crudkit 0.2.2__tar.gz → 0.2.3__tar.gz

{crudkit-0.2.2 → crudkit-0.2.3}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.2.3 (2026-09-21)
+
+- `crudkit_api`: `GET /api/v1/` no longer returns 403 under `CrudKitModelPermissions`.
+  `has_permission` checks authentication first and honours DRF's
+  `_ignore_model_permissions`; the API root (`CrudKitRouter`/`CrudKitAPIRootView`) now lists
+  only the models the user may view. (#25)
+- `crudkit_frontend`: the detail view wraps long (over 60 characters) and multiline text,
+  with a Show more/less toggle when it overflows, instead of a single ellipsised line. (#26)
+- `crudkit_api`: fix a 500 when listing FeedItem or ExternalObject rows; generic relations
+  are no longer included in the list prefetch. (#27)
+- `crudkit`: multi-table-inheritance children are reachable by their own CK-ID again; the
+  parent's `CrudKitIDField` accepts the TYPE_IDs of its descendants. (#28)
+
 ## 0.2.2 (2026-09-19)
 
 - `crudkit_api`: list endpoints no longer build a serializer per row. `GenericViewSet.list`

{crudkit-0.2.2 → crudkit-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: crudkit
-Version: 0.2.2
+Version: 0.2.3
 Summary: A metadata-driven CRUD framework for Django: typed object IDs, soft delete, merge, change log, activity feed, saved views, AI fields and a generic REST API.
 Project-URL: Homepage, https://github.com/fenerum/crudkit
 Project-URL: Changelog, https://github.com/fenerum/crudkit/blob/main/backend/CHANGELOG.md

{crudkit-0.2.2 → crudkit-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "crudkit"
-version = "0.2.2"
+version = "0.2.3"
 description = "A metadata-driven CRUD framework for Django: typed object IDs, soft delete, merge, change log, activity feed, saved views, AI fields and a generic REST API."
 readme = "README.md"
 license = "MIT"

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit/models.py

@@ -1,3 +1,4 @@
+import functools
 import re
 
 from django.conf import settings
@@ -20,6 +21,13 @@ def get_ck_id(type_id, pk):
     return f"{type_id}{pk}"
 
 
+@functools.lru_cache(maxsize=None)
+def get_accepted_type_ids(model):
+    """The TYPE_IDs that address a row of `model`: its own, plus those of its
+    multi-table-inheritance children, which share the parent's pk column."""
+    return frozenset(type_id for type_id, mdl in get_model_types().items() if issubclass(mdl, model))
+
+
 def parse_ck_id(ck_id: str) -> tuple[str, int]:
     if not isinstance(ck_id, str) or not ck_id_regex.fullmatch(ck_id):
         raise ValueError(f"Invalid CrudKit ID: {ck_id!r}")
@@ -87,7 +95,9 @@ class CrudKitIDField(models.BigAutoField):
 
     def _validate_type_id(self, type_id):
         expected = getattr(self.model, "TYPE_ID", None)
-        if expected is not None and type_id != expected:
+        if expected is None or type_id == expected:
+            return
+        if type_id not in get_accepted_type_ids(self.model):
             raise ValueError(f"Expected a {expected} ID, got {type_id}")
 
 

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit/tests/test_fields.py

@@ -1,7 +1,9 @@
+from django.contrib.auth.models import User
 from django.db import connection
 from django.test import TestCase
 
 from crudkit.models import CrudKitIDField, CrudKitPositiveIntegerField, parse_ck_id
+from tests.testapp.models import Comment, Ticket, UrgentComment
 
 
 class TestModel:
@@ -121,3 +123,32 @@ class CrudKitPositiveIntegerFieldTests(TestCase):
             pk = 42
 
         self.assertEqual(self.field.get_prep_value(_FakeInstance()), 42)
+
+
+class SubclassCkIdLookupTests(TestCase):
+    """A multi-table-inheritance child shares the parent's pk column, so both the
+    parent's and the child's TYPE_ID address the same row."""
+
+    def setUp(self):
+        self.user = User.objects.create_user(username="fielduser", password="pw")
+        self.ticket = Ticket.objects.create(subject="Broken invoice", created_by=self.user, updated_by=self.user)
+        self.comment = UrgentComment.objects.create(
+            ticket=self.ticket,
+            body="Test content",
+            created_by=self.user,
+            updated_by=self.user,
+        )
+        self.pk = int(str(self.comment.pk).removeprefix("COM").removeprefix("URG"))
+
+    def test_lookup_by_child_type_id(self):
+        self.assertEqual(UrgentComment.objects.get(pk=f"URG{self.pk}"), self.comment)
+
+    def test_lookup_by_parent_type_id(self):
+        self.assertEqual(UrgentComment.objects.get(pk=f"COM{self.pk}"), self.comment)
+
+    def test_parent_queryset_accepts_child_type_id(self):
+        self.assertEqual(Comment.objects.get(pk=f"URG{self.pk}").pk, self.comment.pk)
+
+    def test_unrelated_type_id_still_rejected(self):
+        with self.assertRaises(ValueError):
+            UrgentComment.objects.get(pk=f"TIC{self.pk}")

