drf-query-method 0.1.0__tar.gz → 0.3.0__tar.gz

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/.github/dependabot.yml

@@ -6,6 +6,11 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+    groups:
+      # CodeQL's init and analyze steps must run the same version.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
     open-pull-requests-limit: 5
 
   - package-ecosystem: uv

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/.github/workflows/ci.yml

@@ -96,7 +96,7 @@ jobs:
             drf_req="djangorestframework~=$DRF.0"
           fi
           uv venv --python "$PYTHON"
-          uv pip install -e . "$django_req" "$drf_req" django-filter coverage pytest pytest-django
+          uv pip install -e . "$django_req" "$drf_req" django-filter djangorestframework-datatables coverage pytest pytest-django
 
       - name: Run tests with coverage
         run: .venv/bin/coverage run -m pytest
@@ -122,7 +122,7 @@ jobs:
       - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
 
       - name: Download coverage data
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: coverage-*
           merge-multiple: true
@@ -144,6 +144,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check job results
-        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
+        uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
         with:
           jobs: ${{ toJSON(needs) }}

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/.github/workflows/codeql.yml

@@ -25,11 +25,11 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: python  # Add c-cpp, go, java-kotlin, or swift if needed
           build-mode: none   # Switch to autobuild for compiled languages
           queries: security-extended
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/.github/workflows/publish.yml

@@ -50,13 +50,13 @@ jobs:
       url: https://pypi.org/p/drf-query-method
     steps:
       - name: Download distribution
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: dist
           path: dist/
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: "dist/*"
 

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/.github/workflows/zizmor.yml

@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           advanced-security: ${{ github.event.repository.private == false || vars.CODE_SECURITY_ENABLED == 'true' }}
           inputs: ./.github/

drf_query_method-0.3.0/CHANGELOG/0.2.0.md

@@ -0,0 +1,10 @@
+# drf-query-method 0.2.0
+
+## Added
+
+- `patch()` makes [django-rest-framework-datatables](https://github.com/izimobil/django-rest-framework-datatables) read
+  `QUERY` request bodies, so server-side DataTables can send their parameters as a `QUERY` body.
+
+## Changed
+
+- `filter_params()` caches its result on the request.

drf_query_method-0.3.0/CHANGELOG/0.3.0.md

@@ -0,0 +1,11 @@
+# drf-query-method 0.3.0
+
+## Changed
+
+- On Django 4.2 to 6.1, `add_query_method()` (and so `patch()`) now treats `QUERY` as a safe method in Django's
+  `CsrfViewMiddleware`, matching Django 6.2. `QUERY` requests no longer need a CSRF token on any supported version,
+  including session-authenticated requests through DRF's `SessionAuthentication`.
+
+## Documentation
+
+- README and usage docs explain CSRF for `QUERY`, and the README no longer says the package is unreleased.

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: drf-query-method
-Version: 0.1.0
+Version: 0.3.0
 Summary: HTTP QUERY method (RFC 10008) support for Django REST framework.
 Project-URL: bugs, https://github.com/BenA-SA/drf-query-method/issues
 Project-URL: changelog, https://github.com/BenA-SA/drf-query-method/releases
@@ -73,19 +73,31 @@ class NoteViewSet(ModelViewSet):
         return self.list(request, *args, **kwargs)
 ```
 
-Routers then send `QUERY /notes/` to `query()`, and `SearchFilter`, `OrderingFilter` and django-filter's
-`DjangoFilterBackend` read their parameters from the request body. If you'd rather not patch DRF, import drop-in
+Routers then send `QUERY /notes/` to `query()`, and `SearchFilter`, `OrderingFilter`, django-filter's
+`DjangoFilterBackend` and django-rest-framework-datatables read their parameters from the request body. If you'd rather not patch DRF, import drop-in
 classes with the same names from `drf_query_method` instead. See the [documentation](https://BenA-SA.github.io/drf-query-method/usage/)
 for both approaches, and for sending `QUERY` requests from JavaScript and other clients.
 
-The package is in early development and not yet released.
+The package is in early development. Releases are on [PyPI](https://pypi.org/project/drf-query-method/).
+
+## CSRF
+
+`QUERY` is a safe method, so it never needs a CSRF token, on any supported Django version. Django 6.2 exempts it from
+CSRF checks itself. On Django 4.2 to 6.1, where this package adds `QUERY`, it also teaches Django's
+`CsrfViewMiddleware` to treat `QUERY` as safe, so the behaviour matches 6.2. DRF's `SessionAuthentication` uses the same
+check, so session-authenticated `QUERY` requests work without a token too.
+
+The trade-off is the one `GET` has always had: a `query()` handler must never change data. Cross-site requests are
+still guarded by CORS, because browsers can only send `QUERY` from JavaScript, and `QUERY` isn't a CORS-safelisted
+method, so a cross-origin request needs your server's permission first.
 
 ## Compatibility
 
 * Python 3.10+
-* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it.
+* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it,
+  including Django 6.2's CSRF behaviour.
 * Django REST framework 3.16+
-* django-filter, optionally
+* django-filter and django-rest-framework-datatables, optionally
 
 ## Installation
 

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/README.md

@@ -35,19 +35,31 @@ class NoteViewSet(ModelViewSet):
         return self.list(request, *args, **kwargs)
 ```
 
