dynamicforms-fastapi-viewsets 0.7.3__tar.gz → 0.8.0__tar.gz

{dynamicforms_fastapi_viewsets-0.7.3 → dynamicforms_fastapi_viewsets-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: dynamicforms-fastapi-viewsets
-Version: 0.7.3
+Version: 0.8.0
 Summary: Django REST Framework-style viewsets for FastAPI, with optional Celery-backed async execution and a Vue/TypeScript client counterpart.
 Project-URL: Homepage, https://github.com/dynamicforms/fastapi-viewsets
 Project-URL: Repository, https://github.com/dynamicforms/fastapi-viewsets
@@ -23,7 +23,7 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Requires-Dist: fastapi>=0.100
-Requires-Dist: pydantic>=2.1
+Requires-Dist: pydantic>=2.11
 Requires-Dist: typing-extensions>=4.10
 Provides-Extra: celery
 Requires-Dist: celery>=5.3; extra == 'celery'
@@ -99,7 +99,7 @@ pip install "dynamicforms-fastapi-viewsets[muxws]"
 pip install "dynamicforms-fastapi-viewsets[django]"
 ```
 
-Requires Python 3.10+, FastAPI and Pydantic v2.
+Requires Python 3.10+, FastAPI and Pydantic 2.11+.
 
 ## Quick example
 

{dynamicforms_fastapi_viewsets-0.7.3 → dynamicforms_fastapi_viewsets-0.8.0}/README.md

@@ -48,7 +48,7 @@ pip install "dynamicforms-fastapi-viewsets[muxws]"
 pip install "dynamicforms-fastapi-viewsets[django]"
 ```
 
-Requires Python 3.10+, FastAPI and Pydantic v2.
+Requires Python 3.10+, FastAPI and Pydantic 2.11+.
 
 ## Quick example
 

dynamicforms_fastapi_viewsets-0.8.0/fastapi_viewsets/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.8.0"

{dynamicforms_fastapi_viewsets-0.7.3 → dynamicforms_fastapi_viewsets-0.8.0}/fastapi_viewsets/backends/django_orm.py

@@ -26,8 +26,11 @@ from functools import reduce
 from typing import Any, ClassVar, Generic, TYPE_CHECKING
 
 from asgiref.sync import sync_to_async
+from django.db import router, transaction
 from django.db.models import BooleanField, F, Func, Q, Value
-from pydantic import BaseModel
+from django.db.models.fields import AutoFieldMixin
+from fastapi.exceptions import RequestValidationError
+from pydantic import BaseModel, ValidationError
 from typing_extensions import TypeVar
 
 from ..context import Context
@@ -68,12 +71,35 @@ T = TypeVar("T", bound=BaseModel)
 
 
 class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
+    """
+    A relation field - `ForeignKey`, `OneToOneField` - appears in `schema` under its `name` and
+    carries the related row's key: `owner: int`, not `owner_id: int` and not a nested model. The
+    backend reads and writes the `owner_id` column for it, filters and sorts on that column, and
+    never loads the related row. A `schema` that declares the column name (`owner_id`) raises
+    `TypeError` when the viewset class is defined.
+    """
+
     model: ClassVar[type["Model"]]
     """The Django model this viewset reads and writes."""
 
     schema: ClassVar[type[BaseModel]]
     """The pydantic model rows are converted into on the way out."""
 
+    def __init_subclass__(cls, **kwargs):
+        super().__init_subclass__(**kwargs)
+        model = getattr(cls, "model", None)
+        declared = getattr(getattr(cls, "schema", None), "model_fields", None)
+        if model is None or declared is None:
+            return
+        columns = [field for field in _model_columns(model) if field.attname != field.name]
+        for field in columns:
+            if field.attname in declared:
+                raise TypeError(
+                    f"{cls.__name__}: {cls.schema.__name__} declares `{field.attname}`, the column of "
+                    f"{model.__name__}.{field.name}. Declare the relation as `{field.name}`; it carries "
+                    f"the related row's key."
+                )
+
     pk_field: ClassVar[str] = "pk"
     """
     The lookup `_get_or_404` hands to `aget()` when a record is fetched by its key. `pk` is Django's
@@ -93,9 +119,8 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
         client's own filters with it, to the in-memory pass, and emit a position read off a field
         that is not there.
 
