django-qbe2 0.1.0a1__tar.gz

django_qbe2-0.1.0a1/.gitignore

@@ -0,0 +1,226 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+*.lcov
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+docs/build/
+
+# Personal plans and local agent state
+/.superpowers/
+/tasks/
+/docs/superpowers/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# uv
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi/*
+!.pixi/config.toml
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule*
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs/Zensical documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore that
+#   can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, you
+#   could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml

django_qbe2-0.1.0a1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Carlos A. Rocha
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_qbe2-0.1.0a1/PKG-INFO

@@ -0,0 +1,145 @@
+Metadata-Version: 2.4
+Name: django-qbe2
+Version: 0.1.0a1
+Summary: A reusable Django app for authorized query-by-example reports.
+Project-URL: Documentation, https://github.com/CARocha/django-qbe2/tree/main/docs
+Project-URL: Repository, https://github.com/CARocha/django-qbe2
+Project-URL: Issues, https://github.com/CARocha/django-qbe2/issues
+Author: Carlos A. Rocha
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 6.1
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.14
+Requires-Python: <3.15,>=3.14
+Requires-Dist: django<6.2,>=6.1
+Description-Content-Type: text/markdown
+
+# Django QBE 2
+
+A reusable Django app for building authorized reports without writing SQL.
+Choose columns, add typed conditions, follow model relationships, preview paginated
+results and export a CSV. Designed for **Python 3.14 and Django 6.1**.
+
+**Experimental alpha:** this is the initial implementation, not a production
+release or a drop-in replacement for the original package. The first release
+candidate is `0.1.0a1`; check [PyPI](https://pypi.org/project/django-qbe2/) for its
+availability. Inspired by [versae/qbe](https://github.com/versae/qbe), rebuilt around
+Django's ORM, explicit permissions and typed query definitions.
+
+## Try the demo
+
+From a checkout containing this implementation:
+
+```sh
+uv sync --python 3.14 --frozen --group dev
+uv run python demo/manage.py migrate
+uv run python demo/manage.py seed_demo
+uv run python demo/manage.py changepassword qbe2_demo_alice
+uv run python demo/manage.py runserver 127.0.0.1:8000
+```
+
+Open [the report builder](http://127.0.0.1:8000/qbe/) and log in as
+`qbe2_demo_alice` with the password you chose. The seed creates six synthetic
+customers and 24 orders for two users. Each user can view only their own records.
+It never sets a shared password or overwrites an existing non-demo account.
+An optional superuser created with `createsuperuser` can inspect all demo records.
+
+## Install in another project
+
+Build and install the local wheel in that project's environment:
+
+```sh
+uv build
+python -m pip install /absolute/path/to/dist/django_qbe2-0.1.0a1-py3-none-any.whl
+```
+
+Add the app and mount its namespaced URLs alongside Django Admin:
+
+```python
+# Keep your existing Django apps, including admin, auth, sessions and messages.
+INSTALLED_APPS += ["django_qbe2"]
+```
+
+```python
+from django.urls import include, path
+
+# Keep your existing admin URL and other routes.