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit_api/permissions.py

@@ -5,6 +5,13 @@ from crudkit.authorization import get_permission_action, has_model_permission, h
 
 class CrudKitModelPermissions(BasePermission):
     def has_permission(self, request, view):
+        if not getattr(request.user, "is_authenticated", False):
+            return False
+        # Set by DRF on rest_framework.routers.APIRootView (inherited by
+        # CrudKitAPIRootView) and on SchemaView: views with no model opting out
+        # of model permissions. DjangoModelPermissions honours it the same way.
+        if getattr(view, "_ignore_model_permissions", False):
+            return True
         queryset = getattr(view, "queryset", None)
         if queryset is None:
             return False

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit_api/tests/test_authorization.py

@@ -3,6 +3,7 @@ from django.test import TestCase
 from rest_framework.test import APIClient
 
 from crudkit.models import View, Workspace
+from crudkit.utils import get_model_types
 from tests.testapp.models import Customer, Ticket
 
 
@@ -108,3 +109,39 @@ class GenericAPIAuthorizationTests(TestCase):
 
         self.assertEqual(response.status_code, 200)
         self.assertEqual([row["id"] for row in response.data["results"]], [self.customer.pk])
+
+
+class APIRootAuthorizationTests(TestCase):
+    def setUp(self):
+        self.client = APIClient()
+
+    def test_anonymous_requests_are_rejected(self):
+        response = self.client.get("/api/v1/")
+        self.assertEqual(response.status_code, 401)
+
+    def test_superuser_sees_every_model(self):
+        self.client.force_authenticate(User.objects.create_superuser(username="root", password="pw"))
+
+        response = self.client.get("/api/v1/")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertLessEqual({"CUS", "TIC"}, set(response.data))
+
+    def test_root_only_lists_models_the_user_can_view(self):
+        user = User.objects.create_user(username="other", password="pw")
+        grant(user, Customer, "view")
+        self.client.force_authenticate(user)
+
+        response = self.client.get("/api/v1/")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("CUS", response.data)
+        self.assertNotIn("TIC", response.data)
+
+    def test_user_without_model_permissions_gets_an_empty_listing(self):
+        self.client.force_authenticate(User.objects.create_user(username="nobody", password="pw"))
+
+        response = self.client.get("/api/v1/")
+
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(set(response.data) & set(get_model_types()), set())

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit_api/tests/test_email_id_serialization.py

@@ -93,3 +93,45 @@ class SubclassIDSerializationTest(TestCase):
                 comment_id.startswith("URG"),
                 f"Comment ID should start with URG, but got {comment_id}",
             )
+
+
+class SubclassDetailRouteTest(TestCase):
+    """The API serialises a MTI child with its own prefix (URG), so every detail
+    route has to accept that id back — retrieve, update, merge and action."""
+
+    def setUp(self):
+        self.user = User.objects.create_superuser(username="detailuser", password="testpass")
+        self.client = APIClient()
+        self.client.force_authenticate(user=self.user)
+
+        self.ticket = Ticket.objects.create(
+            subject="Broken invoice",
+            created_by=self.user,
+            updated_by=self.user,
+        )
+        self.comment = UrgentComment.objects.create(
+            ticket=self.ticket,
+            body="Test content",
+            escalation_reason="production down",
+            created_by=self.user,
+            updated_by=self.user,
+        )
+        self.ck_id = self.client.get(f"/api/v1/URG/{self.comment.pk}/").data["id"]
+        self.assertTrue(self.ck_id.startswith("URG"))
+
+    def test_retrieve_by_serialized_id(self):
+        response = self.client.get(f"/api/v1/URG/{self.ck_id}/")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.data["id"], self.ck_id)
+
+    def test_update_by_serialized_id(self):
+        response = self.client.patch(f"/api/v1/URG/{self.ck_id}/", {"body": "Edited"}, format="json")
+        self.assertEqual(response.status_code, 200)
+        self.comment.refresh_from_db()
+        self.assertEqual(self.comment.body, "Edited")
+
+    def test_action_by_serialized_id(self):
+        response = self.client.post(f"/api/v1/URG/{self.ck_id}/action/", {"action": "escalate"}, format="json")
+        self.assertEqual(response.status_code, 200)
+        self.comment.refresh_from_db()
+        self.assertEqual(self.comment.escalation_reason, "escalated")