-Routers then send `QUERY /notes/` to `query()`, and `SearchFilter`, `OrderingFilter` and django-filter's
-`DjangoFilterBackend` read their parameters from the request body. If you'd rather not patch DRF, import drop-in
+Routers then send `QUERY /notes/` to `query()`, and `SearchFilter`, `OrderingFilter`, django-filter's
+`DjangoFilterBackend` and django-rest-framework-datatables read their parameters from the request body. If you'd rather not patch DRF, import drop-in
 classes with the same names from `drf_query_method` instead. See the [documentation](https://BenA-SA.github.io/drf-query-method/usage/)
 for both approaches, and for sending `QUERY` requests from JavaScript and other clients.
 
-The package is in early development and not yet released.
+The package is in early development. Releases are on [PyPI](https://pypi.org/project/drf-query-method/).
+
+## CSRF
+
+`QUERY` is a safe method, so it never needs a CSRF token, on any supported Django version. Django 6.2 exempts it from
+CSRF checks itself. On Django 4.2 to 6.1, where this package adds `QUERY`, it also teaches Django's
+`CsrfViewMiddleware` to treat `QUERY` as safe, so the behaviour matches 6.2. DRF's `SessionAuthentication` uses the same
+check, so session-authenticated `QUERY` requests work without a token too.
+
+The trade-off is the one `GET` has always had: a `query()` handler must never change data. Cross-site requests are
+still guarded by CORS, because browsers can only send `QUERY` from JavaScript, and `QUERY` isn't a CORS-safelisted
+method, so a cross-origin request needs your server's permission first.
 
 ## Compatibility
 
 * Python 3.10+
-* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it.
+* Django 4.2, 5.0, 5.1, 5.2, 6.0 and 6.1. Django 6.2 adds `QUERY` natively; on earlier versions this package adds it,
+  including Django 6.2's CSRF behaviour.
 * Django REST framework 3.16+
-* django-filter, optionally
+* django-filter and django-rest-framework-datatables, optionally
 
 ## Installation
 

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/docs/usage.md

@@ -57,6 +57,8 @@ were merged:
 * DRF's deprecated OpenAPI generator leaves `QUERY` out, as OpenAPI 3.0 has no query operation.
 * If [django-filter](https://github.com/carltongibson/django-filter) is installed, `DjangoFilterBackend` reads the
   request body too.
+* If [django-rest-framework-datatables](https://github.com/izimobil/django-rest-framework-datatables) is installed, its
+  filter backends, pagination and renderer read the request body too. See [DataTables](#datatables) below.
 
 `patch()` is safe to call more than once, and leaves DRF alone once DRF supports `QUERY` itself.
 
@@ -73,6 +75,8 @@ Every class has the same name as DRF's (or django-filter's), so you change the i
 | `rest_framework.test.APIRequestFactory`, `APIClient`, `APITestCase` and friends | `drf_query_method.test` |
 | `django_filters.rest_framework.DjangoFilterBackend` | `drf_query_method.django_filters` |
 
+django-rest-framework-datatables is supported through `patch()` only.
+
 Use the router and viewset classes together: the viewsets stop a `query()` method answering `QUERY` on detail routes.
 
