django-modelsheet 0.3.0a1__tar.gz

django_modelsheet-0.3.0a1/CHANGELOG.md

@@ -0,0 +1,13 @@
+# Changelog
+
+## 0.3.0a1 — 2026-10-24
+
+- Initial Django package, explicit Admin registration, precompiled static assets.
+- Spreadsheet range editing, local undo/redo, safe atomic saves and row fingerprints.
+- Permission-aware search, grouped filters, sorting, snapshots and Admin switching.
+- Bounded Python/TypeScript formula engines with shared golden fixtures.
+- Immutable bulk previews, confirmation, audit, idempotency and background adapter contract.
+- Demo project, migrations, role/cleanup commands, CI and packaging checks.
+
+This initial release combines the planned v0.1–v0.3 increments. There are no prior
+published schemas to migrate; future releases must preserve forward migration paths.

django_modelsheet-0.3.0a1/CONTRIBUTING.md

@@ -0,0 +1,18 @@
+# Contributing
+
+Use Python 3.11+ (3.12+ with Django 6.x) and Node 22. Install `.[test]`, then run
+`npm ci` inside frontend. Build assets with `npm run build` and include both source
+and generated assets in changes. Never require npm in consuming Django projects.
+
+Run pytest, ruff, Vitest and Playwright as described in README. Formula semantics
+changes must add fixtures to tests/formula_cases.json and pass both runtimes.
+Use actual transactional tests with separate connections for concurrency changes.
+Database-specific behavior must be exercised by the PostgreSQL/MySQL CI jobs.
+
+Run makemigrations for schema changes. Do not rewrite released migrations. Preserve
+permission checks on every API/worker entry point and safe saves by default.
+Do not silently broaden a preview's members or automatically replay failed items.
+
+Update docs and CHANGELOG for public interfaces. Add dependency license notices when
+bundling new assets. Avoid committing local credentials, demo databases and generated
+test reports. The demo's explicit test credentials must not be used in production.

django_modelsheet-0.3.0a1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 django-modelsheet contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_modelsheet-0.3.0a1/MANIFEST.in

@@ -0,0 +1,13 @@
+include LICENSE README.md CHANGELOG.md CONTRIBUTING.md SECURITY.md
+recursive-include modelsheet/static *
+recursive-include modelsheet/templates *.html
+recursive-include modelsheet/locale *.po *.mo
+recursive-include docs *.md *.json
+recursive-include frontend *.ts *.json *.html *.css
+prune frontend/node_modules
+prune frontend/test-results
+prune frontend/playwright-report
+recursive-include tests *.py *.json
+recursive-include demo *.py
+recursive-include scripts *.py
+include manage.py