-        `_meta.pk` offers two such names, and the first that `schema` declares wins: `name`, and
-        `attname` for a relation primary key, which is `owner` on the model and `owner_id` on the
-        response model. Neither on the schema means the schema names the key something else - a
+        That name is `_meta.pk.name`, also for a relation primary key (`artist`, carrying the
+        related row's key). A `schema` without it names the key something else - a
         multi-table-inheritance child, whose `_meta.pk` is the parent link - and the default
         declared further along the MRO stands.
 
@@ -117,11 +142,8 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
             )
 
         declared = getattr(getattr(self, "schema", None), "model_fields", None)
-        if declared is None:
+        if declared is None or pk.name in declared:
             return pk.name
-        for name in (pk.name, pk.attname):
-            if name in declared:
-                return name
         return super().pk_field_name
 
     def get_queryset(self, context: Context) -> "QuerySet":  # noqa: ARG002 - for overrides to narrow per user
@@ -144,11 +166,24 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
         because the in-memory pass goes through `land()`, which converts what it materialises. Every
         one of those rows and its pydantic model are held at once, before the page is cut, so
         `limit=10` against a table of hundreds of thousands of rows can exhaust memory.
+
+        A relation field is read from its column (`owner_id` for `owner`), so the related row is
+        never fetched.
         """
         if isinstance(raw, self.schema):
             return raw
+        if isinstance(raw, self.model):
+            raw = _ColumnView(raw, self._columns())
         return self.schema.model_validate(raw, from_attributes=True)
 
+    def _columns(self) -> dict[str, str]:
+        """Relation field name to the name of its column: `{"owner": "owner_id"}`."""
+        return {field.name: field.attname for field in _model_columns(self.model) if field.attname != field.name}
+
+    def _column(self, name: str) -> str:
+        """The column a query uses for the schema field `name`."""
+        return self._columns().get(name, name)
+
     # -----------------------------------------------------------------------
     # List pipeline
     # -----------------------------------------------------------------------
@@ -175,7 +210,7 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
 
         filter_set = filter_set_for(query)
         if not filter_set and filters_from(query.fltr) is None:
-            # A hand-written filter model, on the older filter_list path. Nothing declarative to
+            # A hand-written filter model, on the filter_list path. Nothing declarative to
             # translate, so the in-memory pass takes it.
             return await super().apply_filter(context, query, records)
 
@@ -189,18 +224,8 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
         return await super().apply_filter(context, query, queryset)
 
     def _concrete_fields(self) -> set[str]:
-        """
-        Every name that names a column in a query, both halves of a relation's pair: a foreign key
-        is `author` and `author_id`, and both are lookups Django accepts. The response model
-        carries the second, so leaving it out would decline push-down for a schema field that maps
-        to a column perfectly well.
-        """
-        names = set()
-        for field in self.model._meta.get_fields():
-            if getattr(field, "concrete", False):
-                names.add(field.name)
-                names.add(field.attname)
-        return names
+        """The schema field names that map to a column: every concrete field's `name`."""
+        return {field.name for field in _model_columns(self.model)}
 
     async def apply_sort(self, context: Context, query: ListQuery, records: ListRecords) -> ListRecords:
         """
@@ -226,7 +251,7 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
             descending = column.direction == SortDirection.desc
             first = self.nulls_first != descending
             placement = {"nulls_first": True} if first else {"nulls_last": True}
-            field = F(column.column_name)
+            field = F(self._column(column.column_name))
             ordering.append(field.desc(**placement) if descending else field.asc(**placement))
         queryset = queryset.order_by(*ordering)
         query.mark_applied("sort")
@@ -264,24 +289,78 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
         return self.to_record(await self._get_or_404(context, pk))
 
     async def perform_create(self, context: Context, data: T) -> T:  # noqa: ARG002
-        instance = await self.model.objects.acreate(**self._writable_fields(data))
+        instance = await self.model.objects.acreate(**self._writable_fields(data, creating=True))
         return self.to_record(instance)
 
