django-viewflow 2.3.0__tar.gz → 2.3.2__tar.gz

{django_viewflow-2.3.0/django_viewflow.egg-info → django_viewflow-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-viewflow
-Version: 2.3.0
+Version: 2.3.2
 Summary: Reusable library to build business applications fast
 Author: Mikhail Podgurskiy
 Author-email: kmmbvnr@gmail.com
@@ -75,7 +75,7 @@ Viewflow comes in two versions:
 
 ## Installation
 
-Viewflow works with Python 3.8+ and Django 4.0+
+Viewflow works with Python 3.10+ and Django 4.2+
 
 Viewflow:
 
@@ -225,6 +225,52 @@ modifications of Viewflow. You can find the commercial license terms in
 
 ## Changelog
 
+For older releases, see [CHANGELOG.rst](./CHANGELOG.rst).
+
+## 2.3.2 2026-07-06
+
+Security and data-integrity release. Highlights:
+
+- Fix cross-flow privilege escalation and information disclosure: a user with
+  only flow A's permission could cancel, or read the full task list of, flow B's
+  process by posting/opening flow B's id on flow A's URL. `CancelProcessView` and
+  `DetailProcessView` now scope their querysets to the view's own flow
+- Fix the bulk-delete endpoint (`action/delete/`) deleting rows without checking
+  login or the `delete` permission; add the missing authentication checks to the
+  standalone `FlowChartView` and the `contrib.plotly` Dash endpoints
+- Fix a transaction-ordering bug that committed partial writes next to a task's
+  `ERROR` status in async mode; `Function`, `End`, `If`, `Split`, `Switch`,
+  `Subprocess`, and `Join` activation now roll back cleanly on failure
+- Fix a celery `Job` node treating `self.retry()`/`Reject` as a task failure and
+  crashing on redelivery of a `STARTED` retry
+- Fix task actions releasing their lock before the transaction commits, which let
+  a concurrent request double-execute an action under `CacheLock`
+- Fix `jsonstore` fields with a falsy `default` (`False`, `0`) returning `None`,
+  discarding a falsy assigned value, and mis-sorting on `order_by()`
+- Fix unbounded memory leaks in form rendering (widget-renderer cache keyed on the
+  widget instance) and in `ListModelView` (`lru_cache` keyed on the view instance)
+- Fix the "Administration" menu showing to every logged-in user instead of staff
+- Fix several `viewflow.fsm` bugs: chart crashes on self-transitions, `State` with
+  a custom getter replacing falsy-but-valid states, REST `transition` committing
+  field writes on a failed transition or allowing arbitrary field writes; add a
+  `chart/` state-chart view and action to `FlowViewsMixin`
+- Fix a crash on the admin change page of any FSM-backed model under Django 5.2+
+  (incl. 6.1) from the `change_form_fsm_tools` template tag
+- Fix grouped `<select>` options under an `<optgroup>` being dropped, a formset
+  validation bypass via a tampered ManagementForm, and `vf-field-select-multiple`
+  dropping or failing to toggle selected values
+- Fix a system check now warning when a flow has `Join` nodes but no real lock,
+  and `manage.py check`/`runserver` crashing for a Join-node flow defined outside
+  any installed app
+
+## 2.3.1 2026-06-30
+
+- Add Django 6.1 support
+- Fix the bulk task assign/unassign actions not enforcing the per-task
+  `can_assign`/`can_unassign` permission
+- Fix task views accepting a task pk from another flow; tasks are now scoped to
+  the flow in the URL
+
 ## 2.3.0 2026-06-30
 
 - Fix `viewflow.fsm` chart generation crashing for `Enum` states and `State.ANY`
@@ -249,29 +295,6 @@ modifications of Viewflow. You can find the commercial license terms in
 - Upgrade `vanilla-jsoneditor` 0.23 → 3 (bundles svelte 5); the JSON field
   editor API is unchanged
 
