commonground-api-common 3.1.0__tar.gz → 3.2.0__tar.gz

{commonground_api_common-3.1.0 → commonground_api_common-3.2.0}/CHANGELOG.rst

@@ -2,6 +2,32 @@
 Change history
 ==============
 
+3.2.0 (2026-11-11)
+------------------
+
+**New features**
+
+* [open-zaak/open-zaak#2452] Add ``alleen_is_gereed_voor_publicatie`` to ``Applicatie`` and its
+  serializer. This flag indicates that an application may only read documents
+  with ``isGereedVoorPublicatie`` set to ``true``. It defaults to ``false``.
+
+* [open-zaak/open-zaak#2537] Add a reusable ``URNField`` and
+  ``URNValidator`` for URN values. The field extends ``CharField`` with a
+  maximum length of 255 characters and validates URN syntax (RFC 8141) using ABNF.
+
+3.1.1 (2026-10-23)
+------------------
+
+**Security**
+
+* Require ``certifi>=2026.10.19``, which no longer trusts the eMudhra root whose
+  intermediate CA keys were compromised. Also update ``pip`` to 26.2.2 or later and
+  rebuild your images without cache, to update the system certificates. See the
+  `Python advisory <https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576>`_.
+* Require ``PyJWT>=2.15.1``. Older versions have known vulnerabilities, among
+  them a ``RecursionError`` on a deeply nested JWT, which anyone could trigger
+  without credentials and which gave a 500 (CVE-2026-101918). It is now a 403.
+
 3.1.0 (2026-10-23)
 ------------------
 

{commonground_api_common-3.1.0/commonground_api_common.egg-info → commonground_api_common-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: commonground-api-common
-Version: 3.1.0
+Version: 3.2.0
 Summary: Commonground API tooling
 Author-email: "Maykin Media, VNG-Realisatie" <support@maykinmedia.nl>
 License-Expression: MIT
@@ -36,8 +36,9 @@ Requires-Dist: iso639-lang
 Requires-Dist: notifications-api-common>=0.3.1
 Requires-Dist: zgw-consumers>=1.0.0
 Requires-Dist: oyaml
-Requires-Dist: PyJWT>=2.10.1
+Requires-Dist: PyJWT>=2.15.1
 Requires-Dist: requests
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: ape-pie
 Requires-Dist: sentry-sdk
 Requires-Dist: structlog
@@ -89,7 +90,7 @@ Commonground-API-common - Tooling voor RESTful APIs
 ===================================================
 
 
-:Version: 3.1.0
+:Version: 3.2.0
 :Source: https://github.com/maykinmedia/commonground-api-common
 :PythonVersion: 3.12
 
@@ -129,6 +130,7 @@ Features
     * ``IsImmutableValidator`` - valideer dat bepaalde velden niet gewijzigd
       worden bij een (partial) update, maar wel mogen gezet worden bij een create
     * ``ResourceValidator`` - valideer dat een URL een bepaalde resource ontsluit
+    * ``URNValidator`` - valideer de URN-syntaxis volgens de ABNF-regels zoals gedefinieerd in RFC 8141
 * Custom inspectors voor drf-yasg:
     * Support voor ``rest_framework_gis`` ``GeometryField``
     * SUpport voor ``django-extra-fields`` ``Base64FieldMixin``
@@ -145,6 +147,7 @@ Features
     * ``LanguageField``
     * ``VertrouwelijkheidsAanduidingField``
     * ``DurationField``
+    * ``URNField``
 * Mocks voor de validators die netwerk IO hebben, eenvoudig via
   ``@override_settings`` toe te passen
 * Test utilities

{commonground_api_common-3.1.0 → commonground_api_common-3.2.0}/README.rst

@@ -3,7 +3,7 @@ Commonground-API-common - Tooling voor RESTful APIs
 ===================================================
 
 
-:Version: 3.1.0
+:Version: 3.2.0
 :Source: https://github.com/maykinmedia/commonground-api-common
 :PythonVersion: 3.12
 
