django-restit 4.2.90__py3-none-any.whl → 4.2.92__py3-none-any.whl

account/models/group.py

@@ -211,7 +211,9 @@ class Group(models.Model, RestModel, MetaDataModel):
             self.name = None
 
     def set_parent(self, value):
-        if isinstance(value, (str, int)):
+        if not value:
+            value = None
+        else:
             if int(value) == self.pk:
                 raise RestValidationError("cannot set self as parent", 1101)
             value = Group.objects.filter(pk=value).last()

{django_restit-4.2.90.dist-info → django_restit-4.2.92.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.90
+Version: 4.2.92
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.90.dist-info → django_restit-4.2.92.dist-info}/RECORD

@@ -26,7 +26,7 @@ account/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuF
 account/models/__init__.py,sha256=cV_lMnT2vL_mjiYtT4hlcIHo52ocFbGSNVkOIHHLXZY,385
 account/models/device.py,sha256=TloXvvrx3khF3BeGFuVYn6DhXjOW0AMZb4F9Fl5nBII,5491
 account/models/feeds.py,sha256=vI7fG4ASY1M0Zjke24RdnfDcuWeATl_yR_25jPmT64g,2011
-account/models/group.py,sha256=Zsclyi83t-X-OshkaauObImVimiI2crTsKEM_aC2vvE,22262
+account/models/group.py,sha256=mjWwePt3ogQUo9m0EhURMz0aBrVVx_0Drr0lNDESQio,22281
 account/models/legacy.py,sha256=zYdtv4LC0ooxPVqWM-uToPwV-lYWQLorSE6p6yn1xDw,2720
 account/models/member.py,sha256=8xi-NahJipic_ut81vCFG-hY9x1U-trZ9KhnhIHAaFM,53092
 account/models/membership.py,sha256=90EpAhOsGaqphDAkONP6j_qQ0OWSRaQsI8H7E7fgMkE,9249
@@ -404,7 +404,7 @@ rest/middleware/request.py,sha256=JchRNy5L-bGd-7h-KFYekGRvREe2eCkZXKOYqIkP2hI,41
 rest/middleware/session.py,sha256=zHSoQpIzRLmpqr_JvW406wzpvU3W3gDbm5JhtzLAMlE,10240
 rest/middleware/session_store.py,sha256=1nSdeXK8PyuYgGgIufqrS6j6QpIrQ7zbMNT0ol75e6U,1901
 rest/models/__init__.py,sha256=M8pvFDq-WCF-QcM58X7pMufYYe0aaQ3U0PwGe9TKbbY,130
-rest/models/base.py,sha256=bPcTeCX7KvhkcVMKEyLmu9eYc7ccJGkIP1n3cctJPVE,69675
+rest/models/base.py,sha256=-NUKed_67o3eCZCknndQixSHU4pR-Lm2wxsb_h4rjVQ,70652
 rest/models/cacher.py,sha256=eKz8TINVhWEqKhJGMsRkKZTtBUIv5rN3NHbZwOC56Uk,578
 rest/models/metadata.py,sha256=1nQ7CYo9bJHoaXE_hVNaj1-Y7yqhHlf2ZlaD1IfTzic,12904
 rest/net.py,sha256=LcB2QV6VNRtsSdmiQvYZgwQUDwOPMn_VBdRiZ6OpI-I,2974
@@ -506,7 +506,7 @@ ws4redis/servers/uwsgi.py,sha256=VyhoCI1DnVFqBiJYHoxqn5Idlf6uJPHvfBKgkjs34mo,172
 ws4redis/settings.py,sha256=K0yBiLUuY81iDM4Yr-k8hbvjn5VVHu5zQhmMK8Dtz0s,1536
 ws4redis/utf8validator.py,sha256=S0OlfjeGRP75aO6CzZsF4oTjRQAgR17OWE9rgZdMBZA,5122
 ws4redis/websocket.py,sha256=R0TUyPsoVRD7Y_oU7w2I6NL4fPwiz5Vl94-fUkZgLHA,14848
-django_restit-4.2.90.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
-django_restit-4.2.90.dist-info/METADATA,sha256=NgUxbFxdTPM54mt7gxCFK77X4SIu0_2TDlioDkYvgC8,7645
-django_restit-4.2.90.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
-django_restit-4.2.90.dist-info/RECORD,,
+django_restit-4.2.92.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
+django_restit-4.2.92.dist-info/METADATA,sha256=Cc0596dSa_nBz3E8F6ac6yxrVhzob92fIQzzqhiIc9Y,7645
+django_restit-4.2.92.dist-info/WHEEL,sha256=sP946D7jFCHeNz5Iq4fL4Lu-PrWrFsgfLXbbkciIZwg,88
+django_restit-4.2.92.dist-info/RECORD,,

rest/models/base.py

@@ -19,6 +19,7 @@ from .metadata import MetaDataBase, MetaDataModel
 DB_ROUTING_MAPS = settings.get("DB_ROUTING_MAPS", {})
 TWO_DECIMAL_PLACES = Decimal(10) ** -2
 EXCEPTION_ON_LIST_PERM_DENIED = settings.get("EXCEPTION_ON_LIST_PERM_DENIED", True)
+ALLOW_BATCHING = settings.get("ALLOW_BATCHING", False)
 
