_editor`. Keep runtime Python dependencies small. Browser assets
+must be bundled with the package; do not load scripts or styles from a CDN.
+Package metadata and build configuration live in `pyproject.toml`; the
+public-facing overview is `README.md`.
+
+## Important modules
+
+- `bd_editor/conf.py` validates built-in, global, and per-app settings.
+- `bd_editor/sanitizer.py` owns HTML cleaning and plain-text helpers.
+- `bd_editor/fields.py` applies sanitization to the Django model field.
+- `bd_editor/uploads.py` contains the optional Pillow image pipeline.
+- `bd_editor/locale/` stores editor JSON labels and Django message catalogs.
+- `frontend/src/editor.js` is the Tiptap-based browser editor source. Build its
+  local static bundle before packaging.
+- Keep document typography and color styles scoped to the editor content
+  surface, separate from Django admin styles.
+- `bd_editor/static/bd_editor/THIRD_PARTY_NOTICES.txt` includes bundled
+  frontend component licenses.
+- The public two-app demo lives under `demo/`; its localized article index,
+  configuration descriptions, and Django catalogs are source-distribution
+  content, not runtime package dependencies.
+
+## Security invariants
+
+- Treat editor input, pasted HTML, URLs, uploaded files, and settings as
+  untrusted.
+- Enforce the HTML allowlist on the server with the selected `nh3` sanitizer.
+  Never allow `script` elements,
+  inline event handlers, executable URL schemes, arbitrary iframes, or video
+  uploads.
+- Embeds must be normalized for explicitly supported providers. Do not accept
+  arbitrary iframe hosts or user-provided iframe permissions.
+- Restrict CSS to a safe property allowlist; never allow CSS capable of loading
+  remote resources.
+- Validate images by their decoded content, size, and pixel dimensions. Use
+  generated storage names rather than client-supplied paths.
+- Optional editor drafts are stored only in browser localStorage and must stay
+  opt-in with a documented expiration and shared-browser privacy warning.
+- Persist the demo's development `SECRET_KEY` in its gitignored key file so
+  autoreloads preserve sessions. Production mode must require an explicit
+  `DJANGO_SECRET_KEY`.
+- Protect image uploads with CSRF, an active staff check, and add/change
+  permission for the associated model.
+- Only mark sanitized output safe in the dedicated template integration.
+  Document that raw SQL and direct database writes bypass Django field
+  validation.
+- Invalid security-sensitive configuration must raise a clear error; do not
+  silently widen an allowlist or fall back to unsafe output.
+
+## Development workflow
+
+- Python package metadata is in `pyproject.toml`; Django code lives in
+  `bd_editor/`.
+- Frontend source and its lockfile live in `frontend/`; generated, locally
+  bundled assets belong under `bd_editor/static/bd_editor/`.
+- Run focused tests with `python -m pytest`.
+- The current compatibility matrix covers Django 5.2, 6.0, and 6.1 on valid
+  Python versions; do not test unsupported Python/Django pairs.
+- Build and inspect distributions with `python -m build` and
+  `python -m twine check dist/*`.
+- Build frontend assets with `npm --prefix frontend run build`.
+- Regenerate bundled license notices with
+  `python scripts/generate_third_party_notices.py` after changing frontend
+  dependencies.
+- Compile Django message catalogs with `python scripts/compile_translations.py`.
+- Demo UI templates and localized catalogs live under `demo/templates/` and
+  `demo/locale/`; the catalog compiler handles both demo and package messages.
+- Keep compatibility tests limited to valid Django/Python combinations.
+- Add English comments for non-obvious security and integration decisions, not
+  for routine code.
+- After each meaningful implementation milestone, update both `Agents.md` and
+  `Progress.md` before moving to the next milestone.
+
+## Release checklist
+
+- Run tests and linting, build frontend assets, build wheel and sdist, inspect
+  bundled static files, and verify package metadata.
+- Compile locale catalogs and regenerate third-party license notices after
+  changing translations or frontend dependencies.
+- Retain notices for all bundled third-party assets and confirm the selected
+  packages' licenses before upgrading them.
+- Do not publish a release or upload credentials as part of local validation.

bd_editor-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 BD-Editor contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bd_editor-0.1.0/MANIFEST.in

