django-smartbase-admin 2.3.1__tar.gz → 2.3.2__tar.gz

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-smartbase-admin
-Version: 2.3.1
+Version: 2.3.2
 Summary: 
 Home-page: https://smartbase-sk.github.io/django-smartbase-admin-docs/
 License: MIT
@@ -36,6 +36,7 @@ Requires-Dist: djangorestframework (>=3.17,<4.0) ; extra == "mcp"
 Requires-Dist: easy-thumbnails[svg] (>=2.8.5,<3.0.0)
 Requires-Dist: jsonschema (>=4.10,<5.0)
 Requires-Dist: lzstring (>=1.0.4,<2.0.0)
+Requires-Dist: mcp (>=1.8,<2) ; extra == "mcp"
 Requires-Dist: nh3 (>=0.2.15) ; extra == "mcp"
 Requires-Dist: setuptools (>=67.0.0,<68.0.0)
 Requires-Dist: xlsxwriter (>=3.2.0,<4.0.0)

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-smartbase-admin"
-version = "2.3.1"
+version = "2.3.2"
 description = ""
 authors = ["SmartBase <info@smartbase.sk>"]
 readme = "README.md"
@@ -51,11 +51,23 @@ setuptools = "^67.0.0"
 django-oauth-toolkit = {version = "^3.2", optional = true}
 djangorestframework = {version = "^3.17", optional = true}
 django-mcp-server = {version = "^0.5.7", optional = true}
+# ``django-mcp-server`` asks for ``mcp>=1.8.0`` with no upper bound, but
+# ``mcp`` 2.0 dropped ``FastMCP`` (renamed ``MCPServer``, and the
+# ``mcp.server.fastmcp`` package is gone), so its
+# ``from mcp.server import FastMCP`` fails on a fresh install. Cap here
+# until upstream supports 2.x.
+mcp = {version = ">=1.8,<2", optional = true}
 # Allowlist HTML sanitizer for ``fetch_detail`` display values.
 nh3 = {version = ">=0.2.15", optional = true}
 
 [tool.poetry.extras]
-mcp = ["django-oauth-toolkit", "djangorestframework", "django-mcp-server", "nh3"]
+mcp = [
+    "django-oauth-toolkit",
+    "djangorestframework",
+    "django-mcp-server",
+    "mcp",
+    "nh3",
+]
 
 [build-system]
 requires = ["poetry-core"]

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/engine/const.py

@@ -30,6 +30,8 @@ class FilterVersions(Enum):
 DEFAULT_PAGE_SIZE = 20
 PAGE_SIZE_OPTIONS = [10, 20, 50, 100]
 AUTOCOMPLETE_PAGE_SIZE = 20
+AUTOCOMPLETE_MCP_PAGE_SIZE = 100
+AUTOCOMPLETE_MCP_PAGE_SIZE_MAX = 1000
 XLSX_PAGE_CHUNK_SIZE = 50000
 IGNORE_LIST_SELECTION = "__all__"
 MODIFIER_OBJECT_ID = "__object_id__"
@@ -65,6 +67,7 @@ BASE_PARAMS_NAME = "params"
 AUTOCOMPLETE_SEARCH_NAME = "__search_term__"
 AUTOCOMPLETE_FORWARD_NAME = "__forward_data__"
 AUTOCOMPLETE_PAGE_NUM = "__requestedPage__"
+AUTOCOMPLETE_PAGE_SIZE_NAME = "__pageSize__"
 ACTION_AUTOCOMPLETE_MODIFIER_SEPARATOR = "::"
 GLOBAL_FILTER_DATA_KEY = "global_filter_data"
 GLOBAL_FILTER_ALIAS_WIDGET_ID = "global_alias"