     async def perform_bulk_create(self, context: Context, data: list[T]) -> list[T]:  # noqa: ARG002
-        instances = [self.model(**self._writable_fields(record)) for record in data]
+        instances = [self.model(**self._writable_fields(record, creating=True)) for record in data]
         created = await sync_to_async(self.model.objects.bulk_create)(instances)
         return [self.to_record(instance) for instance in created]
 
     async def perform_update(self, context: Context, pk: K, data: T, partial: bool = True) -> T:
-        instance = await self._get_or_404(context, pk)
-        fields = self._writable_fields(data, exclude_unset=partial)
-        for name, value in fields.items():
-            setattr(instance, name, value)
-        await instance.asave()
-        return self.to_record(instance)
+        """
+        Writes `data` onto the row `pk` under a row lock; see `_update_locked`. A merged record that
+        fails `schema` raises `RequestValidationError` with `loc` `("body", *field)`.
+        """
+        (record,) = await sync_to_async(self._update_locked)(context, {pk: data}, partial, bulk=False)
+        return record
 
     async def perform_bulk_update(self, context: Context, records: dict[K, T], partial: bool = True) -> list[T]:
-        return [await self.perform_update(context, pk, data, partial=partial) for pk, data in records.items()]
+        """
+        Writes every record in one transaction, under a lock on each row; see `_update_locked`. A
+        missing row or a merged record that fails `schema` writes none of them. Every failing record
+        is reported in one `RequestValidationError`, with `loc` `("body", pk, *field)`.
+        """
+        return await sync_to_async(self._update_locked)(context, records, partial, bulk=True)
+
+    def _update_locked(self, context: Context, records: dict[K, T], partial: bool, bulk: bool) -> list[T]:
+        """
+        Reads each row with `SELECT ... FOR UPDATE`, sets the fields of its record on it, validates
+        the result as `schema` and saves the whole row, in one transaction.
+
+        The lock holds the row from the read to the commit, so a concurrent update of the same row
+        waits and then reads this one's result: it neither reverts the fields this one wrote nor
+        validates against values that are no longer stored. Two updates of the same field still
+        end with the later one's value.
+
+        The rows are locked in key order, so two bulk updates over the same rows do not deadlock.
+        The lock is taken through `_base_manager`, a query on the model's table alone: `FOR UPDATE`
+        refuses `distinct()`, aggregation and a nullable `select_related`, any of which
+        `get_queryset` may add. `get_queryset` decides whether the row is visible, and a row it
+        excludes is a `NotFoundError`. On SQLite, which has no row locks, the write
+        transaction locks the database instead.
+
+        `save()` and the model's signals run inside the transaction, before the commit. Work they
+        start that reads the row over another connection (a Celery task) is scheduled with
+        `transaction.on_commit`; started directly, it can read the values from before the update.
+        """
+        locked = self.model._base_manager.db_manager(router.db_for_write(self.model)).select_for_update()
+        errors: list[dict] = []
+        rows = {}
+        with transaction.atomic(using=locked.db):
+            for pk in sorted(records):
+                try:
+                    instance = locked.get(**{self.pk_field: pk})
+                except self.model.DoesNotExist:
+                    raise NotFoundError(pk) from None
+                if not self.get_queryset(context).filter(pk=instance.pk).exists():
+                    raise NotFoundError(pk)
+                for name, value in self._writable_fields(records[pk], exclude_unset=partial).items():
+                    setattr(instance, name, value)
+                try:
+                    self.to_record(instance)
+                except ValidationError as error:
+                    prefix = ("body", pk) if bulk else ("body",)
+                    errors.extend(
+                        {**entry, "loc": (*prefix, *entry["loc"])}
+                        for entry in error.errors(include_url=False, include_input=False)
+                    )
+                rows[pk] = instance
+            if errors:
+                raise RequestValidationError(errors)
+            for instance in rows.values():
+                instance.save()
+        return [self.to_record(rows[pk]) for pk in records]
 
     async def perform_destroy(self, context: Context, pk: K) -> dict:
         instance = await self._get_or_404(context, pk)
@@ -301,18 +380,51 @@ class DjangoORMViewSet(ImplMixin[K, T], Generic[K, T]):
         except ObjectDoesNotExist:
             raise NotFoundError(pk) from None
 
