django-smartbase-admin 2.1.0__tar.gz → 2.2.0__tar.gz

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-smartbase-admin
-Version: 2.1.0
+Version: 2.2.0
 Summary: 
 Home-page: https://smartbase-sk.github.io/django-smartbase-admin-docs/
 License: MIT

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-smartbase-admin"
-version = "2.1.0"
+version = "2.2.0"
 description = ""
 authors = ["SmartBase <info@smartbase.sk>"]
 readme = "README.md"

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/audit/tests/test_action_processing.py

@@ -454,6 +454,23 @@ class RowActionIntegrationTests(TestCase):
             "/actions/PublishArticleView/template/",
         )
 
+    def test_row_target_view_action_preserves_permission(self):
+        view = FakeAdminView()
+        action = SBAdminRowAction(
+            target_view=PublishArticleView,
+            title="Publish",
+            icon="Check-correct",
+            view=view,
+            permission="delete",
+        )
+
+        processed = view.process_detail_actions(self.request, [action], object_id=123)
+
+        self.assertEqual(processed[0].permission, "delete")
+        self.assertEqual(
+            view.PublishArticleView._sbadmin_action_attrs["permission"], "delete"
+        )
+
     def test_detail_action_without_object_modifier_keeps_template_modifier(self):
         view = FakeAdminView()
         action = SBAdminCustomAction(

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/engine/actions.py

@@ -163,6 +163,7 @@ class SBAdminRowAction(SBAdminCustomAction):
         target_view=None,
         action_id=None,
         url=None,
+        permission=None,
         css_class=None,
         open_in_new_tab=None,
         enabled_if=None,
@@ -180,6 +181,7 @@ class SBAdminRowAction(SBAdminCustomAction):
         )
         resolved_action_id = action_id if action_id is not None else self.action_id
         resolved_url = url if url is not None else self.url
+        resolved_permission = permission if permission is not None else self.permission
         resolved_css_class = css_class if css_class is not None else self.css_class
         resolved_open_in_new_tab = (
             open_in_new_tab if open_in_new_tab is not None else self.open_in_new_tab
@@ -221,6 +223,7 @@ class SBAdminRowAction(SBAdminCustomAction):
             open_in_new_tab=resolved_open_in_new_tab,
             icon=resolved_icon,
             sub_actions=resolved_sub_actions,
+            permission=resolved_permission,
             mcp_description=mcp_description,
         )
 

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/engine/admin_base_view.py

@@ -994,6 +994,7 @@ class SBAdminBaseListView(SBAdminBaseView):
             "tableInitialPageSize": self.get_list_per_page(request),
             "tableHistoryEnabled": self.sbadmin_table_history_enabled,
             "stickyHeaderAndFooter": sticky_header_and_footer,
+            "paginationPageInputMinPages": request.request_data.configuration.list_pagination_page_input_min_pages,
             "enableUrlCompression": request.request_data.configuration.enable_url_compression,
             # used to initialize all columns with these values
             "defaultColumnData": {},

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/engine/configuration.py

@@ -204,6 +204,9 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
     # to self-guard based on admin config (e.g. ``sbadmin_nested``).
     plugins: list = []
     default_list_sticky_header_and_footer = True
+    # Minimum number of pages from which a separate 'jump to page' input
+    # is shown next to list pagination. None disables the input entirely.
+    list_pagination_page_input_min_pages = 50
     enable_url_compression = True
     mcp_readonly = False
     link_history_to_audit = True
@@ -222,6 +225,7 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
         admin_title=None,
         plugins=None,
         default_list_sticky_header_and_footer=None,
+        list_pagination_page_input_min_pages=None,
         enable_url_compression=None,
         mcp_readonly=None,
         link_history_to_audit=None,
@@ -229,7 +233,7 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
         mcp_whoami_sbadmin=None,
     ) -> None:
         super().__init__()
-        self.default_view = default_view or self.default_view or []
+        self.default_view = default_view or self.default_view
         self.registered_views = registered_views or self.registered_views or []
         self.menu_items = menu_items or self.menu_items or []
         self.global_filter_form = global_filter_form or self.global_filter_form
@@ -246,6 +250,10 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
             self.default_list_sticky_header_and_footer = (
                 default_list_sticky_header_and_footer
             )
+        if list_pagination_page_input_min_pages is not None:
+            self.list_pagination_page_input_min_pages = (
+                list_pagination_page_input_min_pages
+            )
         self.enable_url_compression = (
             enable_url_compression
             if enable_url_compression is not None
@@ -283,12 +291,36 @@ class SBAdminRoleConfiguration(metaclass=Singleton):
             menu_item.init_menu_item_static(self.view_map)
 