-## 2.2.15 2025-12-24
-
-- Fix form button name/value lost on resubmission after validation error with Turbo
-- Fix subprocess double execution when completing synchronously
-
-## 2.2.14 2025-11-24
-
-- Add Django 6.0 compatibility (requires Python 3.12+)
-- Improve error handling for permission creation in multiple database configurations
-- Fix BPMN export to include name attribute for gateway nodes (flow.If)
-
-## 2.2.13 2025-09-24
-
-- Fix checkbox field error message styling to display in red color
-
-## 2.2.12 2025-07-25
-
-- Allow to extend and override process_data template
-
-## 2.2.11 2025-05-14
-
-- Return .Avaialble(..) for the start node
-
 
 
 [build]: https://img.shields.io/github/actions/workflow/status/viewflow/viewflow/django.yml?branch=main

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/README.md

@@ -32,7 +32,7 @@ Viewflow comes in two versions:
 
 ## Installation
 
-Viewflow works with Python 3.8+ and Django 4.0+
+Viewflow works with Python 3.10+ and Django 4.2+
 
 Viewflow:
 
@@ -182,6 +182,52 @@ modifications of Viewflow. You can find the commercial license terms in
 
 ## Changelog
 
+For older releases, see [CHANGELOG.rst](./CHANGELOG.rst).
+
+## 2.3.2 2026-07-06
+
+Security and data-integrity release. Highlights:
+
+- Fix cross-flow privilege escalation and information disclosure: a user with
+  only flow A's permission could cancel, or read the full task list of, flow B's
+  process by posting/opening flow B's id on flow A's URL. `CancelProcessView` and
+  `DetailProcessView` now scope their querysets to the view's own flow
+- Fix the bulk-delete endpoint (`action/delete/`) deleting rows without checking
+  login or the `delete` permission; add the missing authentication checks to the
+  standalone `FlowChartView` and the `contrib.plotly` Dash endpoints
+- Fix a transaction-ordering bug that committed partial writes next to a task's
+  `ERROR` status in async mode; `Function`, `End`, `If`, `Split`, `Switch`,
+  `Subprocess`, and `Join` activation now roll back cleanly on failure
+- Fix a celery `Job` node treating `self.retry()`/`Reject` as a task failure and
+  crashing on redelivery of a `STARTED` retry
+- Fix task actions releasing their lock before the transaction commits, which let
+  a concurrent request double-execute an action under `CacheLock`
+- Fix `jsonstore` fields with a falsy `default` (`False`, `0`) returning `None`,
+  discarding a falsy assigned value, and mis-sorting on `order_by()`
+- Fix unbounded memory leaks in form rendering (widget-renderer cache keyed on the
+  widget instance) and in `ListModelView` (`lru_cache` keyed on the view instance)
+- Fix the "Administration" menu showing to every logged-in user instead of staff
+- Fix several `viewflow.fsm` bugs: chart crashes on self-transitions, `State` with
+  a custom getter replacing falsy-but-valid states, REST `transition` committing
+  field writes on a failed transition or allowing arbitrary field writes; add a
+  `chart/` state-chart view and action to `FlowViewsMixin`
+- Fix a crash on the admin change page of any FSM-backed model under Django 5.2+
+  (incl. 6.1) from the `change_form_fsm_tools` template tag
+- Fix grouped `<select>` options under an `<optgroup>` being dropped, a formset
+  validation bypass via a tampered ManagementForm, and `vf-field-select-multiple`
+  dropping or failing to toggle selected values
+- Fix a system check now warning when a flow has `Join` nodes but no real lock,
+  and `manage.py check`/`runserver` crashing for a Join-node flow defined outside
+  any installed app
+
+## 2.3.1 2026-06-30
+
+- Add Django 6.1 support
+- Fix the bulk task assign/unassign actions not enforcing the per-task
+  `can_assign`/`can_unassign` permission
+- Fix task views accepting a task pk from another flow; tasks are now scoped to
+  the flow in the URL
+
 ## 2.3.0 2026-06-30
 
 - Fix `viewflow.fsm` chart generation crashing for `Enum` states and `State.ANY`
@@ -206,29 +252,6 @@ modifications of Viewflow. You can find the commercial license terms in
 - Upgrade `vanilla-jsoneditor` 0.23 → 3 (bundles svelte 5); the JSON field
   editor API is unchanged
 
