django-pfx 1.4.dev104__tar.gz → 1.4.dev108__tar.gz

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.4.dev104
+Version: 1.4.dev108
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com
@@ -34,8 +34,10 @@ Requires-Dist: apispec
 Requires-Dist: pyyaml
 Requires-Dist: pytz
 Requires-Dist: dill
+Requires-Dist: nh3
 Provides-Extra: otp
 Requires-Dist: pyotp; extra == "otp"
+Dynamic: license-file
 
 # Django PFX
 

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/django_pfx.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: django-pfx
-Version: 1.4.dev104
+Version: 1.4.dev108
 Summary: Django PFX is a toolkit designed to streamline the development of RESTful APIs using the Django framework.
 Author: Hervé Martinet
 Author-email: herve.martinet@gmail.com
@@ -34,8 +34,10 @@ Requires-Dist: apispec
 Requires-Dist: pyyaml
 Requires-Dist: pytz
 Requires-Dist: dill
+Requires-Dist: nh3
 Provides-Extra: otp
 Requires-Dist: pyotp; extra == "otp"
+Dynamic: license-file
 
 # Django PFX
 

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/django_pfx.egg-info/SOURCES.txt

@@ -37,7 +37,6 @@ pfx/pfxcore/__init__.py
 pfx/pfxcore/apps.py
 pfx/pfxcore/default_settings.py
 pfx/pfxcore/exceptions.py
-pfx/pfxcore/fields.py
 pfx/pfxcore/settings.py
 pfx/pfxcore/shortcuts.py
 pfx/pfxcore/test.py
@@ -48,6 +47,10 @@ pfx/pfxcore/apidoc/schema.py
 pfx/pfxcore/apidoc/tags.py
 pfx/pfxcore/decorator/__init__.py
 pfx/pfxcore/decorator/rest.py
+pfx/pfxcore/fields/__init__.py
+pfx/pfxcore/fields/media_field.py
+pfx/pfxcore/fields/minutes_duration_field.py
+pfx/pfxcore/fields/nh3_field.py
 pfx/pfxcore/http/__init__.py
 pfx/pfxcore/http/json_response.py
 pfx/pfxcore/locale/fr/LC_MESSAGES/django.mo
@@ -141,6 +144,7 @@ tests/tests/test_cache.py
 tests/tests/test_client.py
 tests/tests/test_fields_choices.py
 tests/tests/test_fields_minutes_duration.py
+tests/tests/test_fields_nh3.py
 tests/tests/test_filters.py
 tests/tests/test_locale_api.py
 tests/tests/test_ordered_rest_view_mixin.py

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/django_pfx.egg-info/requires.txt

@@ -7,6 +7,7 @@ apispec
 pyyaml
 pytz
 dill
+nh3
 
 [otp]
 pyotp

django_pfx-1.4.dev108/pfx/pfxcore/fields/__init__.py

@@ -0,0 +1,3 @@
+from .media_field import MediaField
+from .minutes_duration_field import MinutesDurationField
+from .nh3_field import NH3Field

django_pfx-1.4.dev108/pfx/pfxcore/fields/media_field.py

@@ -0,0 +1,60 @@
+import logging
+from importlib import import_module
+
+from django.db import models
+from django.db.models.signals import post_delete
+from django.dispatch import receiver
+
+from pfx.pfxcore.shortcuts import settings
+
+logger = logging.getLogger(__name__)
+
+
+def get_storage_class(class_path):
+    ps = class_path.split('.')
+    return getattr(import_module('.'.join(ps[:-1])), ps[-1])()
+
+
+class MediaField(models.JSONField):
+    def __init__(
+            self, *args, max_length=255, get_key=None, storage=None,
+            auto_delete=False, **kwargs):
+        self.get_key = get_key or self.get_default_key
+        if not storage and not settings.STORAGE_DEFAULT:
+            raise Exception(
+                "Missing storage. You have to set a storage "
+                "class on the field or define STORAGE_DEFAULT settings.")
+        self.storage = storage or get_storage_class(settings.STORAGE_DEFAULT)
+        self.auto_delete = auto_delete
+        super().__init__(
+            *args, max_length=max_length,
+            default=kwargs.pop('default', dict),
+            blank=kwargs.pop('blank', True),
+            **kwargs)
+
+    @staticmethod
+    def get_default_key(obj, filename):
+        return f"{type(obj).__name__}/{obj.pk}/{filename}"
+
+    def to_python(self, value):
+        return super().to_python(self.storage.to_python(value))
+
+    def get_upload_url(self, request, obj, filename):
+        key = self.get_key(obj, filename)
+        url = self.storage.get_upload_url(request, key)
+        return dict(url=url, file=dict(name=filename, key=key))
+
+    def get_url(self, request, obj):
+        return self.storage.get_url(
+            request, self.value_from_object(obj)['key'])
+
+    def upload(self, obj, file, filename, **kwargs):
+        key = self.get_key(obj, filename)
+        return self.to_python(self.storage.upload(key, file, **kwargs))
+
+
+@receiver(post_delete)
+def post_delete_media(sender, instance, **kwargs):
+    for field in sender._meta.fields:
+        if isinstance(field, MediaField) and field.auto_delete:
+            field.storage.delete(field.value_from_object(instance))

