django-ninja-aio-crud 2.18.1__tar.gz → 2.18.2__tar.gz

{django_ninja_aio_crud-2.18.1 → django_ninja_aio_crud-2.18.2}/CHANGELOG.md

@@ -1,5 +1,94 @@
 # 📋 Release Notes
 
+## 🏷️ [v2.18.2] - 2026-02-02
+
+---
+
+### 🔧 Improvements
+
+#### ✨ Removed Redundant Input Validation
+> `ninja_aio/models/utils.py`
+
+Removed redundant input field validation logic since Pydantic already validates all inputs before they reach the payload processing stage. This simplifies the codebase and properly handles field aliases and custom fields.
+
+**Removed methods:**
+
+| Method | Previous Line | Why Removed |
+|---|---|---|
+| `_validate_input_fields()` | 746-782 | Redundant - Pydantic validates all inputs during schema deserialization |
+| `get_valid_input_fields()` | 198-237 | Only used by removed `_validate_input_fields()` method |
+
+**Updated method:**
+- `parse_input_data()` - Removed call to `_validate_input_fields()` and added clarifying comment that Pydantic handles all validation
+
+**Why this improves the code:**
+
+Since Django Ninja uses Pydantic to validate all inputs against generated schemas:
+- ✅ Custom fields (defined via `custom_fields` parameter) are validated by Pydantic
+- ✅ Field aliases are properly handled by Pydantic during deserialization
+- ✅ By the time `parse_input_data()` receives the `Schema` instance, all validation has already occurred
+- ✅ `model_dump()` simply converts the validated instance to a dict with proper field names
+
+The removed validation was:
+- ❌ Redundant (Pydantic already validated)
+- ❌ Incomplete (couldn't properly handle all Pydantic features like aliases)
+- ❌ Assuming custom fields and aliases couldn't be used in requests
+
+**Example of what now works correctly:**
+
+```python
+from pydantic import Field
+from ninja_aio.models import Serializer, serializers
+
+class UserSerializer(Serializer):
+    class Meta:
+        model = User
+        schema_in = serializers.SchemaModelConfig(
+            fields=["username", "email"],
+            custom_fields=[
+                ("display_name", str, Field(alias="displayName"))  # Alias support
+            ]
+        )
+
+# Input with alias now works properly:
+# {"username": "john", "email": "john@example.com", "displayName": "John Doe"}
+# Pydantic handles the alias → Validation passes → No redundant checks
+```
+
+---
+
+### 🧪 Tests
+
+#### `ModelUtilHelperMethodsTestCase` — Removed 3 tests
+
+**Removed tests:**
+
+| Test | Reason |
+|---|---|
+| `test_validate_input_fields_valid_fields` | Method `_validate_input_fields` no longer exists |
+| `test_validate_input_fields_invalid_fields` | Method `_validate_input_fields` no longer exists |
+| `test_validate_input_fields_skips_custom_fields` | Method `_validate_input_fields` no longer exists |
+
+**Test results:**
+- ✅ 608 tests pass (down from 611)
+- ✅ 100% coverage maintained on `ninja_aio/models/utils.py`
+- ✅ 99% overall coverage maintained
+
+---
+
+### 🎯 Summary
+
+**Django Ninja Aio CRUD v2.18.2** is a code quality improvement release that removes redundant validation logic. By trusting Pydantic's built-in validation, the codebase is simplified while properly supporting all Pydantic features including field aliases and custom fields. This change has no impact on end users since Pydantic was already handling validation - we simply removed the redundant secondary validation that was incomplete and caused issues with aliases.
+
+**Key benefits:**
+- 🧹 **Simpler Code** — Removed 70+ lines of redundant validation logic
+- ✅ **Proper Alias Support** — Field aliases now work correctly without workarounds
+- 🎯 **Trust the Framework** — Pydantic handles all input validation; no redundant checks needed
+- 🔒 **Same Security** — No security impact since Pydantic validation was already the primary defense
+- 🧪 **100% Coverage** — Maintained complete test coverage across the codebase
+
+---
+
 ## 🏷️ [v2.18.1] - 2026-02-01
 
 ---
@@ -365,14 +454,6 @@ Added comprehensive tests for all new functionality:
 
 Added comprehensive performance benchmarking infrastructure for monitoring framework performance during development.
 
-**New files:**
-- `tests/performance/__init__.py` - Performance test package
-- `tests/performance/test_performance.py` - 482 lines, 19 benchmarks
-- `tests/performance/generate_report.py` - 511 lines, interactive HTML report generator
-- `tests/performance/check_regression.py` - 172 lines, regression detection
-- `run-performance.sh` - Shell script to run benchmarks
-- `.github/workflows/performance.yml` - CI workflow for automated benchmarking
-
 **Benchmark categories:**
 - Schema generation (4 tests)
 - Serialization (4 tests)

{django_ninja_aio_crud-2.18.1 → django_ninja_aio_crud-2.18.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-ninja-aio-crud
-Version: 2.18.1
+Version: 2.18.2
 Summary: Django Ninja AIO CRUD - Rest Framework
 Author: Giuseppe Casillo
 Requires-Python: >=3.10, <3.15

{django_ninja_aio_crud-2.18.1 → django_ninja_aio_crud-2.18.2}/ninja_aio/__init__.py

@@ -1,6 +1,6 @@
 """Django Ninja AIO CRUD - Rest Framework"""
 
