django-smartbase-admin 2.0.4__tar.gz → 2.0.5__tar.gz

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-smartbase-admin
-Version: 2.0.4
+Version: 2.0.5
 Summary: 
 Home-page: https://smartbase-sk.github.io/django-smartbase-admin-docs/
 License: MIT

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-smartbase-admin"
-version = "2.0.4"
+version = "2.0.5"
 description = ""
 authors = ["SmartBase <info@smartbase.sk>"]
 readme = "README.md"

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/admin/admin_base.py

@@ -31,7 +31,12 @@ from django.forms.models import (
     ModelFormMetaclass,
     modelform_factory,
 )
-from django.http import HttpResponse, HttpResponseBadRequest, HttpResponseNotAllowed
+from django.http import (
+    HttpResponse,
+    HttpResponseBadRequest,
+    HttpResponseNotAllowed,
+    HttpResponseRedirect,
+)
 from django.template.loader import render_to_string
 from django.template.response import TemplateResponse
 from django.urls import reverse, NoReverseMatch, resolve
@@ -824,6 +829,11 @@ class SBAdminTranslationStatusMixin:
                 translations_view_id, obj.id
             )
         )
+        request = SBAdminThreadLocalService.get_request()
+        if request is not None:
+            translations_edit_url = SBAdminViewService.url_with_current_back_url(
+                request, translations_edit_url
+            )
         result = f"<a href='{translations_edit_url}' class='btn btn-small absolute top-24 right-24'>{_('Edit')}</a>"
         languages = SBAdminTranslationsService.get_all_languages()
         translations = (
@@ -1258,15 +1268,32 @@ class SBAdmin(
             trigger_client_event(response, TABLE_RELOAD_DATA_EVENT_NAME, {})
         return response
 
+    def _apply_back_url(self, request, response):
+        """On a terminal Save, redirect to ``back_url`` instead of the default
+        changelist. Only applies to a redirect response with ``_save`` in POST."""
+        if not isinstance(response, HttpResponseRedirect):
+            return response
+        if "_save" not in request.POST:
+            return response
+        default_url = response.url
+        target = SBAdminViewService.resolve_back_url(
+            request, default_url, current_path=request.path
+        )
+        if target != default_url:
+            return HttpResponseRedirect(target)
+        return response
+
     def response_add(self, request, obj, post_url_continue=None):
         if is_modal(request):
             return self.get_modal_save_response(request, obj)
-        return super().response_add(request, obj, post_url_continue)
+        return self._apply_back_url(
+            request, super().response_add(request, obj, post_url_continue)
+        )
 
     def response_change(self, request, obj):
         if is_modal(request):
             return self.get_modal_save_response(request, obj)
-        return super().response_change(request, obj)
+        return self._apply_back_url(request, super().response_change(request, obj))
 
     @classmethod
     def set_generic_relation_from_parent(cls, request, obj):

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/audit/tests/test_delegate_to_action.py

@@ -2,12 +2,15 @@
 
 from unittest.mock import MagicMock, patch
 
+from django.contrib.auth.models import Group
 from django.core.exceptions import PermissionDenied
 from django.http import Http404, HttpResponse
 from django.test import RequestFactory, TestCase
 
 from django_smartbase_admin.engine.actions import SBAdminCustomAction, sbadmin_action
+from django_smartbase_admin.engine.admin_base_view import SBAdminBaseListView
 from django_smartbase_admin.engine.admin_view import SBAdminView
+from django_smartbase_admin.engine.const import Action
 from django_smartbase_admin.engine.configuration import SBAdminRoleConfiguration
 from django_smartbase_admin.services.views import SBAdminViewService
 
@@ -131,6 +134,37 @@ class TestDelegateToAction(TestCase):
         action_arg = view.has_permission_for_action.call_args.args[1]
         self.assertEqual(action_arg.permission, "delete")
 
