django-restit 4.2.173__tar.gz → 4.2.175__tar.gz

{django_restit-4.2.173 → django_restit-4.2.175}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: django-restit
-Version: 4.2.173
+Version: 4.2.175
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

django_restit-4.2.175/account/migrations/0023_authsession_method.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.18 on 2025-03-23 19:54
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('account', '0022_alter_memberdevice_modified'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='authsession',
+            name='method',
+            field=models.CharField(blank=True, db_index=True, default=None, max_length=127, null=True),
+        ),
+    ]

{django_restit-4.2.173 → django_restit-4.2.175}/account/models/group.py

@@ -118,6 +118,7 @@ class Group(models.Model, RestModel, MetaDataModel):
                 "kind",
                 ("metadata__timezone", "timezone"),
                 ("metadata__eod", "end_of_day"),
+                ("parent__pk", "parent_id"),
                 ("parent__name", "parent"),
                 ("location.line1", "address_line1"),
                 ("location.line2", "address_line2"),
@@ -171,7 +172,7 @@ class Group(models.Model, RestModel, MetaDataModel):
             if item:
                 return item.thumbnail_url()
         return None
-        
+
     @classmethod
     def on_rest_list_filter(cls, request, qset=None):
         if not request.member.hasPermission("view_all_groups"):
@@ -231,7 +232,7 @@ class Group(models.Model, RestModel, MetaDataModel):
                 raise RestValidationError("cannot set self as parent", 1101)
             value = Group.objects.filter(pk=value).last()
         self.parent = value
-    
+
     def set_child_of(self, value):
         # this is a helper to add this group to another group
         parent = Group.objects.filter(pk=value).last()
@@ -321,7 +322,7 @@ class Group(models.Model, RestModel, MetaDataModel):
                 return True
         return False
 
-    def notifyMembers(self, subject, message=None, template=None, context=None, 
+    def notifyMembers(self, subject, message=None, template=None, context=None,
                       email_only=False, sms_msg=None, perms=None, force=False,
                       from_email=None, exclude_member=None):
         if perms is not None:
@@ -436,19 +437,19 @@ class Group(models.Model, RestModel, MetaDataModel):
         qset = self.memberships.filter(state__gte=-10)
         if perms:
             qset = qset.filter(
-                Q(properties__category="permissions", 
-                  properties__key__in=perms, 
-                  properties__value__in=TRUE_VALUES) | 
-                Q(member__properties__category="permissions", 
-                  member__properties__key__in=perms, 
+                Q(properties__category="permissions",
+                  properties__key__in=perms,
+                  properties__value__in=TRUE_VALUES) |
+                Q(member__properties__category="permissions",
+                  member__properties__key__in=perms,
                   member__properties__value__in=TRUE_VALUES))
         if notify:
             qset = qset.filter(
-                Q(properties__category="notify", 
-                  properties__key__in=notify, 
-                  properties__value__in=TRUE_VALUES) | 
-                Q(member__properties__category="notify", 
-                  member__properties__key__in=notify, 
+                Q(properties__category="notify",
+                  properties__key__in=notify,
+                  properties__value__in=TRUE_VALUES) |
+                Q(member__properties__category="notify",
+                  member__properties__key__in=notify,
                   member__properties__value__in=TRUE_VALUES))
 
         if role:
@@ -495,7 +496,7 @@ class Group(models.Model, RestModel, MetaDataModel):
             # enable again?
             ms.set_state(0)
             ms.save()
-            
+
         if MEMBERSHIP_ROLES:
             perms = MEMBERSHIP_ROLES.get(role, [])
             for k in perms:
@@ -601,12 +602,8 @@ class Group(models.Model, RestModel, MetaDataModel):
         if credentials.kind == "member":
             if msg.pk is not None:
                 return credentials.instance.isMemberOf(msg.pk)
-        return False         
+        return False
 
 
 class GroupMetaData(MetaDataBase):
     parent = models.ForeignKey(Group, related_name="properties", on_delete=models.CASCADE)
-
-
-
-