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/engine/filter_widgets.py

@@ -24,8 +24,10 @@ from django_smartbase_admin.engine.admin_view import SBAdminView
 from django_smartbase_admin.engine.const import (
     AUTOCOMPLETE_SEARCH_NAME,
     AUTOCOMPLETE_PAGE_SIZE,
+    AUTOCOMPLETE_MCP_PAGE_SIZE_MAX,
     Action,
     AUTOCOMPLETE_PAGE_NUM,
+    AUTOCOMPLETE_PAGE_SIZE_NAME,
     AUTOCOMPLETE_FORWARD_NAME,
     SELECT_ALL_KEYWORD,
 )
@@ -949,6 +951,22 @@ class AutocompleteFilterWidget(
     def get_value_field(self):
         return self.value_field or self.model._meta.pk.name
 
+    def get_page_size(self, request, post_data):
+        """MCP callers may ask for a bigger page so an agent can pull a whole
+        option list in one call instead of walking 20-row pages. Browser
+        requests always get the fixed UI page size - the JS infinite scroll
+        and the "show search box" heuristic both assume it.
+        """
+        if not getattr(request, "is_mcp", False):
+            return AUTOCOMPLETE_PAGE_SIZE
+        try:
+            page_size = int(
+                post_data.get(AUTOCOMPLETE_PAGE_SIZE_NAME, AUTOCOMPLETE_PAGE_SIZE)
+            )
+        except (TypeError, ValueError):
+            return AUTOCOMPLETE_PAGE_SIZE
+        return max(1, min(page_size, AUTOCOMPLETE_MCP_PAGE_SIZE_MAX))
+
     def filter_search_queryset(self, request, qs, search_term="", forward_data=None):
         if self.filter_search_lambda:
             forward_data = forward_data or {}
@@ -961,8 +979,9 @@ class AutocompleteFilterWidget(
         search_term = post_data.get(AUTOCOMPLETE_SEARCH_NAME)
         forward_data = json.loads(post_data.get(AUTOCOMPLETE_FORWARD_NAME, "{}"))
         page_num = int(post_data.get(AUTOCOMPLETE_PAGE_NUM, 1))
-        from_item = (page_num - 1) * AUTOCOMPLETE_PAGE_SIZE
-        to_item = (page_num) * AUTOCOMPLETE_PAGE_SIZE
+        page_size = self.get_page_size(request, post_data)
+        from_item = (page_num - 1) * page_size
+        to_item = (page_num) * page_size
 
         # filter queryset
         # base restricted queryset
@@ -1045,8 +1064,9 @@ class FromValuesAutocompleteWidget(AutocompleteFilterWidget):
         search_term = post_data.get(AUTOCOMPLETE_SEARCH_NAME)
         forward_data = json.loads(post_data.get(AUTOCOMPLETE_FORWARD_NAME, "{}"))
         page_num = int(post_data.get(AUTOCOMPLETE_PAGE_NUM, 1))
-        from_item = (page_num - 1) * AUTOCOMPLETE_PAGE_SIZE
-        to_item = (page_num) * AUTOCOMPLETE_PAGE_SIZE
+        page_size = self.get_page_size(request, post_data)
+        from_item = (page_num - 1) * page_size
+        to_item = (page_num) * page_size
         qs = self.get_queryset(request)
         qs = self.filter_search_queryset(request, qs, search_term, forward_data)
         qs = (

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/mcp/form_encoding.py

@@ -181,7 +181,11 @@ def form_errors_dict(form) -> dict:
     """Return field and form-wide validation errors for one bound form."""
     from django.core.exceptions import NON_FIELD_ERRORS
 
-    errors = form.errors.as_data()
+    raw_errors = form.errors
+    # ``ModelAdmin._create_formsets`` blanks ``_errors`` to a plain ``{}`` on
+    # view-only inline rows to bypass their validation, so those rows carry no
+    # ``ErrorDict`` — and never any errors either.
+    errors = raw_errors.as_data() if hasattr(raw_errors, "as_data") else raw_errors
     return {
         "non_field": validation_error_entries(errors.get(NON_FIELD_ERRORS, [])),
         "fields": {

