django-restit 4.2.89__py3-none-any.whl → 4.2.91__py3-none-any.whl

account/rpc/group.py

@@ -121,7 +121,7 @@ def rest_on_group_stats(request):
     if not group:
         return rv.restPermissionDenied(request)
     if not request.member.hasPerm(["view_all_groups", "manage_groups"]):
-        if not request.member.hasGroupPerm(group, ["reports"]):
+        if not request.member.hasGroupPerm(group, ["reports", "reporting"]):
             return rv.restPermissionDenied(request)
     qset = group.getAllChildren(True, True, True).filter(is_active=True)
     out = rh.countOccurences(qset, "kind")

{django_restit-4.2.89.dist-info → django_restit-4.2.91.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.89
+Version: 4.2.91
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.89.dist-info → django_restit-4.2.91.dist-info}/RECORD

@@ -42,7 +42,7 @@ account/periodic.py,sha256=-u0n-7QTJgDOkasGhBAPwHAwjpqWGA-MZLEFkVTqCGU,874
 account/rpc/__init__.py,sha256=SGF0M_-H0dKh3b1apSX29BotNWAvITYccGQVC0MIjL8,336
 account/rpc/auth.py,sha256=p62tyihWvSY2zn7eaVxKcCG9qLnnZBIkwdRH81sS5_Y,16615
 account/rpc/device.py,sha256=mB14a6qvJIBnCa9ivLhPXwEt5Gk2foyqsKBtZxC506k,3070
-account/rpc/group.py,sha256=Bs9O69xHXtFT-fykPXPzRtLI9C0Oj967N2hJklv3wZ4,4916
+account/rpc/group.py,sha256=riymUK6ttv8G6SG6K-v7UCvM40WQy3HaGSeF_sEiaU0,4929
 account/rpc/member.py,sha256=VNRSD38mmTUCbq3cCSy3qRyquzeVEwW_8zzrtS0-vAA,1817
 account/rpc/notify.py,sha256=Q2YWejP36egeF060Hih5uX4Psv_B8NWlLLPi7iDYlIw,3344
 account/rpc/oauth.py,sha256=ISLVsR5HvKALANokaOFRvF4FTRxWtXPvVnZAYANKxpo,2864
@@ -404,9 +404,9 @@ rest/middleware/request.py,sha256=JchRNy5L-bGd-7h-KFYekGRvREe2eCkZXKOYqIkP2hI,41
 rest/middleware/session.py,sha256=zHSoQpIzRLmpqr_JvW406wzpvU3W3gDbm5JhtzLAMlE,10240
 rest/middleware/session_store.py,sha256=1nSdeXK8PyuYgGgIufqrS6j6QpIrQ7zbMNT0ol75e6U,1901
 rest/models/__init__.py,sha256=M8pvFDq-WCF-QcM58X7pMufYYe0aaQ3U0PwGe9TKbbY,130
-rest/models/base.py,sha256=bPcTeCX7KvhkcVMKEyLmu9eYc7ccJGkIP1n3cctJPVE,69675
+rest/models/base.py,sha256=-NUKed_67o3eCZCknndQixSHU4pR-Lm2wxsb_h4rjVQ,70652
 rest/models/cacher.py,sha256=eKz8TINVhWEqKhJGMsRkKZTtBUIv5rN3NHbZwOC56Uk,578
-rest/models/metadata.py,sha256=65GvfFbc26_7wJz8qEAzU7fEOZWVz0ttO5j5m_gs4hk,12860
+rest/models/metadata.py,sha256=1nQ7CYo9bJHoaXE_hVNaj1-Y7yqhHlf2ZlaD1IfTzic,12904
 rest/net.py,sha256=LcB2QV6VNRtsSdmiQvYZgwQUDwOPMn_VBdRiZ6OpI-I,2974
 rest/regexes.yaml,sha256=VoGb4E-P_K9f82Yzcpltgzekpt9usRtwu9PYlo46nUw,149463
 rest/requestex.py,sha256=N56056vV3zWkAP-QrYsCu7SdpPzE5kLuPoxGIuZAKt0,16127
@@ -506,7 +506,7 @@ ws4redis/servers/uwsgi.py,sha256=VyhoCI1DnVFqBiJYHoxqn5Idlf6uJPHvfBKgkjs34mo,172
 ws4redis/settings.py,sha256=K0yBiLUuY81iDM4Yr-k8hbvjn5VVHu5zQhmMK8Dtz0s,1536
 ws4redis/utf8validator.py,sha256=S0OlfjeGRP75aO6CzZsF4oTjRQAgR17OWE9rgZdMBZA,5122
 ws4redis/websocket.py,sha256=R0TUyPsoVRD7Y_oU7w2I6NL4fPwiz5Vl94-fUkZgLHA,14848
-django_restit-4.2.89.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
-django_restit-4.2.89.dist-info/METADATA,sha256=oUQ-GYEwBbLeQLyb9if2FDKwacmHQN7cLrFtJFsdD80,7645
-django_restit-4.2.89.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
-django_restit-4.2.89.dist-info/RECORD,,
+django_restit-4.2.91.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
+django_restit-4.2.91.dist-info/METADATA,sha256=Wb9wxvC6pdi9MBkBlC65WcJNqzcfB-tvS65E5rAc-1c,7645
+django_restit-4.2.91.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
+django_restit-4.2.91.dist-info/RECORD,,

rest/models/base.py

@@ -19,6 +19,7 @@ from .metadata import MetaDataBase, MetaDataModel
 DB_ROUTING_MAPS = settings.get("DB_ROUTING_MAPS", {})
 TWO_DECIMAL_PLACES = Decimal(10) ** -2
 EXCEPTION_ON_LIST_PERM_DENIED = settings.get("EXCEPTION_ON_LIST_PERM_DENIED", True)
+ALLOW_BATCHING = settings.get("ALLOW_BATCHING", False)
 
