django-smartbase-admin 2.3.0__tar.gz → 2.3.1__tar.gz

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-smartbase-admin
-Version: 2.3.0
+Version: 2.3.1
 Summary: 
 Home-page: https://smartbase-sk.github.io/django-smartbase-admin-docs/
 License: MIT

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-smartbase-admin"
-version = "2.3.0"
+version = "2.3.1"
 description = ""
 authors = ["SmartBase <info@smartbase.sk>"]
 readme = "README.md"

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/audit/sb_admin.py

@@ -3,7 +3,6 @@ SBAdmin registration for AdminAuditLog.
 Provides rich filtering and history browsing.
 """
 
-import json
 from pprint import pformat
 
 from django.contrib.auth import get_user_model
@@ -652,13 +651,14 @@ class AdminAuditLogAdmin(SBAdmin):
     @sbadmin_action(permission="view")
     def action_list_json(self, request, modifier, object_id=None, page_size=None):
         """Override to ensure object_history filter is cached before processing rows."""
-        from django.http import JsonResponse
-
         # Ensure filter is parsed and cached (may already be done by get_queryset)
         self._parse_and_cache_object_history_filter(request)
-        action = self.sbadmin_list_action_class(self, request, page_size=page_size)
-        data = action.get_json_data()
-        return JsonResponse(data=data, safe=False)
+        return super().action_list_json(
+            request,
+            modifier,
+            object_id=object_id,
+            page_size=page_size,
+        )
 
     def _get_object_history_widget(self):
         """Get the ObjectHistoryFilterWidget instance from sbadmin_list_display."""
@@ -717,7 +717,7 @@ class AdminAuditLogAdmin(SBAdmin):
         subject = "" if hide_obj else f'{model} "{obj_repr}" '
 
         if is_bulk:
-            msg = f'{action.replace("_", " ").title()} {bulk_count} {model}{"s" if bulk_count != 1 else ""}.'
+            msg = f"{action.replace('_', ' ').title()} {bulk_count} {model}{'s' if bulk_count != 1 else ''}."
         elif action == "create":
             msg = f"Added {subject.strip()}."
         elif action == "delete":

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/engine/actions.py

@@ -1,3 +1,5 @@
+import json
+
 from django import forms
 from django.core.exceptions import ImproperlyConfigured
 from django.utils.translation import gettext_lazy as _
@@ -69,6 +71,13 @@ class TableDataEditForm(forms.Form):
             for field in editable_fields
         ]
 
+    def clean_currentRowId(self):
+        row_id = self.cleaned_data["currentRowId"]
+        try:
+            return json.loads(row_id)
+        except (TypeError, json.JSONDecodeError):
+            return row_id
+
 
 class SBAdminCustomAction(object):
     title = None

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/engine/admin_base_view.py

@@ -803,26 +803,36 @@ class SBAdminBaseListView(SBAdminBaseView):
             )
         return JsonResponse({"message": request.POST})
 
+    def get_table_data_edit_form(self, request, data=None):
+        editable_fields = [
+            field
+            for field in self.get_field_map(request).values()
+            if field.tabulator_editor
+        ]
+        return TableDataEditForm(data=data, editable_fields=editable_fields)
+
     def get_table_data_edit_form_components(self, request):
         try:
-            editable_fields = [
-                field
-                for field in self.get_field_map(request).values()
-                if field.tabulator_editor
-            ]
+            form = self.get_table_data_edit_form(request)
         except ImproperlyConfigured:
             return None
-        if not editable_fields:
+        if not form.fields["columnFieldName"].choices:
             return None
-        return {"main": TableDataEditForm(editable_fields=editable_fields)}
+        return {"main": form}
+
+    def table_data_edit_form_valid(self, request, form, object_id) -> HttpResponse:
+        messages.add_message(request, messages.ERROR, _("Not Implemented"))
+        return HttpResponse(status=200, content=render_notifications(request))
+
+    def table_data_edit_form_invalid(self, request, form, object_id) -> HttpResponse:
+        return HttpResponse(status=400, content=render_notifications(request))
 
     @sbadmin_action(mcp_components="get_table_data_edit_form_components")
     def action_table_data_edit(self, request, modifier, object_id=None) -> HttpResponse:
-        current_row_id = json.loads(request.POST.get("currentRowId", ""))
-        column_field_name = request.POST.get("columnFieldName", "")
-        cell_value = request.POST.get("cellValue", "")
-        messages.add_message(request, messages.ERROR, "Not Implemented")
-        return HttpResponse(status=200, content=render_notifications(request))
+        form = self.get_table_data_edit_form(request, data=request.POST)
+        if form.is_valid():
+            return self.table_data_edit_form_valid(request, form, object_id)
+        return self.table_data_edit_form_invalid(request, form, object_id)
 
     def init_actions(self, request) -> None:
         object_id = getattr(getattr(request, "request_data", None), "object_id", None)

