django-smartbase-admin 2.0.0__tar.gz → 2.0.2__tar.gz

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-smartbase-admin
-Version: 2.0.0
+Version: 2.0.2
 Summary: 
 Home-page: https://smartbase-sk.github.io/django-smartbase-admin-docs/
 License: MIT

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-smartbase-admin"
-version = "2.0.0"
+version = "2.0.2"
 description = ""
 authors = ["SmartBase <info@smartbase.sk>"]
 readme = "README.md"

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/src/django_smartbase_admin/audit/tests/test_action_processing.py

@@ -129,11 +129,25 @@ class RowList:
         self.rows = rows
 
     def filter(self, *args, **kwargs):
-        return self
+        rows = self.rows
+        for key, value in kwargs.items():
+            if key.endswith("__in"):
+                field_name = key.removesuffix("__in")
+                allowed = set(value)
+                rows = [row for row in rows if row.get(field_name) in allowed]
+            else:
+                rows = [row for row in rows if row.get(key) == value]
+        return RowList(rows)
 
     def order_by(self, *args):
         return self
 
+    def none(self):
+        return RowList([])
+
+    def union(self, other, all=False):
+        return RowList([*self.rows, *other.rows])
+
     def __iter__(self):
         return iter(self.rows)
 
@@ -380,7 +394,10 @@ class RowActionIntegrationTests(TestCase):
 
         with patch(
             "django_smartbase_admin.plugins.nested.resolve_nested",
-            return_value={"parent_field": "parent"},
+            return_value={
+                "parent_field": "parent",
+                "only_show_filtered_children": False,
+            },
         ):
             result = TabulatorNestedPlugin.modify_final_data(
                 action,

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/src/django_smartbase_admin/engine/dynamic_forms.py

@@ -15,6 +15,25 @@ SBADMIN_DYNAMIC_REGION_PARAM = "sbadmin_dynamic_region"
 SBADMIN_DYNAMIC_REGION_PREFIX_PARAM = "sbadmin_dynamic_region_prefix"
 SBADMIN_DYNAMIC_REGION_ACTION = "sbadmin_dynamic_region"
 SBADMIN_DYNAMIC_REGION_ADD_MODIFIER = "add"
+_FORMSET_PREFIX_PLACEHOLDER = "__prefix__"
+_FORMSET_PREFIX_PLACEHOLDER_TOKEN = "\x00"
+
+
+def _dynamic_region_wrapper_id_from_parts(value: str) -> str:
+    """Build a wrapper id from joined prefix/region parts.
+
+    Django formset empty forms keep ``__prefix__`` in the prefix so
+    ``sbadmin_formset.js`` can substitute the row index. Slugify collapses
+    that token; underscore-to-hyphen replacement turns it into ``---prefix---``.
+    """
+    if _FORMSET_PREFIX_PLACEHOLDER in value:
+        protected = value.replace(
+            _FORMSET_PREFIX_PLACEHOLDER, _FORMSET_PREFIX_PLACEHOLDER_TOKEN
+        )
+        return protected.replace("_", "-").replace(
+            _FORMSET_PREFIX_PLACEHOLDER_TOKEN, _FORMSET_PREFIX_PLACEHOLDER
+        )
+    return slugify(value).replace("_", "-")
 
 
 def field_names_from_layout(layout: Iterable[Any]) -> tuple[str, ...]:
@@ -141,7 +160,7 @@ class SBDynamicRegion:
         if prefix:
             pieces.append(str(prefix))
         pieces.append(self.name)
-        return slugify("-".join(pieces)).replace("_", "-")
+        return _dynamic_region_wrapper_id_from_parts("-".join(pieces))
 
     def resolve(
         self, form: forms.Form, request: HttpRequest | None = None
@@ -535,6 +554,7 @@ class SBAdminDynamicFormMixin:
         collapsible = bool(fieldset_data.get("collapsible", False))
         default_collapsed = bool(fieldset_data.get("default_collapsed", False))
         hide_if_empty = bool(fieldset_data.get("hide_if_empty", False))
+        skip_header = bool(fieldset_data.get("skip_header", False))
         fieldset_layout = self.get_fieldset_layout(fieldset, fieldset_data, request)
         fieldset_empty = (
             hide_if_empty
@@ -551,6 +571,7 @@ class SBAdminDynamicFormMixin:
             "actions": self.get_fieldset_actions(fieldset, fieldset_data, request),
             "hide_if_empty": hide_if_empty,
             "empty": fieldset_empty,
+            "skip_header": skip_header,
         }
 
     def get_fieldset_layout(

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/src/django_smartbase_admin/mcp/dashboard_blueprint.html

