fastadmin 0.3.3__tar.gz → 0.3.5__tar.gz

{fastadmin-0.3.3 → fastadmin-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastadmin
-Version: 0.3.3
+Version: 0.3.5
 Summary: FastAdmin is an easy-to-use Admin Dashboard App for FastAPI/Flask/Django inspired by Django Admin.
 License: MIT
 License-File: LICENSE
@@ -42,7 +42,7 @@ Description-Content-Type: text/markdown
 
 # Admin Dashboard for FastAPI / Flask / Django
 
-[![codecov](https://codecov.io/gh/vsdudakov/fastadmin/branch/main/graph/badge.svg?token=RNGX5HOW3T)](https://codecov.io/gh/vsdudakov/fastadmin)
+[![codecov](https://codecov.io/gh/vsdudakov/fastadmin/branch/main/graph/badge.svg?token=RNGX5HOW3T)](https://app.codecov.io/gh/vsdudakov/fastadmin)
 [![License](https://img.shields.io/github/license/vsdudakov/fastadmin)](https://github.com/vsdudakov/fastadmin/blob/master/LICENSE)
 [![PyPi](https://badgen.net/pypi/v/fastadmin)](https://pypi.org/project/fastadmin/)
 [![Python 3.12](https://img.shields.io/badge/python-3.12-blue.svg)](https://www.python.org/downloads/release/python-3120/)

{fastadmin-0.3.3 → fastadmin-0.3.5}/README.md

@@ -1,6 +1,6 @@
 # Admin Dashboard for FastAPI / Flask / Django
 
-[![codecov](https://codecov.io/gh/vsdudakov/fastadmin/branch/main/graph/badge.svg?token=RNGX5HOW3T)](https://codecov.io/gh/vsdudakov/fastadmin)
+[![codecov](https://codecov.io/gh/vsdudakov/fastadmin/branch/main/graph/badge.svg?token=RNGX5HOW3T)](https://app.codecov.io/gh/vsdudakov/fastadmin)
 [![License](https://img.shields.io/github/license/vsdudakov/fastadmin)](https://github.com/vsdudakov/fastadmin/blob/master/LICENSE)
 [![PyPi](https://badgen.net/pypi/v/fastadmin)](https://pypi.org/project/fastadmin/)
 [![Python 3.12](https://img.shields.io/badge/python-3.12-blue.svg)](https://www.python.org/downloads/release/python-3120/)

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/api/frameworks/django/app/api.py

@@ -64,6 +64,7 @@ async def sign_in(request: HttpRequest) -> JsonResponse:
         session_id = await api_service.sign_in(
             request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None),
             payload,
+            request=request,
         )
 
         response = JsonResponse({})
@@ -111,7 +112,10 @@ async def me(request: HttpRequest) -> JsonResponse:
         if not user_id:
             raise AdminApiException(401, "User is not authenticated.")
         obj = await api_service.get(
-            request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None), settings.ADMIN_USER_MODEL, user_id
+            request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None),
+            settings.ADMIN_USER_MODEL,
+            user_id,
+            request=request,
         )
         return JsonResponse(obj)
 
@@ -143,6 +147,7 @@ async def dashboard_widget(request: HttpRequest, model: str) -> JsonResponse:
             min_x_field=min_x_field,
             max_x_field=max_x_field,
             period_x_field=period_x_field,
+            request=request,
         )
         return JsonResponse(data)
     except AdminApiException as e:
@@ -182,6 +187,7 @@ async def list_objs(request: HttpRequest, model: str) -> JsonResponse:
             filters=list_filters,
             offset=offset,
             limit=limit,
+            request=request,
         )
         return JsonResponse(
             {
@@ -212,6 +218,7 @@ async def get(request: HttpRequest, model: str, id: UUID | int | str) -> JsonRes
             request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             id,
+            request=request,
         )
         return JsonResponse(obj)
 
@@ -234,6 +241,7 @@ async def add(request: HttpRequest, model: str) -> JsonResponse:
             request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             json.loads(request.body),
+            request=request,
         )
         return JsonResponse(obj)
     except AdminApiException as e:
@@ -257,6 +265,7 @@ async def change_password(request: HttpRequest, id: UUID | int | str) -> JsonRes
             request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None),
             id,
             json.loads(request.body),
+            request=request,
         )
         return JsonResponse(id, safe=False)
 