django_pfx-1.4.dev104/pfx/pfxcore/fields.py → django_pfx-1.4.dev108/pfx/pfxcore/fields/minutes_duration_field.py

@@ -1,69 +1,14 @@
 import logging
 import re
 from datetime import timedelta
-from importlib import import_module
 
 from django.core.exceptions import ValidationError
 from django.db import models
-from django.db.models.signals import post_delete
-from django.dispatch import receiver
 from django.utils.translation import gettext_lazy as _
 
-from pfx.pfxcore.shortcuts import settings
-
 logger = logging.getLogger(__name__)
 
 
-def get_storage_class(class_path):
-    ps = class_path.split('.')
-    return getattr(import_module('.'.join(ps[:-1])), ps[-1])()
-
-
-class MediaField(models.JSONField):
-    def __init__(
-            self, *args, max_length=255, get_key=None, storage=None,
-            auto_delete=False, **kwargs):
-        self.get_key = get_key or self.get_default_key
-        if not storage and not settings.STORAGE_DEFAULT:
-            raise Exception(
-                "Missing storage. You have to set a storage "
-                "class on the field or define STORAGE_DEFAULT settings.")
-        self.storage = storage or get_storage_class(settings.STORAGE_DEFAULT)
-        self.auto_delete = auto_delete
-        super().__init__(
-            *args, max_length=max_length,
-            default=kwargs.pop('default', dict),
-            blank=kwargs.pop('blank', True),
-            **kwargs)
-
-    @staticmethod
-    def get_default_key(obj, filename):
-        return f"{type(obj).__name__}/{obj.pk}/{filename}"
-
-    def to_python(self, value):
-        return super().to_python(self.storage.to_python(value))
-
-    def get_upload_url(self, request, obj, filename):
-        key = self.get_key(obj, filename)
-        url = self.storage.get_upload_url(request, key)
-        return dict(url=url, file=dict(name=filename, key=key))
-
-    def get_url(self, request, obj):
-        return self.storage.get_url(
-            request, self.value_from_object(obj)['key'])
-
-    def upload(self, obj, file, filename, **kwargs):
-        key = self.get_key(obj, filename)
-        return self.to_python(self.storage.upload(key, file, **kwargs))
-
-
-@receiver(post_delete)
-def post_delete_media(sender, instance, **kwargs):
-    for field in sender._meta.fields:
-        if isinstance(field, MediaField) and field.auto_delete:
-            field.storage.delete(field.value_from_object(instance))
-
-
 class MinutesDurationField(models.DurationField):
     RE_FLOAT = re.compile(r'^[0-9]*(\.[0-9]*)?$')
     RE_HH_MM = re.compile(r'^([0-9]*):([0-5][0-9])?$')