django_modelsheet-0.3.0a1/PKG-INFO

@@ -0,0 +1,196 @@
+Metadata-Version: 2.4
+Name: django-modelsheet
+Version: 0.3.0a1
+Summary: Spreadsheet editing, formulas and previewed bulk operations for Django Admin
+License-Expression: MIT
+Project-URL: Repository, https://github.com/svalench/django-modelsheet
+Project-URL: Documentation, https://github.com/svalench/django-modelsheet/blob/main/README.md
+Project-URL: Issues, https://github.com/svalench/django-modelsheet/issues
+Project-URL: Changelog, https://github.com/svalench/django-modelsheet/blob/main/CHANGELOG.md
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: Django :: 6.1
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django<6.2,>=5.2
+Provides-Extra: test
+Requires-Dist: pytest>=8; extra == "test"
+Requires-Dist: pytest-django>=4.9; extra == "test"
+Requires-Dist: pytest-timeout>=2; extra == "test"
+Requires-Dist: build; extra == "test"
+Requires-Dist: ruff; extra == "test"
+Requires-Dist: playwright; extra == "test"
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.2; extra == "postgres"
+Provides-Extra: mysql
+Requires-Dist: mysqlclient>=2.2; extra == "mysql"
+Dynamic: license-file
+
+# django-modelsheet
+
+Spreadsheet editing for explicitly registered Django Admin models: cell/range editing,
+local undo/redo, Decimal formulas, server-side filters, and previewed bulk changes.
+
+**0.3.0a1 is an alpha.** The repository includes a working demo, compiled assets,
+tests, and a compatibility CI matrix. A published PyPI release is not implied.
+
+## Quickstart
+
+Install a built wheel (or `pip install .` from this repository). After publication:
+
+```sh
+pip install django-modelsheet
+```
+
+```python
+# settings.py
+INSTALLED_APPS += ["modelsheet"]
+MODELSHEET = {"models": ["shop.Product"], "page_size": 200}
+
+# SQLite only: required for safe writes; PostgreSQL/MySQL use row locks.
+DATABASES["default"].setdefault("OPTIONS", {})["transaction_mode"] = "IMMEDIATE"
+```
+
+```python
+# admin.py
+from django.contrib import admin
+from modelsheet.admin import ModelSheetAdmin
+from .models import Product
+
+@admin.register(Product)
+class ProductAdmin(ModelSheetAdmin):
+    list_display = ("name", "price", "stock")
+    search_fields = ("name",)
+    sheet_fields = ("name", "price", "stock")
+    sheet_editable = ("price", "stock")
+    sheet_computed_fields = {"inventory_value": "=[price]*[stock]"}
+```
+
+```sh
+python manage.py migrate
+python manage.py collectstatic --noinput
+python manage.py modelsheet_roles  # optional: creates groups, assigns no users
+```
+
+Assign a group through Django Admin and mark the account as staff. Superusers can
+use configured sheets immediately. Open **Spreadsheet** from the model list, or
+visit `/admin/shop/product/sheet/`. No frontend build, CDN or extra URL include is
+required in the consuming project. Admin's existing sessions and CSRF protection apply.
+
+## Using the sheet
+
+- Double-click to edit; use the formula bar for a value or expression.
+- Changes stay local until **Save**. Ctrl/Cmd+Z, Ctrl/Cmd+Y and Ctrl/Cmd+S operate on this buffer.
+- Select a range, copy/paste TSV from Excel, or press Ctrl/Cmd+D to fill down.
+- Readonly cells are skipped during paste with a notification. A save is atomic across all changed rows.
+- Use **Sort** for ordered sort fields, or Alt+click a column header (Alt+Shift+click adds a field).
+  Ordinary header clicks select columns. Search and filters run on the server.
+- **Bulk change** selects either highlighted page rows or every matching row, including other pages.
+  Build a preview, inspect its exact count/values, then confirm it. Editing inputs requires a new preview.
+- **Ordinary Admin** is available only when its list can represent the same filter, ordering and page.
+
+Numbers use a decimal point and dates use ISO 8601. Empty pasted cells become