@@ -283,6 +292,7 @@ async def change(request: HttpRequest, model: str, id: UUID | int | str) -> Json
             model,
             id,
             json.loads(request.body),
+            request=request,
         )
         return JsonResponse(obj)
 
@@ -319,6 +329,7 @@ async def export(request: HttpRequest, model: str) -> JsonResponse:
             search=search,
             sort_by=sort_by,
             filters=list_filters,
+            request=request,
         )
         response = StreamingHttpResponse(stream, content_type=content_type)
         response.headers["Content-Disposition"] = f'attachment; filename="{file_name}"'
@@ -349,6 +360,7 @@ async def delete(
             request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             id,
+            request=request,
         )
         return JsonResponse(deleted_id, safe=False)
 
@@ -378,6 +390,7 @@ async def action(
             model,
             action,
             payload,
+            request=request,
         )
         return JsonResponse({})
 
@@ -397,5 +410,6 @@ async def configuration(request: HttpRequest) -> JsonResponse:
 
     obj = await api_service.get_configuration(
         request.COOKIES.get(settings.ADMIN_SESSION_ID_KEY, None),
+        request=request,
     )
     return JsonResponse(asdict(obj))

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/api/frameworks/fastapi/api.py

@@ -35,6 +35,7 @@ async def sign_in(
         session_id = await api_service.sign_in(
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             payload,
+            request=request,
         )
 
         response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
@@ -78,7 +79,10 @@ async def me(
         if not user_id:
             raise AdminApiException(401, "User is not authenticated.")
         return await api_service.get(
-            request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None), settings.ADMIN_USER_MODEL, user_id
+            request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
+            settings.ADMIN_USER_MODEL,
+            user_id,
+            request=request,
         )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
@@ -107,6 +111,7 @@ async def dashboard_widget(
             min_x_field=min_x_field,
             max_x_field=max_x_field,
             period_x_field=period_x_field,
+            request=request,
         )
         return data
     except AdminApiException as e:
@@ -146,6 +151,7 @@ async def list_objs(
             filters=list_filters,
             offset=offset,
             limit=limit,
+            request=request,
         )
         return {
             "total": total,
@@ -172,6 +178,7 @@ async def get(
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             id,
+            request=request,
         )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
@@ -194,6 +201,7 @@ async def add(
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             payload,
+            request=request,
         )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
@@ -212,7 +220,12 @@ async def change_password(
     :return: An object.
     """
     try:
-        await api_service.change_password(request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None), id, payload)
+        await api_service.change_password(
+            request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
+            id,
+            payload,
+            request=request,
+        )
         return id
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
@@ -233,7 +246,13 @@ async def change(
     :return: An object.
     """
     try:
-        return await api_service.change(request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None), model, id, payload)
+        return await api_service.change(
+            request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
+            model,
+            id,
+            payload,
+            request=request,
+        )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
 
@@ -268,6 +287,7 @@ async def export(
             search=search,
             sort_by=sort_by,
             filters=list_filters,
+            request=request,
         )
         headers = {"Content-Disposition": f'attachment; filename="{file_name}"'}
         return StreamingResponse(
@@ -296,6 +316,7 @@ async def delete(
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             id,
+            request=request,
         )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
@@ -321,6 +342,7 @@ async def action(
             model,
             action,
             payload,
+            request=request,
         )
     except AdminApiException as e:
         raise HTTPException(e.status_code, detail=e.detail) from None
@@ -337,4 +359,5 @@ async def configuration(
     """
     return await api_service.get_configuration(
         request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
+        request=request,
     )

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/api/frameworks/flask/api.py

