django-agent-content 0.1.2__tar.gz

django_agent_content-0.1.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sushan Poudel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_agent_content-0.1.2/PKG-INFO

@@ -0,0 +1,195 @@
+Metadata-Version: 2.4
+Name: django-agent-content
+Version: 0.1.2
+Summary: Django app that lets AI agents and MCP clients (Claude Code, Cursor and others) edit your site's content safely: API keys, permissions, drafts, no deletes.
+License-Expression: MIT
+License-File: LICENSE
+Keywords: django,mcp,model context protocol,ai agents,llm,claude,cms,content api,headless cms,django admin,api keys
+Author: Sushan Poudel
+Requires-Python: >=3.10
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 4.2
+Classifier: Framework :: Django :: 5.2
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Dist: Django (>=4.2)
+Project-URL: Changelog, https://github.com/hexa01/django-agent-content#changelog
+Project-URL: Documentation, https://github.com/hexa01/django-agent-content#readme
+Project-URL: Homepage, https://github.com/hexa01/django-agent-content
+Project-URL: Issues, https://github.com/hexa01/django-agent-content/issues
+Project-URL: MCP server, https://github.com/hexa01/agent-content-mcp
+Description-Content-Type: text/markdown
+
+# django-agent-content
+
+**Django + MCP: let AI agents edit your site's content, safely.**
+
+Claude Code, Cursor and other MCP clients (through [agent-content-mcp](https://github.com/hexa01/agent-content-mcp)),
+or any HTTP client, can read and edit the models you choose: blog posts, pages, profiles, products. You decide which
+models and fields are editable. Agents use revocable API keys that act as a Django user, so permissions and the admin's
+change history work as usual. New content can be forced to drafts, and nothing is ever deleted.
+
+```
+AI agent ──> MCP server ──HTTPS + API key──> your Django site: /api/agent/ ──> your models (via ModelForms)
+```
+
+## Install
+
+```bash
+pip install "django-agent-content @ https://github.com/hexa01/django-agent-content/archive/refs/tags/v0.1.1.tar.gz"
+```
+
+```python
+# settings.py
+INSTALLED_APPS = [..., 'agent_content']
+
+# urls.py
+path('api/agent/', include('agent_content.urls')),
+```
+
+```bash
+python manage.py migrate
+```
+
+Requires Django 4.2+ and works with any database Django supports: it uses your project's `DATABASES`.
+
+## Say what agents may edit
+
+In each app whose content agents should edit, add `agent_resources.py` (like `admin.py`). Start from a scaffold:
+
+```bash
+python manage.py agent_content_scaffold blog     # writes blog/agent_resources.py, everything commented out
+```
+
+Then uncomment and adjust:
+
+```python
+from agent_content import Action, Relation, Resource, register, slug_defaults
+
+from .models import Post
+
+register(Resource(
+    Post,
+    lookup='slug',                                           # /api/agent/posts/<slug>/
+    fields=['title', 'slug', 'excerpt', 'body', 'category', 'tags'],   # what agents may write
+    read_only=['status', 'published_at'],                    # what they may only read
+    relations={'category': Relation('name'),                 # refer to related objects by name, not id
+               'tags': Relation('name', create=True, create_defaults=slug_defaults)},
+    create=True, defaults={'status': 'draft'},               # new posts are always drafts
+    locked_fields=['slug'], locked_if=lambda post: post.status == 'published',   # links never break
+    filters=['status'],                                      # ?status=draft
+    actions={'publish': Action(publish, 'Make the post public.',            # POST /api/agent/posts/<slug>/publish/
+                               {'published_at': 'ISO date to show, optional'})},
+))
+```
+
+Only listed fields are exposed. Saves go through a ModelForm and your model's `save()`, so validation and side
+effects match the admin.
+
+### Full example
+
+[`tests/testapp`](https://github.com/hexa01/django-agent-content/tree/main/tests/testapp) is a small working app used by the tests:
+[`models.py`](https://github.com/hexa01/django-agent-content/blob/main/tests/testapp/models.py) and its [`agent_resources.py`](https://github.com/hexa01/django-agent-content/blob/main/tests/testapp/agent_resources.py) show most
+options together: references by name, tags created when missing, drafts by default, a slug that locks once
+published, a filter, search, a `publish` action with a parameter, an inline list (an article's notes) and a
+single-object resource (site settings).
+