@@ -0,0 +1,13 @@
+include Agents.md
+include LICENSE
+include Progress.md
+include README.md
+include pyproject.toml
+recursive-include bd_editor *.css *.html *.js *.json *.mo *.po *.py *.txt
+recursive-include demo *.md *.py *.html *.css *.po *.mo
+recursive-include docs *.md
+recursive-include frontend *.js *.json *.md
+recursive-include scripts *.py
+prune frontend/node_modules
+prune frontend/dist
+global-exclude __pycache__ *.py[cod] *.db *.sqlite3

bd_editor-0.1.0/PKG-INFO

@@ -0,0 +1,101 @@
+Metadata-Version: 2.4
+Name: bd-editor
+Version: 0.1.0
+Summary: A secure, configurable rich-text editor for Django admin and forms.
+Author: BD-Editor contributors
+License-Expression: MIT
+Keywords: django,editor,rich-text,admin,sanitization
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: Django :: 6.1
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django<6.2,>=5.2
+Requires-Dist: nh3>=0.2.18
+Provides-Extra: images
+Requires-Dist: Pillow>=10.4; extra == "images"
+Provides-Extra: test
+Requires-Dist: build>=1.2; extra == "test"
+Requires-Dist: Pillow>=10.4; extra == "test"
+Requires-Dist: polib>=1.2; extra == "test"
+Requires-Dist: pytest>=8.3; extra == "test"
+Requires-Dist: pytest-django>=4.10; extra == "test"
+Requires-Dist: twine>=6.0; extra == "test"
+Provides-Extra: i18n
+Requires-Dist: polib>=1.2; extra == "i18n"
+Provides-Extra: lint
+Requires-Dist: ruff>=0.9; extra == "lint"
+Dynamic: license-file
+
+# BD-Editor
+
+BD-Editor is a configurable rich-text editor for Django admin and forms. It
+provides a bundled editor UI, server-side HTML sanitization, per-app toolbar
+settings and toolbar presets, editable HTML tables, optional browser drafts,
+modal link/image editing, text and highlight color palettes, image format and
+quality selection, and allowlisted video embeds.
+
+The PyPI distribution is named `bd-editor`; import it as `bd_editor`.
+
+## Install
+
+```shell
+pip install bd-editor
+```
+
+For image upload and conversion support:
+
+```shell
+pip install "bd-editor[images]"
+```
+
+## Quick start
+
+1. Add `bd_editor` to `INSTALLED_APPS`.
+2. Add `path("bd-editor/", include("bd_editor.urls"))` to the root URLconf.
+3. Use `bd_editor.fields.RichTextField` on a model. Django admin and
+   `ModelForm` will use the bundled editor widget automatically.
+4. Configure global and app-specific editor behavior in `BD_EDITOR`.
+
+See [the documentation](docs/en/quickstart.md) for a runnable example,
+configuration reference, localization, and security model. A two-app example
+project with localized article listings and live configuration explanations
+is in [demo/](demo/).
+
+## Security boundary
+
+The editing interface uses JavaScript, but submitted content is sanitized on
+the server and does not permit executable scripts, inline event handlers,
+unsafe URL schemes, or arbitrary iframes. Script-like examples entered in code
+blocks are escaped text. Images are validated from their decoded content;
+video uploads are rejected. Image uploads require CSRF protection and a staff
+user with add/change permission for the associated model.
+
+No Django library can intercept direct SQL or writes made outside Django's
+validated ORM paths. Applications must still render through BD-Editor's
+sanitizing template integration and must not mark untrusted values safe
+themselves. See [the security guide](docs/en/security.md).
+
+## Development status
+
+The project is under active development. See [Progress.md](Progress.md) for
+milestones and [Agents.md](Agents.md) for development and security invariants.
+
+## License
+
+BD-Editor is released under the MIT license. Bundled third-party components
+retain their own copyright and license notices.