+    @patch(PATCH_FROM_REQUEST)
+    def test_bulk_delete_url_dispatch_requires_delete_permission(
+        self, mock_from_request
+    ):
+        def action_bulk_delete(request, modifier, object_id):
+            return HttpResponse("ok")
+
+        action_bulk_delete._is_sbadmin_action = True
+        action_bulk_delete._sbadmin_action_attrs = getattr(
+            SBAdminBaseListView.action_bulk_delete, "_sbadmin_action_attrs"
+        )
+
+        view = MagicMock()
+        view.action_bulk_delete = action_bulk_delete
+        view.has_permission_for_action.return_value = True
+        view.init_view_dynamic = MagicMock()
+
+        rd = _make_request_data(Action.BULK_DELETE.value)
+        rd.selected_view = view
+        mock_from_request.return_value = rd
+
+        SBAdminViewService.delegate_to_action(
+            self.factory.get("/"),
+            view="v",
+            action=Action.BULK_DELETE.value,
+            modifier="template",
+        )
+
+        action_arg = view.has_permission_for_action.call_args.args[1]
+        self.assertEqual(action_arg.permission, "delete")
+
     @patch(PATCH_FROM_REQUEST)
     def test_object_id_is_passed_to_method_action_for_template_modifier(
         self, mock_from_request
@@ -190,6 +224,142 @@ class TestDefaultActionPermission(TestCase):
         self.assertEqual(has_perm.call_args.args[-1], "change")
 
 
+class MCPReadonlyRoleConfiguration(SBAdminRoleConfiguration):
+    mcp_readonly = True
+
+
+class MCPReadonlyOverrideRoleConfiguration(MCPReadonlyRoleConfiguration):
+    def has_permission(
+        self, request, request_data, view, model=None, obj=None, permission=None
+    ):
+        return True
+
+
+class LegacyRoleConfiguration:
+    def has_permission(
+        self, request, request_data, view, model=None, obj=None, permission=None
+    ):
+        return True
+
+
+class TestMCPReadonlyPermissions(TestCase):
+    def _request(self, *, is_mcp=True, is_superuser=False, has_perm=True):
+        request = RequestFactory().get("/")
+        request.is_mcp = is_mcp
+        request.user = MagicMock(is_superuser=is_superuser, is_staff=True)
+        request.user.has_perm.return_value = has_perm
+        return request
+
+    def test_mcp_readonly_blocks_model_writes_only_for_mcp_requests(self):
+        config = MCPReadonlyRoleConfiguration()
+        view = MagicMock()
+
+        mcp_request = self._request(is_mcp=True)
+        self.assertTrue(
+            config.has_permission(mcp_request, MagicMock(), view, Group, None, "view")
+        )
+        self.assertFalse(
+            config.has_permission(mcp_request, MagicMock(), view, Group, None, "add")
+        )
+        self.assertFalse(
+            config.has_permission(mcp_request, MagicMock(), view, Group, None, "change")
+        )
+        self.assertFalse(
+            config.has_permission(mcp_request, MagicMock(), view, Group, None, "delete")
+        )
+
+        browser_request = self._request(is_mcp=False)
+        self.assertTrue(
+            config.has_permission(
+                browser_request, MagicMock(), view, Group, None, "change"
+            )
+        )
+
+    def test_mcp_readonly_blocks_mutating_actions_but_allows_view_actions(self):
+        config = MCPReadonlyRoleConfiguration()
+        request = self._request()
+        view = MagicMock()
+
+        mutate_action = SBAdminCustomAction.__new__(SBAdminCustomAction)
+        mutate_action.action_id = "mutate"
+        mutate_action.permission = None
+
+        view_action = SBAdminCustomAction.__new__(SBAdminCustomAction)
+        view_action.action_id = "inspect"
+        view_action.permission = "view"
+
+        delete_action = SBAdminCustomAction.__new__(SBAdminCustomAction)
+        delete_action.action_id = Action.BULK_DELETE.value
+        delete_action.permission = "delete"
+
+        self.assertFalse(
+            config.has_action_permission(
+                request, MagicMock(), view, Group, None, mutate_action
+            )
+        )
+        self.assertFalse(
+            config.has_action_permission(
+                request, MagicMock(), view, Group, None, delete_action
+            )
+        )
+        self.assertTrue(
+            config.has_action_permission(
+                request, MagicMock(), view, Group, None, view_action
+            )
+        )
+        view.has_delete_permission.assert_not_called()
+
+    def test_mcp_readonly_does_not_block_superusers(self):
+        config = MCPReadonlyRoleConfiguration()
+        request = self._request(is_superuser=True)
+
+        self.assertTrue(
+            config.has_permission(
+                request, MagicMock(), MagicMock(), Group, None, "change"
+            )
+        )
+
+    def test_service_gate_applies_before_custom_has_permission_override(self):
+        request = self._request()
+        request.request_data = MagicMock()
+        request.request_data.configuration = MCPReadonlyOverrideRoleConfiguration()
+
+        self.assertFalse(
+            SBAdminViewService.has_permission(
+                request, view=MagicMock(), model=Group, permission="change"
+            )
+        )
+        self.assertTrue(
+            SBAdminViewService.has_permission(
+                request, view=MagicMock(), model=Group, permission="view"
+            )
+        )
+
+    def test_service_gate_allows_legacy_configuration_without_mcp_helper(self):
+        request = self._request()
+        request.request_data = MagicMock()
+        request.request_data.configuration = LegacyRoleConfiguration()
+
+        self.assertTrue(
+            SBAdminViewService.has_permission(
+                request, view=MagicMock(), model=Group, permission="change"
+            )
+        )
+
+    def test_default_bulk_delete_action_declares_delete_permission(self):
+        view = SBAdminBaseListView.__new__(SBAdminBaseListView)
+        view.model = Group
+        view.sbadmin_list_selection_actions = None
+
+        action = next(
+            action
+            for action in view.get_sbadmin_list_selection_actions(MagicMock())
+            if action.action_id == Action.BULK_DELETE.value
+        )
+
+        self.assertEqual(action.permission, "delete")
+
+
 class TestSbadminActionDecorator(TestCase):
     def test_bare_decorator(self):
         @sbadmin_action