{django_restit-4.2.173 → django_restit-4.2.175}/account/models/session.py

@@ -42,6 +42,7 @@ class AuthSession(models.Model, RestModel):
     signature = models.CharField(max_length=127, db_index=True)
     ip = models.CharField(max_length=127, null=True, blank=True, db_index=True)
     buid = models.CharField(max_length=127, null=True, blank=True, default=None)
+    method = models.CharField(max_length=127, null=True, blank=True, db_index=True, default=None)
 
     member = models.ForeignKey("account.Member", null=True, blank=True, related_name="auth_sessions", on_delete=models.CASCADE)
     location = models.ForeignKey("location.GeoIP", related_name="auth_sessions", blank=True, null=True, default=None, on_delete=models.CASCADE)
@@ -72,8 +73,9 @@ class AuthSession(models.Model, RestModel):
         return f"{self.member.username} - {self.ip} - {self.os} - {self.browser}"
 
     @classmethod
-    def NewSession(cls, request):
+    def NewSession(cls, request, method="jwt"):
         obj = cls(ip=request.ip, member=request.member, signature=request.signature)
+        obj.method = method
         obj.user_agent = request.META.get('HTTP_USER_AGENT', None)
         obj.last_activity = datetime.now()
         obj.buid = request.POST.get("__buid__", request.GET.get("__buid__", None))
@@ -92,4 +94,3 @@ class AuthSession(models.Model, RestModel):
                 session.touch()
             return session
         return None
-

{django_restit-4.2.173 → django_restit-4.2.175}/account/rpc/auth.py

@@ -37,6 +37,7 @@ def member_login(request):
 @rd.never_cache
 def jwt_login(request):
     # poor mans JWT, carried over
+    auth_method = "basic"
     username = request.DATA.get('username', None)
     if not username:
         return rv.restPermissionDenied(request, "Password and/or Username is incorrect", error_code=422)
@@ -45,29 +46,31 @@ def jwt_login(request):
         return rv.restPermissionDenied(request, error=f"Password and/or Username is incorrect for {username}", error_code=422)
     auth_code = request.DATA.get(["auth_code", "code", "invite_token"], None)
     if username and auth_code:
+        # this is typically used for OAUTH (final)
         return member_login_uname_code(request, username, auth_code)
     password = request.DATA.get('password', None)
     member.canLogin(request)  # throws exception if cannot login
     if member.requires_totp or member.has_totp:
+        auth_method = "basic+totp"
         resp = checkForTOTP(request, member)
         if resp is not None:
             return resp
     if not member.login(request=request, password=password, use_jwt=True):
         # we do not want permission denied catcher invoked as it is already handled in login method
         return rv.restStatus(request, False, error=f"Invalid Credentials {username}", error_code=401)
-    return on_complete_jwt(request, member)
+    return on_complete_jwt(request, member, auth_method)
 
 
-def on_complete_jwt(request, member):
+def on_complete_jwt(request, member, method="basic"):
     if member.security_token is None or member.security_token == JWT_KEY or member.force_single_session:
         member.refreshSecurityToken()
 
     member.log(
-        "jwt_login", "jwt login succesful", 
+        "jwt_login", "jwt login succesful",
         request, method="login", level=7)
 
     device_id = request.DATA.get(["device_id", "deviceID"])
-    
+
     token = JWToken(
         user_id=member.pk,
         key=member.security_token,
@@ -80,13 +83,13 @@ def on_complete_jwt(request, member):
     request.signature = token.session_id
     request.device_id = device_id
     request.buid = request.DATA.get("__buid__", None)
-    request.auth_session = am.AuthSession.NewSession(request)
+    request.auth_session = am.AuthSession.NewSession(request, method)
     if bool(device_id):
         am.MemberDevice.register(request, member, device_id)
-    
+
     request.jwt_token = token.access_token  # this tells the middleware to store in cookie
     return rv.restGet(
-        request, 
+        request,
         dict(
             access=token.access_token,
             refresh=token.refresh_token,
@@ -221,9 +224,9 @@ def member_login_uname_code(request, username, auth_code):
     member.login(request=request)
     member.save()
     member.log("code_login", "code login", request, method="login", level=8)
-    if request.DATA.get("auth_method") == "basic":
+    if request.DATA.get("auth_method") == "basic" and ALLOW_BASIC_LOGIN:
         return rv.restGet(request, dict(id=member.pk, session_key=request.session.session_key))
-    return on_complete_jwt(request, member)
+    return on_complete_jwt(request, member, "auth_code")
 
 
 @rd.url(r'^logout$')
@@ -296,7 +299,7 @@ def get_member_from_request(request):
         request.member = member
         member.log("login_blocked", "account is locked out", request, method="login", level=31)
         return member, rv.restPermissionDenied(request, error=f"{member.username} Account locked out", error_code=411)
-    return member, None  
+    return member, None
 