@@ -43,6 +43,7 @@ Features
     * ``IsImmutableValidator`` - valideer dat bepaalde velden niet gewijzigd
       worden bij een (partial) update, maar wel mogen gezet worden bij een create
     * ``ResourceValidator`` - valideer dat een URL een bepaalde resource ontsluit
+    * ``URNValidator`` - valideer de URN-syntaxis volgens de ABNF-regels zoals gedefinieerd in RFC 8141
 * Custom inspectors voor drf-yasg:
     * Support voor ``rest_framework_gis`` ``GeometryField``
     * SUpport voor ``django-extra-fields`` ``Base64FieldMixin``
@@ -59,6 +60,7 @@ Features
     * ``LanguageField``
     * ``VertrouwelijkheidsAanduidingField``
     * ``DurationField``
+    * ``URNField``
 * Mocks voor de validators die netwerk IO hebben, eenvoudig via
   ``@override_settings`` toe te passen
 * Test utilities

{commonground_api_common-3.1.0 → commonground_api_common-3.2.0/commonground_api_common.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: commonground-api-common
-Version: 3.1.0
+Version: 3.2.0
 Summary: Commonground API tooling
 Author-email: "Maykin Media, VNG-Realisatie" <support@maykinmedia.nl>
 License-Expression: MIT
@@ -36,8 +36,9 @@ Requires-Dist: iso639-lang
 Requires-Dist: notifications-api-common>=0.3.1
 Requires-Dist: zgw-consumers>=1.0.0
 Requires-Dist: oyaml
-Requires-Dist: PyJWT>=2.10.1
+Requires-Dist: PyJWT>=2.15.1
 Requires-Dist: requests
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: ape-pie
 Requires-Dist: sentry-sdk
 Requires-Dist: structlog
@@ -89,7 +90,7 @@ Commonground-API-common - Tooling voor RESTful APIs
 ===================================================
 
 
-:Version: 3.1.0
+:Version: 3.2.0
 :Source: https://github.com/maykinmedia/commonground-api-common
 :PythonVersion: 3.12
 
@@ -129,6 +130,7 @@ Features
     * ``IsImmutableValidator`` - valideer dat bepaalde velden niet gewijzigd
       worden bij een (partial) update, maar wel mogen gezet worden bij een create
     * ``ResourceValidator`` - valideer dat een URL een bepaalde resource ontsluit
+    * ``URNValidator`` - valideer de URN-syntaxis volgens de ABNF-regels zoals gedefinieerd in RFC 8141
 * Custom inspectors voor drf-yasg:
     * Support voor ``rest_framework_gis`` ``GeometryField``
     * SUpport voor ``django-extra-fields`` ``Base64FieldMixin``
@@ -145,6 +147,7 @@ Features
     * ``LanguageField``
     * ``VertrouwelijkheidsAanduidingField``
     * ``DurationField``
+    * ``URNField``
 * Mocks voor de validators die netwerk IO hebben, eenvoudig via
   ``@override_settings`` toe te passen
 * Test utilities

{commonground_api_common-3.1.0 → commonground_api_common-3.2.0}/commonground_api_common.egg-info/SOURCES.txt

@@ -8,6 +8,7 @@ commonground_api_common.egg-info/dependency_links.txt
 commonground_api_common.egg-info/not-zip-safe
 commonground_api_common.egg-info/requires.txt
 commonground_api_common.egg-info/top_level.txt
+tests/test_applicatie_alleen_is_gereed_voor_publicatie.py
 tests/test_autorisatie_validation.py
 tests/test_cache_headers.py
 tests/test_cached_hyperlinkrelatedfields.py
@@ -48,6 +49,7 @@ tests/test_scopes.py
 tests/test_serializer_extensions.py
 tests/test_serializer_fields.py
 tests/test_server_errors.py
+tests/test_urn_serializers.py
 tests/test_utils.py
 tests/test_validators.py
 tests/test_views.py
@@ -150,6 +152,7 @@ vng_api_common/authorizations/migrations/0015_auto_20220318_1608.py
 vng_api_common/authorizations/migrations/0016_remove_authorizationsconfig_api_root_and_more.py
 vng_api_common/authorizations/migrations/0017_alter_applicatie_client_ids_and_more.py
 vng_api_common/authorizations/migrations/0018_alter_applicatie_options_alter_autorisatie_options.py
+vng_api_common/authorizations/migrations/0019_applicatie_alleen_is_gereed_voor_publicatie.py
 vng_api_common/authorizations/migrations/__init__.py
 vng_api_common/caching/__init__.py
 vng_api_common/caching/bulk.py