+### Resource options
+
+| Option | Meaning |
+|---|---|
+| `fields` | Writable (and readable) fields. |
+| `name` | URL name; default: the model's plural, e.g. `posts`. |
+| `lookup` | Field used in item URLs; default `pk`. |
+| `singular` | One item's name, used for tool names (`get_post`); default: the model's name. |
+| `description` | What this content is, shown to agents. |
+| `read_only` | Readable but not writable. |
+| `computed` | Read-only values: `{'url': lambda obj: obj.get_absolute_url()}`. |
+| `list_fields` | Fields shown in lists. |
+| `relations` | `{'field': Relation('name', create=False)}` for ForeignKey/ManyToMany fields. |
+| `create`, `defaults` | Allow creating; `defaults` are forced on create (e.g. a draft status). |
+| `locked_fields`, `locked_if` | Fields that can't change while `locked_if(obj)` is true. |
+| `filters`, `search` | `?field=value` filters; `search(queryset, text)` for `?q=`. |
+| `queryset` | `queryset()` if not `Model.objects.all()`. |
+| `singleton` | `get()` for one-object resources such as site settings: `/api/agent/<name>/`. |
+| `actions` | `{'publish': Action(fn, 'what it does', {'param': 'what it is'})}`: `POST <lookup>/<name>/`; `fn(obj, data)` returns the object. A plain function also works (its docstring describes it). |
+| `inlines` | `{'notes': Inline(Note, fk='article', fields=[...], order_field='position')}`: `GET`/`PUT <lookup>/notes/` replaces the list. |
+
+## API keys
+
+```bash
+python manage.py agent_content_key --label "Claude Code, laptop"           # never expires
+python manage.py agent_content_key --label "CI" --days 90
+python manage.py agent_content_key --list
+python manage.py agent_content_key --revoke ac_Ab12cd      # by prefix, or --revoke all --user agent-bot
+```
+
+The key is printed once; only its SHA-256 hash is stored. By default it acts as the user `agent-bot` (created if
+missing, with no password and no admin access) and is granted exactly the permissions your registered resources need.
+Keys can also be created, revoked and checked (last used, expiry) under **Admin › Agent content › API keys**.
+
+Agents send `Authorization: Bearer <key>`.
+
+## Endpoints
+
+| Request | Does |
+|---|---|
+| `GET /api/agent/` | API version and a description of every resource the key may see: each field's kind, label, help text, limits, choices and whether it's required, plus actions with their params. [agent-content-mcp](https://github.com/hexa01/agent-content-mcp) builds its tools from this. |
+| `GET <name>/` | List (`?field=value`, `?q=`). |
+| `POST <name>/` | Create (when `create=True`). |
+| `GET`, `PATCH <name>/<lookup>/` | Read, or change only the fields sent. |
+| `POST <name>/<lookup>/<action>/` | Run an action. |
+| `GET`, `PUT <name>/<lookup>/<inline>/` | Read or replace child rows. |
+
+Errors are JSON: `{"error": "...", "fields": {"slug": ["..."]}}`, written so an agent can fix its request.
+
+## Settings
+
+All optional.
+
+| Setting | Default | Meaning |
+|---|---|---|
+| `AGENT_CONTENT_MODULE` | `'agent_resources'` | File name looked up in each app. |
+| `AGENT_CONTENT_ADMIN_BASE` | `'django.contrib.admin.ModelAdmin'` | Base class for the key admin, e.g. `'unfold.admin.ModelAdmin'` for Unfold. |
+| `AGENT_CONTENT_RATE_LIMIT` | `120` | Requests per minute per key. |
+| `AGENT_CONTENT_MAX_BODY` | `1000000` | Largest request body in bytes. |
+| `AGENT_CONTENT_REQUIRE_HTTPS` | `None` | Refuse plain HTTP; `None` means "unless `DEBUG`". Behind a proxy, set Django's `SECURE_PROXY_SSL_HEADER`. |
+
+Tip: add `Disallow: /api/` to your `robots.txt`.
+
+## Security
+
+- Keys are hashed, can expire, and can be revoked at any time; keys of inactive users stop working.
+- What a key can do is its user's Django permissions. The API has no delete endpoints (inline lists replace their rows).
+- HTTPS is required outside `DEBUG`; requests are rate-limited and size-limited.
+- Every change is recorded in the admin's history under the key's user.
+
+## Development
+
+```bash
+python -m venv .venv && .venv/bin/pip install "Django>=5.2"
+.venv/bin/python runtests.py            # SQLite, no project needed
+```
+
+## Changelog
+
+- **0.1.2**: package metadata for PyPI (summary, keywords, classifiers, links); README example app and wording.
+- **0.1.1**: updates change only the fields sent (unsent text is left exactly as it was); actions take a
+  description and params (`Action`); the API description adds field kinds, labels, `required`, `singular` and
+  create defaults.
+- **0.1.0**: first release.
+
+## License
+
+MIT
+