 GRAPH_HELPERS = objict()
 GRAPH_HELPERS.restGet = None
@@ -1177,32 +1178,47 @@ class RestModel(object):
     @classmethod
     def on_rest_batch(cls, request, action):
         # this method is called when rest_batch='somme action'
+        if not ALLOW_BATCHING or not getattr(cls.RestMeta, "CAN_BATCH", True):
+            return GRAPH_HELPERS.restStatus(request, False, error="model does not allow batch actions")
         cls._boundRest()
+        # if not request.member.hasPerm("can_batch_update"):
+        #     raise re.PermissionDeniedException(f"batch updated not allowed by user")
+        if action == "create":
+            return cls.on_rest_batch_create(request)
         batch_ids = request.DATA.getlist("batch_ids", [])
         batch_id_field = request.DATA.get("batch_id_field", "pk")
-        q = {}
         if batch_ids:
+            q = {}
             q["{}__in".format(batch_id_field)] = batch_ids
-        batch_query = request.DATA.get("batch_query", None)
-        if batch_query:
-            # we ignore ids when doing a query
-            q.update(batch_query)
+            qset = cls.on_rest_list_query(request, cls.rw_objects().filter(**q))
+        else:
+            qset = cls.on_rest_list_query(request, cls.rw_objects().all())
         if action == "delete":
             can_delete = getattr(cls.RestMeta, "CAN_DELETE", False)
             if not can_delete:
-                return GRAPH_HELPERS.restStatus(request, False, error="deletion not allowed via rest for this model.")
-            qset = cls.rw_objects().filter(**q)
+                raise re.PermissionDeniedException(f"deletion not allowed for {cls.get_class_name()}", 438)
             count = qset.delete()
             return GRAPH_HELPERS.restStatus(request, True, error="delete {} items".format(count))
         elif action == "update":
-            qset = cls.rw_objects().filter(**q)
             update_fields = request.DATA.get(["batch_data", "batch_update"])
             if not isinstance(update_fields, dict):
                 return GRAPH_HELPERS.restStatus(request, False, error="batch_update should be key/values")
-            count = qset.update(**update_fields)
+            if {"id", "pk", "created", "password"} & update_fields.keys():
+                return GRAPH_HELPERS.restStatus(request, False, error="field/s not allowed")
+            has_meta = False
+            for key in update_fields:
+                if key.startswith("metadata"):
+                    has_meta = True
+                    break
+            if has_meta or not request.member.is_superuser:
+                count = 0
+                for obj in qset:
+                    obj.checkPermsAndSave(request, update_fields)
+                    count += 1
+            else:
+                # only super users can do this
+                count = qset.update(**update_fields)
             return GRAPH_HELPERS.restStatus(request, True, error="updated {} items".format(count))
-        elif action == "create":
-            cls.on_rest_batch_create(request)
         return GRAPH_HELPERS.restStatus(request, False, error="not implemented")
 
     @classmethod
@@ -1213,6 +1229,8 @@ class RestModel(object):
         if isinstance(batch_data, dict):
             if "data" in batch_data:
                 batch_data = batch_data["data"]
+            if isinstance(batch_data, dict):
+                batch_data = [batch_data]
         items = []
         for item in batch_data:
             obj = cls.createFromBatch(item)
@@ -1223,15 +1241,14 @@ class RestModel(object):
     @classmethod
     def createFromBatch(cls, item, request=None):
         obj = None
-        try:
-            rh.debug("batch item", item)
-            item_filter = cls.getRestBatchCreateFilter(item)
-            rh.debug("batch filters", item_filter)
-            obj = cls.ro_objects().filter(**item_filter).last()
-            if obj is None:
-                obj = cls.createFromDict(request, item)
-        except Exception:
-            rh.log_exception(item)
+        item_filter = cls.getRestBatchCreateFilter(item)
+        if not item_filter:
+            raise Exception("requires item filter")
+        rh.debug("createFromBatch", item_filter)
+        obj = cls.ro_objects().filter(**item_filter).last()
+        if obj is None:
+            obj = cls()
+            obj.checkPermsAndSave(request, item)
         return obj
 
     @classmethod