{commonground_api_common-3.1.0 → commonground_api_common-3.2.0}/commonground_api_common.egg-info/requires.txt

@@ -10,8 +10,9 @@ iso639-lang
 notifications-api-common>=0.3.1
 zgw-consumers>=1.0.0
 oyaml
-PyJWT>=2.10.1
+PyJWT>=2.15.1
 requests
+certifi>=2026.10.19
 ape-pie
 sentry-sdk
 structlog

{commonground_api_common-3.1.0 → commonground_api_common-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "commonground-api-common"
-version = "3.1.0"
+version = "3.2.0"
 description = "Commonground API tooling"
 readme = "README.rst"
 license = "MIT"
@@ -44,8 +44,9 @@ dependencies = [
     "notifications-api-common>=0.3.1",
     "zgw-consumers>=1.0.0",
     "oyaml",
-    "PyJWT>=2.10.1",
+    "PyJWT>=2.15.1",
     "requests",
+    "certifi>=2026.10.19",  # required through requests, bounded for 🔒
     "ape-pie",
     "sentry-sdk",
     "structlog",
@@ -157,7 +158,7 @@ exclude_also = [
 ]
 
 [tool.bumpversion]
-current_version = "3.1.0"
+current_version = "3.2.0"
 files = [
     {filename = "pyproject.toml"},
     {filename = "README.rst"},

commonground_api_common-3.2.0/tests/test_applicatie_alleen_is_gereed_voor_publicatie.py

@@ -0,0 +1,148 @@
+import pytest
+
+from vng_api_common.authorizations.models import Applicatie
+from vng_api_common.authorizations.serializers import ApplicatieSerializer
+
+
+@pytest.mark.django_db
+def test_alleen_is_gereed_voor_publicatie_defaults_to_false():
+    applicatie = Applicatie.objects.create(client_ids=["consumer"], label="Consumer")
+
+    applicatie.refresh_from_db()
+
+    assert applicatie.alleen_is_gereed_voor_publicatie is False
+
+
+@pytest.mark.django_db
+def test_serializer_defaults_to_false():
+    serializer = ApplicatieSerializer(
+        data={
+            "client_ids": ["consumer"],
+            "label": "Consumer",
+            "heeft_alle_autorisaties": True,
+        }
+    )
+
+    assert serializer.is_valid(), serializer.errors
+    applicatie = serializer.save()
+    applicatie.refresh_from_db()
+
+    assert applicatie.alleen_is_gereed_voor_publicatie is False
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize("alleen_is_gereed_voor_publicatie", [True, False])
+def test_serializer_saves_alleen_is_gereed_voor_publicatie(
+    alleen_is_gereed_voor_publicatie,
+):
+    serializer = ApplicatieSerializer(
+        data={
+            "client_ids": ["consumer"],
+            "label": "Consumer",
+            "heeft_alle_autorisaties": True,
+            "alleen_is_gereed_voor_publicatie": alleen_is_gereed_voor_publicatie,
+        }
+    )
+
+    assert serializer.is_valid(), serializer.errors
+    applicatie = serializer.save()
+    applicatie.refresh_from_db()
+
+    assert (
+        applicatie.alleen_is_gereed_voor_publicatie is alleen_is_gereed_voor_publicatie
+    )
+
+
+@pytest.mark.django_db
+def test_serializer_enables_alleen_is_gereed_voor_publicatie():
+    applicatie = Applicatie.objects.create(
+        client_ids=["consumer"],
+        label="Consumer",
+        heeft_alle_autorisaties=True,
+        alleen_is_gereed_voor_publicatie=False,
+    )
+    serializer = ApplicatieSerializer(
+        applicatie,
+        data={"alleen_is_gereed_voor_publicatie": True},
+        partial=True,
+    )
+
+    assert serializer.is_valid(), serializer.errors
+    serializer.save()
+    applicatie.refresh_from_db()
+
+    assert applicatie.alleen_is_gereed_voor_publicatie is True
+
+
+@pytest.mark.django_db
+def test_serializer_disables_alleen_is_gereed_voor_publicatie():
+    applicatie = Applicatie.objects.create(
+        client_ids=["consumer"],
+        label="Consumer",
+        heeft_alle_autorisaties=True,
+        alleen_is_gereed_voor_publicatie=True,
+    )
+    serializer = ApplicatieSerializer(
+        applicatie,
+        data={"alleen_is_gereed_voor_publicatie": False},
+        partial=True,
+    )
+
+    assert serializer.is_valid(), serializer.errors
+    serializer.save()
+    applicatie.refresh_from_db()
+
+    assert applicatie.alleen_is_gereed_voor_publicatie is False
+
+
+@pytest.mark.django_db
+def test_partial_update_preserves_alleen_is_gereed_voor_publicatie_when_omitted():
+    applicatie = Applicatie.objects.create(
+        client_ids=["consumer"],
+        label="Consumer",
+        heeft_alle_autorisaties=True,
+        alleen_is_gereed_voor_publicatie=True,
+    )
+    serializer = ApplicatieSerializer(
+        applicatie, data={"label": "Updated consumer"}, partial=True
+    )
+
+    assert serializer.is_valid(), serializer.errors
+    serializer.save()
+    applicatie.refresh_from_db()
+
+    assert applicatie.alleen_is_gereed_voor_publicatie is True
+
+
+@pytest.mark.django_db
+def test_serializer_rejects_null_for_alleen_is_gereed_voor_publicatie():
+    serializer = ApplicatieSerializer(
+        data={
+            "client_ids": ["consumer"],
+            "label": "Consumer",
+            "heeft_alle_autorisaties": True,
+            "alleen_is_gereed_voor_publicatie": None,
+        }
+    )
+
+    assert not serializer.is_valid()
+    assert serializer.errors["alleen_is_gereed_voor_publicatie"] == [
+        "This field may not be null."
+    ]
+
+
+@pytest.mark.django_db
+def test_serializer_rejects_text_for_alleen_is_gereed_voor_publicatie():
+    serializer = ApplicatieSerializer(
+        data={
+            "client_ids": ["consumer"],
+            "label": "Consumer",
+            "heeft_alle_autorisaties": True,
+            "alleen_is_gereed_voor_publicatie": "invalid",
+        }
+    )
+
+    assert not serializer.is_valid()
+    assert serializer.errors["alleen_is_gereed_voor_publicatie"] == [
+        "Must be a valid boolean."
+    ]