 
 @rd.urlPOST('forgot')
@@ -408,5 +411,3 @@ def totp_verify(request):
         return rv.restPermissionDenied(request, "invalid code")
     request.member.setProperty("totp_verified", 1)
     return rv.restStatus(request, True)
-
-

{django_restit-4.2.173 → django_restit-4.2.175}/account/rpc/oauth.py

@@ -20,37 +20,43 @@ def oauth_google_login(request):
     state = request.DATA.get("state")
     app_url = settings.DEFAULT_LOGIN_URL
 
-    rh.log_print("google/login", request.DATA.toDict(), request.session.get("state"))
+    # rh.log_print("google/login", request.DATA.toDict(), request.session.get("state"))
 
     if state:
+        # this is where we should pull out the passed in state and get the proper URL
         state = objict.fromJSON(rh.hexToString(state))
         rh.log_print("state", state)
         app_url = state.url
 
     if not code:
         params = urlencode({'error': error})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
-    redirect_uri = f"{settings.BASE_URL_SECURE}{REST_PREFIX}account/oauth/google/login"
+    redirect_uri = f"{request.scheme}://{request.get_host()}/{REST_PREFIX}account/oauth/google/login"
     auth_data = google.getAccessToken(code, redirect_uri)
     if auth_data is None or auth_data.access_token is None:
         params = urlencode({'error': "failed to get access token from google"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     user_data = google.getUserInfo(auth_data.access_token)
     if user_data is None:
         params = urlencode({'error': "failed to get user data from google"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     if not user_data.email:
         params = urlencode({'error': "no email with account"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     # TODO allow new accounts?
     member = Member.objects.filter(email=user_data.email).last()
     if member is None:
         params = urlencode({'error': "user not found"})
-        return redirect(f"{app_url}?{params}")
+        separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+        return redirect(f"{app_url}{separator}{params}")
 
     member.setProperties(auth_data, category="google_auth")
     member.setProperties(user_data, category="google")
@@ -69,13 +75,8 @@ def oauth_google_login(request):
     member.save()
     member.auditLog("user succesfully authenticated with google", "google_oauth", level=17)
 
-    params = urlencode({'oauth_code': member.auth_code, "username":member.username})
+    params = urlencode({'oauth_code': member.auth_code, "username":member.username, "auth_method":"google_oauth"})
     rurl = None
-    if "?" in app_url:
-        if app_url[-1] == "?":
-            rurl = f"{app_url}{params}"
-        else:
-            rurl = f"{app_url}&{params}"
-    else:
-        rurl = f"{app_url}?{params}"
+    separator = '&' if '?' in app_url and app_url[-1] != '?' else '?'
+    rurl = f"{app_url}{separator}{params}"
     return redirect(rurl)

{django_restit-4.2.173 → django_restit-4.2.175}/account/rpc/passkeys.py

@@ -51,4 +51,4 @@ def rest_on_passkeys_auth_complete(request):
         request.session.pop("fido2_state"),
         request.session.pop("fido2_rp_id"))
     # we now want to handle the JWT or basic login flow
-    return on_complete_jwt(request, uk.member)
+    return on_complete_jwt(request, uk.member, "passkey")

{django_restit-4.2.173 → django_restit-4.2.175}/auditlog/models.py

@@ -55,10 +55,11 @@ class PersistentLog(models.Model, RestModel):
     class RestMeta:
         DEFAULT_SORT = "-when"
         CAN_SAVE = False
+        ESTIMATE_COUNTS = True
         GROUP_FIELD = None  # do this so when we sort by group it is always exact
         QUERY_FIELDS = [
-            "level", "component", "pkey", "action", 
-            "request_method", "request_path", 
+            "level", "component", "pkey", "action",
+            "request_method", "request_path",
             "session__ip", "user",
             "tid", "group", "user__username"]
         SEARCH_FIELDS = ["user__username", "user__last_name", "message", "session__ip", "request_path"]

{django_restit-4.2.173 → django_restit-4.2.175}/incident/models/event.py

@@ -18,8 +18,8 @@ INCIDENT_EVENT_GRANULARITY = settings.get("INCIDENT_EVENT_GRANULARITY", "hourly"
 EVENT_TO_INCIDENT_LEVEL = settings.get("EVENT_TO_INCIDENT_LEVEL", 4)
 EVENT_DETAIL_TEMPLATES = settings.get("EVENT_DETAIL_TEMPLATES", None)
 EVENT_META_KEYWORDS = settings.get("EVENT_META_KEYWORDS", [
-        "path", "ip", "reporter_ip", "code", 
-        "reason", "buid", "merchant", "tid", 
+        "path", "ip", "reporter_ip", "code",
+        "reason", "buid", "merchant", "tid",
         "group", "http_user_agent", "user_agent",
         "app_url", "isp", "city", "state", "country",
         "username"
@@ -28,7 +28,7 @@ EVENT_META_KEYWORDS = settings.get("EVENT_META_KEYWORDS", [
 logger = log.getLogger("incident", filename="incident.log")
 