-## 2.2.15 2025-12-24
-
-- Fix form button name/value lost on resubmission after validation error with Turbo
-- Fix subprocess double execution when completing synchronously
-
-## 2.2.14 2025-11-24
-
-- Add Django 6.0 compatibility (requires Python 3.12+)
-- Improve error handling for permission creation in multiple database configurations
-- Fix BPMN export to include name attribute for gateway nodes (flow.If)
-
-## 2.2.13 2025-09-24
-
-- Fix checkbox field error message styling to display in red color
-
-## 2.2.12 2025-07-25
-
-- Allow to extend and override process_data template
-
-## 2.2.11 2025-05-14
-
-- Return .Avaialble(..) for the start node
-
 
 
 [build]: https://img.shields.io/github/actions/workflow/status/viewflow/viewflow/django.yml?branch=main

{django_viewflow-2.3.0 → django_viewflow-2.3.2/django_viewflow.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-viewflow
-Version: 2.3.0
+Version: 2.3.2
 Summary: Reusable library to build business applications fast
 Author: Mikhail Podgurskiy
 Author-email: kmmbvnr@gmail.com
@@ -75,7 +75,7 @@ Viewflow comes in two versions:
 
 ## Installation
 
-Viewflow works with Python 3.8+ and Django 4.0+
+Viewflow works with Python 3.10+ and Django 4.2+
 
 Viewflow:
 
@@ -225,6 +225,52 @@ modifications of Viewflow. You can find the commercial license terms in
 
 ## Changelog
 
+For older releases, see [CHANGELOG.rst](./CHANGELOG.rst).
+
+## 2.3.2 2026-07-06
+
+Security and data-integrity release. Highlights:
+
+- Fix cross-flow privilege escalation and information disclosure: a user with
+  only flow A's permission could cancel, or read the full task list of, flow B's
+  process by posting/opening flow B's id on flow A's URL. `CancelProcessView` and
+  `DetailProcessView` now scope their querysets to the view's own flow
+- Fix the bulk-delete endpoint (`action/delete/`) deleting rows without checking
+  login or the `delete` permission; add the missing authentication checks to the
+  standalone `FlowChartView` and the `contrib.plotly` Dash endpoints
+- Fix a transaction-ordering bug that committed partial writes next to a task's
+  `ERROR` status in async mode; `Function`, `End`, `If`, `Split`, `Switch`,
+  `Subprocess`, and `Join` activation now roll back cleanly on failure
+- Fix a celery `Job` node treating `self.retry()`/`Reject` as a task failure and
+  crashing on redelivery of a `STARTED` retry
+- Fix task actions releasing their lock before the transaction commits, which let
+  a concurrent request double-execute an action under `CacheLock`
+- Fix `jsonstore` fields with a falsy `default` (`False`, `0`) returning `None`,
+  discarding a falsy assigned value, and mis-sorting on `order_by()`
+- Fix unbounded memory leaks in form rendering (widget-renderer cache keyed on the
+  widget instance) and in `ListModelView` (`lru_cache` keyed on the view instance)
+- Fix the "Administration" menu showing to every logged-in user instead of staff
+- Fix several `viewflow.fsm` bugs: chart crashes on self-transitions, `State` with
+  a custom getter replacing falsy-but-valid states, REST `transition` committing
+  field writes on a failed transition or allowing arbitrary field writes; add a
+  `chart/` state-chart view and action to `FlowViewsMixin`
+- Fix a crash on the admin change page of any FSM-backed model under Django 5.2+
+  (incl. 6.1) from the `change_form_fsm_tools` template tag
+- Fix grouped `<select>` options under an `<optgroup>` being dropped, a formset
+  validation bypass via a tampered ManagementForm, and `vf-field-select-multiple`
+  dropping or failing to toggle selected values
+- Fix a system check now warning when a flow has `Join` nodes but no real lock,
+  and `manage.py check`/`runserver` crashing for a Join-node flow defined outside
+  any installed app
+
+## 2.3.1 2026-06-30
+
+- Add Django 6.1 support
+- Fix the bulk task assign/unassign actions not enforcing the per-task
+  `can_assign`/`can_unassign` permission
+- Fix task views accepting a task pk from another flow; tasks are now scoped to
+  the flow in the URL
+
 ## 2.3.0 2026-06-30
 
