django-ninja-expose 0.1.0__tar.gz

django_ninja_expose-0.1.0/PKG-INFO

@@ -0,0 +1,65 @@
+Metadata-Version: 2.3
+Name: django-ninja-expose
+Version: 0.1.0
+Summary: Add @expose() to a Django model. Get a REST API, powered by Django Ninja.
+Author: Benjamin Chau
+Author-email: Benjamin Chau <68836494+swarfte@users.noreply.github.com>
+Requires-Dist: django>=6.1.3
+Requires-Dist: django-ninja>=1.7.3
+Requires-Python: >=3.14
+Description-Content-Type: text/markdown
+
+# django-ninja-expose
+
+Add `@expose()` to a Django model. Get a REST API.
+
+```python
+from django.db import models
+from django_ninja_expose import expose
+
+@expose()
+class Task(models.Model):
+    title = models.CharField(max_length=200)
+    completed = models.BooleanField(default=False)
+```
+
+```python
+# urls.py
+from django.urls import path
+from ninja import NinjaAPI
+from django_ninja_expose import mount
+
+api = NinjaAPI()
+mount(api)  # or api.add_router("", get_router())
+
+urlpatterns = [path("api/", api.urls)]
+```
+
+You get `GET/POST /api/Task`, `GET/PUT/PATCH/DELETE/HEAD /api/Task/{pk}`, Django-native
+filtering (`?title__icontains=x&completed=false`), Ninja pagination and OpenAPI docs.
+
+## `@expose(path=None, methods=None, fields=None, query=None)`
+
+`None` = automatic, `[]` = none, list = explicit restriction.
+
+| arg | `None` | `[]` | list |
+|---|---|---|---|
+| `path` | class name | n/a | URL path |
+| `methods` | all six (`HEAD` is never implied) | no operations | only these |
+| `fields` | all concrete fields + M2M | no fields | only these |
+| `query` | all exposed fields | filtering disabled | only these (subset of `fields`) |
+
+Invalid configuration fails at import time (`ExposeConfigurationError` and subclasses);
+duplicate paths fail when the router is built.
+
+## Security warning
+
+`@expose()` exposes model data and CRUD operations by default, with no authentication.
+Explicitly restrict `methods`, `fields` and `query` for production APIs, and add auth
+on your `NinjaAPI`.
+
+## Notes
+
+- Foreign keys and many-to-many fields are represented by primary keys (no nesting).
+- Filters accept Django lookups/transforms on whitelisted fields only; relationship traversal is rejected (HTTP 400).
+- Writes run Django's `full_clean()`; non-editable fields (e.g. `auto_now_add`) are never writable.

django_ninja_expose-0.1.0/README.md

@@ -0,0 +1,54 @@
+# django-ninja-expose
+
+Add `@expose()` to a Django model. Get a REST API.
+
+```python
+from django.db import models
+from django_ninja_expose import expose
+
+@expose()
+class Task(models.Model):
+    title = models.CharField(max_length=200)
+    completed = models.BooleanField(default=False)
+```
+
+```python
+# urls.py
+from django.urls import path
+from ninja import NinjaAPI
+from django_ninja_expose import mount
+
+api = NinjaAPI()
+mount(api)  # or api.add_router("", get_router())
+
+urlpatterns = [path("api/", api.urls)]
+```
+
+You get `GET/POST /api/Task`, `GET/PUT/PATCH/DELETE/HEAD /api/Task/{pk}`, Django-native
+filtering (`?title__icontains=x&completed=false`), Ninja pagination and OpenAPI docs.
+
+## `@expose(path=None, methods=None, fields=None, query=None)`
+
+`None` = automatic, `[]` = none, list = explicit restriction.
+
+| arg | `None` | `[]` | list |
+|---|---|---|---|
+| `path` | class name | n/a | URL path |
+| `methods` | all six (`HEAD` is never implied) | no operations | only these |
+| `fields` | all concrete fields + M2M | no fields | only these |
+| `query` | all exposed fields | filtering disabled | only these (subset of `fields`) |
+
+Invalid configuration fails at import time (`ExposeConfigurationError` and subclasses);
+duplicate paths fail when the router is built.
+
+## Security warning
+
+`@expose()` exposes model data and CRUD operations by default, with no authentication.
+Explicitly restrict `methods`, `fields` and `query` for production APIs, and add auth
+on your `NinjaAPI`.
+
+## Notes
+
+- Foreign keys and many-to-many fields are represented by primary keys (no nesting).
+- Filters accept Django lookups/transforms on whitelisted fields only; relationship traversal is rejected (HTTP 400).
+- Writes run Django's `full_clean()`; non-editable fields (e.g. `auto_now_add`) are never writable.