 """
-very generic 
+very generic
 external system can post an event
 {
      "description": "Critical Test Event",
@@ -77,15 +77,15 @@ class Event(JSONMetaData, rm.RestModel):
     # code = models.IntegerField(default=0, db_index=True)
 
     group = models.ForeignKey(
-        "account.Group", on_delete=models.SET_NULL, 
+        "account.Group", on_delete=models.SET_NULL,
         related_name="+", null=True, default=None)
- 
+
     component = models.SlugField(max_length=250, null=True, blank=True, default=None)
     component_id = models.IntegerField(null=True, blank=True, default=None)
 
     # this allows us to bundle multiple events to an incident
     incident = models.ForeignKey(
-        Incident, null=True, default=None, 
+        Incident, null=True, default=None,
         related_name="events", on_delete=models.SET_NULL)
 
     def runRules(self):
@@ -170,14 +170,14 @@ class Event(JSONMetaData, rm.RestModel):
             # logger.info(f"ignore event {self.pk} {self.description}")
             return
 
-        # always create an incident 
+        # always create an incident
         if incident is None:
             incident = Incident(
                 rule=hit_rule, priority=priority,
                 reporter_ip=self.reporter_ip,
                 category=self.category,
                 group=self.group,
-                component=self.component, 
+                component=self.component,
                 component_id=self.component_id,
                 hostname=self.hostname)
             if self.group is None and hit_rule is not None:
@@ -211,4 +211,3 @@ class Event(JSONMetaData, rm.RestModel):
             incident.triggerAction()
         except Exception:
             logger.exception()
-

{django_restit-4.2.173 → django_restit-4.2.175}/incident/models/incident.py

@@ -92,7 +92,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
 
     group = models.ForeignKey("account.Group", on_delete=models.SET_NULL, null=True, default=None)
     assigned_to = models.ForeignKey("account.Member", on_delete=models.SET_NULL, null=True, default=None)
-    
+
     priority = models.IntegerField(default=0)  # 1-10, 1 being the highest
     # 0=new, 1=opened, 2=paused, 3=ignore, 4=resolved, 5=pending
     state = models.IntegerField(default=0, choices=INCIDENT_STATES)
@@ -160,7 +160,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
 
         if event.details:
             self.setProperty("details", event.details)
-    
+
         if event.metadata.geoip and event.metadata.geoip.city:
             self.setProperty("city", event.metadata.geoip.city)
             self.setProperty("state", event.metadata.geoip.state)
@@ -209,7 +209,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
                 self.save()
             elif self.rule.action.startswith("firewall_block"):
                 if settings.FIREWALL_GLOBAL_BLOCK:
-                    Task.Publish("incident", "firewall_block", 
+                    Task.Publish("incident", "firewall_block",
                                  dict(ip=self.reporter_ip),
                                  channel="tq_broadcast")
 
@@ -348,7 +348,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
             member.sendSMS(sms_msg)
         members = group.getMembers(perms=email_perms, as_member=True)
         for member in members:
-            member.sendEmail(subject, body)       
+            member.sendEmail(subject, body)
 
     def notifyWith(self, perm):
         # logger.info("notifyWith", perm)
@@ -407,7 +407,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
             if request != None and "DATA" in request and "note" in request.DATA:
                 self.logHistory(kind="note", note=request.DATA.get("note"), request=request)
 
-    def logHistory(self, kind="history", note=None, media=None, 
+    def logHistory(self, kind="history", note=None, media=None,
                    request=None, member=None, notify=True):
         if request is None:
             request = self.getActiveRequest()
@@ -493,7 +493,7 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
                 email_only=True,
                 from_email=INCIDENT_EMAIL_FROM)
         else:
-            # notitfy everyone but the sender          
+            # notitfy everyone but the sender
             if history.by is None:
                 members = Member.GetWithPermission(perm, ignore_disabled_email=True).exclude(pk=history.by.pk)
                 if members.count() == 0:

{django_restit-4.2.173 → django_restit-4.2.175}/incident/models/ossec.py

@@ -46,8 +46,8 @@ class ServerOssecAlert(models.Model, rm.RestModel):
     level       = models.IntegerField(default=0)
     title       = models.CharField(max_length=200, blank=True, null=True, default=None)
     geoip       = models.ForeignKey("location.GeoIP", blank=True, null=True, default=None, on_delete=models.DO_NOTHING)
-    
+
     metadata = None
-    
+
     def __str__(self):
         return f'{self.hostname}: {self.title}'

{django_restit-4.2.173 → django_restit-4.2.175}/metrics/models.py

@@ -43,14 +43,14 @@ def metric(
         elif granularity in ["minutes", "seconds"]:
             expires = datetime.now() + timedelta(days=7)
         m, created = Metrics.objects.get_or_create(
-            uuid=key, 
+            uuid=key,
             defaults=dict(
                 granularity=granularity, slug=slug, expires=expires,
                 group=group, start=utils.date_for_granulatiry(date, granularity)))
         m.updateMetrics(keys, data, created)
 
 
-def gauge(slug, keys, data, granularity="daily", group=None, date=None, 
+def gauge(slug, keys, data, granularity="daily", group=None, date=None,
           timezone=None, slug_append=None, max_granularity=None):
     # guage does not accumulate but just stores the data like a cache
     # if calledf on the same time period it will just update the current numbers
@@ -72,7 +72,7 @@ def gauge(slug, keys, data, granularity="daily", group=None, date=None,
         elif gran == "daily":
             expires = datetime.now() + timedelta(days=METRICS_EXPIRE_DAILY)
         m, created = Metrics.objects.get_or_create(
-            uuid=key, 
+            uuid=key,
             defaults=dict(
                 granularity=gran, slug=slug, expires=expires,
                 group=group, start=utils.date_for_granulatiry(date, gran)))
@@ -99,7 +99,7 @@ def get_qset(slug, granularity, start=None, end=None,
         start = group.getLocalTime(start)
     elif settings.METRICS_TIMEZONE:
         start = date_util.convertToLocalTime(settings.METRICS_TIMEZONE, start)
-  
+
     start = utils.date_for_granulatiry(start, granularity)
     if end is None:
         if granularity == "hourly":
@@ -133,7 +133,7 @@ def get_totals(slug, keys, granularity, start=None, end=None, group=None):
         start = group.getLocalTime(start)
     elif settings.METRICS_TIMEZONE:
         start = date_util.convertToLocalTime(settings.METRICS_TIMEZONE, start)
-  
+
     start = utils.date_for_granulatiry(start, granularity)
     if end is None:
         end = start + timedelta(minutes=5)
@@ -141,7 +141,7 @@ def get_totals(slug, keys, granularity, start=None, end=None, group=None):
         end = group.getLocalTime(end)
     elif settings.METRICS_TIMEZONE:
         end = date_util.convertToLocalTime(settings.METRICS_TIMEZONE, end)
-    
+
     qset = Metrics.objects.filter(
         slug=slug, granularity=granularity,
         group=group, start__gte=start, start__lte=end)
@@ -162,7 +162,7 @@ def get_metric(slug, granularity, start, group=None):
         start = group.getLocalTime(start)
     elif settings.METRICS_TIMEZONE:
         start = date_util.convertToLocalTime(settings.METRICS_TIMEZONE, start)
-  
+
     start = utils.date_for_granulatiry(start, granularity)
     qset = Metrics.objects.filter(
         slug=slug, granularity=granularity, start__gte=start, start__lte=start, group=group)
@@ -226,7 +226,7 @@ def get_metrics(slug, granularity, start, end=None, group=None, samples=None):
             for k in keys:
                 data[k].append(0)
             continue
-        for k in keys: 
+        for k in keys:
             data[k].append(result["values"].get(k, 0))
         period_values.remove(result)
     return objict(periods=periods, data=data)
@@ -241,7 +241,7 @@ def get_chart_periods(slug, granularity, start, end=None, group=None):
         periods.append(period)
     if granularity != "weekly":
         periods.reverse()
-    return periods   
+    return periods
 
 
 def get_adjusted_date_range(granularity, start, end, group=None, samples=None):
@@ -282,6 +282,7 @@ def generate_uuid(slug, group, slug_append=None):
 class Metrics(models.Model, rm.RestModel):
     class RestMeta:
         QUERY_FIELDS = ["group__kind", "all_fields"]
+        ESTIMATE_COUNTS = True
         GRAPHS = {
             "detailed": {
                 "fields": [
@@ -310,7 +311,7 @@ class Metrics(models.Model, rm.RestModel):
     # allow to group metrics by a group
     group = models.ForeignKey("account.Group", related_name="+", on_delete=models.CASCADE, null=True, default=None)
 