-    def _writable_fields(self, data: T, exclude_unset: bool = False) -> dict[str, Any]:
+    def _writable_fields(self, data: T, exclude_unset: bool = False, creating: bool = False) -> dict[str, Any]:
         """
-        The model's own fields, minus the primary key - the database assigns that, and letting a
-        request body set it is how you overwrite somebody else's row.
+        The fields of `data` that are concrete model fields, keyed by column (`owner_id` for
+        `owner`), so a relation is set from the key the body carries.
+
+        The primary key is left out of an update: saving an instance under a different key writes
+        to the row that key names. A create leaves out only a key the database or Django assigns -
+        an auto-incrementing field, or the parent link of a multi-table-inheritance child - and
+        keeps any other: a natural key or a relation primary key has no value unless the body
+        supplies it.
         """
         editable = {
-            field.name
-            for field in self.model._meta.get_fields()
-            if getattr(field, "concrete", False) and not getattr(field, "primary_key", False)
+            field.name: field.attname
+            for field in _model_columns(self.model)
+            if not field.primary_key or (creating and not _assigned_key(field))
         }
         dumped = data.model_dump(exclude_unset=exclude_unset) if hasattr(data, "model_dump") else dict(data)
-        return {name: value for name, value in dumped.items() if name in editable}
+        return {editable[name]: value for name, value in dumped.items() if name in editable}
+
+
+def _model_columns(model: type["Model"]) -> list:
+    """The model's fields that are columns, the composite primary key excluded."""
+    return [field for field in model._meta.concrete_fields if not isinstance(field, _COMPOSITE_PK)]
+
+
+def _assigned_key(field) -> bool:
+    """Whether a primary key `field` gets its value from the database or from Django on save."""
+    remote = getattr(field, "remote_field", None)
+    return isinstance(field, AutoFieldMixin) or bool(remote and getattr(remote, "parent_link", False))
+
+
+class _ColumnView:
+    """
+    A model instance as `to_record` reads it: a relation field's name answers with its column's
+    value, every other attribute with the instance's own.
+    """
+
+    __slots__ = ("_columns", "_row")
+
+    def __init__(self, row: "Model", columns: dict[str, str]):
+        self._row = row
+        self._columns = columns
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._row, self._columns.get(name, name))
 
 
 def _as_queryset(records: ListRecords) -> "QuerySet | None":
@@ -358,8 +470,8 @@ viewset using it falls back to the in-memory pass - which is the contract workin
 """
 
 
-def _compile_lookup(_viewset, fltr, queryset):
-    return queryset.filter(**{f"{fltr.field}__{_LOOKUPS[type(fltr)]}": fltr.value})
+def _compile_lookup(viewset, fltr, queryset):
+    return queryset.filter(**{f"{viewset._column(fltr.field)}__{_LOOKUPS[type(fltr)]}": fltr.value})
 
 
 for _filter_type in _LOOKUPS:
@@ -412,14 +524,15 @@ def _cursor_condition(viewset: "DjangoORMViewSet", fltr: CursorPredicate) -> Q:
     this, is Postgres-only, and a row constructor fails outright if annotated rather than used
     directly as a condition.
     """
-    keys = fltr.keys
-    nullable = {field.name for field in viewset.model._meta.get_fields() if getattr(field, "null", False)}
+    keys = [(viewset._column(name), descending) for name, descending in fltr.keys]
+    position = {viewset._column(name): value for name, value in fltr.position.items()}
+    nullable = {field.attname for field in _model_columns(viewset.model) if field.null}
     uniform = len({descending for _, descending in keys}) == 1
     if uniform and not fltr.inclusive and not any(name in nullable for name, _ in keys):
-        return _row_value_condition(keys, fltr.position, fltr.backwards)
+        return _row_value_condition(keys, position, fltr.backwards)
     return _segment_condition(
         keys,
-        fltr.position,
+        position,
         fltr.backwards,
         fltr.inclusive,
         fltr.nulls_first,

{dynamicforms_fastapi_viewsets-0.7.3 → dynamicforms_fastapi_viewsets-0.8.0}/fastapi_viewsets/collection_viewset.py