django_ninja_expose-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+[project]
+name = "django-ninja-expose"
+version = "0.1.0"
+description = "Add @expose() to a Django model. Get a REST API, powered by Django Ninja."
+readme = "README.md"
+requires-python = ">=3.14"
+dependencies = [
+    "django>=6.1.3",
+    "django-ninja>=1.7.3",
+]
+
+[[project.authors]]
+name = "Benjamin Chau"
+email = "68836494+swarfte@users.noreply.github.com"
+
+[build-system]
+requires = ["uv_build>=0.12.0,<0.13.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.2.0",
+    "pytest-django>=4.14.0",
+]
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "tests.settings"
+pythonpath = ["."]
+testpaths = ["tests"]

django_ninja_expose-0.1.0/pyproject.toml.orig

@@ -0,0 +1,28 @@
+[project]
+name = "django-ninja-expose"
+version = "0.1.0"
+description = "Add @expose() to a Django model. Get a REST API, powered by Django Ninja."
+readme = "README.md"
+authors = [
+    { name = "Benjamin Chau", email = "68836494+swarfte@users.noreply.github.com" }
+]
+requires-python = ">=3.14"
+dependencies = [
+    "django>=6.1.3",
+    "django-ninja>=1.7.3",
+]
+
+[build-system]
+requires = ["uv_build>=0.12.0,<0.13.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.2.0",
+    "pytest-django>=4.14.0",
+]
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "tests.settings"
+pythonpath = ["."]
+testpaths = ["tests"]

django_ninja_expose-0.1.0/src/django_ninja_expose/__init__.py

@@ -0,0 +1,20 @@
+from .api import get_router, mount
+from .decorator import expose
+from .exceptions import (
+    ExposeConfigurationError,
+    InvalidFieldError,
+    InvalidLookupError,
+    InvalidQueryFieldError,
+    UnsupportedMethodError,
+)
+
+__all__ = [
+    "expose",
+    "get_router",
+    "mount",
+    "ExposeConfigurationError",
+    "UnsupportedMethodError",
+    "InvalidFieldError",
+    "InvalidQueryFieldError",
+    "InvalidLookupError",
+]

django_ninja_expose-0.1.0/src/django_ninja_expose/api.py

@@ -0,0 +1,18 @@
+"""Convenience entry points for wiring exposed models into a NinjaAPI."""
+
+from __future__ import annotations
+
+from ninja import NinjaAPI, Router
+
+from .router import build_router
+
+
+def get_router() -> Router:
+    """Router containing every ``@expose()``d model. Call after apps are loaded."""
+    return build_router()
+
+
+def mount(api: NinjaAPI, prefix: str = "") -> NinjaAPI:
+    """Attach all exposed models to ``api``."""
+    api.add_router(prefix, get_router())
+    return api

django_ninja_expose-0.1.0/src/django_ninja_expose/config.py

@@ -0,0 +1,17 @@
+"""Exposure configuration."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+SUPPORTED_METHODS: tuple[str, ...] = ("GET", "POST", "PUT", "PATCH", "DELETE", "HEAD")
+
+
+@dataclass(frozen=True)
+class ExposureConfig:
+    """Fully resolved configuration (no ``None`` values) for one model."""
+
+    path: str
+    methods: tuple[str, ...]
+    fields: tuple[str, ...]
+    query: tuple[str, ...]