django_agent_content-0.1.2/README.md

@@ -0,0 +1,162 @@
+# django-agent-content
+
+**Django + MCP: let AI agents edit your site's content, safely.**
+
+Claude Code, Cursor and other MCP clients (through [agent-content-mcp](https://github.com/hexa01/agent-content-mcp)),
+or any HTTP client, can read and edit the models you choose: blog posts, pages, profiles, products. You decide which
+models and fields are editable. Agents use revocable API keys that act as a Django user, so permissions and the admin's
+change history work as usual. New content can be forced to drafts, and nothing is ever deleted.
+
+```
+AI agent ──> MCP server ──HTTPS + API key──> your Django site: /api/agent/ ──> your models (via ModelForms)
+```
+
+## Install
+
+```bash
+pip install "django-agent-content @ https://github.com/hexa01/django-agent-content/archive/refs/tags/v0.1.1.tar.gz"
+```
+
+```python
+# settings.py
+INSTALLED_APPS = [..., 'agent_content']
+
+# urls.py
+path('api/agent/', include('agent_content.urls')),
+```
+
+```bash
+python manage.py migrate
+```
+
+Requires Django 4.2+ and works with any database Django supports: it uses your project's `DATABASES`.
+
+## Say what agents may edit
+
+In each app whose content agents should edit, add `agent_resources.py` (like `admin.py`). Start from a scaffold:
+
+```bash
+python manage.py agent_content_scaffold blog     # writes blog/agent_resources.py, everything commented out
+```
+
+Then uncomment and adjust:
+
+```python
+from agent_content import Action, Relation, Resource, register, slug_defaults
+
+from .models import Post
+
+register(Resource(
+    Post,
+    lookup='slug',                                           # /api/agent/posts/<slug>/
+    fields=['title', 'slug', 'excerpt', 'body', 'category', 'tags'],   # what agents may write
+    read_only=['status', 'published_at'],                    # what they may only read
+    relations={'category': Relation('name'),                 # refer to related objects by name, not id
+               'tags': Relation('name', create=True, create_defaults=slug_defaults)},
+    create=True, defaults={'status': 'draft'},               # new posts are always drafts
+    locked_fields=['slug'], locked_if=lambda post: post.status == 'published',   # links never break
+    filters=['status'],                                      # ?status=draft
+    actions={'publish': Action(publish, 'Make the post public.',            # POST /api/agent/posts/<slug>/publish/
+                               {'published_at': 'ISO date to show, optional'})},
+))
+```
+
+Only listed fields are exposed. Saves go through a ModelForm and your model's `save()`, so validation and side
+effects match the admin.
+
+### Full example
+
+[`tests/testapp`](https://github.com/hexa01/django-agent-content/tree/main/tests/testapp) is a small working app used by the tests:
+[`models.py`](https://github.com/hexa01/django-agent-content/blob/main/tests/testapp/models.py) and its [`agent_resources.py`](https://github.com/hexa01/django-agent-content/blob/main/tests/testapp/agent_resources.py) show most
+options together: references by name, tags created when missing, drafts by default, a slug that locks once
+published, a filter, search, a `publish` action with a parameter, an inline list (an article's notes) and a
+single-object resource (site settings).
+
+### Resource options
+
+| Option | Meaning |
+|---|---|
+| `fields` | Writable (and readable) fields. |
+| `name` | URL name; default: the model's plural, e.g. `posts`. |
+| `lookup` | Field used in item URLs; default `pk`. |
+| `singular` | One item's name, used for tool names (`get_post`); default: the model's name. |
+| `description` | What this content is, shown to agents. |
+| `read_only` | Readable but not writable. |
+| `computed` | Read-only values: `{'url': lambda obj: obj.get_absolute_url()}`. |
+| `list_fields` | Fields shown in lists. |
+| `relations` | `{'field': Relation('name', create=False)}` for ForeignKey/ManyToMany fields. |