 GRAPH_HELPERS = objict()
 GRAPH_HELPERS.restGet = None
@@ -1177,32 +1178,47 @@ class RestModel(object):
     @classmethod
     def on_rest_batch(cls, request, action):
         # this method is called when rest_batch='somme action'
+        if not ALLOW_BATCHING or not getattr(cls.RestMeta, "CAN_BATCH", True):
+            return GRAPH_HELPERS.restStatus(request, False, error="model does not allow batch actions")
         cls._boundRest()
+        # if not request.member.hasPerm("can_batch_update"):
+        #     raise re.PermissionDeniedException(f"batch updated not allowed by user")
+        if action == "create":
+            return cls.on_rest_batch_create(request)
         batch_ids = request.DATA.getlist("batch_ids", [])
         batch_id_field = request.DATA.get("batch_id_field", "pk")
-        q = {}
         if batch_ids:
+            q = {}
             q["{}__in".format(batch_id_field)] = batch_ids
-        batch_query = request.DATA.get("batch_query", None)
-        if batch_query:
-            # we ignore ids when doing a query
-            q.update(batch_query)
+            qset = cls.on_rest_list_query(request, cls.rw_objects().filter(**q))
+        else:
+            qset = cls.on_rest_list_query(request, cls.rw_objects().all())
         if action == "delete":
             can_delete = getattr(cls.RestMeta, "CAN_DELETE", False)
             if not can_delete:
-                return GRAPH_HELPERS.restStatus(request, False, error="deletion not allowed via rest for this model.")
-            qset = cls.rw_objects().filter(**q)
+                raise re.PermissionDeniedException(f"deletion not allowed for {cls.get_class_name()}", 438)
             count = qset.delete()
             return GRAPH_HELPERS.restStatus(request, True, error="delete {} items".format(count))
         elif action == "update":
-            qset = cls.rw_objects().filter(**q)
             update_fields = request.DATA.get(["batch_data", "batch_update"])
             if not isinstance(update_fields, dict):
                 return GRAPH_HELPERS.restStatus(request, False, error="batch_update should be key/values")
-            count = qset.update(**update_fields)
+            if {"id", "pk", "created", "password"} & update_fields.keys():
+                return GRAPH_HELPERS.restStatus(request, False, error="field/s not allowed")
+            has_meta = False
+            for key in update_fields:
+                if key.startswith("metadata"):
+                    has_meta = True
+                    break
+            if has_meta or not request.member.is_superuser:
+                count = 0
+                for obj in qset:
+                    obj.checkPermsAndSave(request, update_fields)
+                    count += 1
+            else:
+                # only super users can do this
+                count = qset.update(**update_fields)
             return GRAPH_HELPERS.restStatus(request, True, error="updated {} items".format(count))
-        elif action == "create":
-            cls.on_rest_batch_create(request)
         return GRAPH_HELPERS.restStatus(request, False, error="not implemented")
 
     @classmethod
@@ -1213,6 +1229,8 @@ class RestModel(object):
         if isinstance(batch_data, dict):
             if "data" in batch_data:
                 batch_data = batch_data["data"]
+            if isinstance(batch_data, dict):
+                batch_data = [batch_data]
         items = []
         for item in batch_data:
             obj = cls.createFromBatch(item)
@@ -1223,15 +1241,14 @@ class RestModel(object):
     @classmethod
     def createFromBatch(cls, item, request=None):
         obj = None
-        try:
-            rh.debug("batch item", item)
-            item_filter = cls.getRestBatchCreateFilter(item)
-            rh.debug("batch filters", item_filter)
-            obj = cls.ro_objects().filter(**item_filter).last()
-            if obj is None:
-                obj = cls.createFromDict(request, item)
-        except Exception:
-            rh.log_exception(item)
+        item_filter = cls.getRestBatchCreateFilter(item)
+        if not item_filter:
+            raise Exception("requires item filter")
+        rh.debug("createFromBatch", item_filter)
+        obj = cls.ro_objects().filter(**item_filter).last()
+        if obj is None:
+            obj = cls()
+            obj.checkPermsAndSave(request, item)
         return obj
 
     @classmethod

rest/models/metadata.py

@@ -115,7 +115,7 @@ class MetaDataModel(object):
         if not isinstance(values, dict):
             raise Exception("invalid metadata: {}".format(values))
 
-        for key, value in list(values.items()):
+        for key, value in values.items():
             cat = None
             if "." in key:
                 cat, key = key.split('.')
@@ -230,15 +230,17 @@ class MetaDataModel(object):
             request = rh.getActiveRequest()
         self.__initFieldProps()
 
+        if "." in key:
+            category, key = key.split('.')
+            
         if isinstance(value, dict):
-            return self.setProperties(value, key)
+            if category is None:
+                return self.setProperties(value, key)
         username = "root"
         if request and request.member:
             username = request.member.username
         prop = None
 
-        if "." in key:
-            category, key = key.split('.')
         if category:
             # delete any keys with this category name
             full_key = "{}.{}".format(category, key)