@@ -5,7 +5,7 @@
 <meta name="viewport" content="width=device-width, initial-scale=1" />
 <title>SBAdmin Dashboard</title>
 <!-- Blueprint for a local dashboard on this admin's live data (MCP resource dashboard://blueprint). -->
-<!-- Build any view below — metrics, tables, charts. Fill CONFIG.clientId after registering an OAuth client; scope + MCP path are filled in on read. -->
+<!-- Build any view below — metrics, tables, charts. The OAuth client self-registers on first connect; scope + MCP path are filled in on read. -->
 <!-- Serve on a spare port, e.g. python -m http.server 8010. -->
 
 <style>
@@ -35,12 +35,17 @@
 /* ============================ CONFIG ============================ */
 const CONFIG = {
   issuer:      location.origin,                 // this server when served same-origin; else set explicitly
-  clientId:    "REPLACE_WITH_CLIENT_ID",        // from Dynamic Client Registration (see header)
+  clientId:    null,                            // auto-registered (DCR) on first connect, then cached per-issuer
   redirectUri: location.origin + location.pathname,
   scope:       "__MCP_SCOPE__",                 // scope this server exposes (filled in on resource read)
   mcpUrl:      location.origin + "/__MCP_PATH__",  // MCP endpoint (path filled in); set host if off-origin
 };
 
+// Cache the registered client per issuer, so the same page pointed at a
+// different admin doesn't reuse a client_id that admin never issued.
+const CLIENT_KEY = "sbadmin_client_id:" + CONFIG.issuer;
+CONFIG.clientId = localStorage.getItem(CLIENT_KEY);
+
 /* ===================== OAuth 2.1 + PKCE (auth) ===================== */
 const b64url = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)))
   .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -52,11 +57,24 @@ let TOKEN = sessionStorage.getItem("sbadmin_token") || null;
 async function discover() {
   const r = await fetch(CONFIG.issuer + "/.well-known/oauth-authorization-server");
   if (!r.ok) throw new Error("OAuth discovery failed");
-  return r.json();                              // -> { authorization_endpoint, token_endpoint, ... }
+  return r.json();                              // -> { authorization_endpoint, token_endpoint, registration_endpoint, ... }
+}
+
+async function ensureClient(meta) {
+  if (CONFIG.clientId) return;                  // cached from a previous connect
+  const r = await fetch(meta.registration_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ client_name: "SBAdmin dashboard", redirect_uris: [CONFIG.redirectUri] }),
+  });
+  if (!r.ok) throw new Error("client registration failed: " + r.status);
+  CONFIG.clientId = (await r.json()).client_id;
+  localStorage.setItem(CLIENT_KEY, CONFIG.clientId);   // reuse, don't re-register each load
 }
 
 async function login() {
   const meta = await discover();
+  await ensureClient(meta);                     // self-register on first connect (DCR)
   const verifier = rand();
   const state = rand();
   sessionStorage.setItem("pkce_verifier", verifier);

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/src/django_smartbase_admin/mcp/mcp.py