+NULL for nullable fields, otherwise empty text for text fields or a validation error.
+Prefix text beginning with `=` with an apostrophe, for example `'=SUM(A1:A2)`.
+
+## Configuration
+
+```python
+MODELSHEET = {
+    "models": ["shop.Product"],
+    "page_size": 200,
+    "max_page_size": 500,
+    "max_save_rows": 500,
+    "count_mode": "exact",  # exact | none (no approximate COUNT promise)
+    "bulk_background_threshold": 5000,
+    "max_bulk_rows": 100000,
+    "chunk_size": 200,
+    "snapshot_ttl_seconds": 1800,
+    "preview_ttl_seconds": 1800,
+    "history_retention_days": 365,
+    "max_operations_per_minute": 30,
+    "max_request_bytes": 1000000,
+    "formula": {"max_length": 500, "max_depth": 10, "max_steps": 10000, "timeout_ms": 250},
+    "background_adapter": None,
+}
+```
+
+Run `python manage.py modelsheet_cleanup` periodically through your scheduler.
+It removes expired snapshots and terminal/unused-preview operations beyond retention.
+Do not reuse old idempotency keys after their operation has been purged.
+
+## Permissions
+
+Access requires `is_active`, `is_staff`, `modelsheet.open`, the model's standard
+`view` permission, and `ModelAdmin.has_view_permission()`. Editing additionally
+requires the standard `change` permission and `has_change_permission()`.
+
+Package permission codenames include app/model identifiers:
+
+```text
+modelsheet.view_field_shop_product_price
+modelsheet.edit_field_shop_product_price
+modelsheet.bulk_shop_product
+modelsheet.history_shop_product
+```
+
+`get_queryset(request)` bounds every read/write. Object-level Admin hooks and the
+configured policy apply in addition. Hidden fields cannot be used in filters,
+sorting, formulas or history. Field permissions never grant model-level editing.
+
+Group templates are opt-in and additive: Viewer, Editor, Operator, Auditor and Admin.
+They grant access to the configured sheet fields; review these grants before
+assigning users, especially sensitive columns. They do not grant superuser status.
+
+## Development and demo
+
+```sh
+python -m pip install -e '.[test]'
+cd frontend
+npm ci
+npm run build
+npm test
+cd ..
+python manage.py migrate
+python manage.py seed_demo --create-user
+python manage.py runserver
+```
+
+The explicit `--create-user` option creates a local-only `admin` / `admin` account.
+The demo settings are not production settings. Open
+`http://127.0.0.1:8000/admin/shop/product/sheet/`.
+
+```sh
+python -m pytest
+python -m ruff check .
+python -m build --no-isolation
+cd frontend
+npx playwright install chromium
+npm run test:e2e
+```
+
+Target matrix: Django 5.2 / Python 3.11–3.14; Django 6.0 and 6.1 / Python
+3.12–3.14; PostgreSQL, MySQL/InnoDB, SQLite. CI exercises valid combinations and
+the same transactional contract across databases. Consult CI results before
+treating a combination as verified; local results are recorded in `docs/validation.md`.
+
+## Boundaries
+
+Safe mode calls `full_clean()` and the instance's `save()` by default, including
+normal model signals. Custom `ModelAdmin.save_model()`, custom Admin forms,
+`save_related()` and external effects need an explicit adapter. Snapshot fingerprints
+cover concrete model fields, not all intermediate history or related-table contents.
+
+Sheets use the `default` database. User models require no extra fields or inheritance.
+Existing scalar fields are editable; FK fields can be displayed/filtered but FK/M2M
+editors, server undo, file import/export, fast-save, cursor pagination and persistent
+formulas are deferred. Large operations require your own background adapter.
+
+See [formulas](docs/formulas.md), [extension API](docs/extensions.md),
+[background processing](docs/background.md), [HTTP API](docs/api.md), and
+[release procedure](docs/releasing.md). Bundled dependency notices are in
+`modelsheet/static/modelsheet/THIRD_PARTY_LICENSES.txt`.