@@ -30,6 +30,7 @@ async def sign_in() -> Response:
         session_id = await api_service.sign_in(
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             payload,
+            request=request,
         )
         response = make_response({})
         response.set_cookie(settings.ADMIN_SESSION_ID_KEY, value=session_id, httponly=True)
@@ -74,7 +75,10 @@ async def me() -> dict:
         if not user_id:
             raise AdminApiException(401, "User is not authenticated.")
         return await api_service.get(
-            request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None), settings.ADMIN_USER_MODEL, user_id
+            request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
+            settings.ADMIN_USER_MODEL,
+            user_id,
+            request=request,
         )
     except AdminApiException as e:
         http_exception = HTTPException(e.detail)
@@ -104,6 +108,7 @@ async def dashboard_widget(model: str) -> dict:
             min_x_field=min_x_field,
             max_x_field=max_x_field,
             period_x_field=period_x_field,
+            request=request,
         )
         return data
     except AdminApiException as e:
@@ -142,6 +147,7 @@ async def list_objs(model: str) -> dict:
             filters=list_filters,
             offset=offset,
             limit=limit,
+            request=request,
         )
         return {
             "total": total,
@@ -174,6 +180,7 @@ async def get(model: str, id: UUID | int | str) -> dict:
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             id,
+            request=request,
         )
     except AdminApiException as e:
         http_exception = HTTPException(e.detail)
@@ -195,6 +202,7 @@ async def add(model: str) -> dict:
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             payload,
+            request=request,
         )
     except AdminApiException as e:
         http_exception = HTTPException(e.detail)
@@ -220,6 +228,7 @@ async def change_password(id: UUID | int | str) -> UUID | int | str:
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             id,
             payload,
+            request=request,
         )
         return id
     except AdminApiException as e:
@@ -248,6 +257,7 @@ async def change(model: str, id: UUID | int | str) -> dict:
             model,
             id,
             payload,
+            request=request,
         )
     except AdminApiException as e:
         http_exception = HTTPException(e.detail)
@@ -283,6 +293,7 @@ async def export(model: str) -> Response:
             search=search,
             sort_by=sort_by,
             filters=list_filters,
+            request=request,
         )
         response = Response(stream, mimetype=content_type)
         response.headers["Content-Disposition"] = f'attachment; filename="{file_name}"'
@@ -313,6 +324,7 @@ async def delete(
             request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
             model,
             id,
+            request=request,
         )
     except AdminApiException as e:
         http_exception = HTTPException(e.detail)
@@ -340,6 +352,7 @@ async def action(
             model,
             action,
             payload,
+            request=request,
         )
         return {}
     except AdminApiException as e:
@@ -357,5 +370,6 @@ async def configuration() -> dict:
     """
     obj = await api_service.get_configuration(
         request.cookies.get(settings.ADMIN_SESSION_ID_KEY, None),
+        request=request,
     )
     return asdict(obj)

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/api/service.py

@@ -36,6 +36,14 @@ from fastadmin.settings import settings
 logger = logging.getLogger(__name__)
 
 
+def is_allowed_field_or_path(field: str, allowed_fields: set[str]) -> bool:
+    """Allow direct fields and nested paths from allowed base fields."""
+    if field in allowed_fields:
+        return True
+    base_field = field.split("__", 1)[0]
+    return base_field in allowed_fields
+
+
 def convert_id(id: str | int | UUID) -> int | UUID | None:
     """Convert the given id to int or UUID.
 
@@ -94,10 +102,31 @@ async def get_user_id_from_session_id(session_id: str | None) -> UUID | int | No
 
 
 class ApiService:
+    @staticmethod
+    def _bind_admin_context(
+        admin_model: ModelAdmin | InlineModelAdmin | Any, request: Any | None, user: Any | None
+    ) -> None:
+        if hasattr(admin_model, "set_context"):
+            admin_model.set_context(request=request, user=user)
+
+    async def _get_authenticated_user(self, session_id: str | None) -> tuple[UUID | int, Any | None]:
+        current_user_id = await get_user_id_from_session_id(session_id)
+        if not current_user_id:
+            raise AdminApiException(401, detail="User is not authenticated.")
+
+        admin_user_model = get_admin_model(settings.ADMIN_USER_MODEL)
+        current_user = (
+            await admin_user_model.get_obj(current_user_id)
+            if admin_user_model and hasattr(admin_user_model, "get_obj")
+            else None
+        )
+        return current_user_id, current_user
+
     async def sign_in(
         self,
         session_id: str | None,
         payload: SignInInputSchema,
+        request: Any | None = None,
     ) -> str:
         model = settings.ADMIN_USER_MODEL
         admin_model = get_admin_model(model)
@@ -110,6 +139,7 @@ class ApiService:
         else:
             authenticate_fn = sync_to_async(admin_model.authenticate)  # type: ignore [arg-type]
 