django_pfx-1.4.dev108/pfx/pfxcore/fields/nh3_field.py

@@ -0,0 +1,83 @@
+from django.conf import settings
+from django.db import models
+from django.utils.safestring import mark_safe
+
+import nh3
+
+
+def get_nh3_default_options():
+    nh3_args = {}
+    nh3_settings = {
+        "NH3_ALLOWED_TAGS": "tags",
+        "NH3_ALLOWED_ATTRIBUTES": "attributes",
+        "NH3_STRIP_COMMENTS": "strip_comments",
+        "NH3_URL_SCHEMES": "url_schemes",
+        "NH3_ATTRIBUTE_FILTER": "attribute_filter",
+        "NH3_LINK_REL": "link_rel",
+        "NH3_GENERIC_ATTRIBUTE_PREFIXES": "generic_attribute_prefixes",
+        "NH3_TAG_ATTRIBUTE_VALUES": "tag_attribute_values",
+        "NH3_SET_TAG_ATTRIBUTE_VALUES": "set_tag_attribute_values",
+    }
+
+    for setting, kwarg in nh3_settings.items():
+        if hasattr(settings, setting):
+            attr = getattr(settings, setting)
+            nh3_args[kwarg] = attr
+
+    return nh3_args
+
+
+class NH3Field(models.TextField):
+    def __init__(
+        self,
+        allowed_tags=None,
+        allowed_attributes=None,
+        url_schemes=None,
+        strip_comments=None,
+        attribute_filter=None,
+        link_rel=None,
+        generic_attribute_prefixes=None,
+        tag_attribute_values=None,
+        set_tag_attribute_values=None,
+        *args,
+        **kwargs,
+    ):
+        super().__init__(*args, **kwargs)
+
+        self.nh3_kwargs = get_nh3_default_options()
+
+        if allowed_tags:
+            self.nh3_kwargs["tags"] = allowed_tags
+        if allowed_attributes:
+            self.nh3_kwargs["attributes"] = allowed_attributes
+        if url_schemes:
+            self.nh3_kwargs["url_schemes"] = url_schemes
+        if strip_comments:
+            self.nh3_kwargs["strip_comments"] = strip_comments
+        if attribute_filter:
+            self.nh3_kwargs["attribute_filter"] = attribute_filter
+        if link_rel:
+            self.nh3_kwargs["link_rel"] = link_rel
+        if generic_attribute_prefixes:
+            self.nh3_kwargs["generic_attribute_prefixes"] = (
+                generic_attribute_prefixes)
+        if tag_attribute_values:
+            self.nh3_kwargs["tag_attribute_values"] = tag_attribute_values
+        if set_tag_attribute_values:
+            self.nh3_kwargs["set_tag_attribute_values"] = (
+                set_tag_attribute_values)
+
+    def pre_save(self, model_instance, add):
+        data = getattr(model_instance, self.attname)
+        if data is None:
+            return data
+        clean_value = nh3.clean(data, **self.nh3_kwargs) if data else ""
+        setattr(model_instance, self.attname, mark_safe(clean_value))
+        return clean_value
+
+    def from_db_value(self, value, expression, connection):
+        if value is None:
+            return value
+        # Values are sanitised before saving, so any value returned from the DB
+        # is safe to render unescaped.
+        return mark_safe(value)

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/pfx/pfxcore/locale/fr/LC_MESSAGES/django.po

@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2025-03-05 17:31+0100\n"
+"POT-Creation-Date: 2025-03-31 12:17+0200\n"
 "PO-Revision-Date: 2021-06-22 23:31+0200\n"
 "Last-Translator: \n"
 "Language-Team: \n"
@@ -47,11 +47,11 @@ msgstr "Interdit"
 msgid "Resource not found"
 msgstr "Ressource non trouvée"
 
-#: fields.py:86
+#: fields/minutes_duration_field.py:31
 msgid "Invalid value."
 msgstr "Valeur invalide."
 
-#: fields.py:101
+#: fields/minutes_duration_field.py:46
 msgid ""
 "Invalid format, it can be a number in hours, “1:05”, “:05”, “1h 5m”, “1.5h” "
 "or “30m”."
@@ -281,23 +281,23 @@ msgstr "Le paramètre object est requis pour move={move}."
 msgid "object {pk} does not exists in this move context."
 msgstr "object {pk} n'existe pas dans ce contexte de déplacement."
 
-#: views/rest_views.py:239
+#: views/rest_views.py:234
 #, python-brace-format
 msgid "{obj} cannot be deleted because it is referenced by other objects."
 msgstr ""
 "{obj} ne peut pas être supprimé car il est référencé par d’autres objets."
 
-#: views/rest_views.py:324
+#: views/rest_views.py:319
 #, python-brace-format
 msgid "{model} {obj} created."
 msgstr "{model} {obj} créé."
 
-#: views/rest_views.py:325
+#: views/rest_views.py:320
 #, python-brace-format
 msgid "{model} {obj} updated."
 msgstr "{model} {obj} modifié."
 
-#: views/rest_views.py:1170
+#: views/rest_views.py:1165
 #, python-brace-format
 msgid "{model} {obj} deleted."
 msgstr "{model} {obj} supprimé."