 On Django versions before 6.2, also call `drf_query_method.add_query_method()` at startup (`patch()` does this for you).
@@ -131,19 +135,47 @@ A few things to check before relying on `QUERY` in production:
     CORS_ALLOW_METHODS = (*default_methods, "QUERY")
     ```
 
-* **CSRF.** On Django versions before 6.2, session-authenticated `QUERY` requests need a CSRF token, the same as
-  `POST`.
+* **CSRF.** None needed: `QUERY` is a safe method, so it never needs a CSRF token on any supported Django version. See
+  [Django versions before 6.2](#django-versions-before-62) for how older versions get the same behaviour.
 * **Proxies, CDNs and firewalls.** Some reject request methods they don't recognise. Check that `QUERY` reaches your
   application through everything in front of it.
 * **Caching.** `QUERY` responses are cacheable in principle, but caches generally don't key on request bodies, and
   Django's `cache_page` ignores `QUERY` from 6.2. Don't expect responses to be cached.
-* **django-rest-framework-datatables** reads its parameters with its own helper, which looks at the request body only
-  for `POST`. It doesn't read `QUERY` bodies yet.
+## DataTables
+
+With `patch()` and [django-rest-framework-datatables](https://github.com/izimobil/django-rest-framework-datatables),
+a server-side DataTable can send its parameters as a `QUERY` body instead of a long query string. Keep `format=datatables`
+in the URL, and set the Ajax type:
+
+```javascript
+new DataTable("#notes", {
+  serverSide: true,
+  ajax: {url: "/api/notes/?format=datatables", type: "QUERY"},
+  columns: [{data: "title"}, {data: "created"}],
+});
+```
+
+jQuery sends DataTables' parameters as a form-encoded body for any method other than `GET` and `HEAD`, which is the
+form django-rest-framework-datatables expects. The view needs a `query()` handler, as above. Its `?keep=` parameter is
+still read from the URL.
 
 ## Django versions before 6.2
 
-Django 6.2 supports `QUERY` natively. On earlier versions this package adds it, with one difference: Django's CSRF
-middleware treats `QUERY` as unsafe until 6.2, so session-authenticated `QUERY` requests need a CSRF token.
+Django 6.2 supports `QUERY` natively. On Django 4.2 to 6.1, `add_query_method()` (which `patch()` calls) brings the same
+behaviour to older versions in two ways:
+
+* It adds `query` to Django's allowed view methods, so views can define a `query()` handler.
+* It treats `QUERY` as a safe method in `CsrfViewMiddleware`, as Django 6.2 does. Before 6.2 the middleware only
+  exempts `GET`, `HEAD`, `OPTIONS` and `TRACE`, so without this, session-authenticated `QUERY` requests would need a
+  CSRF token. DRF's `SessionAuthentication` checks CSRF through the same middleware, so it follows suit.
+
+The result is that `QUERY` never needs a CSRF token, whichever supported Django version you're on. If you call
+`add_query_method()` yourself rather than `patch()`, call it once at startup, before requests are served.
+
+This is safe for the same reason it is in Django 6.2. CSRF protects against another site making a logged-in user's
+browser send a request. HTML forms can only send `GET` and `POST`, so `QUERY` can only come from JavaScript, and
+because `QUERY` is not a CORS-safelisted method, the browser asks your server's permission with a preflight request
+before sending a cross-origin one. As with `GET`, a `query()` handler must never change data.
 