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/mcp/mcp.py

@@ -767,7 +767,11 @@ class SBAdminTools(MCPToolset):
                 result["detail_actions"] = actions
             return result
         except PermissionDenied as exc:
-            raise PermissionError(str(exc)) from exc
+            message = str(exc).strip() or (
+                f"User has no view permission on object pk={object_id!r} "
+                f"in admin {admin.get_id()!r}."
+            )
+            raise PermissionError(message) from exc
 
     @_guarded_tool_call
     def fetch_detail(

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/mcp/service.py

@@ -200,9 +200,20 @@ class SBAdminMCPDetailService:
         else:
             unknown = [f for f in fields if f not in available]
             if unknown:
+                if obj is None:
+                    raise LookupError(
+                        f"Requested add-form fields {unknown} are not available in "
+                        f"admin {admin.get_id()!r}. Available add-form fields: "
+                        f"{available}. Retry fetch_add_form with fields chosen from "
+                        "this list, or omit fields to fetch all available add-form "
+                        "fields."
+                    )
                 raise LookupError(
-                    f"Admin {admin.get_id()!r} has no detail fields {unknown}; "
-                    f"available: {available}"
+                    f"Requested detail fields {unknown} are not available for object "
+                    f"{str(obj.pk)!r} in admin {admin.get_id()!r}. "
+                    f"Available detail fields for this object: {available}. "
+                    "Retry fetch_detail with fields chosen from this list, or omit "
+                    "fields to fetch all available detail fields."
                 )
             selected_set = set(fields)
 
@@ -440,7 +451,15 @@ class SBAdminMCPDetailService:
             raise PermissionDenied(
                 f"User has no view permission on admin {type(admin).__name__}."
             )
-        obj = admin.get_object(request, object_id)
+        try:
+            obj = admin.get_object(request, object_id)
+        except PermissionDenied as exc:
+            if str(exc).strip():
+                raise
+            raise PermissionDenied(
+                f"User has no view permission on object pk={object_id!r} "
+                f"in admin {admin.get_id()!r}."
+            ) from exc
         if obj is None:
             raise LookupError(
                 f"Object pk={object_id!r} not found in admin {admin.get_id()!r}."

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/mcp/tests/test_actions.py

@@ -8,7 +8,6 @@ full list-action / autocomplete-search code paths end to end.
 
 from __future__ import annotations
 
-import json
 from unittest.mock import MagicMock
 
 from django.core.exceptions import PermissionDenied
@@ -20,7 +19,6 @@ from filer.models import Folder
 
 from django_smartbase_admin.admin.admin_base import SBAdmin
 from django_smartbase_admin.admin.site import sb_admin_site
-from django_smartbase_admin.engine.actions import sbadmin_action
 from django_smartbase_admin.engine.const import Action
 from django_smartbase_admin.engine.field import SBAdminField
 from django_smartbase_admin.engine.filter_widgets import AutocompleteFilterWidget
@@ -68,13 +66,12 @@ class FolderActionsTestAdmin(SBAdmin):
     )
     sbadmin_fieldsets = ((None, {"fields": ("name", "parent")}),)
 
-    @sbadmin_action(mcp_components="get_table_data_edit_form_components")
-    def action_table_data_edit(self, request, modifier, object_id=None):
+    def table_data_edit_form_valid(self, request, form, object_id):
         return JsonResponse(
             {
-                "row_id": json.loads(request.POST["currentRowId"]),
-                "column": request.POST["columnFieldName"],
-                "value": request.POST["cellValue"],
+                "row_id": form.cleaned_data["currentRowId"],
+                "column": form.cleaned_data["columnFieldName"],
+                "value": form.cleaned_data["cellValue"],
             }
         )
 
@@ -264,12 +261,50 @@ class ListRowsTests(_ToolTestBase):
         self.assertEqual(main_errors["type"], "form")
         self.assertIn("columnFieldName", main_errors["fields"])
 
+        for row_id in (
+            "3b6f49fe-51eb-4f01-9a36-cf1518279c6a",
+            "folder-root",
+        ):
+            with self.subTest(row_id=row_id):
+                string_id_result = SBAdminTools(
+                    request=build_mcp_request(user)
+                ).invoke_action(
+                    "filer_folder",
+                    Action.TABLE_DATA_EDIT.value,
+                    component_values={
+                        "main": {
+                            "currentRowId": row_id,
+                            "columnFieldName": "editable_name",
+                            "cellValue": "updated",
+                        }
+                    },
+                )
+                self.assertEqual(string_id_result["status"], "ok")
+                self.assertEqual(string_id_result["row_id"], row_id)
+
         with self.assertRaises(LookupError):
             SBAdminTools(request=build_mcp_request(user)).invoke_action(
                 "filer_folder",
                 Action.LIST_JSON.value,
             )
 