+urlpatterns += [path("qbe/", include("django_qbe2.urls"))]
+```
+
+Keep standard authentication, sessions and CSRF middleware, APP_DIRS template
+discovery and the admin context processors. Serve the packaged assets with your
+usual Django static-file setup. The reporting app itself has no models to migrate.
+The catalog is empty until you register reports.
+
+## Register reports and their policies
+
+Create `qbe.py` in your own installed app. Modules are discovered at startup,
+without fetching report data. Register related targets as well as root models:
+
+```python
+from django_qbe2.registry import Report, register
+from .models import Customer, Order
+
+
+@register
+class CustomerReport(Report):
+    model = Customer
+    fields = ("name",)
+
+    def get_queryset(self, request):
+        return Customer.objects.filter(owner=request.user)
+
+
+@register
+class OrderReport(Report):
+    model = Order
+    fields = ("number", "customer__name", "total")
+    field_labels = {"customer__name": "Customer", "total": "Total amount"}
+
+    def get_queryset(self, request):
+        return Order.objects.filter(owner=request.user)
+```
+
+Users need active staff status and Django `view` permissions for the root and any
+related model used. Staff status alone does not grant report access. Every report
+must provide an explicit row policy; Django model permissions do not imply row
+authorization. The same policies apply to columns, filters, ordering, HTML and CSV.
+
+## What is included
+
+- Text, integer, decimal, boolean, date, datetime and UUID fields.
+- AND conditions, ascending/descending order and stable pagination.
+- One forward ForeignKey/OneToOne hop with related-row authorization.
+- Bounded CSV streaming, exact decimals, Unicode and safe text formula handling.
+- Django Admin styling, light/dark modes and responsive, keyboard-accessible controls.
+
+Saved queries, aggregates, OR/NOT groups, ManyToMany, inverse relationships,
+arbitrary joins, multi-database selection, Excel and the visual diagram are later work.
+CSV uses a synchronous streaming iterator intended for WSGI deployment.
+See the [public documentation](https://github.com/CARocha/django-qbe2/blob/main/docs/README.md) for installation, row policies,
+settings, API reference and troubleshooting. Sources are plain English
+reStructuredText under [docs/source](https://github.com/CARocha/django-qbe2/blob/main/docs/source/index.rst), readable by developers
+and agents. Contributor instructions live in [AGENTS.md](https://github.com/CARocha/django-qbe2/blob/main/AGENTS.md).
+
+## Build the documentation
+
+```sh
+uv sync --python 3.14 --frozen --group dev --group docs
+uv run --group docs sphinx-build -n -W -b html docs/source docs/_build/html
+uv run --group docs sphinx-build -n -W -b text docs/source docs/_build/text
+python -m http.server 8001 --bind 127.0.0.1 --directory docs/_build/html
+```
+
+Open http://127.0.0.1:8001/. Sphinx is a documentation dependency only. CI checks
+HTML and plain-text builds with warnings treated as errors. A manual GitHub Pages
+workflow is prepared; the documentation site is not yet published.
+
+## License and attribution
+
+MIT, copyright Carlos A. Rocha. The project acknowledges Javier de la Rosa and the
+contributors to `versae/qbe` as its inspiration. The current code is a new
+implementation; preserve upstream notices if you reuse upstream code in a future change.