@@ -1,3 +1,5 @@
+import dataclasses
+
 from abc import ABC, abstractmethod
 from collections.abc import Callable, Iterable, MutableMapping, MutableSequence, MutableSet
 from typing import Any, Generic, TypeVar
@@ -5,7 +7,7 @@ from typing import Any, Generic, TypeVar
 from pydantic import BaseModel
 
 from .context import Context
-from .exceptions import NotFoundError
+from .exceptions import NotFoundError, ReadOnlyCollectionError
 from .mixins import ImplMixin
 
 T = TypeVar("T")
@@ -94,7 +96,7 @@ class CollectionViewSet(AsyncCollectionViewSet[K, T]):
             elif isinstance(container, MutableSet):
                 self._add_func = container.add
                 self._update_func = self._update_set
-                self._delete_func = container.remove
+                self._delete_func = self._delete_set
             elif isinstance(container, MutableMapping):
                 self._add_func = self._add_mapping
                 self._update_func = self._update_mapping
@@ -102,23 +104,36 @@ class CollectionViewSet(AsyncCollectionViewSet[K, T]):
 
     def _check_mutable(self):
         if not self.is_mutable:
-            raise Exception("Provided container is not mutable")
+            raise ReadOnlyCollectionError()
 
     def _get_pk(self, item: T) -> K:
         if isinstance(item, dict):
             return item[self.pk_field]
         return getattr(item, self.pk_field)
 
+    @staticmethod
+    def _stated_fields(data: T) -> dict[str, Any]:
+        """The fields a partial update states: those a model has set, or a dict's keys."""
+        if isinstance(data, BaseModel):
+            return {name: getattr(data, name) for name in data.model_fields_set}
+        return dict(data)
+
+    def _apply_partial(self, item: T, data: T) -> T:
+        """`item` with the fields `data` states written onto it, in place."""
+        fields = self._stated_fields(data)
+        if isinstance(item, dict):
+            item.update(fields)
+        else:
+            for key, value in fields.items():
+                setattr(item, key, value)
+        return item
+
     # Sequence helpers
     def _update_sequence(self, pk: K, data: T, partial: bool):
         for i, item in enumerate(self.container):
             if self._get_pk(item) == pk:
                 if partial:
-                    if isinstance(item, dict):
-                        item.update(data)
-                    else:
-                        for key, value in data.items():
-                            setattr(item, key, value)
+                    self._apply_partial(item, data)
                 else:
                     self.container[i] = data
                 return self.container[i]
@@ -132,19 +147,24 @@ class CollectionViewSet(AsyncCollectionViewSet[K, T]):
         raise NotFoundError(pk)
 
     # Set helpers
-    def _update_set(
-        self,
-        pk: K,
-        data: T,
-        partial: bool,  # noqa: ARG002 - `container_update` passes `(pk, data, partial)` whichever helper is bound
-    ):
+    def _update_set(self, pk: K, data: T, partial: bool):
+        # an item of a set is hashable, so it is replaced rather than changed in place
         for item in self.container:
             if self._get_pk(item) == pk:
+                if partial:
+                    data = _replaced(item, self._stated_fields(data))
                 self.container.remove(item)
-                self.container.add(data)  # Sets don't really support partial update easily without mutation
+                self.container.add(data)
                 return data
         raise NotFoundError(pk)
 
+    def _delete_set(self, pk: K):
+        for item in self.container:
+            if self._get_pk(item) == pk:
+                self.container.remove(item)
+                return
+        raise NotFoundError(pk)
+
     # Mapping helpers
     def _add_mapping(self, data: T):
         pk = self._get_pk(data)
@@ -154,12 +174,7 @@ class CollectionViewSet(AsyncCollectionViewSet[K, T]):
         if pk not in self.container:
             raise NotFoundError(pk)
         if partial:
-            item = self.container[pk]
-            if isinstance(item, dict):
-                item.update(data)
-            else:
-                for key, value in data.items():
-                    setattr(item, key, value)
+            self._apply_partial(self.container[pk], data)
         else:
             self.container[pk] = data
         return self.container[pk]
@@ -220,3 +235,17 @@ class CollectionViewSet(AsyncCollectionViewSet[K, T]):
             self._delete_func(pk)
         except KeyError as e:
             raise NotFoundError(pk) from e
+
+
+def _replaced(item: Any, fields: dict[str, Any]) -> Any:
+    """A copy of the hashable `item` with `fields` written onto it: a pydantic model, a named tuple
+    or a dataclass."""
+    if isinstance(item, BaseModel):
+        return item.model_copy(update=fields)
+    if hasattr(item, "_replace"):
+        return item._replace(**fields)
+    if dataclasses.is_dataclass(item):
+        return dataclasses.replace(item, **fields)
+    raise TypeError(
+        f"{type(item).__name__} cannot be updated partially: it is neither a model, a named tuple nor a dataclass"
+    )