django_ninja_expose-0.1.0/src/django_ninja_expose/decorator.py

@@ -0,0 +1,88 @@
+"""The public ``@expose()`` decorator."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import TypeVar
+
+from django.db.models import Model
+
+from . import registry
+from .config import SUPPORTED_METHODS, ExposureConfig
+from .exceptions import (
+    ExposeConfigurationError,
+    InvalidFieldError,
+    InvalidQueryFieldError,
+    UnsupportedMethodError,
+)
+from .introspection import get_eligible_fields
+
+M = TypeVar("M", bound=type[Model])
+
+
+def _resolve(
+    model: type[Model],
+    path: str | None,
+    methods: Iterable[str] | None,
+    fields: Iterable[str] | None,
+    query: Iterable[str] | None,
+) -> ExposureConfig:
+    if path is not None and (not isinstance(path, str) or not path.strip("/")):
+        raise ExposeConfigurationError(f"Invalid path {path!r} for {model.__name__}.")
+    resolved_path = path.strip("/") if path is not None else model.__name__
+
+    if methods is None:
+        resolved_methods = SUPPORTED_METHODS
+    else:
+        seen: list[str] = []
+        for m in methods:
+            upper = str(m).upper()
+            if upper not in SUPPORTED_METHODS:
+                raise UnsupportedMethodError(f"{m} is not a supported HTTP method.")
+            if upper not in seen:
+                seen.append(upper)
+        resolved_methods = tuple(seen)
+
+    eligible = get_eligible_fields(model)
+    if fields is None:
+        resolved_fields = tuple(eligible)
+    else:
+        resolved_fields = tuple(dict.fromkeys(fields))
+        for name in resolved_fields:
+            if name not in eligible:
+                raise InvalidFieldError(f"{model.__name__} has no field named '{name}'.")
+
+    if query is None:
+        resolved_query = resolved_fields
+    else:
+        resolved_query = tuple(dict.fromkeys(query))
+        for name in resolved_query:
+            if name not in eligible:
+                raise InvalidQueryFieldError(
+                    f"{model.__name__} has no field named '{name}' (used in query)."
+                )
+            if name not in resolved_fields:
+                raise InvalidQueryFieldError(
+                    f"Query field '{name}' of {model.__name__} is not in the exposed fields."
+                )
+
+    return ExposureConfig(resolved_path, resolved_methods, resolved_fields, resolved_query)
+
+
+def expose(
+    path: str | None = None,
+    methods: Iterable[str] | None = None,
+    fields: Iterable[str] | None = None,
+    query: Iterable[str] | None = None,
+):
+    """Expose a Django model as a REST API.
+
+    ``None`` means automatic, ``[]`` means none, a list means explicit restriction.
+    The model class is returned unchanged.
+    """
+
+    def decorator(model: M) -> M:
+        registry.register(model, _resolve(model, path, methods, fields, query))
+        return model
+
+    return decorator

django_ninja_expose-0.1.0/src/django_ninja_expose/exceptions.py

@@ -0,0 +1,21 @@
+"""Exceptions raised by django-ninja-expose."""
+
+
+class ExposeConfigurationError(Exception):
+    """Raised at startup when an ``@expose()`` configuration is invalid."""
+
+
+class UnsupportedMethodError(ExposeConfigurationError):
+    """An unsupported HTTP method was requested."""
+
+
+class InvalidFieldError(ExposeConfigurationError):
+    """``fields`` references a field the model does not have."""
+
+
+class InvalidQueryFieldError(ExposeConfigurationError):
+    """``query`` references an unknown field or a field that is not exposed."""
+
+
+class InvalidLookupError(Exception):
+    """A request used an invalid filter field or lookup (mapped to HTTP 400)."""

django_ninja_expose-0.1.0/src/django_ninja_expose/introspection.py

@@ -0,0 +1,28 @@
+"""Thin wrappers around ``Model._meta``."""
+
+from __future__ import annotations
+
+from django.db import models
+from django.db.models import Model
+from django.db.models.fields import AutoFieldMixin
+
+
+def get_eligible_fields(model: type[Model]) -> dict[str, models.Field]:
+    """Concrete fields plus forward many-to-many fields, keyed by name."""
+    meta = model._meta
+    result: dict[str, models.Field] = {f.name: f for f in meta.concrete_fields}
+    result.update({f.name: f for f in meta.many_to_many})
+    return result
+
+
+def get_pk(model: type[Model]) -> models.Field:
+    return model._meta.pk
+
+
+def is_auto_pk(field: models.Field) -> bool:
+    return isinstance(field, AutoFieldMixin)
+
+
+def is_writable(field: models.Field) -> bool:
+    """Whether a field may appear in create/update payloads."""
+    return bool(field.editable) and not is_auto_pk(field)