-    # now we create a set of k/v 
+    # now we create a set of k/v
     k1 = models.SlugField(max_length=64, null=True, default=None)
     v1 = models.BigIntegerField(default=0)
 

{django_restit-4.2.173 → django_restit-4.2.175}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.173"
+version = "4.2.175"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

{django_restit-4.2.173 → django_restit-4.2.175}/rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.173"
+__version__ = "4.2.175"

{django_restit-4.2.173 → django_restit-4.2.175}/rest/models/base.py

@@ -7,6 +7,7 @@ import importlib
 from django.db import models as dm
 from django.db.transaction import atomic
 from django.apps import apps
+from django.db import connection
 
 from rest import helpers as rh
 from rest import errors as re
@@ -876,7 +877,7 @@ class RestModel(object):
         if not graph and request is not None:
             graph = request.DATA.get("graph", "default")
         return GRAPH_HELPERS.restList(
-            request, qset, sort=sort, totals=totals, 
+            request, qset, sort=sort, totals=totals,
             return_httpresponse=return_httpresponse,
             response_params=dict(graph=graph),
             **cls.getGraph(graph))
@@ -896,6 +897,17 @@ class RestModel(object):
             request = cls.getActiveRequest()
         return cls.restList(request, qset, graph, totals, False)
 
+    @classmethod
+    def restListEstimatedCount(cls, request, qset):
+        # TODO attempt to make this work with the qset,
+        # right now it gets an estimated count of the entire table
+        if getattr(cls.RestMeta, "ESTIMATE_COUNTS", False):
+            if connection.vendor == 'postgresql':
+                with connection.cursor() as cursor:
+                    cursor.execute(f"SELECT reltuples::bigint FROM pg_class WHERE relname = '{cls._meta.db_table}'")
+                    return cursor.fetchone()[0]
+        return qset.count()
+
     def restStatus(self, request, status, **kwargs):
         RestModel._setupGraphHelpers()
         return GRAPH_HELPERS.restStatus(request, status, **kwargs)
@@ -959,7 +971,7 @@ class RestModel(object):
         has_perms = True
         if perms is not None:
             has_perms = cls.on_rest_list_has_perms(request, perms, qset)
-        
+
         if request.group:
             qset = cls.on_rest_filter_children(request, qset)
         if not has_perms:
@@ -1040,7 +1052,7 @@ class RestModel(object):
         elif dr_offset > 0:
             dr_start = dr_start + timedelta(minutes=dr_offset)
             dr_end = dr_end + timedelta(minutes=dr_offset)
-    
+
         rh.debug("tr_end changing", str(dr_start), str(dr_end))
         dr_field = request.DATA.get("dr_field", getattr(cls.RestMeta, "DATE_RANGE_FIELD", "created"))
         q = dict()
@@ -1145,7 +1157,7 @@ class RestModel(object):
             cls._boundRest()
             if format.startswith("json"):
                 return GRAPH_HELPERS.views.restJSON(
-                    request, qset, fields, 
+                    request, qset, fields,
                     name, format_size, localize=localize)
             elif format.startswith("csv"):
                 return GRAPH_HELPERS.views.restCSV(
@@ -1159,7 +1171,7 @@ class RestModel(object):
                 return GRAPH_HELPERS.views.restFlat(
                     request, qset, fields,
                     name, format_size, localize=localize)
-    
+
     @classmethod
     def on_rest_list_summary(cls, request, qset):
         cls._boundRest()
@@ -1589,7 +1601,7 @@ class RestModel(object):
                 "group": "group__kind"
             }
 
-        QUERY_FIELDS can be used to restrict what fields can be queried 
+        QUERY_FIELDS can be used to restrict what fields can be queried
         and add special fields:
 
         ?group__kind=iso
@@ -1600,7 +1612,7 @@ class RestModel(object):
         or
         <field_name>__<operator>=value
 
-        You cannot do <field_name>__<sub_field>__<operator> unless 
+        You cannot do <field_name>__<sub_field>__<operator> unless
          <field_name>__<sub_field> is
 
         allowed <operator>s