{dynamicforms_fastapi_viewsets-0.7.3 → dynamicforms_fastapi_viewsets-0.8.0}/fastapi_viewsets/conf.py

@@ -35,14 +35,14 @@ class Settings:
         self.default_list_shape: str = "plain"
         """
         The shape a list endpoint answers in when the viewset does not say - "plain", "paginated"
-        or "cursor". Left at "plain" so that adding this setting changed nothing for anybody;
-        an application that pages everything sets it once here instead of on every viewset.
+        or "cursor". An application that pages everything sets it once here instead of on every
+        viewset.
         """
         self.viewsets_register_muxws: bool = True
         """
         Whether a viewset is reachable over the muxws transport (see fastapi_viewsets/mux_ws/) when
         it does not say either way itself. `route_viewset(register_muxws=...)` overrides this per
-        viewset, and `muxws_endpoint(register_muxws=...)` overrides it again per endpoint - each
+        viewset, and `@transports(muxws=...)` overrides it again per endpoint - each
         level only decides for the levels below it that left the question open (None). Read at
         decoration time, so it must be set before any viewset class is decorated.
         """
@@ -51,8 +51,8 @@ class Settings:
         Purely for OpenAPI/Swagger discoverability (a lock icon + testable Authorize flow) - attached
         as an extra sub-dependency alongside the per-route Middleware.depends() bridge (see
         route_viewset.py), not otherwise consumed by this library. Must be set before any viewset
-        class is decorated with route_viewset (same existing constraint as
-        disable_response_model=bool(settings.viewsets_command_middleware) already has).
+        class is decorated with route_viewset, as `viewsets_command_middleware` must, which decides
+        `disable_response_model` when the routes are built.
         """
 
 

{dynamicforms_fastapi_viewsets-0.7.3 → dynamicforms_fastapi_viewsets-0.8.0}/fastapi_viewsets/context/__init__.py

@@ -7,6 +7,7 @@ from abc import ABC, abstractmethod
 from typing import Any, TYPE_CHECKING
 
 from pydantic import BaseModel
+from pydantic_core import to_jsonable_python
 
 from ..conf import settings
 
@@ -318,19 +319,22 @@ def serialize_value(value: Any) -> Any:
 def to_jsonable(value: Any) -> Any:
     """
     Recursively convert a value into a JSON-safe structure: a SerializableObject is tagged (see
-    serialize_value()), a Pydantic model is dumped, a list/tuple is recursed into element-wise -
-    anything else passes through unchanged. The one shared implementation of a conversion several
-    call sites need on their own single (non-Context, non-dict) return/body value - ViewSetResult's
-    own (de)serialization, and a celery_viewset worker's task result - rather than each keeping a
-    slightly different copy that drifts out of sync with what the others handle.
+    serialize_value()), a Pydantic model is dumped, a dict is recursed into value-wise, a
+    list/tuple element-wise, and any other value goes through pydantic_core.to_jsonable_python()
+    (datetime, Decimal, UUID, Enum, set, dataclass, ...) - the encoding FastAPI's response
+    serialization applies to the same value on REST/muxws. Shared by ViewSetResult's own
+    serialization and celery_viewset's worker/client payloads. from_jsonable() is its inverse for
+    tagged objects.
     """
     if isinstance(value, SerializableObject):
         return serialize_value(value)
     if isinstance(value, BaseModel):
         return value.model_dump(mode="json")
+    if isinstance(value, dict):
+        return {k: to_jsonable(v) for k, v in value.items()}
     if isinstance(value, (list, tuple)):
         return [to_jsonable(v) for v in value]
-    return value
+    return to_jsonable_python(value)
 
 
 def deserialize_value(value: Any) -> Any:
@@ -340,6 +344,21 @@ def deserialize_value(value: Any) -> Any:
     return value
 