     def init_menu_items_dynamic(self, request, request_data):
-        menu_items = [
-            item.process_and_serialize(request, request_data)[0]
-            for item in self.menu_items
-        ]
+        menu_items = []
+        for item in self.menu_items:
+            item_dict, _item_active = item.process_and_serialize(request, request_data)
+            if item_dict is not None:
+                menu_items.append(item_dict)
         request_data.menu_items = menu_items
 
+    def get_default_view_id(self, request, request_data):
+        if self.default_view:
+            return self.default_view.get_view_id()
+        return self.get_first_menu_view_id(request, request_data)
+
+    def get_first_menu_view_id(self, request, request_data):
+        for item in self.menu_items:
+            view_id = self._first_permitted_menu_view_id(item, request, request_data)
+            if view_id:
+                return view_id
+        return None
+
+    def _first_permitted_menu_view_id(self, item, request, request_data):
+        if item.has_menu_permission(request, request_data) and item.get_view_id():
+            return item.get_view_id()
+        for sub_item in item.sub_items:
+            view_id = self._first_permitted_menu_view_id(
+                sub_item, request, request_data
+            )
+            if view_id:
+                return view_id
+        return None
+
     def init_view_map(self):
         self.view_map.update({view.get_id(): view for view in self.registered_views})
         self.view_map.update(

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/engine/menu_item.py

@@ -3,6 +3,7 @@ from django.utils.html import format_html
 from django.utils.safestring import SafeString
 
 from django_smartbase_admin.services.configuration import SBAdminConfigurationService
+from django_smartbase_admin.services.request_cache import cache_on_request
 
 DEFAULT_MENU_ITEM_BADGE_CLASS = "badge badge-simple badge-primary ml-auto"
 
@@ -103,23 +104,82 @@ class SBAdminMenuItem(object):
             '<span class="{}">{}</span>', self.get_badge_class(request), badge
         )
 
+    def has_view_menu_permission(self, request):
+        if not self.view:
+            return True
+
+        has_menu_permission = getattr(self.view, "has_menu_permission", None)
+        if callable(has_menu_permission):
+            return has_menu_permission(request)
+
+        permission_checks = (
+            "has_view_permission",
+            "has_change_permission",
+            "has_add_permission",
+            "has_delete_permission",
+        )
+        checked_any_permission = False
+        for permission_check_name in permission_checks:
+            permission_check = getattr(self.view, permission_check_name, None)
+            if not callable(permission_check):
+                continue
+            checked_any_permission = True
+            if permission_check(request):
+                return True
+
+        if checked_any_permission:
+            return False
+
+        return True
+
+    def has_menu_permission(self, request, request_data):
+        if not self.view:
+            return True
+
+        cache_key = f"engine.menu_item.has_menu_permission:{self.view.get_id()}"
+        return cache_on_request(
+            cache_key,
+            lambda: self.has_view_menu_permission(request),
+            request=request,
+        )
+
+    def get_active_menu_view_id(self, request, request_data):
+        selected_view = getattr(request_data, "selected_view", None) or getattr(
+            request, "sbadmin_selected_view", None
+        )
+        return (
+            getattr(selected_view, "menu_highlight_view_id", None) or request_data.view
+        )
+
     def get_subitems_serialized(self, request, request_data):
         subitem_active = False
         subitems_serialized = []
         for item in self.sub_items:
             item_dict, item_active = item.process_and_serialize(request, request_data)
+            if item_dict is None:
+                continue
             subitems_serialized.append(item_dict)
             subitem_active = item_active or subitem_active
         return subitems_serialized, subitem_active
 