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/engine/admin_base_view.py

@@ -108,9 +108,6 @@ class SBAdminBaseView(object):
         return self.has_permission(request, obj, "delete")
 
     def has_permission_for_action(self, request, action: SBAdminCustomAction) -> bool:
-        if getattr(action, "action_id", None) == Action.BULK_DELETE.value:
-            if not self.has_delete_permission(request):
-                return False
         return self.has_permission(
             request=request,
             obj=None,
@@ -550,14 +547,19 @@ class SBAdminBaseView(object):
     def get_change_view_context(
         self, request: HttpRequest, object_id: str | int | None
     ) -> dict[str, Any]:
-        """Default change-form context: Back → model changelist. ModelAdmin subclasses only."""
+        """Default change-form context: Back → ``back_url`` or model changelist.
+        ModelAdmin only."""
+        default_back = reverse(
+            "sb_admin:{}_{}_changelist".format(
+                self.opts.app_label, self.opts.model_name
+            )
+        )
+        back_url = SBAdminViewService.resolve_back_url(
+            request, default_back, current_path=request.path
+        )
         return {
             "show_back_button": True,
-            "back_url": reverse(
-                "sb_admin:{}_{}_changelist".format(
-                    self.opts.app_label, self.opts.model_name
-                )
-            ),
+            "back_url": back_url,
         }
 
     def get_global_context(
@@ -986,6 +988,7 @@ class SBAdminBaseListView(SBAdminBaseView):
                         title=_("History"),
                         url=url,
                         no_params=True,
+                        permission="view",
                     ),
                 ]
             except Exception:
@@ -1023,6 +1026,7 @@ class SBAdminBaseListView(SBAdminBaseView):
                     view=self,
                     action_id=Action.BULK_DELETE.value,
                     css_class="btn-destructive",
+                    permission="delete",
                 ),
             ]
         return self.sbadmin_list_selection_actions
@@ -1075,7 +1079,7 @@ class SBAdminBaseListView(SBAdminBaseView):
         data = action.get_xlsx_data(request)
         return SBAdminXLSXExportService.create_workbook_http_respone(*data)
 
-    @sbadmin_action
+    @sbadmin_action(permission="delete")
     def action_bulk_delete(self, request, modifier, object_id=None):
         action = self.sbadmin_list_action_class(self, request)
         if (

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/engine/admin_view.py

@@ -13,6 +13,7 @@ from django_smartbase_admin.engine.const import (
     DEFAULT_PAGE_SIZE,
 )
 from django_smartbase_admin.services.configuration import SBAdminConfigurationService
+from django_smartbase_admin.services.views import SBAdminViewService
 
 
 class SBAdminView(SBAdminBaseQuerysetMixin, SBAdminBaseView):
@@ -108,9 +109,12 @@ class SBAdminView(SBAdminBaseQuerysetMixin, SBAdminBaseView):
         return f"{url}{f'?{changelist_filters}' if changelist_filters else ''}"
 
     def get_back_url(self, request):
-        return self.add_preserved_filters(
+        default_url = self.add_preserved_filters(
             request, self.get_action_url(Action.LIST.value)
         )
+        return SBAdminViewService.resolve_back_url(
+            request, default_url, current_path=request.path
+        )
 
     def get_detail_change_response(self, request, msg_dict):
         if "_continue" in request.POST:
@@ -123,6 +127,7 @@ class SBAdminView(SBAdminBaseQuerysetMixin, SBAdminBaseView):
             )
             messages.success(request, msg)
             redirect_url = self.keep_preserved_filters(request, request.path)
+            redirect_url = SBAdminViewService.keep_back_url(request, redirect_url)
             return HttpResponseRedirect(redirect_url)
         if "_save" in request.POST:
             msg = format_html(