 - Fix `viewflow.fsm` chart generation crashing for `Enum` states and `State.ANY`
@@ -249,29 +295,6 @@ modifications of Viewflow. You can find the commercial license terms in
 - Upgrade `vanilla-jsoneditor` 0.23 → 3 (bundles svelte 5); the JSON field
   editor API is unchanged
 
-## 2.2.15 2025-12-24
-
-- Fix form button name/value lost on resubmission after validation error with Turbo
-- Fix subprocess double execution when completing synchronously
-
-## 2.2.14 2025-11-24
-
-- Add Django 6.0 compatibility (requires Python 3.12+)
-- Improve error handling for permission creation in multiple database configurations
-- Fix BPMN export to include name attribute for gateway nodes (flow.If)
-
-## 2.2.13 2025-09-24
-
-- Fix checkbox field error message styling to display in red color
-
-## 2.2.12 2025-07-25
-
-- Allow to extend and override process_data template
-
-## 2.2.11 2025-05-14
-
-- Return .Avaialble(..) for the start node
-
 
 
 [build]: https://img.shields.io/github/actions/workflow/status/viewflow/viewflow/django.yml?branch=main

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/django_viewflow.egg-info/SOURCES.txt

@@ -247,6 +247,7 @@ viewflow/templates/viewflow/contrib/plotly.html
 viewflow/templates/viewflow/contrib/swagger.html
 viewflow/templates/viewflow/contrib/import_export/export_action.html
 viewflow/templates/viewflow/contrib/import_export/import_action.html
+viewflow/templates/viewflow/fsm/detail.html
 viewflow/templates/viewflow/includes/app_menu.html
 viewflow/templates/viewflow/includes/list_bulk_actions.html
 viewflow/templates/viewflow/includes/list_filter.html
@@ -262,6 +263,7 @@ viewflow/templates/viewflow/views/confirm_delete.html
 viewflow/templates/viewflow/views/delete_action.html
 viewflow/templates/viewflow/views/detail.html
 viewflow/templates/viewflow/views/form.html
+viewflow/templates/viewflow/views/fsm_chart.html
 viewflow/templates/viewflow/views/list.html
 viewflow/templates/viewflow/views/transition.html
 viewflow/templates/viewflow/workflow/assign.html
@@ -315,6 +317,7 @@ viewflow/workflow/admin.py
 viewflow/workflow/apps.py
 viewflow/workflow/base.py
 viewflow/workflow/chart.py
+viewflow/workflow/checks.py
 viewflow/workflow/context.py
 viewflow/workflow/exceptions.py
 viewflow/workflow/fields.py

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/setup.py

@@ -4,7 +4,7 @@ README = open("README.md", "r", encoding="utf-8").read()
 
 setuptools.setup(
     name="django-viewflow",
-    version="2.3.0",
+    version="2.3.2",
     author_email="kmmbvnr@gmail.com",
     author="Mikhail Podgurskiy",
     description="Reusable library to build business applications fast",

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/__init__.py

@@ -7,13 +7,11 @@
 # LICENSE_EXCEPTION and the Commercial license defined in file 'COMM_LICENSE',
 # which is part of this source code package.
 
-from django.conf import settings as django_settings
-from .conf import settings
 from .this_object import this
 from .utils import viewprop, Icon, DEFAULT
 
 __title__ = "Django-Viewflow"
-__version__ = "2.3.0"
+__version__ = "2.3.2"
 __author__ = "Mikhail Podgurskiy"
 __license__ = "AGPL"
 __copyright__ = "Copyright 2018-2021 Mikhail Podgurskiy"
@@ -22,11 +20,7 @@ __all__ = ("this", "viewprop", "Icon", "DEFAULT")
 
 default_app_config = "viewflow.apps.ViewflowConfig"
 