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/mcp/instructions.py

@@ -22,7 +22,9 @@ What you can do:
   ``view_id`` and ``parent_object_id`` from ``fetch_detail.widgets``; read
   non-list widgets with ``fetch_widget_data``.
 * Look up a related record by name to get its id — for filtering by it or
-  setting it on a create/update form (``autocomplete``).
+  setting it on a create/update form (``autocomplete``). Raise its
+  ``page_size`` (default 100, max 1000) to read a whole option list in one
+  call instead of paging through it.
 * Create, update, and delete records — including their related rows
   (``create_object`` / ``update_detail`` / ``delete_objects``).
 * Run actions on a row, a detail page, the whole list, a selection, or an

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/mcp/mcp.py

@@ -28,7 +28,9 @@ from django_smartbase_admin.engine.const import (
     Action,
     ADVANCED_FILTER_DATA_NAME,
     AUTOCOMPLETE_FORWARD_NAME,
+    AUTOCOMPLETE_MCP_PAGE_SIZE,
     AUTOCOMPLETE_PAGE_NUM,
+    AUTOCOMPLETE_PAGE_SIZE_NAME,
     AUTOCOMPLETE_SEARCH_NAME,
     BASE_PARAMS_NAME,
     COLUMNS_DATA_NAME,
@@ -1102,6 +1104,17 @@ class SBAdminTools(MCPToolset):
         request = self.request
         ensure_sbadmin_request_data(request)
         admin = resolve_admin(view_id, request=request)
+        # Bind the edited pk the way the UI detail URL does — object-scoped
+        # widget querysets read ``request_data.object_id`` to narrow their
+        # choices, and without it they validate against an empty queryset and
+        # reject every value with ``invalid_choice``. Mirrors
+        # ``_fetch_detail_payload`` on the read side.
+        bind_sbadmin_request_data(
+            request,
+            view=admin.get_id(),
+            object_id=str(object_id),
+            method="GET",
+        )
         admin.init_view_dynamic(request, request.request_data)
         try:
             return SBAdminMCPDetailService.update_detail_data(
@@ -1568,6 +1581,7 @@ class SBAdminTools(MCPToolset):
         widget_id: str,
         search: str = "",
         page: int = 1,
+        page_size: int = AUTOCOMPLETE_MCP_PAGE_SIZE,
     ) -> list[dict]:
         """Search an autocomplete-backed field — same dropdown the UI shows.
 
@@ -1590,10 +1604,16 @@ class SBAdminTools(MCPToolset):
             inside ``action_autocomplete`` itself.
           search: free text term — empty string returns the first page
             of all matches.
-          page: 1-indexed page number. Pages are 20 entries.
+          page: 1-indexed page number, in units of ``page_size``.
+          page_size: entries per call, default 100, clamped to 1000.
+            Pass 1000 to pull a whole option list in one call instead of
+            paging through it.
 
         Returns ``[{"value": ..., "label": ...}, ...]`` ready to drop
         into ``filter_data`` (or into a write call for form fields).
+        A full page (``len == page_size``) means there may be more —
+        raise ``page_size`` or ask for the next ``page``; a short page is
+        the end of the list.
         """
         request = self.request
         admin = resolve_admin(view_id, request=request)
@@ -1604,6 +1624,7 @@ class SBAdminTools(MCPToolset):
             post={
                 AUTOCOMPLETE_SEARCH_NAME: search,
                 AUTOCOMPLETE_PAGE_NUM: str(int(page)),
+                AUTOCOMPLETE_PAGE_SIZE_NAME: str(int(page_size)),
                 AUTOCOMPLETE_FORWARD_NAME: "{}",
             },
             method="POST",

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/mcp/schema.py

@@ -99,7 +99,8 @@ WIDGET_SHAPES: dict[str, dict] = {
     "AutocompleteFilterWidget": {
         "value_shape": (
             "list of {'value': <pk>, 'label': <str>} entries — "
-            "pks resolved via the autocomplete tool"
+            "pks resolved via the autocomplete tool (raise its page_size, "
+            "max 1000, to read a whole option list in one call)"
         ),
         "example": [],
     },

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/mcp/tests/test_actions.py

@@ -8,7 +8,8 @@ full list-action / autocomplete-search code paths end to end.
 