 ## Moving to DRF's own support
 

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "drf-query-method"
-version = "0.1.0"
+version = "0.3.0"
 description = "HTTP QUERY method (RFC 10008) support for Django REST framework."
 readme = "README.md"
 authors = [
@@ -54,6 +54,7 @@ lint = [
 test = [
     "coverage",
     "django-filter",
+    "djangorestframework-datatables",
     "pytest",
     "pytest-django",
 ]
@@ -81,7 +82,7 @@ homepage = "https://github.com/BenA-SA/drf-query-method"
 
 [[tool.ty.overrides]]
 # These tests use attributes that patch() adds to DRF at runtime.
-include = ["tests/test_patching.py"]
+include = ["tests/test_patching.py", "tests/test_datatables.py"]
 rules = { unresolved-attribute = "ignore" }
 
 [tool.ruff]

drf_query_method-0.3.0/src/drf_query_method/methods.py

@@ -0,0 +1,47 @@
+"""Make Django accept the QUERY method on versions before 6.2."""
+
+import functools
+
+from django.middleware.csrf import CsrfViewMiddleware
+from django.views.generic import View
+
+
+def add_query_method() -> None:
+    """Make Django before 6.2 handle ``QUERY`` as Django 6.2 does.
+
+    Django 6.2 supports ``QUERY`` natively, so this does nothing there. On
+    earlier versions it adds ``query`` to ``View.http_method_names``, so any
+    view, including DRF's, can dispatch ``QUERY`` requests to a ``query()``
+    handler, and it treats ``QUERY`` as a safe method in
+    ``CsrfViewMiddleware``, so ``QUERY`` requests need no CSRF token. See
+    :func:`skip_csrf_for_query`.
+    """
+    if "query" in View.http_method_names:
+        return
+    View.http_method_names = [*View.http_method_names, "query"]
+    CsrfViewMiddleware.process_view = skip_csrf_for_query(CsrfViewMiddleware.process_view)
+
+
+def skip_csrf_for_query(process_view):
+    """Wrap ``CsrfViewMiddleware.process_view`` to accept ``QUERY`` like ``GET``.
+
+    Django 6.2 adds ``QUERY`` to the methods the middleware exempts as safe
+    under RFC 9110. Earlier versions hard-code ``GET``, ``HEAD``, ``OPTIONS``
+    and ``TRACE``, so the wrapper sends ``QUERY`` down the same path: a request
+    already processed, or a ``csrf_exempt`` view, is left alone, and anything
+    else is accepted without a token. Every other method falls through to
+    Django unchanged.
+
+    DRF's ``SessionAuthentication`` checks CSRF through ``CSRFCheck``, a
+    ``CsrfViewMiddleware`` subclass, so it follows the same rule.
+    """
+
+    @functools.wraps(process_view)
+    def wrapper(self, request, callback, callback_args, callback_kwargs):
+        if request.method != "QUERY":
+            return process_view(self, request, callback, callback_args, callback_kwargs)
+        if getattr(request, "csrf_processing_done", False) or getattr(callback, "csrf_exempt", False):
+            return None
+        return self._accept(request)
+
+    return wrapper

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/src/drf_query_method/params.py

@@ -6,6 +6,8 @@ from django.http import QueryDict
 from django.utils.datastructures import MultiValueDict
 from rest_framework.exceptions import ParseError
 
+_CACHE_ATTRIBUTE = "_drf_query_method_filter_params"
+
 
 def merge_filter_params(request) -> QueryDict:
     """Return ``request.query_params`` with a QUERY request's body merged over it.
@@ -17,11 +19,16 @@ def merge_filter_params(request) -> QueryDict:
     values, as repeated query-string parameters do.
 
     Raises ``ParseError`` (400) when the body is not an object of parameters,
-    such as a JSON array.
+    such as a JSON array. The result is cached on the request, as packages
+    such as django-rest-framework-datatables read many parameters each.
     """
     if request.method != "QUERY":
         return request.query_params
 
+    cached = request.__dict__.get(_CACHE_ATTRIBUTE)
+    if cached is not None:
+        return cached
+
     body = request.data
     if not isinstance(body, Mapping):
         raise ParseError(f"QUERY request body must be an object of parameters, not {type(body).__name__}.")
@@ -32,6 +39,7 @@ def merge_filter_params(request) -> QueryDict:
     params = request.query_params.copy()
     for key, values in body.lists():
         params.setlist(key, values)
+    request.__dict__[_CACHE_ATTRIBUTE] = params
     return params
 
 

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/src/drf_query_method/patching.py