-if settings.AUTOREGISTER:
-    # Register site middleware
-    site_middleware = "viewflow.middleware.SiteMiddleware"
-    if site_middleware not in django_settings.MIDDLEWARE:
-        django_settings.MIDDLEWARE += (site_middleware,)
-    turbo_middleware = "viewflow.middleware.HotwireTurboMiddleware"
-    if turbo_middleware not in django_settings.MIDDLEWARE:
-        django_settings.MIDDLEWARE += (turbo_middleware,)
+# Middleware auto-registration lives in ViewflowConfig.ready() -- the app
+# registry isn't populated yet at this point, so apps.is_installed() (needed
+# to recognize viewflow regardless of how it's spelled in INSTALLED_APPS)
+# isn't safe to call here.

django_viewflow-2.3.2/viewflow/apps.py

@@ -0,0 +1,39 @@
+from django.apps import AppConfig, apps
+from django.conf import settings as django_settings
+
+# Copyright (c) 2017-2020, Mikhail Podgurskiy
+# All Rights Reserved.
+
+# This work is dual-licensed under AGPL defined in file 'LICENSE' with
+# LICENSE_EXCEPTION and the Commercial licence defined in file 'COMM_LICENSE',
+# which is part of this source code package.
+
+
+class ViewflowConfig(AppConfig):
+    """Default application config."""
+
+    name = "viewflow"
+    label = "viewflow_base"  # allow to user 'viewflow' label for 'viewflow.workflow'
+
+    def ready(self):
+        from .conf import settings
+
+        # The registry isn't populated yet when viewflow.conf.DEFAULTS is
+        # first computed, so its AUTOREGISTER default is a best-effort
+        # string check that only recognizes the bare "viewflow" app-label
+        # form. apps.is_installed() is only safe to call here, once every
+        # app is loaded, and correctly recognizes viewflow regardless of
+        # how it's spelled in INSTALLED_APPS (including the
+        # "viewflow.apps.ViewflowConfig" AppConfig-path form). Only
+        # correct the default -- an explicit user setting always wins.
+        custom = getattr(django_settings, "VIEWFLOW", {})
+        if "AUTOREGISTER" not in custom:
+            settings.settings["AUTOREGISTER"] = apps.is_installed("viewflow")
+
+        if settings.AUTOREGISTER:
+            site_middleware = "viewflow.middleware.SiteMiddleware"
+            if site_middleware not in django_settings.MIDDLEWARE:
+                django_settings.MIDDLEWARE += (site_middleware,)
+            turbo_middleware = "viewflow.middleware.HotwireTurboMiddleware"
+            if turbo_middleware not in django_settings.MIDDLEWARE:
+                django_settings.MIDDLEWARE += (turbo_middleware,)

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/conf.py

@@ -38,9 +38,16 @@ class Settings(object):
             custom = getattr(django_settings, "VIEWFLOW", {})
         self.settings = deepcopy(DEFAULTS)
 
-        for key, value in custom.get("WIDGET_RENDERERS", {}).items():
-            widget_class, renderer_class = import_string(key), import_string(value)
-            self.settings["WIDGET_RENDERERS"][widget_class] = renderer_class
+        for key, value in custom.items():
+            if key == "WIDGET_RENDERERS":
+                for widget_key, renderer_value in value.items():
+                    widget_class, renderer_class = (
+                        import_string(widget_key),
+                        import_string(renderer_value),
+                    )
+                    self.settings["WIDGET_RENDERERS"][widget_class] = renderer_class
+            elif key in self.settings:
+                self.settings[key] = value
 
     def __getattr__(self, attr):
         if attr not in self.settings:

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/contrib/admin/__init__.py

@@ -42,7 +42,7 @@ class Admin(AppMenuMixin, Application):
         self.admin_site = admin_site or admin.site
         super().__init__(**kwargs)
 
-    def has_perm(self, user):
+    def has_view_permission(self, user, obj=None):
         return user.is_staff
 
     @property

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/contrib/auth.py

@@ -19,6 +19,7 @@ from django.core.cache import cache
 from django.core.cache.utils import make_template_fragment_key
 from django.core.files.storage import default_storage
 from django.db import models
+from django.template.defaultfilters import filesizeformat
 from django.urls import path
 from django.utils.decorators import method_decorator
 from django.views import generic
@@ -29,6 +30,9 @@ from viewflow.urls import Viewset
 from viewflow.utils import viewprop
 