commonground_api_common-3.2.0/tests/test_fields.py

@@ -0,0 +1,63 @@
+from django.core.exceptions import ValidationError
+
+import pytest
+
+from testapp.models import Medewerker
+from vng_api_common.fields import URNField
+
+
+def test_bsn_length():
+    with pytest.raises(ValidationError):
+        Medewerker(bsn="11122233").full_clean()
+
+    with pytest.raises(ValidationError):
+        Medewerker(bsn="1112223333").full_clean()
+
+    Medewerker(bsn="111222333").full_clean()
+
+
+def test_rsin_length():
+    with pytest.raises(ValidationError):
+        Medewerker(rsin="11122233").full_clean()
+
+    with pytest.raises(ValidationError):
+        Medewerker(rsin="1112223333").full_clean()
+
+    Medewerker(rsin="111222333").full_clean()
+
+
+@pytest.mark.parametrize("max_length", [255, 512])
+def test_urn_field_length(max_length):
+    field = URNField(max_length=max_length)
+    value = "urn:example:".ljust(max_length, "a")
+
+    assert field.max_length == max_length
+    assert field.clean(value, None) == value
+    with pytest.raises(ValidationError) as error:
+        field.clean(value + "a", None)
+    assert error.value.error_list[0].code == "max_length"
+
+
+def test_urn_field_validation():
+    field = URNField()
+
+    assert field.clean("urn:example:document", None) == "urn:example:document"
+    with pytest.raises(ValidationError) as error:
+        field.clean("https://example.com/document", None)
+    assert error.value.error_list[0].code == "invalid_urn"
+
+
+@pytest.mark.parametrize(
+    "kwargs", [{}, {"max_length": 512, "blank": True, "null": True}]
+)
+def test_urn_field_deconstruction(kwargs):
+    field = URNField(**kwargs)
+
+    _, path, args, reconstructed_kwargs = field.deconstruct()
+    reconstructed = URNField(*args, **reconstructed_kwargs)
+
+    assert path == "vng_api_common.fields.URNField"
+    assert reconstructed.max_length == field.max_length
+    assert reconstructed.blank == field.blank
+    assert reconstructed.null == field.null
+    assert reconstructed.validators == field.validators