@@ -2,8 +2,9 @@
 
 :func:`patch` makes DRF behave as if encode/django-rest-framework#10091 were
 merged, so existing views, routers and settings pick up ``QUERY`` without
-changing imports. Call it once at startup, for example from an
-``AppConfig.ready()``. It does nothing to DRF once DRF supports ``QUERY``
+changing imports. When django-filter or django-rest-framework-datatables
+is installed, they read QUERY request bodies too. Call it once at startup,
+for example from an ``AppConfig.ready()``. It does nothing to DRF once DRF supports ``QUERY``
 itself.
 """
 
@@ -78,8 +79,28 @@ def _patch_django_filter() -> None:
     )
 
 
+def _patch_drf_datatables() -> None:
+    """Make django-rest-framework-datatables read QUERY request bodies.
+
+    Its modules import ``get_param`` by name, so each binding is replaced.
+    """
+    from rest_framework_datatables import filters, pagination, renderers, utils
+
+    from drf_query_method.params import filter_params
+
+    original = utils.get_param
+
+    def get_param(request, param, default=None):
+        if request.method == "QUERY":
+            return filter_params(request).get(param, default)
+        return original(request, param, default)
+
+    for module in (utils, filters, pagination, renderers):
+        _set(module, "get_param", get_param)
+
+
 def patch() -> None:
-    """Add QUERY support to Django, DRF and django-filter in place.
+    """Add QUERY support to Django, DRF, django-filter and django-rest-framework-datatables in place.
 
     Safe to call more than once. On Django versions before 6.2 this also
     calls :func:`~drf_query_method.add_query_method`, which :func:`unpatch`
@@ -95,6 +116,8 @@ def patch() -> None:
         _patch_drf()
     if importlib.util.find_spec("django_filters") is not None:
         _patch_django_filter()
+    if importlib.util.find_spec("rest_framework_datatables") is not None:
+        _patch_drf_datatables()
 
 
 def unpatch() -> None:

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/tests/settings.py

@@ -5,12 +5,19 @@ SECRET_KEY = "drf-query-method-tests"
 INSTALLED_APPS = [
     "django.contrib.auth",
     "django.contrib.contenttypes",
+    "django.contrib.sessions",
     "django_filters",
     "rest_framework",
 ]
 
 ROOT_URLCONF = "tests.urls"
 
+MIDDLEWARE = [
+    "django.contrib.sessions.middleware.SessionMiddleware",
+    "django.middleware.csrf.CsrfViewMiddleware",
+    "django.contrib.auth.middleware.AuthenticationMiddleware",
+]
+
 DATABASES = {
     "default": {
         "ENGINE": "django.db.backends.sqlite3",

drf_query_method-0.3.0/tests/test_csrf.py

@@ -0,0 +1,39 @@
+import pytest
+from django.contrib.auth.models import User
+from django.http import HttpResponse
+from django.middleware.csrf import CsrfViewMiddleware
+from django.test import RequestFactory
+
+from drf_query_method import add_query_method
+from drf_query_method.test import APIClient
+
+
+@pytest.fixture
+def client(db):
+    client = APIClient(enforce_csrf_checks=True)
+    client.force_login(User.objects.create(username="alice"))
+    return client
+
+
+def test_session_authenticated_query_needs_no_csrf_token(client):
+    response = client.query("/session/", {"search": "a"}, format="json")
+    assert response.status_code == 200
+    assert response.data == {"method": "QUERY"}
+
+
+def test_session_authenticated_post_still_needs_a_csrf_token(client):
+    assert client.post("/session/", {}, format="json").status_code == 403
+
+
+def test_csrf_middleware_accepts_query_as_a_safe_method():
+    middleware = CsrfViewMiddleware(lambda request: HttpResponse())
+    request = RequestFactory().generic("QUERY", "/")
+    assert middleware.process_view(request, lambda request: HttpResponse(), (), {}) is None
+    assert request.csrf_processing_done
+
+
+def test_add_query_method_wraps_the_middleware_once():
+    add_query_method()
+    add_query_method()
+    process_view = CsrfViewMiddleware.process_view
+    assert not hasattr(getattr(process_view, "__wrapped__", None), "__wrapped__")