 
+MAX_AVATAR_SIZE = 5 * 1024 * 1024  # 5 MB
+
+
 class AuthenticationForm(auth_forms.AuthenticationForm):
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
@@ -68,16 +72,29 @@ class ProfileView(generic.DetailView):
 
     def post(self, request, *args, **kwargs):
         class AvatarForm(forms.Form):
-            avatar = forms.FileField(required=True)
+            avatar = forms.ImageField(required=True)
+
+            def clean_avatar(self):
+                avatar = self.cleaned_data["avatar"]
+                if avatar.size > MAX_AVATAR_SIZE:
+                    raise forms.ValidationError(
+                        _(
+                            "Avatar file is too large (%(size)s). "
+                            "Max size is %(max_size)s."
+                        )
+                        % {
+                            "size": filesizeformat(avatar.size),
+                            "max_size": filesizeformat(MAX_AVATAR_SIZE),
+                        }
+                    )
+                return avatar
 
         form = AvatarForm(request.POST, request.FILES)
         if form.is_valid():
             file_name = "avatars/{}.png".format(request.user.pk)
             if default_storage.exists(file_name):
                 default_storage.delete(file_name)
-            default_storage.save(
-                file_name, form.cleaned_data["avatar"], max_length=512 * 1024
-            )
+            default_storage.save(file_name, form.cleaned_data["avatar"])
             key = make_template_fragment_key(
                 "django-viewflow-avatar", [request.user.pk]
             )

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/contrib/plotly/views.py

@@ -1,11 +1,34 @@
+import functools
 import json
 import re
+from django.core.exceptions import PermissionDenied
 from django.http import HttpResponse, JsonResponse
 from django.views.decorators.csrf import csrf_exempt
 from django.views.decorators.http import require_POST
 from django.views.generic import TemplateView
 
 
+def dash_view_permission_required(view_func):
+    """Require an authenticated user with view permission on the Dashboard.
+
+    Dash endpoints have no built-in auth of their own, and Dashboard's
+    default `has_view_permission` (inherited from AppMenuMixin, since
+    Dashboard isn't an Application) is always True -- so without this,
+    an anonymous user could read the dashboard layout/data and invoke
+    registered callbacks.
+    """
+
+    @functools.wraps(view_func)
+    def wrapper(request, viewset, *args, **kwargs):
+        if not request.user.is_authenticated:
+            raise PermissionDenied
+        if not viewset.has_view_permission(request.user):
+            raise PermissionDenied
+        return view_func(request, viewset, *args, **kwargs)
+
+    return wrapper
+
+
 def _extract_urls(data):
     """
     Given html string of <script src=""> tags, extracts list of static files stripping version info
@@ -35,15 +58,18 @@ class DashboardView(TemplateView):
         )
 
 
+@dash_view_permission_required
 def layout_endpoint(request, viewset):
     dash_response = viewset.dash_app.serve_layout()
     return HttpResponse(dash_response.data, content_type="application/json")
 
 
+@dash_view_permission_required
 def dependencies_endpoint(request, viewset):
     return JsonResponse(viewset.dash_app._callback_list, safe=False)
 
 
+@dash_view_permission_required
 @csrf_exempt
 @require_POST
 def update_component_endpoint(request, viewset):

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/fields.py

@@ -11,8 +11,8 @@ import json
 import uuid
 from typing import List
 from django.db import DEFAULT_DB_ALIAS, models, router
-from django.db.models import signals
-from django.db.models.sql.where import WhereNode, AND
+from django.db.models.deletion import Collector
+from django.db.models.sql.where import WhereNode, AND, OR
 from django.utils.duration import duration_iso_string
 from django.utils.functional import Promise
 from django.utils.timezone import is_aware
@@ -47,17 +47,17 @@ class CompositeKey(models.AutoField):
         def delete(inst, using=None, keep_parents=False):
             using = using or router.db_for_write(self.model, instance=inst)
 