     def process_and_serialize(self, request, request_data):
         sub_items, subitem_active = self.get_subitems_serialized(request, request_data)
-        active = subitem_active or request_data.view == self.get_id()
+        has_menu_permission = self.has_menu_permission(request, request_data)
+        # Root menu item without permissions.
+        if not has_menu_permission and not sub_items:
+            return None, False
+        # Root wrapper menu item without visible children.
+        if not self.view and not sub_items:
+            return None, False
+        active = (
+            subitem_active
+            or self.get_active_menu_view_id(request, request_data) == self.get_id()
+        )
         json_dict = {
             "sub_items": sub_items,
             "get_label": self.get_label(),
             "get_icon": self.get_icon(),
-            "get_url": self.get_url(request),
+            "get_url": self.get_url(request) if has_menu_permission else "",
             "get_id": self.get_id(),
             "get_view_id": self.get_view_id(),
             "get_badge": self.render_badge(request),

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/engine/request.py

@@ -57,7 +57,7 @@ class SBAdminViewRequestData(object):
     def refresh_selected_view(self, request):
         self.configuration = SBAdminConfigurationService.get_configuration(self)
         if not self.view:
-            self.view = self.configuration.default_view.get_view_id()
+            self.view = self.configuration.get_default_view_id(request, self)
         try:
             self.selected_view = self.configuration.view_map[self.view]
         except KeyError:

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/locale/cs/LC_MESSAGES/django.po

@@ -1196,3 +1196,11 @@ msgstr "Jazyk"
 #, python-format
 #~ msgid "Are you sure you want to delete the selected %(objects_name)s? All of the following objects and their related items will be deleted:"
 #~ msgstr "Opravdu chcete smazat vybrané %(objects_name)s? Všechny následující objekty a jejich související položky budou smazány:"
+
+msgctxt "pagination"
+msgid "Page"
+msgstr "Strana"
+
+msgctxt "pagination"
+msgid "Go"
+msgstr "Přejít"

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/locale/sk/LC_MESSAGES/django.po

@@ -1184,3 +1184,130 @@ msgstr "Jazyk"
 #, python-format
 #~ msgid "Are you sure you want to delete the selected %(objects_name)s? All of the following objects and their related items will be deleted:"
 #~ msgstr "Ste si istý že chcete odstrániť vybrané %(objects_name)s? Všetky nasledujúce položky a ich súvisiace objekty budú odstránené:"
+
+msgctxt "pagination"
+msgid "Page"
+msgstr "Strana"
+
+msgctxt "pagination"
+msgid "Go"
+msgstr "Prejsť"
+
+# MCP request log / AI Assistant Module dashboard
+
+msgid "AI Assistant Module"
+msgstr "AI asistent"
+
+msgid "Calls"
+msgstr "Volania"
+
+msgid "Errors"
+msgstr "Chyby"
+
+msgid "Avg duration (ms)"
+msgstr "Priem. trvanie (ms)"
+
+msgid "Items returned"
+msgstr "Vrátené položky"
+
+msgid "Request (KB)"
+msgstr "Požiadavka (KB)"
+
+msgid "Response (KB)"
+msgstr "Odpoveď (KB)"
+
+msgid "No data"
+msgstr "Žiadne dáta"
+
+msgid "Recent calls"
+msgstr "Posledné volania"
+
+msgid "Time"
+msgstr "Čas"
+
+msgid "Tool"
+msgstr "Nástroj"
+
+msgid "Duration (ms)"
+msgstr "Trvanie (ms)"
+
+msgid "Error"
+msgstr "Chyba"
+
+msgid "Request"
+msgstr "Požiadavka"
+
+msgid "Response"
+msgstr "Odpoveď"
+
+msgid "Request size (B)"
+msgstr "Veľkosť požiadavky (B)"
+
+msgid "Response size (B)"
+msgstr "Veľkosť odpovede (B)"
+
+msgid "Result status"
+msgstr "Stav výsledku"
+
+msgid "Total"
+msgstr "Spolu"
+
+msgid "Fields"
+msgstr "Polia"
+
+msgid "Inlines"
+msgstr "Vnorené"
+
+msgid "Inline rows"
+msgstr "Riadky vnorených"
+
+msgid "Error type"
+msgstr "Typ chyby"
+
+msgid "Error message"
+msgstr "Chybová správa"
+
+msgid "Last %(days)s days"
+msgstr "Posledných %(days)s dní"
+
+msgid "Duration"
+msgstr "Trvanie"
+
+msgid "Changed"
+msgstr "Zmenené"
+
+msgid "rows"
+msgstr "riadkov"
+
+msgid "Audit log"
+msgstr "Audit"
+
+msgid "Record count"
+msgstr "Počet záznamov"
+
+msgid "Detail field count"
+msgstr "Počet polí detailu"
+
+msgid "Detail inline count"
+msgstr "Počet inlinov detailu"
+
+msgid "Detail inline rows"
+msgstr "Riadky inlinov detailu"
+
+msgid "Returned field count"
+msgstr "Počet vrátených polí"
+
+msgid "Returned inline count"
+msgstr "Počet vrátených inlinov"
+
+msgid "Returned inline rows"
+msgstr "Počet vrátených riadkov inlinov"
+
+msgid "MCP calls"
+msgstr "MCP volania"
+
+msgid "Grouping"
+msgstr "Zoskupenie"
+
+msgid "By user"
+msgstr "Podľa používateľa"