drf_query_method-0.3.0/tests/test_datatables.py

@@ -0,0 +1,94 @@
+from urllib.parse import urlencode
+
+import django_filters
+import pytest
+from django.contrib.auth.models import User
+from rest_framework import generics
+from rest_framework.renderers import JSONRenderer
+from rest_framework.test import APIRequestFactory
+from rest_framework_datatables import filters, pagination, renderers
+from rest_framework_datatables.django_filters.backends import DatatablesFilterBackend
+from rest_framework_datatables.django_filters.filters import GlobalFilter
+from rest_framework_datatables.django_filters.filterset import DatatablesFilterSet
+
+from tests.views import UserSerializer
+
+DATATABLES_PARAMS = {
+    "draw": "3",
+    "start": "1",
+    "length": "1",
+    "columns[0][data]": "username",
+    "columns[0][name]": "username",
+    "columns[0][searchable]": "true",
+    "columns[0][orderable]": "true",
+    "columns[0][search][value]": "",
+    "columns[0][search][regex]": "false",
+    "order[0][column]": "0",
+    "order[0][dir]": "desc",
+    "search[value]": "o",
+    "search[regex]": "false",
+}
+
+
+class GlobalCharFilter(GlobalFilter, django_filters.CharFilter):
+    pass
+
+
+class UserGlobalFilterSet(DatatablesFilterSet):
+    username = GlobalCharFilter(lookup_expr="icontains")
+
+    class Meta:
+        model = User
+        fields = ["username"]
+
+
+def build_view(filter_backend):
+    class View(generics.ListAPIView):
+        queryset = User.objects.order_by("pk")
+        serializer_class = UserSerializer
+        permission_classes = []
+        filterset_class = UserGlobalFilterSet
+        renderer_classes = [JSONRenderer, renderers.DatatablesRenderer]
+        filter_backends = [filter_backend]
+        pagination_class = pagination.DatatablesPageNumberPagination
+
+        def query(self, request, *args, **kwargs):
+            return self.list(request, *args, **kwargs)
+
+    return View.as_view()
+
+
+@pytest.fixture
+def users(db):
+    for username in ["alice", "bob", "carol"]:
+        User.objects.create(username=username)
+
+
+@pytest.mark.parametrize("filter_backend", [filters.DatatablesFilterBackend, DatatablesFilterBackend])
+def test_datatables_reads_query_body(patched, users, filter_backend):
+    request = APIRequestFactory().query(
+        "/?format=datatables", urlencode(DATATABLES_PARAMS), content_type="application/x-www-form-urlencoded"
+    )
+    response = build_view(filter_backend)(request)
+    response.render()
+    assert response.data["draw"] == 3
+    assert response.data["recordsTotal"] == 3
+    assert response.data["recordsFiltered"] == 2
+    assert [user["username"] for user in response.data["data"]] == ["bob"]
+
+
+def test_datatables_get_is_unchanged(patched, users):
+    request = APIRequestFactory().get("/", {**DATATABLES_PARAMS, "format": "datatables"})
+    response = build_view(filters.DatatablesFilterBackend)(request)
+    assert [user["username"] for user in response.data["data"]] == ["bob"]
+
+
+def test_merged_filter_params_are_cached_per_request():
+    from rest_framework.parsers import JSONParser
+    from rest_framework.request import Request
+
+    from drf_query_method.params import merge_filter_params
+    from drf_query_method.test import APIRequestFactory as QueryRequestFactory
+
+    request = Request(QueryRequestFactory().query("/", {"a": "1"}, format="json"), parsers=[JSONParser()])
+    assert merge_filter_params(request) is merge_filter_params(request)

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/tests/urls.py

@@ -1,8 +1,9 @@
 from django.urls import path
 
-from tests.views import QueryEchoView, redirect_view
+from tests.views import QueryEchoView, SessionQueryView, redirect_view
 
 urlpatterns = [
     path("query/", QueryEchoView.as_view()),
     path("redirect/", redirect_view),
+    path("session/", SessionQueryView.as_view()),
 ]