django_qbe2-0.1.0a1/README.md

@@ -0,0 +1,126 @@
+# Django QBE 2
+
+A reusable Django app for building authorized reports without writing SQL.
+Choose columns, add typed conditions, follow model relationships, preview paginated
+results and export a CSV. Designed for **Python 3.14 and Django 6.1**.
+
+**Experimental alpha:** this is the initial implementation, not a production
+release or a drop-in replacement for the original package. The first release
+candidate is `0.1.0a1`; check [PyPI](https://pypi.org/project/django-qbe2/) for its
+availability. Inspired by [versae/qbe](https://github.com/versae/qbe), rebuilt around
+Django's ORM, explicit permissions and typed query definitions.
+
+## Try the demo
+
+From a checkout containing this implementation:
+
+```sh
+uv sync --python 3.14 --frozen --group dev
+uv run python demo/manage.py migrate
+uv run python demo/manage.py seed_demo
+uv run python demo/manage.py changepassword qbe2_demo_alice
+uv run python demo/manage.py runserver 127.0.0.1:8000
+```
+
+Open [the report builder](http://127.0.0.1:8000/qbe/) and log in as
+`qbe2_demo_alice` with the password you chose. The seed creates six synthetic
+customers and 24 orders for two users. Each user can view only their own records.
+It never sets a shared password or overwrites an existing non-demo account.
+An optional superuser created with `createsuperuser` can inspect all demo records.
+
+## Install in another project
+
+Build and install the local wheel in that project's environment:
+
+```sh
+uv build
+python -m pip install /absolute/path/to/dist/django_qbe2-0.1.0a1-py3-none-any.whl
+```
+
+Add the app and mount its namespaced URLs alongside Django Admin:
+
+```python
+# Keep your existing Django apps, including admin, auth, sessions and messages.
+INSTALLED_APPS += ["django_qbe2"]
+```
+
+```python
+from django.urls import include, path
+
+# Keep your existing admin URL and other routes.
+urlpatterns += [path("qbe/", include("django_qbe2.urls"))]
+```
+
+Keep standard authentication, sessions and CSRF middleware, APP_DIRS template
+discovery and the admin context processors. Serve the packaged assets with your
+usual Django static-file setup. The reporting app itself has no models to migrate.
+The catalog is empty until you register reports.
+
+## Register reports and their policies
+
+Create `qbe.py` in your own installed app. Modules are discovered at startup,
+without fetching report data. Register related targets as well as root models:
+
+```python
+from django_qbe2.registry import Report, register
+from .models import Customer, Order
+
+
+@register
+class CustomerReport(Report):
+    model = Customer
+    fields = ("name",)
+
+    def get_queryset(self, request):
+        return Customer.objects.filter(owner=request.user)
+
+
+@register
+class OrderReport(Report):
+    model = Order
+    fields = ("number", "customer__name", "total")
+    field_labels = {"customer__name": "Customer", "total": "Total amount"}
+
+    def get_queryset(self, request):
+        return Order.objects.filter(owner=request.user)
+```
+
+Users need active staff status and Django `view` permissions for the root and any
+related model used. Staff status alone does not grant report access. Every report
+must provide an explicit row policy; Django model permissions do not imply row
+authorization. The same policies apply to columns, filters, ordering, HTML and CSV.
+
+## What is included
+
+- Text, integer, decimal, boolean, date, datetime and UUID fields.
+- AND conditions, ascending/descending order and stable pagination.
+- One forward ForeignKey/OneToOne hop with related-row authorization.
+- Bounded CSV streaming, exact decimals, Unicode and safe text formula handling.
+- Django Admin styling, light/dark modes and responsive, keyboard-accessible controls.
+
+Saved queries, aggregates, OR/NOT groups, ManyToMany, inverse relationships,
+arbitrary joins, multi-database selection, Excel and the visual diagram are later work.
+CSV uses a synchronous streaming iterator intended for WSGI deployment.
+See the [public documentation](https://github.com/CARocha/django-qbe2/blob/main/docs/README.md) for installation, row policies,
+settings, API reference and troubleshooting. Sources are plain English
+reStructuredText under [docs/source](https://github.com/CARocha/django-qbe2/blob/main/docs/source/index.rst), readable by developers
+and agents. Contributor instructions live in [AGENTS.md](https://github.com/CARocha/django-qbe2/blob/main/AGENTS.md).
+
+## Build the documentation
+
+```sh
+uv sync --python 3.14 --frozen --group dev --group docs
+uv run --group docs sphinx-build -n -W -b html docs/source docs/_build/html
+uv run --group docs sphinx-build -n -W -b text docs/source docs/_build/text
+python -m http.server 8001 --bind 127.0.0.1 --directory docs/_build/html
+```
+
+Open http://127.0.0.1:8001/. Sphinx is a documentation dependency only. CI checks
+HTML and plain-text builds with warnings treated as errors. A manual GitHub Pages
+workflow is prepared; the documentation site is not yet published.
+
+## License and attribution
+
+MIT, copyright Carlos A. Rocha. The project acknowledges Javier de la Rosa and the
+contributors to `versae/qbe` as its inspiration. The current code is a new
+implementation; preserve upstream notices if you reuse upstream code in a future change.