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/engine/configuration.py

@@ -7,7 +7,6 @@ from django_smartbase_admin.engine.actions import SBAdminCustomAction
 from django_smartbase_admin.engine.const import (
     GLOBAL_FILTER_DATA_KEY,
     FilterVersions,
-    Action,
 )
 from django_smartbase_admin.models import (
     ColorScheme,
@@ -194,6 +193,7 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
     plugins: list = []
     default_list_sticky_header_and_footer = True
     enable_url_compression = True
+    mcp_readonly = False
 
     def __init__(
         self,
@@ -208,6 +208,7 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
         plugins=None,
         default_list_sticky_header_and_footer=None,
         enable_url_compression=None,
+        mcp_readonly=None,
     ) -> None:
         super().__init__()
         self.default_view = default_view or self.default_view or []
@@ -232,6 +233,9 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
             if enable_url_compression is not None
             else self.enable_url_compression
         )
+        self.mcp_readonly = (
+            mcp_readonly if mcp_readonly is not None else self.mcp_readonly
+        )
 
     def init_registered_views(self):
         registered_views = []
@@ -340,19 +344,38 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
     ):
         return qs
 
+    def get_action_permission(self, action):
+        return getattr(action, "permission", None) or "change"
+
     def has_action_permission(self, request, request_data, view, model, obj, action):
         if model:
-            if action.action_id == Action.BULK_DELETE.value:
-                return view.has_delete_permission(request, obj)
-            permission = getattr(action, "permission", None) or "change"
+            permission = self.get_action_permission(action)
+            if self.is_mcp_readonly_request(request) and permission != "view":
+                return False
             return self.has_permission(
                 request, request_data, view, model, obj, permission
             )
         return request.user.is_staff
 
+    def is_mcp_readonly_request(self, request):
+        return (
+            self.mcp_readonly
+            and getattr(request, "is_mcp", False)
+            and not request.user.is_superuser
+        )
+
+    def is_mcp_readonly_permission(self, request, permission):
+        if not self.is_mcp_readonly_request(request):
+            return False
+        if isinstance(permission, SBAdminCustomAction):
+            return self.get_action_permission(permission) != "view"
+        return permission in ("add", "change", "delete")
+
     def has_permission(
         self, request, request_data, view, model=None, obj=None, permission=None
     ):
+        if self.is_mcp_readonly_permission(request, permission):
+            return False
         if isinstance(permission, SBAdminCustomAction):
             return self.has_action_permission(
                 request, request_data, view, model, obj, permission

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/engine/const.py

@@ -77,6 +77,7 @@ OVERRIDE_CONTENT_OF_NOTIFICATION = "override_notification_content"
 # JSON key carrying rendered Django-messages HTML on list-action responses;
 # read by ``SBAdminTable._handleAjaxNotifications`` in ``table.js``.
 SB_ADMIN_AJAX_NOTIFICATIONS_KEY = "sb_admin_notifications"
+SB_ADMIN_BACK_URL = "back_url"
 FIELDSET_HIDE_HEADER_CLASS = "hide-header"
 FIELDSET_PLAIN_CLASS = "sbadmin-fieldset-plain"
 ROW_CLASS_FIELD = "get_sbadmin_row_class"

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/mcp/schema.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 import logging
 
 from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
 
 from django_smartbase_admin.engine.const import ROW_CLASS_FIELD
 from django_smartbase_admin.engine.fake_inline import is_fake_inline_batch_safe
@@ -320,6 +321,10 @@ def _detail_field_entries(admin, request) -> list[str]:
         names = list(
             SBAdminMCPDetailService.get_detail_fields(admin, request, None) or []
         )
+    except ImproperlyConfigured:
+        # List-only admin with no detail page — no fieldsets by design.
+        # Mirrors how get_form autocomplete registration treats this case.
+        return []
     except Exception:
         logger.warning(
             "MCP schema: get_detail_fields failed for %s",

{django_smartbase_admin-2.0.4 → django_smartbase_admin-2.0.5}/src/django_smartbase_admin/services/views.py