+    def test_table_data_edit_invalid_form_response_is_overridable(self):
+        admin_view = sb_admin_site._registry[Folder]
+        form = MagicMock()
+        form.is_valid.return_value = False
+        admin_view.get_table_data_edit_form = MagicMock(return_value=form)
+        admin_view.table_data_edit_form_invalid = MagicMock(
+            return_value=JsonResponse({"status": "custom-invalid"}, status=422)
+        )
+
+        request = MagicMock(POST={})
+        response = admin_view.action_table_data_edit(request, modifier=None)
+
+        self.assertEqual(response.status_code, 422)
+        admin_view.table_data_edit_form_invalid.assert_called_once_with(
+            request, form, None
+        )
+
     def test_mcp_action_permission_is_checked_before_component_provider(self):
         class FolderTableEditDeniedAdmin(FolderActionsTestAdmin):
             provider_calls = 0

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/mcp/tests/test_fetch_detail.py

@@ -55,6 +55,16 @@ class FolderDetailTestAdmin(SBAdmin):
         return obj.children.count() if obj else 0
 
 
+class SelfOnlyFolderDetailAdmin(FolderDetailTestAdmin):
+    """Mirror profile admins that hide every object except request.user."""
+
+    def get_object(self, request, object_id, from_field=None):
+        obj = super().get_object(request, object_id, from_field=from_field)
+        if obj is not None and obj.pk != request.user.pk:
+            raise PermissionDenied
+        return obj
+
+
 class ChildFolderListWidget(SBAdminDashboardListWidget):
     widget_id = "child_folder_list_widget"
     model = Folder
@@ -314,7 +324,11 @@ class FetchDetailTests(_FetchDetailTestBase):
 
         denied_user = MagicMock(is_authenticated=True, is_superuser=False)
         MCPToolTestConfig.view_permission_for = set()
-        with self.assertRaises((PermissionError, PermissionDenied)):
+        with self.assertRaisesRegex(
+            PermissionError,
+            rf"User has no view permission on object pk='{self.parent.pk}' "
+            r"in admin 'filer_folder'\.",
+        ):
             self._fetch(self.parent.pk, user=denied_user)
 
     def test_restrict_queryset_hides_object(self):
@@ -335,6 +349,30 @@ class FetchDetailTests(_FetchDetailTestBase):
             MCPToolTestConfig.restrict_qs = None
 
 
+class FetchSelfOnlyDetailTests(_FetchDetailTestBase):
+    admin_class = SelfOnlyFolderDetailAdmin
+
+    @classmethod
+    def setUpTestData(cls):
+        cls.own_folder = Folder.objects.create(name="own")
+        cls.foreign_folder = Folder.objects.create(name="foreign")
+
+    def test_bare_permission_denied_reports_object_and_admin(self):
+        user = MagicMock(
+            pk=self.own_folder.pk,
+            id=self.own_folder.pk,
+            is_authenticated=True,
+            is_superuser=True,
+        )
+
+        with self.assertRaisesRegex(
+            PermissionError,
+            rf"User has no view permission on object pk='{self.foreign_folder.pk}' "
+            r"in admin 'filer_folder'\.",
+        ):
+            self._fetch(self.foreign_folder.pk, user=user)
+
+
 class FetchDetailWidgetTests(_FetchDetailTestBase):
     admin_class = FolderDetailWithWidgetAdmin
 

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/mcp/tests/test_smoke.py

@@ -83,9 +83,22 @@ class MCPOAuthSmokeTests(TestCase):
         r = self.client.get("/.well-known/oauth-protected-resource")
         self.assertEqual(r.status_code, 200, r.content)
         data = r.json()
-        self.assertTrue(data["resource"].endswith("/mcp/"), data)
+        self.assertTrue(data["resource"].endswith("/mcp"), data)
         self.assertEqual(data["bearer_methods_supported"], ["header"])
 
+    def test_canonical_mcp_endpoint_does_not_redirect(self):
+        body = json.dumps({"jsonrpc": "2.0", "id": 1, "method": "tools/list"})
+
+        response = self.client.post(
+            "/mcp",
+            data=body,
+            content_type="application/json",
+            HTTP_ACCEPT="application/json, text/event-stream",
+        )
+
+        self.assertIn(response.status_code, (401, 403), response.content)
+        self.assertNotIn(response.status_code, (301, 302, 307, 308))
+
     def test_dynamic_client_registration_minimal(self):
         client_data = self._register_client()
         self.assertTrue(client_data["client_id"])
@@ -253,7 +266,7 @@ class MCPOAuthSmokeTests(TestCase):
         if token:
             headers["HTTP_AUTHORIZATION"] = f"Bearer {token}"
         return self.client.post(
-            "/mcp/",
+            "/mcp",
             data=json.dumps(body),
             content_type="application/json",
             **headers,