django_ninja_expose-0.1.0/src/django_ninja_expose/operations.py

@@ -0,0 +1,179 @@
+"""Operation factory: CRUD views registered on a Ninja router."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from django.core.exceptions import ValidationError
+from django.db import models, transaction
+from django.db.models import Model
+from django.http import HttpRequest, HttpResponse
+from django.shortcuts import get_object_or_404
+from django.utils.module_loading import import_string
+from ninja import Router, Status
+from ninja.conf import settings as ninja_settings
+from ninja.errors import HttpError
+from ninja.errors import ValidationError as NinjaValidationError
+from ninja.pagination import paginate
+
+from .config import ExposureConfig
+from .exceptions import InvalidLookupError
+from .introspection import get_eligible_fields
+from .queries import apply_filters, build_filters
+from .schemas import ModelSchemas
+
+
+def _reserved_params() -> set[str]:
+    """Query params owned by the Ninja pagination class (limit/offset/page...)."""
+    paginator = import_string(ninja_settings.PAGINATION_CLASS)
+    return set(paginator.Input.model_fields)
+
+
+def _validation_error(exc: ValidationError) -> NinjaValidationError:
+    if hasattr(exc, "error_dict"):
+        errors = [
+            {"loc": ["body", k], "msg": "; ".join(v), "type": "value_error"}
+            for k, v in exc.message_dict.items()
+        ]
+    else:
+        errors = [{"loc": ["body"], "msg": "; ".join(exc.messages), "type": "value_error"}]
+    return NinjaValidationError(errors)
+
+
+def _resolve_field(model: type[Model], key: str) -> models.Field:
+    try:
+        return model._meta.get_field(key)
+    except Exception:  # alias such as `project_id`
+        return model._meta.get_field(key.removesuffix("_id"))
+
+
+def _apply(model: type[Model], instance: Model, data: dict[str, Any]) -> dict[str, list]:
+    """Assign payload data to instance; return m2m values to set after save."""
+    m2m: dict[str, list] = {}
+    for key, value in data.items():
+        field = _resolve_field(model, key)
+        if field.many_to_many:
+            if value is None:  # omitted optional m2m: leave unchanged
+                continue
+            m2m[field.name] = list(value or [])
+        elif field.is_relation:
+            setattr(instance, field.attname, value)
+        else:
+            setattr(instance, field.name, value)
+    return m2m
+
+
+def _save(model: type[Model], instance: Model, data: dict[str, Any]) -> Model:
+    try:
+        with transaction.atomic():
+            m2m = _apply(model, instance, data)
+            # Validate only what the payload touched (relevant for PATCH).
+            touched = {_resolve_field(model, k).name for k in data}
+            exclude = [f.name for f in model._meta.fields if f.name not in touched]
+            instance.full_clean(exclude=exclude)
+            for name, ids in m2m.items():
+                related = model._meta.get_field(name).remote_field.model
+                if related._default_manager.filter(pk__in=ids).count() != len(set(ids)):
+                    raise ValidationError({name: ["Some related objects do not exist."]})
+            instance.save()
+            for name, ids in m2m.items():
+                getattr(instance, name).set(ids)
+    except ValidationError as exc:
+        raise _validation_error(exc) from exc
+    return instance
+
+
+def register_operations(
+    router: Router, model: type[Model], config: ExposureConfig, schemas: ModelSchemas
+) -> None:
+    collection = f"/{config.path}"
+    detail = f"/{config.path}/{{pk}}"
+    prefix = model._meta.label_lower.replace(".", "_")
+    methods = config.methods
+    reserved = _reserved_params()
+    Read, pk_type = schemas.read, schemas.pk_type
+
+    def queryset() -> models.QuerySet:
+        return model._default_manager.all()
+
+    def filtered(request: HttpRequest) -> models.QuerySet:
+        params = {k: request.GET[k] for k in request.GET}
+        try:
+            filters = build_filters(model, config.query, params, reserved)
+            return apply_filters(queryset(), filters)
+        except InvalidLookupError as exc:
+            raise HttpError(400, str(exc)) from exc
+
+    def add(url: str, http_method: str, func, name: str, **kwargs) -> None:
+        func.__name__ = name
+        router.add_api_operation(
+            url,
+            [http_method],
+            func,
+            operation_id=f"{prefix}_{name}",
+            tags=[model.__name__],
+            **kwargs,
+        )
+
+    if "GET" in methods:
+
+        def list_view(request: HttpRequest, **kwargs):
+            return filtered(request)
+
+        add(collection, "GET", paginate()(list_view), "list", response=list[Read])
+
+        def get_view(request: HttpRequest, pk):
+            return get_object_or_404(queryset(), pk=pk)
+
+        get_view.__annotations__ = {"pk": pk_type}
+        add(detail, "GET", get_view, "get", response=Read)
+
+    if "POST" in methods:
+
+        def create_view(request: HttpRequest, payload):
+            return Status(201, _save(model, model(), payload.model_dump()))
+
+        create_view.__annotations__ = {"payload": schemas.create}
+        add(collection, "POST", create_view, "create", response={201: Read})
+
+    if "PUT" in methods:
+
+        def put_view(request: HttpRequest, pk, payload):
+            obj = get_object_or_404(queryset(), pk=pk)
+            return _save(model, obj, payload.model_dump())
+
+        put_view.__annotations__ = {"pk": pk_type, "payload": schemas.update}
+        add(detail, "PUT", put_view, "update", response=Read)
+
+    if "PATCH" in methods:
+
+        def patch_view(request: HttpRequest, pk, payload):
+            obj = get_object_or_404(queryset(), pk=pk)
+            return _save(model, obj, payload.model_dump(exclude_unset=True))
+
+        patch_view.__annotations__ = {"pk": pk_type, "payload": schemas.patch}
+        add(detail, "PATCH", patch_view, "patch", response=Read)
+
+    if "DELETE" in methods:
+
+        def delete_view(request: HttpRequest, pk):
+            get_object_or_404(queryset(), pk=pk).delete()
+            return Status(204, None)
+
+        delete_view.__annotations__ = {"pk": pk_type}
+        add(detail, "DELETE", delete_view, "delete", response={204: None})
+
+    if "HEAD" in methods:
+
+        def head_list_view(request: HttpRequest):
+            filtered(request)
+            return HttpResponse(status=200)
+
+        add(collection, "HEAD", head_list_view, "head_list")
+
+        def head_detail_view(request: HttpRequest, pk):
+            get_object_or_404(queryset(), pk=pk)
+            return HttpResponse(status=200)
+
+        head_detail_view.__annotations__ = {"pk": pk_type}
+        add(detail, "HEAD", head_detail_view, "head_detail")