 from __future__ import annotations
 
-from unittest.mock import MagicMock
+import json
+from unittest.mock import MagicMock, patch
 
 from django.core.exceptions import PermissionDenied
 from django.db.models import F
@@ -19,10 +20,20 @@ from filer.models import Folder
 
 from django_smartbase_admin.admin.admin_base import SBAdmin
 from django_smartbase_admin.admin.site import sb_admin_site
-from django_smartbase_admin.engine.const import Action
+from django_smartbase_admin.engine.const import (
+    Action,
+    AUTOCOMPLETE_FORWARD_NAME,
+    AUTOCOMPLETE_MCP_PAGE_SIZE,
+    AUTOCOMPLETE_PAGE_NUM,
+    AUTOCOMPLETE_PAGE_SIZE,
+    AUTOCOMPLETE_PAGE_SIZE_NAME,
+    AUTOCOMPLETE_SEARCH_NAME,
+)
 from django_smartbase_admin.engine.field import SBAdminField
 from django_smartbase_admin.engine.filter_widgets import AutocompleteFilterWidget
+from django_smartbase_admin.mcp.bridge import set_request_payload
 from django_smartbase_admin.mcp.mcp import SBAdminTools
+from django_smartbase_admin.services.views import SBAdminViewService
 from django_smartbase_admin.mcp.tests._common import (
     MCPToolTestConfig,
     build_mcp_request,
@@ -453,3 +464,116 @@ class AutocompleteTests(_ToolTestBase):
             SBAdminTools(request=build_mcp_request(user)).autocomplete(
                 "filer_folder", widget_id, search="queue"
             )
+
+
+class AutocompletePageSizeTests(_ToolTestBase):
+    """``page_size`` exists so an agent reads a whole option list in one
+    call instead of walking 20-row pages. It is MCP-only: the browser
+    autocomplete keeps the fixed page size its infinite scroll and
+    "show the search box" heuristic assume."""
+
+    ROW_COUNT = 25
+
+    @classmethod
+    def setUpTestData(cls):
+        # More rows than the UI page size, fewer than the MCP default, so
+        # "one call returns everything" and "20 is the browser cap" are
+        # both observable under one fixture.
+        for index in range(cls.ROW_COUNT):
+            Folder.objects.create(name=f"opt_{index:02d}")
+
+    def setUp(self):
+        super().setUp()
+        self.user = MagicMock(is_authenticated=True, is_superuser=True)
+        admins = SBAdminTools(request=build_mcp_request(self.user)).list_admins()
+        folder = next(
+            a for a in admins["admin_views"] if a["view_id"] == "filer_folder"
+        )
+        self.widget_id = next(
+            f["filter"]["widget_id"] for f in folder["fields"] if f["name"] == "parent"
+        )
+
+    def _autocomplete(self, **kwargs):
+        return SBAdminTools(request=build_mcp_request(self.user)).autocomplete(
+            "filer_folder", self.widget_id, **kwargs
+        )
+
+    def _search_via_action(self, post_data, is_mcp):
+        """Drive ``action_autocomplete`` the way the transport does, but
+        with the MCP flag under test — ``build_mcp_request`` leaves
+        ``is_mcp`` unset, so a request that skips the tool wrapper is
+        indistinguishable from a browser one."""
+        request = build_mcp_request(self.user)
+        if is_mcp:
+            request.is_mcp = True
+        set_request_payload(
+            request,
+            post={
+                AUTOCOMPLETE_SEARCH_NAME: "",
+                AUTOCOMPLETE_PAGE_NUM: "1",
+                AUTOCOMPLETE_FORWARD_NAME: "{}",
+                **post_data,
+            },
+            method="POST",
+        )
+        response = SBAdminViewService.delegate_to_action(
+            request,
+            view="filer_folder",
+            action=Action.AUTOCOMPLETE.value,
+            modifier=self.widget_id,
+        )
+        return json.loads(response.content.decode())["data"]
+
+    def test_default_page_size_returns_whole_option_list_in_one_call(self):
+        self.assertGreater(AUTOCOMPLETE_MCP_PAGE_SIZE, self.ROW_COUNT)
+        self.assertEqual(len(self._autocomplete()), self.ROW_COUNT)
+        self.assertEqual(len(self._autocomplete(page_size=1000)), self.ROW_COUNT)
+
+    def test_page_size_applies_when_autocomplete_is_the_first_tool_call(self):
+        """``get_page_size`` gates on ``request.is_mcp``, which the bridge
+        sets in ``ensure_sbadmin_request_data``. The ``autocomplete`` tool
+        doesn't call that itself — it arrives through ``resolve_admin``,
+        before the payload is set and the action dispatched. Pin that:
+        a request whose *only* tool call is ``autocomplete`` must still be
+        flagged, or the widget silently falls back to the 20-row UI page.
+        """
+        request = build_mcp_request(self.user)
+        self.assertFalse(getattr(request, "is_mcp", False))
+
+        rows = SBAdminTools(request=request).autocomplete(
+            "filer_folder", self.widget_id, page_size=1000
+        )
+
+        self.assertTrue(request.is_mcp)
+        self.assertEqual(len(rows), self.ROW_COUNT)
+
+    def test_paging_is_in_units_of_page_size(self):
+        first = self._autocomplete(page_size=10, page=1)
+        second = self._autocomplete(page_size=10, page=2)
+        third = self._autocomplete(page_size=10, page=3)
+        self.assertEqual([len(first), len(second), len(third)], [10, 10, 5])
+        # Contiguous, non-overlapping slices of the same ordering.
+        values = [row["value"] for row in first + second + third]
+        self.assertEqual(len(set(values)), self.ROW_COUNT)
+        self.assertEqual(
+            values, [row["value"] for row in self._autocomplete(page_size=1000)]
+        )
+
+    def test_page_size_clamped_to_max(self):
+        with patch(
+            "django_smartbase_admin.engine.filter_widgets.AUTOCOMPLETE_MCP_PAGE_SIZE_MAX",
+            3,
+        ):
+            self.assertEqual(len(self._autocomplete(page_size=99999)), 3)
+
+    def test_invalid_page_size_falls_back_to_ui_page_size(self):
+        rows = self._search_via_action(
+            {AUTOCOMPLETE_PAGE_SIZE_NAME: "abc"}, is_mcp=True
+        )
+        self.assertEqual(len(rows), AUTOCOMPLETE_PAGE_SIZE)
+
+    def test_browser_request_ignores_page_size(self):
+        rows = self._search_via_action(
+            {AUTOCOMPLETE_PAGE_SIZE_NAME: "1000"}, is_mcp=False
+        )
+        self.assertEqual(len(rows), AUTOCOMPLETE_PAGE_SIZE)