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit_api/tests/test_list_serialization.py

@@ -8,7 +8,7 @@ from rest_framework.request import Request
 from rest_framework.test import APIClient, APIRequestFactory
 
 from crudkit.fields import DEFAULT_CURRENCY
-from crudkit.models import ExchangeRate
+from crudkit.models import ExchangeRate, ExternalObject, FeedItem
 from crudkit_api.serializers import GenericSerializer, _nested_relation_field, get_serializer
 from crudkit_api.views import GenericViewSet
 from tests.testapp.models import Customer, Ticket, Topic
@@ -96,3 +96,33 @@ class ListSerializationTest(TestCase):
 
     def test_nested_field_classes_are_cached(self):
         self.assertIs(_nested_relation_field(Customer, 1), _nested_relation_field(Customer, 1))
+
+
+class GenericRelationListTest(TestCase):
+    """FeedItem and ExternalObject are the targets of the generic relations
+    every model inherits, so on those two the relation names resolve to the
+    reverse descriptor. Listing them must not try to prefetch that."""
+
+    @classmethod
+    def setUpTestData(cls):
+        cls.user = User.objects.create_superuser(username="genericrelation", password="testpass")
+        audit = {"created_by": cls.user, "updated_by": cls.user}
+        cls.customer = Customer.objects.create(name="Acme", **audit)
+        cls.feed_item = FeedItem.objects.create(parent_object=cls.customer, body="Called them", **audit)
+        ExternalObject.objects.create(system_name="hubspot", system_id="123", related_object=cls.customer, **audit)
+
+    def setUp(self):
+        self.client = APIClient()
+        self.client.force_authenticate(user=self.user)
+
+    def test_feed_item_list_filtered_by_parent(self):
+        response = self.client.get(f"/api/v1/FEI/?parent_object={self.customer.pk}")
+        self.assertEqual(response.status_code, 200)
+        results = response.json()["results"]
+        self.assertEqual([row["id"] for row in results], [self.feed_item.pk])
+        self.assertEqual(results[0]["parent_object"], self.customer.pk)
+
+    def test_external_object_list(self):
+        response = self.client.get("/api/v1/EXT/")
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(len(response.json()["results"]), 1)

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit_api/urls.py

@@ -2,6 +2,7 @@ from django.urls import include, path
 from rest_framework import routers
 from rest_framework_simplejwt.views import TokenRefreshView
 
+from crudkit.authorization import has_model_permission
 from crudkit.utils import get_model_types
 from crudkit_api.authentication import LoginView, UserProfileView
 from crudkit_api.serializers import get_serializer
@@ -10,8 +11,26 @@ from crudkit_api.views import GenericViewSet, SearchViewSet, WidgetsViewSet
 # ViewSets define the view behavior.
 
 
+class CrudKitAPIRootView(routers.APIRootView):
+    """Router root that only advertises the models the user is allowed to view."""
+
+    def get(self, request, *args, **kwargs):
+        response = super().get(request, *args, **kwargs)
+        models = get_model_types()
+        response.data = {
+            type_id: url
+            for type_id, url in response.data.items()
+            if type_id not in models or has_model_permission(request.user, models[type_id], "view")
+        }
+        return response
+
+
+class CrudKitRouter(routers.DefaultRouter):
+    APIRootView = CrudKitAPIRootView
+
+
 # Routers provide an easy way of automatically determining the URL conf.
-router = routers.DefaultRouter()
+router = CrudKitRouter()
 # router.register(r"users", UserViewSet)
 
 for type_id, mdl in get_model_types().items():

{crudkit-0.2.2 → crudkit-0.2.3}/src/crudkit_api/views.py

@@ -1,7 +1,7 @@
 import re
 
 from django.contrib.auth.models import User
-from django.contrib.contenttypes.fields import GenericForeignKey
+from django.contrib.contenttypes.fields import GenericForeignKey, GenericRelation
 from django.core.exceptions import ValidationError
 from django.db import connection, models, reset_queries, transaction
 from django.db.models import ProtectedError, Q
@@ -106,6 +106,12 @@ class GenericViewSet(viewsets.ModelViewSet):
             if f.is_relation
             and not hasattr(f, "related_name")
             and type(f) is not GenericForeignKey
+            # A GenericRelation also installs a reverse descriptor of the same
+            # name on its target, so on FeedItem and ExternalObject the base
+            # class' feeditem_set/externalobject_set are shadowed and
+            # prefetching them by name walks the relation backwards. Nothing in
+            # GenericSerializer renders a generic relation anyway.
+            and not isinstance(f, GenericRelation)
             and (not fields or f.name in fields)
         ]