django_ninja_expose-0.1.0/src/django_ninja_expose/queries.py

@@ -0,0 +1,75 @@
+"""Query engine: safely turn query parameters into ORM filters."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable, Mapping
+from typing import Any
+
+from django.core.exceptions import FieldError, ValidationError
+from django.db import models
+from django.db.models import Model, QuerySet
+
+from .exceptions import InvalidLookupError
+from .introspection import get_eligible_fields
+
+LOOKUP_SEP = "__"
+_BOOL = {"true": True, "false": False}
+_MULTI = {"in", "range"}
+_ORM_ERRORS = (FieldError, ValueError, TypeError, ValidationError)
+
+
+def _convert(raw: str, last: str, is_bool_field: bool) -> Any:
+    lowered = raw.lower()
+    if last == "isnull":
+        if lowered not in _BOOL:
+            raise InvalidLookupError("isnull expects 'true' or 'false'.")
+        return _BOOL[lowered]
+    if last in _MULTI:
+        return raw.split(",")
+    if is_bool_field and lowered in _BOOL:
+        return _BOOL[lowered]
+    return raw
+
+
+def build_filters(
+    model: type[Model],
+    allowed: Iterable[str],
+    params: Mapping[str, str],
+    reserved: Iterable[str] = (),
+) -> dict[str, Any]:
+    """Validate params against the whitelist and return ``filter(**kwargs)``."""
+    allowed = set(allowed)
+    reserved = set(reserved)
+    eligible = get_eligible_fields(model)
+    filters: dict[str, Any] = {}
+
+    for key, raw in params.items():
+        if key in reserved:
+            continue
+        base, *rest = key.split(LOOKUP_SEP)
+        if base not in allowed or base not in eligible:
+            raise InvalidLookupError(f"Filtering by '{base}' is not allowed.")
+        field = eligible[base]
+
+        if rest:
+            # The part directly after the field must be a lookup or transform of
+            # the field itself; this blocks relationship traversal (project__name).
+            first = rest[0]
+            if not (field.get_lookup(first) or field.get_transform(first)):
+                raise InvalidLookupError(f"Unsupported lookup '{first}' for field '{base}'.")
+        is_bool = isinstance(field, models.BooleanField) and not rest
+        filters[key] = _convert(raw, rest[-1] if rest else "exact", is_bool)
+
+    # Let Django validate the full expression (transform chains, value coercion).
+    try:
+        model._default_manager.none().filter(**filters)
+    except _ORM_ERRORS as exc:
+        raise InvalidLookupError(f"Invalid filter: {exc}") from exc
+    return filters
+
+
+def apply_filters(qs: QuerySet, filters: dict[str, Any]) -> QuerySet:
+    try:
+        return qs.filter(**filters)
+    except _ORM_ERRORS as exc:
+        raise InvalidLookupError(f"Invalid filter: {exc}") from exc