+        self._bind_admin_context(admin_model, request=request, user=None)
         user_id = await authenticate_fn(payload.username, payload.password)
 
         if not user_id or not isinstance(user_id, int | UUID):
@@ -131,10 +161,9 @@ class ApiService:
     async def sign_out(
         self,
         session_id: str | None,
+        request: Any | None = None,
     ) -> bool:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, _current_user = await self._get_authenticated_user(session_id)
 
         return True
 
@@ -145,10 +174,9 @@ class ApiService:
         min_x_field: str | None = None,
         max_x_field: str | None = None,
         period_x_field: str | None = None,
+        request: Any | None = None,
     ) -> dict[str, str | int | float]:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         query_params = DashboardWidgetQuerySchema(
             min_x_field=min_x_field,
@@ -160,6 +188,8 @@ class ApiService:
         if not dashboard_widget_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
 
+        self._bind_admin_context(dashboard_widget_model, request=request, user=current_user)
+
         if inspect.iscoroutinefunction(dashboard_widget_model.get_data):
             get_data = dashboard_widget_model.get_data
         else:
@@ -182,10 +212,9 @@ class ApiService:
         filters: dict | None = None,
         offset: int | None = 0,
         limit: int | None = 10,
+        request: Any | None = None,
     ) -> tuple[list[dict], int]:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         query_params = ListQuerySchema(
             search=search,
@@ -198,13 +227,14 @@ class ApiService:
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
 
         # validations
-        fields = admin_model.get_fields_for_serialize()
+        fields = set(admin_model.get_fields_for_serialize())
 
         if query_params.search and admin_model.search_fields:
             for field in admin_model.search_fields:
-                if field not in fields:
+                if not is_allowed_field_or_path(field, fields):
                     raise AdminApiException(422, detail=f"Search by {field} is not allowed")
 
         exclude_filter_fields = ("search", "sort_by", "offset", "limit")
@@ -227,7 +257,7 @@ class ApiService:
                 raise AdminApiException(422, detail=f"Sort by {query_params.sort_by} is not allowed")
         elif admin_model.ordering:
             for ordering_field in admin_model.ordering:
-                if ordering_field.strip("-") not in fields:
+                if not is_allowed_field_or_path(ordering_field.strip("-"), fields):
                     raise AdminApiException(422, detail=f"Sort by {ordering_field} is not allowed")
 
         if admin_model.list_select_related:
@@ -248,14 +278,14 @@ class ApiService:
         session_id: str | None,
         model: str,
         id: UUID | int | str,
+        request: Any | None = None,
     ) -> dict:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
 
         try:
             obj = await admin_model.get_obj(id)
@@ -270,14 +300,14 @@ class ApiService:
         session_id: str | None,
         model: str,
         payload: dict,
+        request: Any | None = None,
     ) -> dict:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
         return await admin_model.save_model(None, payload)  # type: ignore [return-value]
 
     async def change_password(
@@ -285,14 +315,14 @@ class ApiService:
         session_id: str | None,
         id: UUID | int | str,
         payload: dict,
+        request: Any | None = None,
     ) -> None:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_model(settings.ADMIN_USER_MODEL)
         if not admin_model:
             raise AdminApiException(404, detail=f"{settings.ADMIN_USER_MODEL} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
 
         payload = ChangePasswordInputSchema(**payload)
         if payload.password != payload.confirm_password:
@@ -325,14 +355,14 @@ class ApiService:
         model: str,
         id: UUID | int | str,
         payload: dict,
+        request: Any | None = None,
     ) -> dict:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
 
         try:
             obj = await admin_model.save_model(id, payload)
@@ -350,10 +380,9 @@ class ApiService:
         search: str | None = None,
         sort_by: str | None = None,
         filters: dict | None = None,
+        request: Any | None = None,
     ) -> tuple[str, str, StringIO | BytesIO | None]:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         query_params = ListQuerySchema(
             search=search,
@@ -366,13 +395,14 @@ class ApiService:
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
 