django_qbe2-0.1.0a1/docs/README.md

@@ -0,0 +1,20 @@
+# Public documentation
+
+Read [source/index.rst](source/index.rst) directly or build the Sphinx site:
+
+```sh
+uv sync --python 3.14 --frozen --group dev --group docs
+uv run --group docs sphinx-build -n -W -b html docs/source docs/_build/html
+uv run --group docs sphinx-build -n -W -b text docs/source docs/_build/text
+python -m http.server 8001 --bind 127.0.0.1 --directory docs/_build/html
+```
+
+Open http://127.0.0.1:8001/. Sources are English reStructuredText. The documentation
+build does not import Django or connect to a database. Generated files are ignored.
+The `docs` group adds no runtime dependencies to the reusable app.
+
+Installation: [source/installation.rst](source/installation.rst).
+Demo: [source/quickstart.rst](source/quickstart.rst).
+Permissions: [source/reports.rst](source/reports.rst).
+Contributor and CI checks: [source/contributing.rst](source/contributing.rst).
+Publication: [source/releases.rst](source/releases.rst).

django_qbe2-0.1.0a1/pyproject.toml

@@ -0,0 +1,51 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "django-qbe2"
+version = "0.1.0a1"
+description = "A reusable Django app for authorized query-by-example reports."
+readme = "README.md"
+requires-python = ">=3.14,<3.15"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Carlos A. Rocha" }]
+dependencies = ["Django>=6.1,<6.2"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Framework :: Django",
+  "Framework :: Django :: 6.1",
+  "Programming Language :: Python :: 3.14",
+  "Intended Audience :: Developers",
+]
+
+[project.urls]
+Documentation = "https://github.com/CARocha/django-qbe2/tree/main/docs"
+Repository = "https://github.com/CARocha/django-qbe2"
+Issues = "https://github.com/CARocha/django-qbe2/issues"
+
+[dependency-groups]
+dev = ["ruff>=0.11", "psycopg[binary]>=3.2.10"]
+docs = [
+    "sphinx>=8.2,<10",
+]
+release = [
+    "hatchling>=1.27,<2",
+    "twine>=6,<7",
+]
+
+[tool.hatch.build.targets.wheel]
+core-metadata-version = "2.4"
+packages = ["src/django_qbe2"]
+
+[tool.hatch.build.targets.sdist]
+core-metadata-version = "2.4"
+include = ["src/django_qbe2", "pyproject.toml", "README.md", "LICENSE"]
+
+[tool.ruff]
+target-version = "py314"
+line-length = 88
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B"]

django_qbe2-0.1.0a1/src/django_qbe2/__init__.py

@@ -0,0 +1 @@
+"""Reusable, explicitly authorized query-by-example reports for Django."""

django_qbe2-0.1.0a1/src/django_qbe2/access.py

@@ -0,0 +1,30 @@
+from collections.abc import Callable
+from functools import wraps
+
+from django.contrib.auth.views import redirect_to_login
+from django.core.exceptions import PermissionDenied
+from django.http import Http404, HttpRequest, HttpResponse
+from django.urls import reverse
+
+from django_qbe2.catalog import ReportSpec, get_catalog
+
+
+def require_qbe_access(
+    view: Callable[..., HttpResponse],
+) -> Callable[..., HttpResponse]:
+    @wraps(view)
+    def wrapped(request: HttpRequest, *args, **kwargs):
+        if not request.user.is_authenticated:
+            return redirect_to_login(request.get_full_path(), reverse("admin:login"))
+        if not request.user.is_active or not request.user.is_staff:
+            raise PermissionDenied
+        return view(request, *args, **kwargs)
+
+    return wrapped
+
+
+def visible_report(request: HttpRequest, report_id: str) -> ReportSpec:
+    report = get_catalog(request).get(report_id)
+    if report is None:
+        raise Http404("Report not available.")
+    return report

django_qbe2-0.1.0a1/src/django_qbe2/apps.py

@@ -0,0 +1,14 @@
+from importlib import import_module
+
+from django.apps import AppConfig
+from django.utils.module_loading import autodiscover_modules
+
+
+class QBEConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "django_qbe2"
+    verbose_name = "Query by Example"
+
+    def ready(self):
+        import_module("django_qbe2.checks")
+        autodiscover_modules("qbe")