@@ -1387,21 +1387,24 @@ class SBAdminTools(MCPToolset):
         "display whatever you need: metrics, tables, charts/graphs, any custom "
         "view. It logs in via OAuth 2.1 (auth code + PKCE) to this "
         "server and calls the MCP tools through an api(tool, args) helper. "
-        "SETUP: (1) save the content as an .html file; (2) register an OAuth "
-        "client via POST <issuer>/oauth/register (redirect_uris = where you "
-        "serve the page) and put the returned client_id into CONFIG — a public "
-        "PKCE id, no secret; CONFIG.scope and the MCP path are prefilled; "
-        "(3) serve it over http, NOT file:// (Origin 'null' is always "
-        "CORS-blocked) — locally on a spare, non-default port so it doesn't "
-        "clash with the admin/other dev servers, e.g. python -m http.server "
-        "8010; (4) build the "
+        "SETUP: (1) save the content as an .html file; (2) serve it over http, "
+        "NOT file:// (Origin 'null' is always CORS-blocked) — locally on a "
+        "spare, non-default port so it doesn't clash with the admin/other dev "
+        "servers, e.g. python -m http.server 8010; (3) open it and Connect — "
+        "the OAuth client self-registers via DCR on first connect (a public "
+        "PKCE id cached in localStorage; nothing to paste), and CONFIG.scope + "
+        "the MCP path are prefilled; (4) build the "
         "view: call MCP tool(s) via api() (discover views/fields via "
         "list_admins) and render the results any way you like — cards, tables, "
         "charts, free-form layout (the example cards are just one option; add a "
         "chart library for graphs). Same-origin as the admin needs no CORS; "
-        "off-origin, point "
-        "CONFIG.issuer/mcpUrl at this server and enable SBAdminMCPCorsMiddleware "
-        "+ SBADMIN_MCP_ALLOWED_ORIGINS."
+        "off-origin (incl. a local http://localhost page against an https "
+        "admin), point CONFIG.issuer/mcpUrl at this server and have the "
+        "operator add the page's origin to SBADMIN_MCP_ALLOWED_ORIGINS with "
+        "SBAdminMCPCorsMiddleware enabled. Plain http on localhost is fine — "
+        "loopback is a secure context (PKCE works), the self-registered "
+        "redirect_uri is loopback so http is accepted, and the admin traffic is "
+        "still https."
     ),
     mime_type="text/html",
 )

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/src/django_smartbase_admin/mcp/middleware.py

@@ -7,9 +7,15 @@ cross-origin POST to ``/mcp/`` and send an OAuth preflight to
 ``Access-Control-Allow-Origin`` + matching ``-Methods`` / ``-Headers``,
 the browser blocks every request before it reaches Django.
 
-This middleware adds the required headers on the MCP endpoint plus the
-OAuth discovery / registration / authorization paths, gated by an
-explicit origin allowlist set via ``SBADMIN_MCP_ALLOWED_ORIGINS``.
+This middleware adds the required headers on the MCP endpoint and the
+OAuth discovery / token / registration paths, gated by an explicit
+origin allowlist set via ``SBADMIN_MCP_ALLOWED_ORIGINS``.
+
+No credentials are advertised: the MCP flow authenticates with a
+``Bearer`` token and the OAuth flow is public-client + PKCE, so no
+cross-origin request needs cookies. That is what makes adding a
+``http://localhost:<port>`` dashboard origin safe — an allowed local
+page still can't ride the user's admin session.
 
 Default allowlist covers Claude (``https://claude.ai``) and Cursor
 (``https://cursor.com``) so their install flows work out of the box.
@@ -35,9 +41,6 @@ DEFAULT_ALLOWED_ORIGINS: tuple[str, ...] = (
     "https://cursor.com",
 )
 
-# Paths the middleware decorates. Kept inline rather than reverse()'d
-# because middleware runs on every request — a startup-time URL resolver
-# walk would just trade configuration for an import-order hazard.
 _MCP_PATH_PREFIXES: tuple[str, ...] = (
     "/mcp",
     "/.well-known/oauth-authorization-server",
@@ -46,8 +49,6 @@ _MCP_PATH_PREFIXES: tuple[str, ...] = (
     "/o/",
 )
 
-# Headers MCP clients legitimately send. ``MCP-Protocol-Version`` and
-# ``MCP-Session-Id`` are part of the streamable HTTP transport spec.
 _ALLOWED_REQUEST_HEADERS = (
     "Authorization, Content-Type, MCP-Protocol-Version, MCP-Session-Id"
 )
@@ -63,13 +64,12 @@ def _allowed_origins() -> frozenset[str]:
     )
 
 
-def _path_is_mcp(path: str) -> bool:
+def _path_needs_cors(path: str) -> bool:
     return any(path.startswith(prefix) for prefix in _MCP_PATH_PREFIXES)
 
 
 def _apply_cors_headers(response: HttpResponse, origin: str) -> None:
     response["Access-Control-Allow-Origin"] = origin
-    response["Access-Control-Allow-Credentials"] = "true"
     response["Access-Control-Allow-Methods"] = _ALLOWED_METHODS
     response["Access-Control-Allow-Headers"] = _ALLOWED_REQUEST_HEADERS
     response["Access-Control-Expose-Headers"] = _EXPOSED_RESPONSE_HEADERS
@@ -84,7 +84,7 @@ class SBAdminMCPCorsMiddleware:
         self.get_response = get_response
 