django_modelsheet-0.3.0a1/README.md

@@ -0,0 +1,164 @@
+# django-modelsheet
+
+Spreadsheet editing for explicitly registered Django Admin models: cell/range editing,
+local undo/redo, Decimal formulas, server-side filters, and previewed bulk changes.
+
+**0.3.0a1 is an alpha.** The repository includes a working demo, compiled assets,
+tests, and a compatibility CI matrix. A published PyPI release is not implied.
+
+## Quickstart
+
+Install a built wheel (or `pip install .` from this repository). After publication:
+
+```sh
+pip install django-modelsheet
+```
+
+```python
+# settings.py
+INSTALLED_APPS += ["modelsheet"]
+MODELSHEET = {"models": ["shop.Product"], "page_size": 200}
+
+# SQLite only: required for safe writes; PostgreSQL/MySQL use row locks.
+DATABASES["default"].setdefault("OPTIONS", {})["transaction_mode"] = "IMMEDIATE"
+```
+
+```python
+# admin.py
+from django.contrib import admin
+from modelsheet.admin import ModelSheetAdmin
+from .models import Product
+
+@admin.register(Product)
+class ProductAdmin(ModelSheetAdmin):
+    list_display = ("name", "price", "stock")
+    search_fields = ("name",)
+    sheet_fields = ("name", "price", "stock")
+    sheet_editable = ("price", "stock")
+    sheet_computed_fields = {"inventory_value": "=[price]*[stock]"}
+```
+
+```sh
+python manage.py migrate
+python manage.py collectstatic --noinput
+python manage.py modelsheet_roles  # optional: creates groups, assigns no users
+```
+
+Assign a group through Django Admin and mark the account as staff. Superusers can
+use configured sheets immediately. Open **Spreadsheet** from the model list, or
+visit `/admin/shop/product/sheet/`. No frontend build, CDN or extra URL include is
+required in the consuming project. Admin's existing sessions and CSRF protection apply.
+
+## Using the sheet
+
+- Double-click to edit; use the formula bar for a value or expression.
+- Changes stay local until **Save**. Ctrl/Cmd+Z, Ctrl/Cmd+Y and Ctrl/Cmd+S operate on this buffer.
+- Select a range, copy/paste TSV from Excel, or press Ctrl/Cmd+D to fill down.
+- Readonly cells are skipped during paste with a notification. A save is atomic across all changed rows.
+- Use **Sort** for ordered sort fields, or Alt+click a column header (Alt+Shift+click adds a field).
+  Ordinary header clicks select columns. Search and filters run on the server.
+- **Bulk change** selects either highlighted page rows or every matching row, including other pages.
+  Build a preview, inspect its exact count/values, then confirm it. Editing inputs requires a new preview.
+- **Ordinary Admin** is available only when its list can represent the same filter, ordering and page.
+
+Numbers use a decimal point and dates use ISO 8601. Empty pasted cells become
+NULL for nullable fields, otherwise empty text for text fields or a validation error.
+Prefix text beginning with `=` with an apostrophe, for example `'=SUM(A1:A2)`.
+
+## Configuration
+
+```python
+MODELSHEET = {
+    "models": ["shop.Product"],
+    "page_size": 200,
+    "max_page_size": 500,
+    "max_save_rows": 500,
+    "count_mode": "exact",  # exact | none (no approximate COUNT promise)
+    "bulk_background_threshold": 5000,
+    "max_bulk_rows": 100000,
+    "chunk_size": 200,
+    "snapshot_ttl_seconds": 1800,
+    "preview_ttl_seconds": 1800,
+    "history_retention_days": 365,
+    "max_operations_per_minute": 30,
+    "max_request_bytes": 1000000,
+    "formula": {"max_length": 500, "max_depth": 10, "max_steps": 10000, "timeout_ms": 250},
+    "background_adapter": None,
+}
+```
+
+Run `python manage.py modelsheet_cleanup` periodically through your scheduler.
+It removes expired snapshots and terminal/unused-preview operations beyond retention.
+Do not reuse old idempotency keys after their operation has been purged.
+
+## Permissions
+
+Access requires `is_active`, `is_staff`, `modelsheet.open`, the model's standard
+`view` permission, and `ModelAdmin.has_view_permission()`. Editing additionally
+requires the standard `change` permission and `has_change_permission()`.
+
+Package permission codenames include app/model identifiers:
+
+```text
+modelsheet.view_field_shop_product_price
+modelsheet.edit_field_shop_product_price
+modelsheet.bulk_shop_product
+modelsheet.history_shop_product
+```
+
+`get_queryset(request)` bounds every read/write. Object-level Admin hooks and the
+configured policy apply in addition. Hidden fields cannot be used in filters,
+sorting, formulas or history. Field permissions never grant model-level editing.
+
+Group templates are opt-in and additive: Viewer, Editor, Operator, Auditor and Admin.
+They grant access to the configured sheet fields; review these grants before
+assigning users, especially sensitive columns. They do not grant superuser status.
+
+## Development and demo
+
+```sh
+python -m pip install -e '.[test]'
+cd frontend
+npm ci
+npm run build
+npm test
+cd ..
+python manage.py migrate
+python manage.py seed_demo --create-user
+python manage.py runserver
+```
+
+The explicit `--create-user` option creates a local-only `admin` / `admin` account.
+The demo settings are not production settings. Open
+`http://127.0.0.1:8000/admin/shop/product/sheet/`.
+
+```sh
+python -m pytest
+python -m ruff check .
+python -m build --no-isolation
+cd frontend
+npx playwright install chromium
+npm run test:e2e
+```
+
+Target matrix: Django 5.2 / Python 3.11–3.14; Django 6.0 and 6.1 / Python
+3.12–3.14; PostgreSQL, MySQL/InnoDB, SQLite. CI exercises valid combinations and
+the same transactional contract across databases. Consult CI results before
+treating a combination as verified; local results are recorded in `docs/validation.md`.
+
+## Boundaries
+
+Safe mode calls `full_clean()` and the instance's `save()` by default, including
+normal model signals. Custom `ModelAdmin.save_model()`, custom Admin forms,
+`save_related()` and external effects need an explicit adapter. Snapshot fingerprints
+cover concrete model fields, not all intermediate history or related-table contents.
+
+Sheets use the `default` database. User models require no extra fields or inheritance.
+Existing scalar fields are editable; FK fields can be displayed/filtered but FK/M2M
+editors, server undo, file import/export, fast-save, cursor pagination and persistent
+formulas are deferred. Large operations require your own background adapter.
+
+See [formulas](docs/formulas.md), [extension API](docs/extensions.md),
+[background processing](docs/background.md), [HTTP API](docs/api.md), and
+[release procedure](docs/releasing.md). Bundled dependency notices are in
+`modelsheet/static/modelsheet/THIRD_PARTY_LICENSES.txt`.