+| `create`, `defaults` | Allow creating; `defaults` are forced on create (e.g. a draft status). |
+| `locked_fields`, `locked_if` | Fields that can't change while `locked_if(obj)` is true. |
+| `filters`, `search` | `?field=value` filters; `search(queryset, text)` for `?q=`. |
+| `queryset` | `queryset()` if not `Model.objects.all()`. |
+| `singleton` | `get()` for one-object resources such as site settings: `/api/agent/<name>/`. |
+| `actions` | `{'publish': Action(fn, 'what it does', {'param': 'what it is'})}`: `POST <lookup>/<name>/`; `fn(obj, data)` returns the object. A plain function also works (its docstring describes it). |
+| `inlines` | `{'notes': Inline(Note, fk='article', fields=[...], order_field='position')}`: `GET`/`PUT <lookup>/notes/` replaces the list. |
+
+## API keys
+
+```bash
+python manage.py agent_content_key --label "Claude Code, laptop"           # never expires
+python manage.py agent_content_key --label "CI" --days 90
+python manage.py agent_content_key --list
+python manage.py agent_content_key --revoke ac_Ab12cd      # by prefix, or --revoke all --user agent-bot
+```
+
+The key is printed once; only its SHA-256 hash is stored. By default it acts as the user `agent-bot` (created if
+missing, with no password and no admin access) and is granted exactly the permissions your registered resources need.
+Keys can also be created, revoked and checked (last used, expiry) under **Admin › Agent content › API keys**.
+
+Agents send `Authorization: Bearer <key>`.
+
+## Endpoints
+
+| Request | Does |
+|---|---|
+| `GET /api/agent/` | API version and a description of every resource the key may see: each field's kind, label, help text, limits, choices and whether it's required, plus actions with their params. [agent-content-mcp](https://github.com/hexa01/agent-content-mcp) builds its tools from this. |
+| `GET <name>/` | List (`?field=value`, `?q=`). |
+| `POST <name>/` | Create (when `create=True`). |
+| `GET`, `PATCH <name>/<lookup>/` | Read, or change only the fields sent. |
+| `POST <name>/<lookup>/<action>/` | Run an action. |
+| `GET`, `PUT <name>/<lookup>/<inline>/` | Read or replace child rows. |
+
+Errors are JSON: `{"error": "...", "fields": {"slug": ["..."]}}`, written so an agent can fix its request.
+
+## Settings
+
+All optional.
+
+| Setting | Default | Meaning |
+|---|---|---|
+| `AGENT_CONTENT_MODULE` | `'agent_resources'` | File name looked up in each app. |
+| `AGENT_CONTENT_ADMIN_BASE` | `'django.contrib.admin.ModelAdmin'` | Base class for the key admin, e.g. `'unfold.admin.ModelAdmin'` for Unfold. |
+| `AGENT_CONTENT_RATE_LIMIT` | `120` | Requests per minute per key. |
+| `AGENT_CONTENT_MAX_BODY` | `1000000` | Largest request body in bytes. |
+| `AGENT_CONTENT_REQUIRE_HTTPS` | `None` | Refuse plain HTTP; `None` means "unless `DEBUG`". Behind a proxy, set Django's `SECURE_PROXY_SSL_HEADER`. |
+
+Tip: add `Disallow: /api/` to your `robots.txt`.
+
+## Security
+
+- Keys are hashed, can expire, and can be revoked at any time; keys of inactive users stop working.
+- What a key can do is its user's Django permissions. The API has no delete endpoints (inline lists replace their rows).
+- HTTPS is required outside `DEBUG`; requests are rate-limited and size-limited.
+- Every change is recorded in the admin's history under the key's user.
+
+## Development
+
+```bash
+python -m venv .venv && .venv/bin/pip install "Django>=5.2"
+.venv/bin/python runtests.py            # SQLite, no project needed
+```
+
+## Changelog
+
+- **0.1.2**: package metadata for PyPI (summary, keywords, classifiers, links); README example app and wording.
+- **0.1.1**: updates change only the fields sent (unsent text is left exactly as it was); actions take a
+  description and params (`Action`); the API description adds field kinds, labels, `required`, `singular` and
+  create defaults.
+- **0.1.0**: first release.
+
+## License
+
+MIT