 
+def from_jsonable(value: Any) -> Any:
+    """
+    Inverse of to_jsonable() for tagged objects: reconstructs every tagged SerializableObject,
+    at any depth of dicts and lists. A Pydantic model and any other value to_jsonable() encoded
+    stay in their JSON form.
+    """
+    if isinstance(value, dict):
+        if _TYPE_KEY in value and _VALUE_KEY in value:
+            return deserialize_value(value)
+        return {k: from_jsonable(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [from_jsonable(v) for v in value]
+    return value
+
+
 async def serialize_context(data: dict[str, Any]) -> dict[str, Any]:
     """
     Returns a JSON-safe dict: SerializableObject values are swapped for a tagged payload (see
@@ -395,8 +414,7 @@ async def build_context(
     processor that wants its own configuration slice declares a parameter literally named `config`
     (detected by name, same convention as `context` in route_viewset.py); it's then called with
     that keyword set to its own resolved entry from `action_configuration` (or None if nothing was
-    configured for it). A processor that doesn't declare `config` is called exactly as before - no
-    existing processor needs to change.
+    configured for it). A processor that doesn't declare `config` is called without it.
     """
     action_configuration = action_configuration or {}
     merged: dict[str, Any] = {}

{dynamicforms_fastapi_viewsets-0.7.3 → dynamicforms_fastapi_viewsets-0.8.0}/fastapi_viewsets/context/auth/jwt.py

@@ -2,6 +2,7 @@ import datetime
 
 from typing import Any, TYPE_CHECKING
 
+from ...conf import settings
 from .. import LazyObject
 from . import AuthBackend
 
@@ -14,30 +15,41 @@ class _JWTUserLazy(LazyObject):
     resolve() is sync and needs no I/O - signature+expiry verification is cheap, local computation
     (unlike DjangoSessionAuthBackend, there's no session store to hit). Uses the default
     recipe+resolved_value shortcut (see LazyObject) since decoded claims are already JSON-safe.
+
+    The recipe carries the token and the position of the verifying backend in
+    `settings.viewsets_auth_processors`, never the secret: a Celery worker, configured with the same
+    settings, verifies the token with its own copy of that backend. Where that position holds no
+    `JWTAuthBackend`, the token resolves to None.
     """
 
-    def __init__(self, token: str, secret: str, algorithm: str):
+    def __init__(self, token: str, backend: "JWTAuthBackend | None"):
         super().__init__()
         self._token = token
-        self._secret = secret
-        self._algorithm = algorithm
+        self._backend = backend
 
     def resolve(self) -> Any:
         import jwt as pyjwt
 
+        if self._backend is None:
+            return None
         try:
-            return pyjwt.decode(self._token, self._secret, algorithms=[self._algorithm])
+            return pyjwt.decode(self._token, self._backend.secret, algorithms=[self._backend.algorithm])
         except pyjwt.PyJWTError:
             # expired/invalid signature - same "recognized shape, invalid credential" case as
             # DjangoSessionAuthBackend
             return None
 
     def serialize_recipe(self) -> Any:
-        return {"token": self._token, "secret": self._secret, "algorithm": self._algorithm}
+        processors = settings.viewsets_auth_processors
+        position = next((i for i, backend in enumerate(processors) if backend is self._backend), None)
+        return {"token": self._token, "backend": position}
 
     @classmethod
     def deserialize_recipe(cls, data: Any) -> "_JWTUserLazy":
-        return cls(data["token"], data["secret"], data["algorithm"])
+        processors = settings.viewsets_auth_processors
+        position = data.get("backend")
+        backend = processors[position] if isinstance(position, int) and 0 <= position < len(processors) else None
+        return cls(data["token"], backend if isinstance(backend, JWTAuthBackend) else None)
 
 
 class JWTAuthBackend(AuthBackend):
@@ -64,7 +76,7 @@ class JWTAuthBackend(AuthBackend):
         header = request.headers.get(self.header_name, "")
         if not header.lower().startswith("bearer "):
             return None  # not a bearer token - let the next backend try it
-        return _JWTUserLazy(header[len("bearer ") :].strip(), self.secret, self.algorithm)
+        return _JWTUserLazy(header[len("bearer ") :].strip(), self)
 
 
 def encode_jwt(