     def __call__(self, request):
-        if not _path_is_mcp(request.path):
+        if not _path_needs_cors(request.path):
             return self.get_response(request)
 
         origin = request.META.get("HTTP_ORIGIN", "")

django_smartbase_admin-2.0.2/src/django_smartbase_admin/mcp/oauth/validators.py

@@ -0,0 +1,34 @@
+"""Minimal DOT validator for the SBAdmin MCP OAuth server.
+
+``OAUTH2_PROVIDER["ALLOWED_REDIRECT_URI_SCHEMES"]`` is a global, host-blind
+scheme list. Allowing ``"http"`` so a local (``http://localhost``) dashboard
+can register a redirect URI would otherwise permit an http redirect to *any*
+host. This validator narrows http to loopback hosts (RFC 8252 §7.3); https and
+native custom schemes (``cursor://``, ``claude://``) are unaffected.
+
+Wire it in as ``OAUTH2_PROVIDER["OAUTH2_VALIDATOR_CLASS"]``, or subclass it if
+the deployment needs further customization.
+"""
+
+from __future__ import annotations
+
+from urllib.parse import urlsplit
+
+from oauth2_provider.oauth2_validators import OAuth2Validator
+
+LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
+
+
+def is_non_loopback_http(redirect_uri: str) -> bool:
+    """True for an ``http://`` URI whose host is not a loopback literal."""
+    parts = urlsplit(redirect_uri)
+    return parts.scheme == "http" and parts.hostname not in LOOPBACK_HOSTS
+
+
+class SBAdminMCPOAuth2Validator(OAuth2Validator):
+    def validate_redirect_uri(self, client_id, redirect_uri, request, *args, **kwargs):
+        if is_non_loopback_http(redirect_uri):
+            return False
+        return super().validate_redirect_uri(
+            client_id, redirect_uri, request, *args, **kwargs
+        )

{django_smartbase_admin-2.0.0 → django_smartbase_admin-2.0.2}/src/django_smartbase_admin/mcp/oauth/views.py

@@ -28,6 +28,8 @@ from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_GET, require_POST
 from oauth2_provider.models import get_application_model
 
+from django_smartbase_admin.mcp.oauth.validators import is_non_loopback_http
+
 # Single scope granting full read-write access to the SBAdmin MCP tools.
 # Tool-level authorization is the staff gate plus Django model permissions;
 # the scope is not split read/write, so it must not imply read-only.
@@ -95,6 +97,17 @@ def register(request: HttpRequest) -> JsonResponse:
             },
             status=400,
         )
+    # http is accepted only for loopback (RFC 8252 §7.3); reject here so a
+    # non-loopback http URI can't be registered, matching the authorize-time
+    # check in SBAdminMCPOAuth2Validator.
+    if any(is_non_loopback_http(uri) for uri in redirect_uris):
+        return JsonResponse(
+            {
+                "error": "invalid_redirect_uri",
+                "error_description": "http redirect URIs are allowed only for loopback hosts",
+            },
+            status=400,
+        )
 
     Application = get_application_model()
     app = Application(

django_smartbase_admin-2.0.2/src/django_smartbase_admin/mcp/tests/test_cors_middleware.py