         # validations
-        fields = admin_model.get_fields_for_serialize()
+        fields = set(admin_model.get_fields_for_serialize())
 
         if query_params.search and admin_model.search_fields:
             for field in admin_model.search_fields:
-                if field not in fields:
+                if not is_allowed_field_or_path(field, fields):
                     raise AdminApiException(422, detail=f"Search by {field} is not allowed")
 
         exclude_filter_fields = ("search", "sort_by", "offset", "limit")
@@ -395,7 +425,7 @@ class ApiService:
                 raise AdminApiException(422, detail=f"Sort by {query_params.sort_by} is not allowed")
         elif admin_model.ordering:
             for ordering_field in admin_model.ordering:
-                if ordering_field.strip("-") not in fields:
+                if not is_allowed_field_or_path(ordering_field.strip("-"), fields):
                     raise AdminApiException(422, detail=f"Sort by {ordering_field} is not allowed")
 
         content_type = "text/plain"
@@ -424,14 +454,14 @@ class ApiService:
         session_id: str | None,
         model: str,
         id: UUID | int | str,
+        request: Any | None = None,
     ) -> UUID | int | str:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+        current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
 
         if str(current_user_id) == str(id) and model == settings.ADMIN_USER_MODEL:
             raise AdminApiException(403, detail="You cannot delete yourself.")
@@ -441,14 +471,20 @@ class ApiService:
             raise AdminApiException(404, detail=f"{model} not found.") from None
         return id
 
-    async def action(self, session_id: str | None, model: str, action: str, payload: ActionInputSchema) -> None:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
-            raise AdminApiException(401, detail="User is not authenticated.")
+    async def action(
+        self,
+        session_id: str | None,
+        model: str,
+        action: str,
+        payload: ActionInputSchema,
+        request: Any | None = None,
+    ) -> None:
+        _current_user_id, current_user = await self._get_authenticated_user(session_id)
 
         admin_model = get_admin_or_admin_inline_model(model)
         if not admin_model:
             raise AdminApiException(404, detail=f"{model} model is not registered.")
+        self._bind_admin_context(admin_model, request=request, user=current_user)
 
         if action not in admin_model.actions:
             raise AdminApiException(422, detail=f"{action} action is not in actions setting.")
@@ -467,9 +503,11 @@ class ApiService:
     async def get_configuration(
         self,
         session_id: str | None,
+        request: Any | None = None,
     ) -> ConfigurationSchema:
-        current_user_id = await get_user_id_from_session_id(session_id)
-        if not current_user_id:
+        try:
+            current_user_id, current_user = await self._get_authenticated_user(session_id)
+        except AdminApiException:
             return ConfigurationSchema(
                 site_name=settings.ADMIN_SITE_NAME,
                 site_sign_in_logo=settings.ADMIN_SITE_SIGN_IN_LOGO,
@@ -485,7 +523,10 @@ class ApiService:
             )
 
         admin_models = cast(dict[Any, ModelAdmin | InlineModelAdmin], get_admin_models())
-        models = cast(Sequence[ModelSchema], await generate_models_schema(admin_models, user_id=current_user_id))
+        models = cast(
+            Sequence[ModelSchema],
+            await generate_models_schema(admin_models, user_id=current_user_id, user=current_user, request=request),
+        )
         dashboard_widgets = generate_dashboard_widgets_schema()
         return ConfigurationSchema(
             site_name=settings.ADMIN_SITE_NAME,

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/models/base.py

@@ -3,6 +3,7 @@ import datetime
 import inspect
 import json
 from collections.abc import Sequence
+from contextvars import ContextVar
 from io import BytesIO, StringIO
 from typing import Any
 from uuid import UUID
@@ -16,6 +17,9 @@ from fastadmin.models.schemas import DashboardWidgetType, ModelFieldWidgetSchema
 class BaseModelAdmin:
     """Base class for model admin"""
 
+    _request_context: ContextVar[Any | None]
+    _user_context: ContextVar[Any | None]
+
     # Use it only if you use several orms in your project.
     model_name_prefix: str | None = None
 
@@ -198,6 +202,23 @@ class BaseModelAdmin:
         :params model_cls: an orm/db model class.
         """
         self.model_cls = model_cls
+        self._request_context = ContextVar(f"fastadmin_admin_request_context_{id(self)}", default=None)
+        self._user_context = ContextVar(f"fastadmin_admin_user_context_{id(self)}", default=None)
+
+    @property
+    def request(self) -> Any | None:
+        """Current request object for this async context."""
+        return self._request_context.get()
+
+    @property
+    def user(self) -> Any | None:
+        """Current authenticated user object for this async context."""
+        return self._user_context.get()
+
+    def set_context(self, request: Any | None = None, user: Any | None = None) -> None:
+        """Set request/user context for the current async task."""
+        self._request_context.set(request)
+        self._user_context.set(user)
 