-            signals.pre_delete.send(sender=cls, instance=inst, using=using)
-
-            query = cls._default_manager.filter(**self.__get__(inst))
-            query._raw_delete(using)
+            collector = Collector(using=using, origin=inst)
+            collector.collect([inst], keep_parents=keep_parents)
+            result = collector.delete()
 
             for column in self.columns:
                 setattr(inst, column, None)
 
-            signals.post_delete.send(sender=cls, instance=inst, using=using)
+            return result
 
-        cls.delete = delete
+        if cls.delete is models.Model.delete:
+            cls.delete = delete
 
     def get_prep_value(self, value):
         return self.to_python(value)
@@ -138,3 +138,37 @@ class Exact(models.Lookup):
         for lookup in lookups:
             value_constraint.add(lookup, AND)
         return value_constraint.as_sql(compiler, connection)
+
+
+@CompositeKey.register_lookup
+class In(models.Lookup):
+    """Supports ``pk__in=[...]``, notably the deletion `Collector`'s own
+    batch-delete query, which filters by ``<pk_attname>__in`` directly."""
+
+    lookup_name = "in"
+
+    def get_prep_lookup(self):
+        # The base Lookup.get_prep_lookup() would call
+        # output_field.get_prep_value() on the whole rhs list at once --
+        # CompositeKey.get_prep_value() expects a single key. Each key is
+        # prepared individually, per-field, in as_sql() instead.
+        return self.rhs
+
+    def as_sql(self, compiler, connection):
+        fields = [
+            self.lhs.field.model._meta.get_field(column)
+            for column in self.lhs.field.columns
+        ]
+        lookup_classes = [field.get_lookup("exact") for field in fields]
+
+        keys_constraint = WhereNode(connector=OR)
+        for key in self.rhs:
+            key_constraint = WhereNode()
+            for lookup_class, field, column in zip(
+                lookup_classes, fields, self.lhs.field.columns
+            ):
+                key_constraint.add(
+                    lookup_class(field.get_col(self.lhs.alias), key[column]), AND
+                )
+            keys_constraint.add(key_constraint, OR)
+        return keys_constraint.as_sql(compiler, connection)

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/forms/renderers.py

@@ -68,13 +68,19 @@ class WidgetRenderer(object):
         return self.create_root(context)
 
     @staticmethod
-    @lru_cache(maxsize=None)
     def get_renderer(widget: forms.Widget) -> "Type[WidgetRenderer]":
+        return WidgetRenderer._get_renderer_for_class(type(widget))
+
+    @staticmethod
+    @lru_cache(maxsize=None)
+    def _get_renderer_for_class(
+        widget_class: "Type[forms.Widget]",
+    ) -> "Type[WidgetRenderer]":
         from viewflow.conf import settings
 
-        for widget_class in type(widget).mro()[:-2]:
+        for klass in widget_class.mro()[:-2]:
             try:
-                return settings.WIDGET_RENDERERS[widget_class]
+                return settings.WIDGET_RENDERERS[klass]
             except KeyError:
                 continue
 
@@ -254,11 +260,12 @@ class SelectRenderer(WidgetRenderer):
                     "name": name or "",
                     "options": {
                         key: value
-                        for key, value in options[0].items()
+                        for key, value in option.items()
                         if key not in ["template_name", "type", "wrap_label"]
                     },
                 }
                 for name, options, _ in context["widget"]["optgroups"]
+                for option in options
             ],
             cls=FormDataEncoder,
         )

{django_viewflow-2.3.0 → django_viewflow-2.3.2}/viewflow/fsm/admin.py

@@ -48,11 +48,12 @@ class FlowAdminMixin(object):
         object. Override this function if your flow class does not have a
         constructor that accepts the model object as the only argument.
         """
+        owner = self.get_flow_state(request)._owner
         try:
-            return self.get_flow_state()._owner(obj)
+            return owner(obj)
         except TypeError:
             raise ValueError(
-                f"{self.flow_state._owner} does not have a constructor that accepts"
+                f"{owner} does not have a constructor that accepts"
                 " a single argument. Please redefine 'get_object_flow' on the model"
                 " admin."
             )