@@ -0,0 +1,56 @@
+"""CORS middleware: which origins/paths get headers, and the no-credentials default.
+
+The dashboard + browser MCP clients authenticate with a Bearer token and a
+public-client PKCE OAuth flow, so no cross-origin request needs cookies. The
+middleware must therefore not advertise credentials by default, and must keep
+the cookie-authed (navigation-only) authorize endpoint off the CORS surface.
+"""
+
+from __future__ import annotations
+
+from django.http import HttpResponse
+from django.test import RequestFactory, SimpleTestCase, override_settings
+
+from django_smartbase_admin.mcp.middleware import SBAdminMCPCorsMiddleware
+
+ORIGIN = "http://localhost:8010"
+
+
+@override_settings(SBADMIN_MCP_ALLOWED_ORIGINS=[ORIGIN])
+class CorsMiddlewareTests(SimpleTestCase):
+    def _send(self, path, *, origin=ORIGIN, method="post", preflight=False):
+        rf = RequestFactory()
+        extra = {"HTTP_ORIGIN": origin} if origin else {}
+        if preflight:
+            extra["HTTP_ACCESS_CONTROL_REQUEST_METHOD"] = "POST"
+            request = rf.options(path, **extra)
+        else:
+            request = getattr(rf, method)(path, **extra)
+        middleware = SBAdminMCPCorsMiddleware(lambda r: HttpResponse("ok"))
+        return middleware(request)
+
+    def test_allowed_origin_gets_cors_without_credentials_by_default(self):
+        resp = self._send("/mcp/")
+        self.assertEqual(resp["Access-Control-Allow-Origin"], ORIGIN)
+        self.assertNotIn("Access-Control-Allow-Credentials", resp)
+        self.assertIn("Origin", resp["Vary"])
+
+        pre = self._send("/mcp/", preflight=True)
+        self.assertEqual(pre.status_code, 204)
+        self.assertEqual(pre["Access-Control-Allow-Origin"], ORIGIN)
+        self.assertNotIn("Access-Control-Allow-Credentials", pre)
+
+    def test_mcp_and_oauth_paths_are_decorated(self):
+        for path in ("/mcp/", "/o/token/", "/.well-known/oauth-authorization-server"):
+            self.assertEqual(
+                self._send(path, method="get")["Access-Control-Allow-Origin"], ORIGIN
+            )
+
+    def test_disallowed_origin_and_unrelated_paths_get_no_cors(self):
+        self.assertNotIn(
+            "Access-Control-Allow-Origin",
+            self._send("/mcp/", origin="http://evil.example"),
+        )
+        self.assertNotIn(
+            "Access-Control-Allow-Origin", self._send("/admin/", method="get")
+        )

django_smartbase_admin-2.0.2/src/django_smartbase_admin/mcp/tests/test_oauth_redirect_loopback.py

@@ -0,0 +1,79 @@
+"""Loopback-only http redirect URIs — the validator gate and the DCR endpoint.
+
+``ALLOWED_REDIRECT_URI_SCHEMES`` must keep "http" so a local dashboard can
+register a loopback redirect, but http to any other host must be refused. Both
+the authorize-time validator and the registration endpoint enforce that.
+"""
+
+from __future__ import annotations
+
+import json
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from django.test import RequestFactory, TestCase
+from oauth2_provider.oauth2_validators import OAuth2Validator
+
+from django_smartbase_admin.mcp.oauth.validators import (
+    SBAdminMCPOAuth2Validator,
+    is_non_loopback_http,
+)
+from django_smartbase_admin.mcp.oauth.views import register
+
+
+class LoopbackRedirectTests(TestCase):
+    def test_is_non_loopback_http_truth_table(self):
+        for uri in (
+            "http://evil.example/cb",
+            "http://192.168.0.5:8010/",
+            "http://example.com/",
+        ):
+            self.assertTrue(is_non_loopback_http(uri), uri)
+        for uri in (
+            "http://localhost:8010/",
+            "http://127.0.0.1/cb",
+            "http://[::1]:8010/",
+            "https://anything.example/cb",
+            "cursor://callback",
+        ):
+            self.assertFalse(is_non_loopback_http(uri), uri)
+
+    def test_validator_rejects_non_loopback_http_only(self):
+        validator = SBAdminMCPOAuth2Validator()
+        with patch.object(
+            OAuth2Validator, "validate_redirect_uri", return_value=True
+        ) as parent:
+            self.assertFalse(
+                validator.validate_redirect_uri(
+                    "c", "http://evil.example/cb", SimpleNamespace()
+                )
+            )
+            parent.assert_not_called()
+        with patch.object(
+            OAuth2Validator, "validate_redirect_uri", return_value=True
+        ) as parent:
+            self.assertTrue(
+                validator.validate_redirect_uri(
+                    "c", "http://localhost:8010/", SimpleNamespace()
+                )
+            )
+            parent.assert_called_once()
+
+    def test_dcr_register_enforces_loopback_for_http(self):
+        rf = RequestFactory()
+
+        def _register(uris):
+            request = rf.post(
+                "/oauth/register",
+                data=json.dumps({"redirect_uris": uris}),
+                content_type="application/json",
+            )
+            return register(request)
+
+        bad = _register(["http://evil.example/cb"])
+        self.assertEqual(bad.status_code, 400)
+        self.assertEqual(json.loads(bad.content)["error"], "invalid_redirect_uri")
+
+        ok = _register(["http://localhost:8010/"])
+        self.assertEqual(ok.status_code, 201)
+        self.assertIn("client_id", json.loads(ok.content))