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/pfx/pfxcore/views/fields.py

@@ -1,11 +1,10 @@
 import inspect
 import logging
 import operator
-from datetime import date
 
+from django.core.exceptions import ValidationError
 from django.db import models
 from django.db.models.constants import LOOKUP_SEP
-from django.utils.formats import date_format
 from django.utils.functional import cached_property
 
 from apispec.utils import deepupdate
@@ -144,13 +143,8 @@ class ViewField:
             return self.json_repr(value)
         return value.json_repr()
 
-    def to_json(self, obj, format_date):
+    def to_json(self, obj):
         value = self.get_value(obj)
-        if format_date and isinstance(value, date):
-            return dict(
-                value=value,
-                formatted=date_format(
-                    value, format='SHORT_DATE_FORMAT', use_l10n=True))
         if self.field_type == FieldType.MinutesDurationField:
             return pfx_fields.MinutesDurationField.to_json(value)
         if self.field_type == FieldType.ModelObject:
@@ -343,9 +337,15 @@ class ViewModelField(ViewField):
                      if isinstance(value, dict) and 'value' in value
                      else value)
         elif self.field_type == FieldType.DateField:
-            value = (value['value']
-                     if isinstance(value, dict) and 'value' in value
-                     else value)
+            try:
+                value = value and field.to_python(value)
+            except ValidationError as e:
+                raise ValidationError({field.name: e})
+        elif self.field_type == FieldType.DateTimeField:
+            try:
+                value = value and field.to_python(value)
+            except ValidationError as e:
+                raise ValidationError({field.name: e})
         elif self.field_type == FieldType.IntegerField:
             value = value if value != '' else None
         elif self.field_type == FieldType.FloatField:

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/pfx/pfxcore/views/rest_views.py

@@ -205,11 +205,6 @@ class ModelMixin():
         """
         return self.model._meta.verbose_name
 
-    @property
-    def format_date(self):
-        """:meta private: Undocumented because it must be changed."""
-        return get_bool(self.request.GET, 'date_format')
-
     def message_response(self, message, **kwargs):
         """Build a message JSON response.
 
@@ -296,7 +291,7 @@ class ModelResponseMixin(ModelMixin):
         :rtype: :class:`JsonResponse`
         """
         return JsonResponse(self.serialize_object(o, **{
-            _f.alias: _f.to_json(o, self.format_date)
+            _f.alias: _f.to_json(o)
             for _f in self.get_fields().values()}, meta=meta))
 
     def validate(self, obj, rel_data=None, created=False, **kwargs):
@@ -759,7 +754,7 @@ class ListRestViewMixin(ModelResponseMixin):
             *self.get_list_fields_prefetch_related())
         for o in qs:
             yield self.serialize_object(o, **{
-                _f.alias: _f.to_json(o, self.format_date)
+                _f.alias: _f.to_json(o)
                 for _f in self.get_list_fields().values()})
 
     def get_short_list_result(self, qs):
@@ -1043,14 +1038,14 @@ class CreateRestViewMixin(ModelBodyMixin, ModelResponseMixin):
         return True
 
     def _post(self, *args, **kwargs):
-        obj = self.new_object()
-        data, rel_data = self.get_model_data(
-            obj, self.deserialize_body(), created=True)
-        forbidden = False
-        if not self.object_create_perm(data):
-            forbidden = True
-        self.set_values(obj, **data)
         try:
+            obj = self.new_object()
+            data, rel_data = self.get_model_data(
+                obj, self.deserialize_body(), created=True)
+            forbidden = False
+            if not self.object_create_perm(data):
+                forbidden = True
+            self.set_values(obj, **data)
             self.validate(obj, rel_data=rel_data, created=True)
             if forbidden:
                 raise ForbiddenError
@@ -1101,14 +1096,14 @@ class UpdateRestViewMixin(ModelBodyMixin, ModelResponseMixin):
         return True
 
     def _put(self, id, *args, **kwargs):
-        obj = self.get_object(pk=id)
-        data, rel_data = self.get_model_data(
-            obj, self.deserialize_body(), created=False)
-        forbidden = False
-        if not self.object_update_perm(obj, data):
-            forbidden = True
-        self.set_values(obj, **data)
         try:
+            obj = self.get_object(pk=id)
+            data, rel_data = self.get_model_data(
+                obj, self.deserialize_body(), created=False)
+            forbidden = False
+            if not self.object_update_perm(obj, data):
+                forbidden = True
+            self.set_values(obj, **data)
             self.validate(obj, rel_data=rel_data, created=False)
             if forbidden:
                 raise ForbiddenError