django_agent_content-0.1.2/agent_content/__init__.py

@@ -0,0 +1,8 @@
+"""Let AI agents edit a Django site's content through a small, permission-checked JSON API.
+
+Apps say what may be edited in an `agent_resources.py` (see registry.py); keys are managed in admin
+or with `manage.py agent_content_key`."""
+
+from .registry import Action, Inline, Relation, Resource, register, slug_defaults
+
+__all__ = ['Action', 'Inline', 'Relation', 'Resource', 'register', 'slug_defaults']

django_agent_content-0.1.2/agent_content/admin.py

@@ -0,0 +1,51 @@
+from django.contrib import admin, messages
+from django.utils import timezone
+from django.utils.html import format_html
+from django.utils.module_loading import import_string
+
+from . import conf
+from .models import APIKey
+
+# a site using an admin theme (e.g. Unfold) sets AGENT_CONTENT_ADMIN_BASE to the theme's ModelAdmin
+BaseAdmin = import_string(conf.get('AGENT_CONTENT_ADMIN_BASE'))
+
+
+@admin.register(APIKey)
+class APIKeyAdmin(BaseAdmin):
+    list_display = ['label', 'user', 'key_start', 'state', 'expires_at', 'last_used_at', 'created_at']
+    list_filter = ['user']
+    search_fields = ['label', 'prefix', 'user__username']
+    actions = ['revoke_keys']
+    fields = ['user', 'label', 'expires_at']
+
+    def get_readonly_fields(self, request, obj=None):
+        # once created, only the label and expiry can change; the key itself never does
+        return ['user', 'key_start', 'state', 'created_at', 'last_used_at', 'revoked_at'] if obj else []
+
+    def get_fields(self, request, obj=None):
+        return self.fields + (['key_start', 'state', 'created_at', 'last_used_at', 'revoked_at'] if obj else [])
+
+    @admin.display(description='Key')
+    def key_start(self, key):
+        return f'{key.prefix}…'
+
+    @admin.display(description='Status')
+    def state(self, key):
+        return key.status
+
+    def save_model(self, request, obj, form, change):
+        if change:
+            return super().save_model(request, obj, form, change)
+        raw = obj.assign_new_key()
+        super().save_model(request, obj, form, change)
+        self.message_user(request, format_html(
+            'New key for {}: <code style="user-select:all">{}</code> Copy it now: it won\'t be shown again.', obj.user, raw,
+        ), messages.WARNING)
+
+    def has_delete_permission(self, request, obj=None):
+        return False  # revoke instead, so the history of which key did what stays readable
+
+    @admin.action(description='Revoke selected keys')
+    def revoke_keys(self, request, queryset):
+        count = queryset.filter(revoked_at__isnull=True).update(revoked_at=timezone.now())
+        self.message_user(request, f'Revoked {count} key(s).')

django_agent_content-0.1.2/agent_content/apps.py

@@ -0,0 +1,13 @@
+from django.apps import AppConfig
+from django.utils.module_loading import autodiscover_modules
+
+
+class AgentContentConfig(AppConfig):
+    default_auto_field = 'django.db.models.BigAutoField'
+    name = 'agent_content'
+    verbose_name = 'Agent content'
+
+    def ready(self):
+        # load every app's agent_resources.py (or the AGENT_CONTENT_MODULE name), like admin.py is loaded
+        from . import conf
+        autodiscover_modules(conf.get('AGENT_CONTENT_MODULE'))