     @staticmethod
     def get_model_pk_name(orm_model_cls: Any) -> str:
@@ -227,6 +248,8 @@ class BaseModelAdmin:
         search: str | None = None,
         sort_by: str | None = None,
         filters: dict | None = None,
+        prefetch_related_fields: list[str] | None = None,
+        additional_search_fields: list[str] | None = None,
     ) -> tuple[list[Any], int]:
         """This method is used to get list of orm/db model objects.
 
@@ -235,6 +258,8 @@ class BaseModelAdmin:
         :params search: a search query.
         :params sort_by: a sort by field name.
         :params filters: a dict of filters.
+        :params prefetch_related_fields: a list of related fields to prefetch.
+        :params additional_search_fields: a list of additional search fields.
         :return: A tuple of list of objects and total count.
         """
         raise NotImplementedError
@@ -372,12 +397,12 @@ class BaseModelAdmin:
         return serialized_dict
 
     async def _serialize_obj_after_save(self, obj: Any) -> dict:
-        """Serialize object after save; re-fetch if detached (e.g. SQLAlchemy after commit)."""
+        """Serialize object after save; re-fetch if detached/session is over."""
         try:
             return await self.serialize_obj(obj)
         except Exception as exc:
-            # SQLAlchemy DetachedInstanceError when session is closed after commit
-            if exc.__class__.__name__ != "DetachedInstanceError":
+            # ORM-specific detached/session-over cases after commit.
+            if exc.__class__.__name__ not in {"DetachedInstanceError", "DatabaseSessionIsOver"}:
                 raise
             pk_name = self.get_model_pk_name(self.model_cls)
             pk = getattr(obj, pk_name, None)
@@ -697,6 +722,9 @@ class ModelAdmin(BaseModelAdmin):
 
 
 class DashboardWidgetAdmin:
+    _request_context: ContextVar[Any | None]
+    _user_context: ContextVar[Any | None]
+
     title: str
     dashboard_widget_type: DashboardWidgetType
     x_field: str
@@ -706,6 +734,25 @@ class DashboardWidgetAdmin:
     x_field_filter_widget_props: dict[str, Any] | None = None
     x_field_periods: list[str] | None = None
 
+    def __init__(self) -> None:
+        self._request_context = ContextVar(f"fastadmin_dashboard_request_context_{id(self)}", default=None)
+        self._user_context = ContextVar(f"fastadmin_dashboard_user_context_{id(self)}", default=None)
+
+    @property
+    def request(self) -> Any | None:
+        """Current request object for this async context."""
+        return self._request_context.get()
+
+    @property
+    def user(self) -> Any | None:
+        """Current authenticated user object for this async context."""
+        return self._user_context.get()
+
+    def set_context(self, request: Any | None = None, user: Any | None = None) -> None:
+        """Set request/user context for the current async task."""
+        self._request_context.set(request)
+        self._user_context.set(user)
+
     async def get_data(
         self,
         min_x_field: str | None = None,

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/models/helpers.py

@@ -101,6 +101,8 @@ def get_admin_or_admin_inline_model(orm_model_cls: str) -> ModelAdmin | InlineMo
 async def generate_models_schema(
     admin_models: dict[Any, ModelAdmin | InlineModelAdmin],
     user_id: UUID | int | None = None,
+    user: Any | None = None,
+    request: Any | None = None,
     inline_parent_admin_modal: ModelAdmin | None = None,
 ) -> list[ModelSchema | InlineModelSchema]:
     """Generate models schema
@@ -111,6 +113,8 @@ async def generate_models_schema(
     """
     models_schemas: list[ModelSchema | InlineModelSchema] = []
     for orm_model_cls, admin_model_obj in admin_models.items():
+        if hasattr(admin_model_obj, "set_context"):
+            admin_model_obj.set_context(request=request, user=user)
         orm_model_fields = admin_model_obj.get_model_fields_with_widget_types()
         orm_model_fields_for_serialize = admin_model_obj.get_fields_for_serialize()
 