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/mcp/tests/test_permissions.py

@@ -175,6 +175,13 @@ class TestMCPPermissions(TestCase):
         self.assertIn("alpha_perm", labels)
         self.assertNotIn("hidden_perm", labels)
 
+        # A page big enough to hold the whole table must not become a way
+        # around the restriction.
+        unpaged = SBAdminTools(request=build_mcp_request(user)).autocomplete(
+            "filer_folder", parent_widget_id, page_size=1000
+        )
+        self.assertNotIn("hidden_perm", " ".join(row["label"] for row in unpaged))
+
     def test_dynamic_list_display_gates_schema_and_field_handles(self):
         """``get_sbadmin_list_display(request)`` is the de-facto
         field-level permission gate. The same hidden field must:

{django_smartbase_admin-2.3.1 → django_smartbase_admin-2.3.2}/src/django_smartbase_admin/mcp/tests/test_update_detail.py

@@ -11,6 +11,7 @@ from __future__ import annotations
 
 from unittest.mock import MagicMock
 
+from django import forms
 from django.contrib import admin as django_admin
 from django.contrib.auth import get_user_model
 from django.core.exceptions import PermissionDenied
@@ -48,6 +49,53 @@ class UpdateFolderWithInlineAdmin(UpdateFolderAdmin):
     inlines = [FolderPermissionInline]
 