django_agent_content-0.1.2/agent_content/auth.py

@@ -0,0 +1,51 @@
+import json
+from functools import wraps
+
+from django.http import JsonResponse
+from django.views.decorators.csrf import csrf_exempt
+
+from . import conf
+from .models import APIKey, KeyUsage
+
+
+def error(status, message, **extra):
+    return JsonResponse({'error': message, **extra}, status=status)
+
+
+def agent_view(view):
+    """Every API request: HTTPS, an API key (not a session, so no CSRF), rate and size limits, JSON body.
+    The view runs with request.user set to the key's user and request.data holding the parsed body."""
+
+    @csrf_exempt
+    @wraps(view)
+    def wrapper(request, *args, **kwargs):
+        if conf.get('AGENT_CONTENT_REQUIRE_HTTPS') and not request.is_secure():
+            return error(403, 'HTTPS is required.')
+
+        scheme, _, raw = request.headers.get('Authorization', '').partition(' ')
+        key = APIKey.find(raw.strip()) if scheme.lower() == 'bearer' and raw else None
+        if key is None:
+            response = error(401, 'A valid API key is required: Authorization: Bearer <key>.')
+            response['WWW-Authenticate'] = 'Bearer'
+            return response
+
+        if KeyUsage.hit(key) > conf.get('AGENT_CONTENT_RATE_LIMIT'):
+            return error(429, 'Too many requests. Try again in a minute.')
+        key.touch()
+
+        request.data = {}
+        if request.method in ('POST', 'PUT', 'PATCH'):
+            if len(request.body) > conf.get('AGENT_CONTENT_MAX_BODY'):
+                return error(413, 'The request body is too large.')
+            try:
+                request.data = json.loads(request.body or b'{}')
+            except ValueError:
+                return error(400, 'The request body must be JSON.')
+            if not isinstance(request.data, dict):
+                return error(400, 'The request body must be a JSON object.')
+
+        request.user = key.user
+        request.agent_key = key
+        return view(request, *args, **kwargs)
+
+    return wrapper

django_agent_content-0.1.2/agent_content/conf.py

@@ -0,0 +1,23 @@
+"""Settings, each optional. Override any of them in the project's settings.py."""
+
+from django.conf import settings
+
+DEFAULTS = {
+    # the file each app uses to register what agents may edit
+    'AGENT_CONTENT_MODULE': 'agent_resources',
+    # admin base class for the API key admin, e.g. 'unfold.admin.ModelAdmin'
+    'AGENT_CONTENT_ADMIN_BASE': 'django.contrib.admin.ModelAdmin',
+    # requests per minute per key
+    'AGENT_CONTENT_RATE_LIMIT': 120,
+    # largest accepted request body, in bytes
+    'AGENT_CONTENT_MAX_BODY': 1_000_000,
+    # refuse plain http; None means "only when DEBUG is off"
+    'AGENT_CONTENT_REQUIRE_HTTPS': None,
+}
+
+
+def get(name):
+    value = getattr(settings, name, DEFAULTS[name])
+    if name == 'AGENT_CONTENT_REQUIRE_HTTPS' and value is None:
+        return not settings.DEBUG
+    return value

django_agent_content-0.1.2/agent_content/management/commands/agent_content_key.py

@@ -0,0 +1,65 @@
+from datetime import timedelta
+
+from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Permission
+from django.core.management.base import BaseCommand, CommandError
+from django.utils import timezone
+
+from agent_content.models import APIKey
+from agent_content.registry import resources
+
+
+class Command(BaseCommand):
+    help = ('Create an API key (printed once), or list/revoke keys. The user is created if missing, as a non-staff '
+            'account (it can\'t log into admin) with exactly the permissions the registered resources need.')
+
+    def add_arguments(self, parser):
+        parser.add_argument('--user', default='agent-bot', help='Username the key acts as (default: agent-bot).')
+        parser.add_argument('--label', default='Agent', help='Where the key is used, e.g. "Claude Code, laptop".')
+        expiry = parser.add_mutually_exclusive_group()
+        expiry.add_argument('--days', type=int, help='Expire after this many days.')
+        expiry.add_argument('--never', action='store_true', help='Never expire (the default).')
+        parser.add_argument('--no-grant', action='store_true', help='Don\'t change the user\'s permissions.')
+        parser.add_argument('--list', action='store_true', help='List keys instead of creating one.')
+        parser.add_argument('--revoke', metavar='PREFIX', help='Revoke the key starting with PREFIX, or "all" for the user\'s keys.')
+
+    def handle(self, *args, **options):
+        User = get_user_model()
+        if options['list']:
+            for key in APIKey.objects.select_related('user'):
+                self.stdout.write(f'{key.prefix}…  {key.status:8} {key.user}  {key.label}  '
+                                  f'expires {key.expires_at or "never"}  last used {key.last_used_at or "never"}')
+            return
+
+        if options['revoke']:
+            keys = APIKey.objects.filter(revoked_at__isnull=True)
+            keys = keys.filter(user__username=options['user']) if options['revoke'] == 'all' else keys.filter(prefix__startswith=options['revoke'])
+            count = keys.update(revoked_at=timezone.now())
+            self.stdout.write(self.style.SUCCESS(f'Revoked {count} key(s).'))
+            return
+
+        user, created = User.objects.get_or_create(
+            username=options['user'], defaults={'is_staff': False, 'is_active': True})
+        if created:
+            user.set_unusable_password()
+            user.save()
+        if not options['no_grant']:
+            self.grant(user)
+
+        expires = timezone.now() + timedelta(days=options['days']) if options['days'] else None
+        key, raw = APIKey.generate(user, options['label'], expires)
+        self.stdout.write(self.style.SUCCESS(f'Key for {user} ({"expires " + str(expires.date()) if expires else "never expires"}):'))
+        self.stdout.write(raw)
+        self.stdout.write('Copy it now: it is not stored and won\'t be shown again.')
+
+    def grant(self, user):
+        needed = set().union(*(r.permissions() for r in resources().values())) if resources() else set()
+        if not needed:
+            raise CommandError('No agent resources are registered (no agent_resources.py found).')
+        for perm in sorted(needed):
+            app_label, codename = perm.split('.')
+            try:
+                user.user_permissions.add(Permission.objects.get(content_type__app_label=app_label, codename=codename))
+            except Permission.DoesNotExist:
+                raise CommandError(f'Permission {perm} does not exist. Run migrate first.')
+        self.stdout.write(f'{user} can: {", ".join(sorted(needed))}')