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/mcp/instructions.py

@@ -37,6 +37,9 @@ Rules: copy ``widget_id`` only from prior tool output (never invent it).
 ``list_rows`` requires non-empty ``fields``. Write results:
 ``{"status": "ok", ...}`` or ``{"status": "invalid", "errors": ...}`` (no DB change).
 Inline dict keys use ``inline_name`` from ``list_admins`` (inline class name).
+Send nested arguments (``inlines``, ``field_values``, ``object_ids``, ``filter_data``,
+``sort``) as real JSON objects/arrays, never stringified JSON; pass ids as JSON
+numbers exactly as returned (e.g. ``174``, not ``"174"``) so rows match.
 Create flow: ``fetch_add_form`` then ``create_object``; inline FK ids on add often
 need ``autocomplete`` on another admin with the same ``filter.target_model``.
 

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/mcp/mcp.py

@@ -259,16 +259,40 @@ def _guarded_tool_call(method):
     leaks across calls and tests, causing audit rows to be written under
     stale users.
     """
+    import time
     from functools import wraps
 
+    from django_smartbase_admin.mcp.signals import mcp_tool_called
+
     @wraps(method)
     def wrapper(self, *args, **kwargs):
-        if not sb_admin_site.has_permission(self.request):
-            raise PermissionDenied
+        start = time.perf_counter()
+        result = None
+        error = None
         try:
-            return method(self, *args, **kwargs)
+            if not sb_admin_site.has_permission(self.request):
+                raise PermissionDenied
+            result = method(self, *args, **kwargs)
+            return result
+        except Exception as exc:
+            error = exc
+            raise
         finally:
+            # Clear the bound request BEFORE notifying listeners so a logging
+            # receiver's own DB writes don't run inside the SBAdmin/audit
+            # context (which would emit an AdminAuditLog row per log row).
             SBAdminThreadLocalService.clear_request()
+            # send_robust: a failing receiver must not break the tool call.
+            mcp_tool_called.send_robust(
+                sender=type(self),
+                request=getattr(self, "request", None),
+                tool_name=method.__name__,
+                tool_args=args,
+                tool_kwargs=kwargs,
+                result=result,
+                error=error,
+                duration_ms=int((time.perf_counter() - start) * 1000),
+            )
 
     wrapper.sbadmin_mcp_tool = True
     return wrapper
@@ -967,14 +991,18 @@ class SBAdminTools(MCPToolset):
             fetched payload back. Unknown or readonly names raise
             ``LookupError``.
           inlines: ``{inline_name: [row_op, ...]}`` keyed by the same
-            ``inline_name`` used by ``fetch_detail``. Each op is:
+            ``inline_name`` used by ``fetch_detail``. Pass it as a real
+            JSON object/array — never a stringified one. Each op is:
 
             * ``{"id": <pk>, ...overrides}`` — update an existing row.
             * ``{"id": <pk>, "_delete": true}`` — delete the row.
             * ``{...field values}`` (no ``id``) — create a new row.
 