commonground_api_common-3.2.0/tests/test_filters.py

@@ -0,0 +1,102 @@
+from django.core.exceptions import ValidationError
+from django.db import models
+
+import pytest
+
+from testapp.models import Person
+from vng_api_common.constants import FILTER_URL_DID_NOT_RESOLVE
+from vng_api_common.filters import ListURNFilter, URLModelChoiceField, URNFilter
+from vng_api_common.utils import NotAViewSet
+
+
+def test_filter_field_url_to_pk_trailing_slash():
+    field = URLModelChoiceField(queryset=Person.objects.all())
+    with pytest.raises(NotAViewSet):
+        field.url_to_pk("https://google.com/")
+
+
+def test_filter_field_to_python_trailing_slash():
+    field = URLModelChoiceField(queryset=Person.objects.all())
+    value = field.to_python("https://google.com/")
+    assert value == FILTER_URL_DID_NOT_RESOLVE
+
+
+def test_filter_field_to_python_invalid_url_raises_error():
+    field = URLModelChoiceField(queryset=Person.objects.all())
+    with pytest.raises(ValidationError) as exc:
+        field.to_python("thisisnotaurl")
+
+    assert exc.value.code == "invalid"
+
+
+@pytest.mark.parametrize("filter_class", [URNFilter, ListURNFilter])
+@pytest.mark.parametrize("value", [None, "", [], (), {}])
+def test_urn_filters_empty_value_leaves_queryset_unchanged(filter_class, value):
+    queryset = Person.objects.all()
+
+    assert filter_class(field_name="name").filter(queryset, value) is queryset
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize("exclude", [False, True])
+@pytest.mark.parametrize("value", ["urn", "example", "42", "a.b+", "missing"])
+def test_urn_filter_matches_whole_literal_segments(value, exclude):
+    urns = [
+        "urn:example:42",
+        "urn:examples:142",
+        "urn:example:a.b+",
+        "urn:example:axb",
+        "urn:Example:42extra",
+    ]
+    people = [Person.objects.create(name=urn) for urn in urns]
+    queryset = Person.objects.all()
+
+    result = URNFilter(field_name="name", exclude=exclude).filter(queryset, value)
+
+    assert set(result) == {
+        person for person in people if (value in person.name.split(":")) != exclude
+    }
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize("json_key", [None, "reference"])
+@pytest.mark.parametrize("exclude", [False, True])
+@pytest.mark.parametrize("value", ["urn", "example", "42", "a.b+", "missing"])
+def test_list_urn_filter_matches_supported_json_shapes(
+    json_key, value, exclude, django_assert_num_queries
+):
+    key = json_key or "urn"
+    rows = [
+        (["urn:example:42", "urn:other:42"], {"urn", "example", "42"}),
+        ([{key: "urn:example:a.b+", "label": "other"}], {"urn", "example", "a.b+"}),
+        (["urn:examples:142", {key: "urn:other:axb"}], {"urn"}),
+        ([None, "", {}, {"label": "urn:example:42"}], set()),
+        ([], set()),
+        (None, set()),
+        ({key: "urn:example:42"}, set()),  # not a list
+        ("urn:example:42", set()),  # not a list
+    ]
+    cases = []
+    expected_pks = set()
+    for items, matching_values in rows:
+        person = Person.objects.create(name="test")
+        cases.append(
+            models.When(
+                pk=person.pk,
+                then=models.Value(items, output_field=models.JSONField()),
+            )
+        )
+        if (value in matching_values) != exclude:
+            expected_pks.add(person.pk)
+
+    queryset = Person.objects.annotate(
+        references=models.Case(*cases, output_field=models.JSONField())
+    )
+    kwargs = {"json_key": json_key} if json_key else {}
+    urn_filter = ListURNFilter(field_name="references", exclude=exclude, **kwargs)
+
+    with django_assert_num_queries(0):
+        result = urn_filter.filter(queryset, value)
+
+    with django_assert_num_queries(1):
+        assert set(result.values_list("pk", flat=True)) == expected_pks