django_modelsheet-0.3.0a1/SECURITY.md

@@ -0,0 +1,15 @@
+# Security
+
+For a suspected vulnerability, use the repository's private vulnerability reporting
+feature when available; do not disclose exploit details or customer data in a public
+issue. If private reporting is unavailable, ask the maintainer for a private channel
+without including sensitive details.
+
+The package is currently an unreleased alpha. Track Django security updates and pin
+supported patch versions in deployments. Follow least privilege when assigning group
+templates. Audit history stores plaintext before/after values in the application DB;
+protect database access/backups and choose an appropriate retention period.
+
+Formula expressions have no host-language execution facilities. UI values are rendered
+as text. Mutations use CSRF and server-side field/row checks. External application
+hooks and background context restoration are part of the integrating project's trust boundary.

django_modelsheet-0.3.0a1/demo/settings.py

@@ -0,0 +1,76 @@
+"""Development/test project. Never deploy with this secret or DEBUG enabled."""
+
+import os
+from pathlib import Path
+
+BASE_DIR = Path(__file__).resolve().parent.parent
+SECRET_KEY = "modelsheet-local-demo-only-do-not-deploy"
+DEBUG = True
+ALLOWED_HOSTS = ["localhost", "127.0.0.1", "testserver"]
+INSTALLED_APPS = [
+    "django.contrib.admin",
+    "django.contrib.auth",
+    "django.contrib.contenttypes",
+    "django.contrib.sessions",
+    "django.contrib.messages",
+    "django.contrib.staticfiles",
+    "modelsheet",
+    "demo.shop",
+]
+MIDDLEWARE = [
+    "django.middleware.security.SecurityMiddleware",
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.locale.LocaleMiddleware",
+    "django.middleware.common.CommonMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+    "django.contrib.messages.middleware.MessageMiddleware",
+]
+ROOT_URLCONF = "demo.urls"
+TEMPLATES = [
+    {
+        "BACKEND": "django.template.backends.django.DjangoTemplates",
+        "APP_DIRS": True,
+        "OPTIONS": {
+            "context_processors": [
+                "django.template.context_processors.request",
+                "django.contrib.auth.context_processors.auth",
+                "django.contrib.messages.context_processors.messages",
+            ]
+        },
+    }
+]
+DATABASES = {
+    "default": {
+        "ENGINE": "django.db.backends.sqlite3",
+        "NAME": BASE_DIR / "demo.sqlite3",
+        "OPTIONS": {"transaction_mode": "IMMEDIATE", "timeout": 20},
+    }
+}
+if os.environ.get("MODELSHEET_DB") == "postgres":
+    DATABASES["default"] = {
+        "ENGINE": "django.db.backends.postgresql",
+        "NAME": "modelsheet",
+        "USER": "modelsheet",
+        "PASSWORD": "modelsheet",
+        "HOST": "127.0.0.1",
+        "PORT": "5432",
+    }
+elif os.environ.get("MODELSHEET_DB") == "mysql":
+    DATABASES["default"] = {
+        "ENGINE": "django.db.backends.mysql",
+        "NAME": "modelsheet",
+        "USER": "root",
+        "PASSWORD": "modelsheet",
+        "HOST": "127.0.0.1",
+        "PORT": "3306",
+        "OPTIONS": {"charset": "utf8mb4", "init_command": "SET default_storage_engine=INNODB"},
+    }
+DEFAULT_AUTO_FIELD = "django.db.models.BigAutoField"
+STATIC_URL = "/static/"
+STATIC_ROOT = BASE_DIR / "staticfiles"
+LANGUAGE_CODE = "en"
+LANGUAGES = [("en", "English"), ("ru", "Русский")]
+TIME_ZONE = "UTC"
+USE_TZ = True
+MODELSHEET = {"models": ["shop.Product", "shop.Order"], "page_size": 200}