-            Inlines not mentioned are passed through unchanged. Unknown
-            inline names or row ids raise ``LookupError``.
+            ``id`` is the **integer** pk exactly as ``fetch_detail``
+            returns it — send it as a JSON number (``174``), not a string
+            (``"174"``), or the row won't match. Inlines not mentioned are
+            passed through unchanged. Unknown inline names or row ids raise
+            ``LookupError``.
 
         Returns ``{"status": "ok", "id": ..., "fields": ...,
         "inlines": ...}`` mirroring ``fetch_detail`` after the save, or

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/mcp/middleware.py

@@ -2,7 +2,7 @@
 
 Browser-hosted MCP clients (claude.ai's Cowork integration, the various
 ChatGPT bridges, Cursor's web client) and custom browser dashboards
-cross-origin POST to ``/mcp/`` and send an OAuth preflight to
+cross-origin POST to the configured MCP endpoint and send an OAuth preflight to
 ``/.well-known/oauth-protected-resource``. Without
 ``Access-Control-Allow-Origin`` + matching ``-Methods`` / ``-Headers``,
 the browser blocks every request before it reaches Django.
@@ -41,8 +41,7 @@ DEFAULT_ALLOWED_ORIGINS: tuple[str, ...] = (
     "https://cursor.com",
 )
 
-_MCP_PATH_PREFIXES: tuple[str, ...] = (
-    "/mcp",
+_OAUTH_PATH_PREFIXES: tuple[str, ...] = (
     "/.well-known/oauth-authorization-server",
     "/.well-known/oauth-protected-resource",
     "/oauth/",
@@ -76,8 +75,23 @@ def _allowed_request_headers() -> str:
     return ", ".join(headers)
 
 
+def _mcp_path_prefix() -> str | None:
+    endpoint = getattr(settings, "DJANGO_MCP_ENDPOINT", "mcp/")
+    endpoint = endpoint.strip("/")
+    if not endpoint:
+        return None
+    return f"/{endpoint}"
+
+
+def _path_matches_prefix(path: str, prefix: str) -> bool:
+    return path == prefix or path.startswith(f"{prefix}/")
+
+
 def _path_needs_cors(path: str) -> bool:
-    return any(path.startswith(prefix) for prefix in _MCP_PATH_PREFIXES)
+    mcp_prefix = _mcp_path_prefix()
+    if mcp_prefix and _path_matches_prefix(path, mcp_prefix):
+        return True
+    return any(path.startswith(prefix) for prefix in _OAUTH_PATH_PREFIXES)
 
 
 def _apply_cors_headers(response: HttpResponse, origin: str) -> None:

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/mcp/service.py

@@ -647,7 +647,15 @@ class SBAdminMCPDetailService:
             if not value:
                 return []
             ids = list(value)
-            objects = {item.pk: item for item in form_field.queryset.filter(pk__in=ids)}
+            try:
+                objects = {
+                    item.pk: item for item in form_field.queryset.filter(pk__in=ids)
+                }
+            except (ValueError, TypeError):
+                # An id that can't match the related pk type (e.g. a non-numeric
+                # value where the pk is integer) must not 500 the read-back; it
+                # falls back to str() below as an unresolved id.
+                objects = {}
             # Preserve submitted order; unresolved ids fall back to str()
             # rather than getting silently dropped.
             return [

django_smartbase_admin-2.2.0/src/django_smartbase_admin/mcp/signals.py

@@ -0,0 +1,9 @@
+"""Signals emitted by the MCP tool layer.
+
+``mcp_tool_called`` fires once per dispatched tool. Receiver kwargs:
+    request, tool_name, tool_args, tool_kwargs, result, error, duration_ms
+"""
+
+import django.dispatch
+
+mcp_tool_called = django.dispatch.Signal()

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/mcp/tests/test_cors_middleware.py

@@ -8,11 +8,21 @@ the cookie-authed (navigation-only) authorize endpoint off the CORS surface.
 