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/requirements.txt

@@ -20,3 +20,4 @@ apispec
 pyyaml
 pytz
 pyotp
+nh3

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/setup.cfg

@@ -40,6 +40,7 @@ install_requires =
 	pyyaml
 	pytz
 	dill
+	nh3
 
 [options.extras_require]
 otp = pyotp

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/tests/tests/__init__.py

@@ -8,6 +8,7 @@ from .test_cache import TestCache
 from .test_client import TestApiClient
 from .test_fields_choices import TestFieldsChoices
 from .test_fields_minutes_duration import TestFieldsMinutesDuration
+from .test_fields_nh3 import TestFieldsNh3
 from .test_filters import FiltersTest
 from .test_locale_api import LocaleAPITest
 from .test_ordered_rest_view_mixin import TestOrderedRestViewMixin

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/tests/tests/basic_api_test.py

@@ -632,15 +632,6 @@ class BasicAPITest(TestAssertMixin, TestCase):
         response = self.client.get(f'/api/books/{self.author1_book1.pk}')
         self.assertRC(response, 200)
         self.assertJE(response, 'pub_date', '1937-01-01')
-        response = self.client.get(
-            f'/api/books/{self.author1_book1.pk}?date_format=0')
-        self.assertRC(response, 200)
-        self.assertJE(response, 'pub_date', '1937-01-01')
-        response = self.client.get(
-            f'/api/books/{self.author1_book1.pk}?date_format=1')
-        self.assertRC(response, 200)
-        self.assertJE(response, 'pub_date.value', '1937-01-01')
-        self.assertJE(response, 'pub_date.formatted', '01/01/1937')
 
     def test_get_detail_with_rel_object(self):
         response = self.client.get(f'/api/books/{self.author3_book1.pk}')
@@ -764,6 +755,18 @@ class BasicAPITest(TestAssertMixin, TestCase):
             response, '__all__.@0',
             'The Hobbit already exists for John Ronald Reuel Tolkien')
 
+    def test_create_invalid_date(self):
+        response = self.client.post(
+            '/api/books', dict(
+                name="The Silmarillion",
+                author=self.author1.pk,
+                pub_date="19777-09-15"))
+        self.assertRC(response, 422)
+        self.assertJE(
+            response, 'pub_date.@0',
+            '“19777-09-15” value has an invalid date format. '
+            'It must be in YYYY-MM-DD format.')
+
     def test_update(self):
         response = self.client.put(
             f'/api/authors/{self.author1.pk}',

{django_pfx-1.4.dev104 → django_pfx-1.4.dev108}/tests/tests/test_fields_minutes_duration.py

@@ -29,7 +29,7 @@ class TestFieldsMinutesDuration(TestAssertMixin, TestCase):
             pub_date=date(1937, 1, 1)
         )
 
-    @patch('pfx.pfxcore.fields.logger', MagicMock())
+    @patch('pfx.pfxcore.fields.minutes_duration_field.logger', MagicMock())
     def test_to_python(self):
         d = MinutesDurationField()
         self.assertIsNone(d.to_python(None))

django_pfx-1.4.dev108/tests/tests/test_fields_nh3.py

@@ -0,0 +1,38 @@
+from django.db import connection, models
+from django.test import TestCase
+from django.test.utils import override_settings
+
+from pfx.pfxcore.fields import NH3Field
+from pfx.pfxcore.models import JSONReprMixin
+from pfx.pfxcore.test import TestAssertMixin
+
+
+class TestNh3Model(JSONReprMixin, models.Model):
+    html = NH3Field()
+    custom_html = NH3Field(
+        allowed_tags={'h1', 'p', 'span'},
+        allowed_attributes={'*': {'class'}})
+
+    class Meta:
+        verbose_name = "TestModel"
+        verbose_name_plural = "TestModels"
+        ordering = ['pk']
+
+
+@override_settings(ROOT_URLCONF=__name__)
+class TestFieldsNh3(TestAssertMixin, TestCase):
+
+    @classmethod
+    def setUpTestData(cls):
+        with connection.schema_editor() as schema_editor:
+            schema_editor.create_model(TestNh3Model)
+
+    def test_save(self):
+        t = TestNh3Model.objects.create(
+            html="<unknown>AAA</unknown>",
+            custom_html='<h1>TEST</h1>'
+            '<script>alert("hello")</script>'
+            '<p><span class="test" style="font-family: noto;"></span></p>')
+        self.assertEqual(t.html, "AAA")
+        self.assertEqual(
+            t.custom_html, '<h1>TEST</h1><p><span class="test"></span></p>')