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/tests/views.py

@@ -3,7 +3,9 @@
 from django.contrib.auth.models import User
 from django.http.response import HttpResponseRedirectBase
 from rest_framework import generics, serializers
+from rest_framework.authentication import SessionAuthentication
 from rest_framework.decorators import action, api_view
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
@@ -72,3 +74,14 @@ class QueryActionViewSet(viewsets.GenericViewSet):
     @action(detail=False, methods=["post"])
     def query(self, request):
         return Response("action")
+
+
+class SessionQueryView(APIView):
+    authentication_classes = [SessionAuthentication]
+    permission_classes = [IsAuthenticated]
+
+    def query(self, request):
+        return Response({"method": request.method})
+
+    def post(self, request):
+        return Response({"method": request.method})

{drf_query_method-0.1.0 → drf_query_method-0.3.0}/uv.lock

@@ -408,9 +408,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c4/dd/de5f4543765bec94e036a5e9593a42f8fa7efec8de78eb56b9ca834385f3/djangorestframework-3.18.3-py3-none-any.whl", hash = "sha256:8544bb674846731b1e3c9b309236ee1dc412905a0aa725be2ec193ca950a7d12", size = 903986, upload-time = "2026-10-06T21:33:49.917Z" },
 ]
 
+[[package]]
+name = "djangorestframework-datatables"
+version = "0.7.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "djangorestframework" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c7/a0/7481fee713387fd5c632b05c1d95c32f5b2ea6e1e8f15c9cf1894e1895a8/djangorestframework_datatables-0.7.2.tar.gz", hash = "sha256:d7953968088ceb14968621a0c0a83d2f39ec1cda24b5ebe1240f3c9619bc7129", size = 19647, upload-time = "2024-06-14T17:11:41.742Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f3/25/17cd01982c7299cbca9e20247e73c83bfa53a0ed9e8b7735c915c1bb6675/djangorestframework_datatables-0.7.2-py2.py3-none-any.whl", hash = "sha256:fd5747b1e3d0bfb84713a975394dd4d879b57ee8bc66cc0f97566fa67f4406f4", size = 15303, upload-time = "2024-06-14T17:11:39.658Z" },
+]
+
 [[package]]
 name = "drf-query-method"
-version = "0.1.0"
+version = "0.3.0"
 source = { editable = "." }
 dependencies = [
     { name = "django", version = "5.2.18", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.12'" },
@@ -430,6 +442,7 @@ dev = [
     { name = "coverage", version = "7.17.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
     { name = "django-filter", version = "26.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
     { name = "django-filter", version = "26.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "djangorestframework-datatables" },
     { name = "pytest" },
     { name = "pytest-django" },
     { name = "ruff" },
@@ -449,6 +462,7 @@ test = [
     { name = "coverage", version = "7.17.0", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
     { name = "django-filter", version = "26.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
     { name = "django-filter", version = "26.2", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "djangorestframework-datatables" },
     { name = "pytest" },
     { name = "pytest-django" },
 ]
@@ -468,6 +482,7 @@ provides-extras = ["django-filter"]
 dev = [
     { name = "coverage" },
     { name = "django-filter" },
+    { name = "djangorestframework-datatables" },
     { name = "pytest" },
     { name = "pytest-django" },
     { name = "ruff" },
@@ -481,6 +496,7 @@ lint = [{ name = "ruff" }]
 test = [
     { name = "coverage" },
     { name = "django-filter" },
+    { name = "djangorestframework-datatables" },
     { name = "pytest" },
     { name = "pytest-django" },
 ]

drf_query_method-0.1.0/src/drf_query_method/methods.py

@@ -1,16 +0,0 @@
-"""Make Django accept the QUERY method on versions before 6.2."""
-
-from django.views.generic import View
-
-
-def add_query_method() -> None:
-    """Add ``query`` to Django's ``View.http_method_names`` if it is missing.
-
-    Django 6.2 lists ``query`` itself, so this does nothing there. On earlier
-    versions it lets any view, including DRF's, dispatch ``QUERY`` requests to
-    a ``query()`` handler. Earlier versions of Django's CSRF middleware treat
-    ``QUERY`` as unsafe, so session-authenticated ``QUERY`` requests need a
-    CSRF token until Django 6.2.
-    """
-    if "query" not in View.http_method_names:
-        View.http_method_names = [*View.http_method_names, "query"]