 from __future__ import annotations
 
+from django.conf import settings
 from django.http import HttpResponse
 from django.test import RequestFactory, SimpleTestCase, override_settings
 
 from django_smartbase_admin.mcp.middleware import SBAdminMCPCorsMiddleware
 
+if not settings.configured:
+    settings.configure(
+        DEFAULT_CHARSET="utf-8",
+        SECRET_KEY="test-secret-key",
+        DATABASES={
+            "default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}
+        },
+    )
+
 ORIGIN = "http://localhost:8010"
 
 
@@ -51,6 +61,19 @@ class CorsMiddlewareTests(SimpleTestCase):
                 self._send(path, method="get")["Access-Control-Allow-Origin"], ORIGIN
             )
 
+    @override_settings(DJANGO_MCP_ENDPOINT="api/mcp/")
+    def test_configured_mcp_endpoint_is_used_for_cors(self):
+        resp = self._send("/api/mcp/rest/tools/list_rows/", preflight=True)
+
+        self.assertEqual(resp.status_code, 204)
+        self.assertEqual(resp["Access-Control-Allow-Origin"], ORIGIN)
+
+    @override_settings(DJANGO_MCP_ENDPOINT="api/mcp/")
+    def test_default_mcp_endpoint_is_not_decorated_when_endpoint_moves(self):
+        resp = self._send("/mcp/rest/tools/list_rows/", method="get")
+
+        self.assertNotIn("Access-Control-Allow-Origin", resp)
+
     def test_preflight_uses_default_allowed_headers(self):
         resp = self._send("/mcp/rest/tools/list_rows/", preflight=True)
 

{django_smartbase_admin-2.1.0 → django_smartbase_admin-2.2.0}/src/django_smartbase_admin/mcp/tests/test_smoke.py

@@ -24,8 +24,11 @@ import secrets
 from urllib.parse import parse_qs, urlparse
 
 from django.contrib.auth import get_user_model
+from django.contrib.auth.models import Permission
 from django.test import Client, TestCase, override_settings
 
+from django_smartbase_admin.messaging.models import MessageRecipient
+
 
 def _b64url(b: bytes) -> str:
     return base64.urlsafe_b64encode(b).decode().rstrip("=")
@@ -51,6 +54,12 @@ class MCPOAuthSmokeTests(TestCase):
         self.user = User.objects.create(username="alice", is_active=True, is_staff=True)
         self.user.set_password("pw")
         self.user.save()
+        self.user.user_permissions.add(
+            Permission.objects.get(
+                content_type__app_label=MessageRecipient._meta.app_label,
+                codename=f"view_{MessageRecipient._meta.model_name}",
+            )
+        )
         self.client = Client()
         self.assertTrue(
             self.client.login(username="alice", password="pw"),

django_smartbase_admin-2.2.0/src/django_smartbase_admin/mcp_log/apps.py

@@ -0,0 +1,29 @@
+from django.apps import AppConfig
+
+
+class MCPLogConfig(AppConfig):
+    """Optional MCP request logging.
+
+    Opt-in via ``INSTALLED_APPS``; ``ready()`` connects the logger to
+    ``mcp_tool_called`` and registers the admin view. The host project
+    schedules retention (``MCPRequestLog.prune``).
+    """
+
+    name = "django_smartbase_admin.mcp_log"
+    label = "sbadmin_mcp_log"
+    verbose_name = "SBAdmin MCP Log"
+    default_auto_field = "django.db.models.BigAutoField"
+
+    def ready(self):
+        from django_smartbase_admin.admin.site import sb_admin_site
+        from django_smartbase_admin.mcp.signals import mcp_tool_called
+        from django_smartbase_admin.mcp_log.models import MCPRequestLog
+        from django_smartbase_admin.mcp_log.logger import on_mcp_tool_called
+        from django_smartbase_admin.mcp_log.sb_admin import MCPRequestLogAdmin
+
+        mcp_tool_called.connect(
+            on_mcp_tool_called, dispatch_uid="sbadmin_mcp_log_logger"
+        )
+
+        if not sb_admin_site.is_registered(MCPRequestLog):
+            sb_admin_site.register(MCPRequestLog, MCPRequestLogAdmin)