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/mcp/urls.py

@@ -18,7 +18,7 @@ from django.urls import include, path
 
 from django_smartbase_admin.mcp.rest import SBAdminMCPToolAPIView
 
-_mcp_endpoint = getattr(settings, "DJANGO_MCP_ENDPOINT", "mcp/")
+_mcp_endpoint = getattr(settings, "DJANGO_MCP_ENDPOINT", "mcp")
 _mcp_endpoint = _mcp_endpoint.strip("/")
 _rest_list_rows_path = (
     f"{_mcp_endpoint}/rest/tools/list_rows/"
@@ -27,9 +27,9 @@ _rest_list_rows_path = (
 )
 
 urlpatterns = [
-    # MCP JSON-RPC endpoint. Path is controlled by ``DJANGO_MCP_ENDPOINT``
-    # (default ``"mcp"``; we set ``"mcp/"`` so it matches our discovery
-    # metadata's trailing slash).
+    # Delegate the complete transport wiring to django-mcp-server. Keep
+    # DJANGO_MCP_ENDPOINT slashless: remote clients such as Claude canonicalize
+    # the MCP resource to /mcp and do not replay the POST across a 301.
     path("", include("mcp_server.urls")),
     path(
         _rest_list_rows_path,

django_smartbase_admin-2.3.1/src/django_smartbase_admin/tests/test_translation_widgets.py

@@ -0,0 +1,30 @@
+from ckeditor_uploader.fields import RichTextUploadingField
+from django.db import models
+from django.forms import modelform_factory
+from django.test import SimpleTestCase
+
+from django_smartbase_admin.admin.widgets import SBAdminCKEditorUploadingWidget
+from django_smartbase_admin.views.translations_view import ModelTranslationView
+
+
+class TranslatedArticle(models.Model):
+    content = RichTextUploadingField(config_name="blog_config")
+
+    class Meta:
+        app_label = "django_smartbase_admin"
+        managed = False
+
+
+class TranslationWidgetTests(SimpleTestCase):
+    def test_uploading_ckeditor_keeps_model_field_config(self):
+        form_class = modelform_factory(TranslatedArticle, fields=("content",))
+        form_field = form_class.base_fields["content"]
+        db_field = TranslatedArticle._meta.get_field("content")
+
+        ModelTranslationView().assign_widget_to_form_field(
+            form_field,
+            db_field=db_field,
+        )
+
+        self.assertIsInstance(form_field.widget, SBAdminCKEditorUploadingWidget)
+        self.assertEqual(form_field.widget.config_name, "blog_config")

{django_smartbase_admin-2.3.0 → django_smartbase_admin-2.3.1}/src/django_smartbase_admin/views/translations_view.py

@@ -13,7 +13,7 @@ from django.utils.safestring import mark_safe
 from django.utils.translation import gettext_lazy as _
 
 from django_smartbase_admin.actions.admin_action_list import SBAdminListAction
-from django_smartbase_admin.admin.admin_base import SBAdminInlineAndAdminCommon
+from django_smartbase_admin.admin.admin_base import SBAdminFormFieldWidgetsMixin
 from django_smartbase_admin.engine.admin_base_view import SBAdminBaseListView
 from django_smartbase_admin.engine.actions import sbadmin_action
 from django_smartbase_admin.engine.admin_view import SBAdminView
@@ -31,7 +31,11 @@ from django_smartbase_admin.utils import is_htmx_request, querydict_to_dict
 from urllib.parse import quote as urlquote
 
 
-class ModelTranslationView(SBAdminView, SBAdminBaseListView):
+class ModelTranslationView(
+    SBAdminFormFieldWidgetsMixin,
+    SBAdminView,
+    SBAdminBaseListView,
+):
     translated_fields = None
     list_template_name = "sb_admin/actions/translations-list.html"
     FORM_BASE_ID = "translation-form-"
@@ -321,16 +325,12 @@ class ModelTranslationView(SBAdminView, SBAdminBaseListView):
                 if translation_form_widgets.get(field_name):
                     continue
 
-                widget = SBAdminInlineAndAdminCommon.formfield_widgets.get(
-                    field.__class__
+                db_field = translated_model._meta.get_field(field_name)
+                self.assign_widget_to_form_field(
+                    field,
+                    db_field=db_field,
+                    request=request,
                 )
-                if not widget:
-                    continue
-                choices = getattr(field, "choices", None)
-                if choices:
-                    field.widget = widget(form_field=field, choices=choices)
-                    continue
-                field.widget = widget(form_field=field)
 
             for language_code in self.get_display_language_codes(
                 request, include_main=True