django_modelsheet-0.3.0a1/demo/shop/admin.py

@@ -0,0 +1,46 @@
+from django.contrib import admin
+
+from modelsheet.admin import ModelSheetAdmin
+from .models import Category, Order, Product
+
+
+@admin.register(Product)
+class ProductAdmin(ModelSheetAdmin):
+    list_display = ("name", "price", "stock", "status", "category", "active")
+    list_filter = ("status", "category", "active")
+    search_fields = ("name", "note")
+    sheet_fields = (
+        "name",
+        "price",
+        "cost_price",
+        "stock",
+        "status",
+        "category",
+        "active",
+        "available_on",
+        "note",
+    )
+    sheet_editable = (
+        "name",
+        "price",
+        "cost_price",
+        "stock",
+        "status",
+        "active",
+        "available_on",
+        "note",
+    )
+    sheet_computed_fields = {"inventory_value": "=[price]*[stock]"}
+    list_per_page = 200
+
+
+@admin.register(Order)
+class OrderAdmin(ModelSheetAdmin):
+    list_display = ("reference", "total", "paid")
+    sheet_fields = ("reference", "total", "paid", "created_at")
+    sheet_editable = ("paid",)
+    search_fields = ("reference",)
+    list_per_page = 200
+
+
+admin.site.register(Category)

django_modelsheet-0.3.0a1/demo/shop/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+
+class ShopConfig(AppConfig):
+    name = "demo.shop"
+    label = "shop"

django_modelsheet-0.3.0a1/demo/shop/management/commands/seed_demo.py

@@ -0,0 +1,38 @@
+from decimal import Decimal
+
+from django.contrib.auth import get_user_model
+from django.core.management.base import BaseCommand
+
+from demo.shop.models import Category, Product
+
+
+class Command(BaseCommand):
+    help = "Seed local demo products; creates admin/admin only when --create-user is supplied."
+
+    def add_arguments(self, parser):
+        parser.add_argument("--rows", type=int, default=500)
+        parser.add_argument("--create-user", action="store_true")
+
+    def handle(self, *args, **options):
+        category, _ = Category.objects.get_or_create(name="Consumables")
+        Product.objects.bulk_create(
+            [
+                Product(
+                    name=f"Product {i:07}",
+                    price=Decimal("10.00") + i,
+                    stock=i % 30,
+                    category=category,
+                )
+                for i in range(options["rows"])
+            ],
+            ignore_conflicts=True,
+        )
+        if options["create_user"]:
+            user, created = get_user_model().objects.get_or_create(
+                username="admin", defaults={"is_staff": True, "is_superuser": True}
+            )
+            if created:
+                user.set_password("admin")
+                user.save()
+                self.stdout.write("Local demo login: admin / admin")
+        self.stdout.write(f"Products: {Product.objects.count()}")