django_agent_content-0.1.2/agent_content/management/commands/agent_content_scaffold.py

@@ -0,0 +1,63 @@
+from pathlib import Path
+
+from django.apps import apps
+from django.core.management.base import BaseCommand, CommandError
+from django.db import models
+
+from agent_content import conf
+
+HEADER = '''"""What AI agents may edit in this app, through agent_content's API.
+
+Everything below starts commented out: uncomment the models and fields agents should be able to change.
+Only listed fields are exposed. Docs: the Resource options in agent_content/registry.py.
+"""
+
+from agent_content import Inline, Relation, Resource, register, slug_defaults  # noqa: F401
+
+'''
+
+
+class Command(BaseCommand):
+    help = 'Write a starter agent_resources.py for an app, listing its models and editable fields (all commented out).'
+
+    def add_arguments(self, parser):
+        parser.add_argument('app_label')
+
+    def handle(self, app_label, **options):
+        try:
+            config = apps.get_app_config(app_label)
+        except LookupError:
+            raise CommandError(f'No installed app "{app_label}".')
+        path = Path(config.path) / f'{conf.get("AGENT_CONTENT_MODULE")}.py'
+        if path.exists():
+            raise CommandError(f'{path} already exists; not overwriting it.')
+
+        blocks = [self.block(model) for model in config.get_models()]
+        imports = f'# from .models import {", ".join(m.__name__ for m in config.get_models())}\n\n' if blocks else ''
+        path.write_text(HEADER + imports + '\n\n'.join(blocks) + '\n')
+        self.stdout.write(self.style.SUCCESS(f'Wrote {path}. Review it, uncomment what agents may edit, then restart.'))
+
+    def block(self, model):
+        fields, relations = [], []
+        for field in model._meta.get_fields():
+            if not getattr(field, 'concrete', False) or field.auto_created or not field.editable:
+                continue
+            if isinstance(field, (models.FileField, models.AutoField)) or field.name in ('password', 'is_superuser', 'is_staff'):
+                continue
+            fields.append(field.name)
+            if field.many_to_one or field.many_to_many:
+                relations.append(field.name)
+        lookup = 'slug' if any(f.name == 'slug' for f in model._meta.fields) else 'pk'
+        lines = [
+            f'# register(Resource(',
+            f'#     {model.__name__},',
+            f'#     lookup={lookup!r},',
+            f'#     fields={fields!r},',
+            f'#     # read_only=[],            # readable but not writable, e.g. status or dates',
+            f'#     # create=False,            # True to allow new ones; set defaults={{...}} to force e.g. a draft status',
+        ]
+        if relations:
+            rel = ', '.join(f'{name!r}: Relation("name")' for name in relations)
+            lines.append(f'#     # relations={{{rel}}},  # refer to related objects by a field instead of id')
+        lines.append('# ))')
+        return '\n'.join(lines)