django-restit 4.2.90__tar.gz → 4.2.92__tar.gz

{django_restit-4.2.90 → django_restit-4.2.92}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.90
+Version: 4.2.92
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.90 → django_restit-4.2.92}/account/models/group.py

@@ -211,7 +211,9 @@ class Group(models.Model, RestModel, MetaDataModel):
             self.name = None
 
     def set_parent(self, value):
-        if isinstance(value, (str, int)):
+        if not value:
+            value = None
+        else:
             if int(value) == self.pk:
                 raise RestValidationError("cannot set self as parent", 1101)
             value = Group.objects.filter(pk=value).last()

{django_restit-4.2.90 → django_restit-4.2.92}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.90"
+version = "4.2.92"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

{django_restit-4.2.90 → django_restit-4.2.92}/rest/models/base.py

@@ -19,6 +19,7 @@ from .metadata import MetaDataBase, MetaDataModel
 DB_ROUTING_MAPS = settings.get("DB_ROUTING_MAPS", {})
 TWO_DECIMAL_PLACES = Decimal(10) ** -2
 EXCEPTION_ON_LIST_PERM_DENIED = settings.get("EXCEPTION_ON_LIST_PERM_DENIED", True)
+ALLOW_BATCHING = settings.get("ALLOW_BATCHING", False)
 
 GRAPH_HELPERS = objict()
 GRAPH_HELPERS.restGet = None
@@ -1177,32 +1178,47 @@ class RestModel(object):
     @classmethod
     def on_rest_batch(cls, request, action):
         # this method is called when rest_batch='somme action'
+        if not ALLOW_BATCHING or not getattr(cls.RestMeta, "CAN_BATCH", True):
+            return GRAPH_HELPERS.restStatus(request, False, error="model does not allow batch actions")
         cls._boundRest()
+        # if not request.member.hasPerm("can_batch_update"):
+        #     raise re.PermissionDeniedException(f"batch updated not allowed by user")
+        if action == "create":
+            return cls.on_rest_batch_create(request)
         batch_ids = request.DATA.getlist("batch_ids", [])
         batch_id_field = request.DATA.get("batch_id_field", "pk")
-        q = {}
         if batch_ids:
+            q = {}
             q["{}__in".format(batch_id_field)] = batch_ids
-        batch_query = request.DATA.get("batch_query", None)
-        if batch_query:
-            # we ignore ids when doing a query
-            q.update(batch_query)
+            qset = cls.on_rest_list_query(request, cls.rw_objects().filter(**q))
+        else:
+            qset = cls.on_rest_list_query(request, cls.rw_objects().all())
         if action == "delete":
             can_delete = getattr(cls.RestMeta, "CAN_DELETE", False)
             if not can_delete:
-                return GRAPH_HELPERS.restStatus(request, False, error="deletion not allowed via rest for this model.")
-            qset = cls.rw_objects().filter(**q)
+                raise re.PermissionDeniedException(f"deletion not allowed for {cls.get_class_name()}", 438)
             count = qset.delete()
             return GRAPH_HELPERS.restStatus(request, True, error="delete {} items".format(count))
         elif action == "update":
-            qset = cls.rw_objects().filter(**q)
             update_fields = request.DATA.get(["batch_data", "batch_update"])
             if not isinstance(update_fields, dict):
                 return GRAPH_HELPERS.restStatus(request, False, error="batch_update should be key/values")
-            count = qset.update(**update_fields)
+            if {"id", "pk", "created", "password"} & update_fields.keys():
+                return GRAPH_HELPERS.restStatus(request, False, error="field/s not allowed")
+            has_meta = False
+            for key in update_fields:
+                if key.startswith("metadata"):
+                    has_meta = True
+                    break
+            if has_meta or not request.member.is_superuser:
+                count = 0
+                for obj in qset:
+                    obj.checkPermsAndSave(request, update_fields)
+                    count += 1
+            else:
+                # only super users can do this
+                count = qset.update(**update_fields)
             return GRAPH_HELPERS.restStatus(request, True, error="updated {} items".format(count))
-        elif action == "create":
-            cls.on_rest_batch_create(request)
         return GRAPH_HELPERS.restStatus(request, False, error="not implemented")
 
     @classmethod
@@ -1213,6 +1229,8 @@ class RestModel(object):
         if isinstance(batch_data, dict):
             if "data" in batch_data:
                 batch_data = batch_data["data"]
+            if isinstance(batch_data, dict):
+                batch_data = [batch_data]
         items = []
         for item in batch_data:
             obj = cls.createFromBatch(item)
@@ -1223,15 +1241,14 @@ class RestModel(object):
     @classmethod
     def createFromBatch(cls, item, request=None):
         obj = None
-        try:
-            rh.debug("batch item", item)
-            item_filter = cls.getRestBatchCreateFilter(item)
-            rh.debug("batch filters", item_filter)
-            obj = cls.ro_objects().filter(**item_filter).last()
-            if obj is None:
-                obj = cls.createFromDict(request, item)
-        except Exception:
-            rh.log_exception(item)
+        item_filter = cls.getRestBatchCreateFilter(item)
+        if not item_filter:
+            raise Exception("requires item filter")
+        rh.debug("createFromBatch", item_filter)
+        obj = cls.ro_objects().filter(**item_filter).last()
+        if obj is None:
+            obj = cls()
+            obj.checkPermsAndSave(request, item)
         return obj
 
     @classmethod