-__version__ = "2.18.1"
+__version__ = "2.18.2"
 
 from .api import NinjaAIO
 

{django_ninja_aio_crud-2.18.1 → django_ninja_aio_crud-2.18.2}/ninja_aio/models/utils.py

@@ -195,46 +195,6 @@ class ModelUtil:
         """
         return [field.name for field in self.model._meta.get_fields()]
 
-    def get_valid_input_fields(
-        self, is_serializer: bool, serializer: "ModelSerializer | None" = None
-    ) -> set[str]:
-        """
-        Get allowlist of valid field names for input validation.
-
-        Security: Prevents field injection by returning only fields that should
-        be accepted from user input.
-
-        Parameters
-        ----------
-        is_serializer : bool
-            Whether using a ModelSerializer
-        serializer : ModelSerializer, optional
-            Serializer instance if applicable
-
-        Returns
-        -------
-        set[str]
-            Set of valid field names that can be accepted in input payloads
-        """
-        valid_fields = set(self.model_fields)
-
-        # If using a serializer, also include custom fields
-        if is_serializer and serializer:
-            # Get all custom fields defined in the serializer
-            try:
-                # Custom fields are those that are not model fields but are defined
-                # in the serializer configuration
-                for schema_type in ['create', 'update', 'read', 'detail']:
-                    try:
-                        schema_fields = serializer.get_fields(schema_type)
-                        if schema_fields:
-                            valid_fields.update(schema_fields)
-                    except (AttributeError, TypeError):
-                        continue
-            except (AttributeError, TypeError):
-                pass
-
-        return valid_fields
 
     @property
     def model_name(self) -> str:
@@ -743,43 +703,6 @@ class ModelUtil:
         obj = await self.get_object(request, query_data=query_data, is_for=is_for)
         return await self._bump_object_from_schema(obj, obj_schema)
 
-    def _validate_input_fields(
-        self, payload: dict, is_serializer: bool, serializer
-    ) -> None:
-        """
-        Validate non-custom payload keys against model fields.
-
-        Parameters
-        ----------
-        payload : dict
-            Input payload to validate.
-        is_serializer : bool
-            Whether using a ModelSerializer.
-        serializer : ModelSerializer | Serializer
-            Serializer instance if applicable.
-
-        Raises
-        ------
-        SerializeError
-            If invalid field names are found in payload.
-        """
-        invalid_fields = []
-        for key in payload.keys():
-            # Skip custom fields - they're validated by Pydantic schema
-            if is_serializer and serializer.is_custom(key):
-                continue
-            # Validate non-custom fields exist on the model
-            if key not in self.model_fields:
-                invalid_fields.append(key)
-
-        if invalid_fields:
-            raise SerializeError(
-                {
-                    "detail": f"Invalid field names in payload: {', '.join(sorted(invalid_fields))}",
-                    "invalid_fields": sorted(invalid_fields),
-                },
-                400,
-            )
 
     def _collect_custom_and_optional_fields(
         self, payload: dict, is_serializer: bool, serializer
@@ -888,7 +811,7 @@ class ModelUtil:
 
         Steps
         -----
-        - Validate fields against allowlist (security).
+        - Validate fields against schema (including aliases and custom fields).
         - Strip custom fields (retain separately).
         - Drop optional fields with None (ModelSerializer only).
         - Decode BinaryField base64 values.
@@ -917,8 +840,8 @@ class ModelUtil:
         )
         serializer = self.serializer if self.with_serializer else self.model
 
-        # Security: Validate non-custom payload keys against model fields
-        self._validate_input_fields(payload, is_serializer, serializer)
+        # Note: Field validation is handled by Pydantic during schema deserialization
+        # No additional validation needed here since data is already a validated Schema instance
 
         # Collect custom and optional fields
         customs, optionals = self._collect_custom_and_optional_fields(

{django_ninja_aio_crud-2.18.1 → django_ninja_aio_crud-2.18.2}/tests/models/test_models_extra.py

@@ -537,28 +537,6 @@ class ModelUtilHelperMethodsTestCase(TestCase):
         cls.util_custom = ModelUtil(CustomOptionalSerializer)
         cls.util_plain = ModelUtil(app_models.TestModelSerializer)
 
-    def test_validate_input_fields_valid_fields(self):
-        """_validate_input_fields should not raise for valid fields."""
-        payload = {"name": "test", "description": "desc"}
-        # Should not raise
-        self.util_plain._validate_input_fields(payload, False, None)
-
-    def test_validate_input_fields_invalid_fields(self):
-        """_validate_input_fields should raise SerializeError for invalid fields."""
-        payload = {"name": "test", "invalid_field": "value"}
-        with self.assertRaises(SerializeError) as cm:
-            self.util_plain._validate_input_fields(payload, False, None)
-        error_data = cm.exception.error
-        self.assertIn("invalid_fields", error_data)
-        self.assertIn("invalid_field", error_data["invalid_fields"])
-
-    def test_validate_input_fields_skips_custom_fields(self):
-        """_validate_input_fields should skip custom fields when using serializer."""
-        payload = {"name": "test", "extra": "custom"}
-        # Should not raise because 'extra' is a custom field
-        self.util_custom._validate_input_fields(
-            payload, True, CustomOptionalSerializer
-        )
 
     def test_collect_custom_and_optional_fields_with_serializer(self):
         """_collect_custom_and_optional_fields should collect custom and optional fields."""