@@ -2,12 +2,14 @@ import json
 import pickle
 import urllib
 from typing import Any, TYPE_CHECKING
+from urllib.parse import urlencode, urlsplit, urlunsplit, parse_qsl
 
 from django.core.exceptions import PermissionDenied
 from django.db.models import Q, FilteredRelation, F
-from django.http import Http404
+from django.http import Http404, HttpRequest
 from django.shortcuts import redirect
-from django.urls import reverse
+from django.urls import reverse, resolve, Resolver404, get_script_prefix
+from django.utils.http import url_has_allowed_host_and_scheme
 
 from django_smartbase_admin.engine.const import (
     BASE_PARAMS_NAME,
@@ -16,6 +18,7 @@ from django_smartbase_admin.engine.const import (
     ADVANCED_FILTER_DATA_NAME,
     TABLE_PARAMS_SELECTED_FILTER_TYPE,
     TABLE_TAB_ADVANCED_FITLERS,
+    SB_ADMIN_BACK_URL,
 )
 from django_smartbase_admin.engine.actions import SBAdminCustomAction
 from django_smartbase_admin.engine.request import SBAdminViewRequestData
@@ -211,7 +214,16 @@ class SBAdminViewService(object):
 
     @classmethod
     def has_permission(cls, request, view=None, model=None, obj=None, permission=None):
-        return request.request_data.configuration.has_permission(
+        configuration = request.request_data.configuration
+        is_mcp_readonly_permission = getattr(
+            configuration, "is_mcp_readonly_permission", None
+        )
+        if (
+            callable(is_mcp_readonly_permission)
+            and is_mcp_readonly_permission(request, permission) is True
+        ):
+            return False
+        return configuration.has_permission(
             request, request.request_data, view, model, obj, permission
         )
 
@@ -334,3 +346,78 @@ class SBAdminViewService(object):
                     f"{annotate_name}__{model_field.name}"
                 )
         return {**lang_annotates, **field_annotates}
+
+    @classmethod
+    def _get_back_url_param(cls, request: HttpRequest) -> str | None:
+        if request.method == "POST":
+            value = request.POST.get(SB_ADMIN_BACK_URL)
+            if value:
+                return value
+        return request.GET.get(SB_ADMIN_BACK_URL) or None
+
+    @classmethod
+    def validate_back_url(
+        cls, request: HttpRequest, url: str | None, *, current_path: str | None = None
+    ) -> bool:
+        """A ``back_url`` is valid only if it is a same-host SBAdmin URL.
+
+        Guards against open redirects (external host / scheme) and self-loops.
+        """
+        if not url:
+            return False
+        if not url_has_allowed_host_and_scheme(
+            url, allowed_hosts={request.get_host()}, require_https=request.is_secure()
+        ):
+            return False
+        path = urlsplit(url).path
+        if current_path and path == current_path:
+            return False
+        script_prefix = get_script_prefix()
+        resolve_path = path
+        if script_prefix != "/" and resolve_path.startswith(script_prefix):
+            resolve_path = "/" + resolve_path[len(script_prefix) :]
+        try:
+            match = resolve(resolve_path)
+        except Resolver404:
+            return False
+        return match.namespace == "sb_admin"
+
+    @classmethod
+    def resolve_back_url(
+        cls,
+        request: HttpRequest,
+        default_url: str,
+        *,
+        current_path: str | None = None,
+    ) -> str:
+        """Best back URL, in priority order: ``POST[back_url]`` (hidden field),
+        ``GET[back_url]`` (query param), then ``default_url``."""
+        candidate = cls._get_back_url_param(request)
+        if cls.validate_back_url(request, candidate, current_path=current_path):
+            return candidate
+        return default_url
+
+    @classmethod
+    def append_back_url(cls, target_url: str, back_url: str | None) -> str:
+        """Add/replace ``back_url`` on ``target_url`` preserving other params."""
+        if not back_url:
+            return target_url
+        parts = urlsplit(target_url)
+        query = [
+            (key, value)
+            for key, value in parse_qsl(parts.query, keep_blank_values=True)
+            if key != SB_ADMIN_BACK_URL
+        ]
+        query.append((SB_ADMIN_BACK_URL, back_url))
+        return urlunsplit(parts._replace(query=urlencode(query)))
+
+    @classmethod
+    def url_with_current_back_url(cls, request: HttpRequest, target_url: str) -> str:
+        """Point an outgoing link at ``target_url`` with a ``back_url`` back to
+        the current page (so Save/Back on the target returns here)."""
+        return cls.append_back_url(target_url, request.get_full_path())
+
+    @classmethod
+    def keep_back_url(cls, request: HttpRequest, url: str) -> str:
+        """Carry the request's existing ``back_url`` onto ``url`` (redirects)."""
+        return cls.append_back_url(url, cls._get_back_url_param(request))