django_ninja_expose-0.1.0/src/django_ninja_expose/registry.py

@@ -0,0 +1,21 @@
+"""Lightweight Model -> ExposureConfig registry."""
+
+from __future__ import annotations
+
+from django.db.models import Model
+
+from .config import ExposureConfig
+
+_registry: dict[type[Model], ExposureConfig] = {}
+
+
+def register(model: type[Model], config: ExposureConfig) -> None:
+    _registry[model] = config
+
+
+def get_registry() -> dict[type[Model], ExposureConfig]:
+    return dict(_registry)
+
+
+def clear() -> None:
+    _registry.clear()

django_ninja_expose-0.1.0/src/django_ninja_expose/router.py

@@ -0,0 +1,27 @@
+"""Build a Ninja Router from the exposure registry."""
+
+from __future__ import annotations
+
+from django.db.models import Model
+from ninja import Router
+
+from .exceptions import ExposeConfigurationError
+from .operations import register_operations
+from .registry import get_registry
+from .schemas import build_schemas
+
+
+def build_router(models: list[type[Model]] | None = None) -> Router:
+    """Create a Router with endpoints for every exposed model (or the given ones)."""
+    registry = get_registry()
+    if models is not None:
+        registry = {m: registry[m] for m in models}
+
+    seen: dict[str, type[Model]] = {}
+    router = Router()
+    for model, config in registry.items():
+        if config.path in seen:
+            raise ExposeConfigurationError(f"Duplicate expose path: '{config.path}'.")
+        seen[config.path] = model
+        register_operations(router, model, config, build_schemas(model, config))
+    return router

django_ninja_expose-0.1.0/src/django_ninja_expose/schemas.py

@@ -0,0 +1,69 @@
+"""Schema factory: Read / Create / Update / Patch schemas built on Ninja."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any
+
+from django.db.models import Model
+from ninja import Schema
+from ninja.orm import create_schema
+from ninja.orm.fields import get_schema_field
+from pydantic import ConfigDict, create_model
+
+from .config import ExposureConfig
+from .introspection import get_eligible_fields, get_pk, is_writable
+
+
+class _InputSchema(Schema):
+    """Accept both `project` and the alias `project_id` for foreign keys."""
+
+    model_config = ConfigDict(populate_by_name=True)
+
+
+@dataclass(frozen=True)
+class ModelSchemas:
+    read: type[Schema]
+    create: type[Schema]
+    update: type[Schema]
+    patch: type[Schema]
+    pk_type: Any
+
+
+def _build(
+    model: type[Model],
+    name: str,
+    fields: list[str],
+    optional: list[str] | str | None = None,
+    base=Schema,
+):
+    if not fields:  # ninja treats an empty list as "all fields"
+        return create_model(name, __base__=base)
+    return create_schema(
+        model,
+        name=name,
+        fields=fields,
+        optional_fields=optional,
+        base_class=base,
+    )
+
+
+def build_schemas(model: type[Model], config: ExposureConfig) -> ModelSchemas:
+    eligible = get_eligible_fields(model)
+    pk = get_pk(model)
+    base = f"{model._meta.app_label.title()}{model.__name__}"
+
+    read_fields = list(config.fields)
+
+    create_fields = [n for n in read_fields if is_writable(eligible[n])]
+    update_fields = [n for n in create_fields if n != pk.name]
+    # blank many-to-many fields may be omitted (Ninja would otherwise require them)
+    blank_m2m = [n for n in create_fields if eligible[n].many_to_many and eligible[n].blank]
+
+    return ModelSchemas(
+        read=_build(model, f"{base}Read", read_fields),
+        create=_build(model, f"{base}Create", create_fields, optional=blank_m2m, base=_InputSchema),
+        update=_build(model, f"{base}Update", update_fields, optional=blank_m2m, base=_InputSchema),
+        patch=_build(model, f"{base}Patch", update_fields, optional="__all__", base=_InputSchema),
+        pk_type=get_schema_field(pk, optional=False)[0],
+    )