bd_editor-0.1.0/Progress.md

@@ -0,0 +1,68 @@
+# BD-Editor progress
+
+## Current status
+
+- Milestone 1: complete.
+- Milestone 2: complete.
+- Milestone 3: complete.
+- Milestone 4: complete.
+- Milestone 5: complete.
+- Milestone 6: complete.
+- Follow-up admin and demo UX changes: complete.
+- Demo autoreload session-key fix: complete.
+- Editor content-style isolation, full-width layout, and color palettes: complete.
+
+## Completed milestones
+
+- Added the initial PyPI metadata, MIT license, package entry point, and
+  contributor/security guide.
+- Implemented validated global/per-app settings, HTML helpers, the
+  `RichTextField`, form/widget integration, uploads and embeds.
+- Added focused sanitizer, ORM, form, CSRF, model-permission, and
+  image-conversion tests.
+- Built and headlessly smoke-tested the local Tiptap editor, including toolbar,
+  source mode, and inert script-like code samples.
+- Added English/Turkish editor strings and Django catalogs.
+- Added the two-app demo, migrations, English/Turkish guides, and Django
+  catalog compilation. The demo passes Django checks and migrations.
+- Built and validated the universal wheel and source distribution; Twine
+  metadata checks pass and the wheel contains the required static, template,
+  and localization assets.
+- The 35-test suite passes on Python 3.14 with Django 6.1.3; the
+  earlier 20-test suite also passed on Django 5.2.19, 6.0.10, and
+  6.1.3. CI is configured for the supported Python/Django combinations.
+- Added `small`, `standard`, and `full` toolbar presets with app-level
+  overrides, editable HTML tables, and an opt-in localStorage draft setting.
+- Added icon-based CKEditor-style toolbar rows, modal link/image/video/table
+  workflows, and server-validated per-upload image format/quality choices.
+- Added focused tests for profile resolution, table attributes, and image
+  format/quality selection.
+- Prevented Enter in image/link/embed/table dialog inputs from implicitly
+  submitting the containing admin form; verified image upload by keyboard in
+  Django admin without navigating away or saving the article.
+- Added a bilingual demo homepage with combined sanitized article listings,
+  actual global/app configuration snippets, and localized explanations.
+- Verified English/Turkish demo views, app article detail, and Turkish admin
+  editor in a live browser.
+- The demo now persists its generated development secret to the ignored
+  `demo/.secret_key` file; production mode requires `DJANGO_SECRET_KEY`.
+- Added regression checks for stable development keys, empty key files, and
+  production startup without an explicit key.
+- The final source distribution includes both localized demo catalogs,
+  templates, and static assets; Twine metadata checks and archive-content
+  verification both pass.
+- Replaced the demo's per-process random development key with a stable
+  gitignored local key file and made an explicit environment key mandatory in
+  production.
+- Added settings regression tests for reload stability and production-key
+  requirements.
+- Scoped neutral article typography to the editor surface, increased its
+  width to fill its form field, and added accessible foreground/highlight color
+  palettes backed by the server's CSS allowlist.
+
+## Known boundaries
+
+- Django-managed ORM and form write paths are validated; raw SQL and direct
+  database writes cannot be intercepted by the package.
+- Image processing will be an optional Pillow extra. Video uploads are not
+  supported; only configured video embeds will be accepted.

bd_editor-0.1.0/README.md

@@ -0,0 +1,58 @@
+# BD-Editor
+
+BD-Editor is a configurable rich-text editor for Django admin and forms. It
+provides a bundled editor UI, server-side HTML sanitization, per-app toolbar
+settings and toolbar presets, editable HTML tables, optional browser drafts,
+modal link/image editing, text and highlight color palettes, image format and
+quality selection, and allowlisted video embeds.
+
+The PyPI distribution is named `bd-editor`; import it as `bd_editor`.
+
+## Install
+
+```shell
+pip install bd-editor
+```
+
+For image upload and conversion support:
+
+```shell
+pip install "bd-editor[images]"
+```
+
+## Quick start
+
+1. Add `bd_editor` to `INSTALLED_APPS`.
+2. Add `path("bd-editor/", include("bd_editor.urls"))` to the root URLconf.
+3. Use `bd_editor.fields.RichTextField` on a model. Django admin and
+   `ModelForm` will use the bundled editor widget automatically.
+4. Configure global and app-specific editor behavior in `BD_EDITOR`.
+
+See [the documentation](docs/en/quickstart.md) for a runnable example,
+configuration reference, localization, and security model. A two-app example
+project with localized article listings and live configuration explanations
+is in [demo/](demo/).
+
+## Security boundary
+
+The editing interface uses JavaScript, but submitted content is sanitized on
+the server and does not permit executable scripts, inline event handlers,
+unsafe URL schemes, or arbitrary iframes. Script-like examples entered in code
+blocks are escaped text. Images are validated from their decoded content;
+video uploads are rejected. Image uploads require CSRF protection and a staff
+user with add/change permission for the associated model.
+
+No Django library can intercept direct SQL or writes made outside Django's
+validated ORM paths. Applications must still render through BD-Editor's
+sanitizing template integration and must not mark untrusted values safe
+themselves. See [the security guide](docs/en/security.md).
+
+## Development status
+
+The project is under active development. See [Progress.md](Progress.md) for
+milestones and [Agents.md](Agents.md) for development and security invariants.
+
+## License
+
+BD-Editor is released under the MIT license. Bundled third-party components
+retain their own copyright and license notices.

bd_editor-0.1.0/bd_editor/__init__.py

@@ -0,0 +1,5 @@
+"""Secure, configurable rich-text editing for Django."""
+
+__version__ = "0.1.0"
+
+default_app_config = "bd_editor.apps.BDEditorConfig"

bd_editor-0.1.0/bd_editor/apps.py

@@ -0,0 +1,12 @@
+from django.apps import AppConfig
+
+
+class BDEditorConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "bd_editor"
+    verbose_name = "BD-Editor"
+
+    def ready(self):
+        from .conf import validate_settings
+
+        validate_settings()