 
+class ViewOnlyFolderPermissionInline(FolderPermissionInline):
+    readonly_fields = ("type", "everybody", "can_read")
+    can_delete = False
+    max_num = 0
+
+    def has_add_permission(self, request, obj=None):
+        return False
+
+    def has_change_permission(self, request, obj=None):
+        return False
+
+
+class UpdateFolderWithViewOnlyInlineAdmin(UpdateFolderAdmin):
+    inlines = [ViewOnlyFolderPermissionInline]
+
+
+class ObjectIdProbeForm(forms.ModelForm):
+    """Records ``request_data.object_id`` seen while the POST is validated.
+
+    Object-scoped autocomplete querysets narrow their choices by the edited
+    pk, so the write path has to expose it the same way the UI detail URL
+    does.
+    """
+
+    seen_object_ids: list = []
+
+    class Meta:
+        model = Folder
+        fields = ("name",)
+
+    def clean(self):
+        from django_smartbase_admin.services.thread_local import (
+            SBAdminThreadLocalService,
+        )
+
+        request = SBAdminThreadLocalService.get_request()
+        type(self).seen_object_ids.append(
+            getattr(getattr(request, "request_data", None), "object_id", None)
+        )
+        return super().clean()
+
+
+class UpdateFolderObjectIdProbeAdmin(UpdateFolderAdmin):
+    form = ObjectIdProbeForm
+    fieldsets = ((None, {"fields": ("name",)}),)
+
+
 # Pre-register so ``sb_admin_site.urls`` includes
 # ``filer_folder_change`` / ``filer_folder_changelist`` when the
 # URLconf is loaded — ``ModelAdmin._response_post_save`` reverses
@@ -339,3 +387,59 @@ class UpdateDetailInlineTests(_UpdateDetailTestBase):
         self.assertEqual(row_errors["id"], self.perm_a.pk)
         self.assertIsInstance(row_errors["index"], int)
         self.assertTrue(row_errors["non_field"] or row_errors["fields"])
+
+
+@override_settings(
+    ROOT_URLCONF=__name__,
+    SB_ADMIN_CONFIGURATION="tests.sbadmin_config.MCPSBAdminConfiguration",
+)
+class UpdateDetailViewOnlyInlineTests(_UpdateDetailTestBase):
+    """View-only inline rows must not swallow the real form errors.
+
+    ``ModelAdmin._create_formsets`` bypasses validation of those rows by
+    assigning ``form._errors = {}`` — a plain dict with no ``as_data``.
+    """
+
+    admin_class = UpdateFolderWithViewOnlyInlineAdmin
+
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+        cls.folder = Folder.objects.create(name="folder")
+        cls.perm = FolderPermission.objects.create(
+            folder=cls.folder, type=1, everybody=True
+        )
+
+    def test_main_form_errors_are_reported(self):
+        result = self._update(self.folder.pk, main_values={"name": ""})
+
+        self.assertEqual(result["status"], "invalid")
+        main_errors = result["errors"]["components"]["main"]
+        self.assertEqual(main_errors["fields"]["name"][0]["code"], "required")
+        self.assertNotIn(
+            "ViewOnlyFolderPermissionInline", result["errors"]["components"]
+        )
+
+
+@override_settings(
+    ROOT_URLCONF=__name__,
+    SB_ADMIN_CONFIGURATION="tests.sbadmin_config.MCPSBAdminConfiguration",
+)
+class UpdateDetailObjectIdBindingTests(_UpdateDetailTestBase):
+    admin_class = UpdateFolderObjectIdProbeAdmin
+
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+        cls.folder = Folder.objects.create(name="folder")
+
+    def test_object_id_is_bound_while_the_post_is_validated(self):
+        ObjectIdProbeForm.seen_object_ids.clear()
+
+        result = self._update(self.folder.pk, main_values={"name": "renamed"})
+
+        self.assertEqual(result["status"], "ok", msg=result.get("errors"))
+        self.assertEqual(
+            set(ObjectIdProbeForm.seen_object_ids),
+            {str(self.folder.pk)},
+        )