@@ -258,6 +262,8 @@ async def generate_models_schema(
                     view_on_site=admin_model_obj.view_on_site,
                     inlines=await generate_models_schema(
                         {inline.model: inline(inline.model) for inline in admin_model_obj.inlines},
+                        user=user,
+                        request=request,
                         inline_parent_admin_modal=admin_model_obj,
                         user_id=user_id,
                     ),  # type: ignore [arg-type]

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/models/orms/django.py

@@ -1,4 +1,3 @@
-import operator
 from base64 import b64decode
 from typing import Any
 from uuid import UUID
@@ -245,6 +244,8 @@ class DjangoORMMixin:
         search: str | None = None,
         sort_by: str | None = None,
         filters: dict | None = None,
+        prefetch_related_fields: list[str] | None = None,
+        additional_search_fields: list[str] | None = None,
     ) -> tuple[list[Any], int]:
         """This method is used to get list of orm/db model objects.
 
@@ -253,19 +254,30 @@ class DjangoORMMixin:
         :params search: a search query.
         :params sort_by: a sort by field name.
         :params filters: a dict of filters.
+        :params prefetch_related_fields: a list of related fields to prefetch.
+        :params additional_search_fields: a list of additional search fields.
         :return: A tuple of list of objects and total count.
         """
         qs = self.model_cls.objects.all()
 
+        if prefetch_related_fields:
+            qs = qs.prefetch_related(*prefetch_related_fields)
+
         if filters:
             for field_with_condition, value in filters.items():
                 field = field_with_condition[0]
                 condition = field_with_condition[1]
                 qs = qs.filter(**{f"{field}__{condition}" if condition != "exact" else field: value})
 
-        if search and self.search_fields:
-            search_conditions = [Q(**{f + "__icontains": search}) for f in self.search_fields]
-            search_q = search_conditions[0] if len(search_conditions) == 1 else operator.or_(*search_conditions)
+        search_fields = list(self.search_fields)
+        if additional_search_fields:
+            search_fields.extend(additional_search_fields)
+
+        if search and search_fields:
+            search_conditions = [Q(**{f + "__icontains": search}) for f in search_fields]
+            search_q = search_conditions[0]
+            for condition in search_conditions[1:]:
+                search_q |= condition
             qs = qs.filter(search_q)
 
         if sort_by:

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/models/orms/ponyorm.py

@@ -1,4 +1,6 @@
+import inspect
 from enum import EnumMeta
+from types import SimpleNamespace
 from typing import Any
 from uuid import UUID
 
@@ -222,6 +224,8 @@ class PonyORMMixin:
         search: str | None = None,
         sort_by: str | None = None,
         filters: dict | None = None,
+        prefetch_related_fields: list[str] | None = None,
+        additional_search_fields: list[str] | None = None,
     ) -> tuple[list[Any], int]:
         """This method is used to get list of orm/db model objects.
 
@@ -230,6 +234,8 @@ class PonyORMMixin:
         :params search: a search query.
         :params sort_by: a sort by field name.
         :params filters: a dict of filters.
+        :params prefetch_related_fields: a list of related fields to prefetch.
+        :params additional_search_fields: a list of additional search fields.
         :return: A tuple of list of objects and total count.
         """
 
@@ -269,11 +275,16 @@ class PonyORMMixin:
                 filter_expr = f""""{value}" {pony_condition}  m.{field}"""
                 qs = qs.filter(filter_expr)
 
-        if search and self.search_fields:
+        search_fields = list(self.search_fields)
+        if additional_search_fields:
+            search_fields.extend(additional_search_fields)
+
+        if search and search_fields:
             ids = []
-            for search_field in self.search_fields:
+            for search_field in search_fields:
+                pony_search_field = search_field.replace("__", ".")
                 # Pony string filter for case-insensitive search
-                filter_expr = f'"{search.lower()}" in m.{search_field}.lower()'
+                filter_expr = f'"{search.lower()}" in m.{pony_search_field}.lower()'
                 qs_ids = qs.filter(filter_expr)
                 objs = list(qs_ids)
                 ids += [o.id for o in objs]
@@ -293,6 +304,9 @@ class PonyORMMixin:
         if self.list_select_related:
             qs = qs.prefetch(*[getattr(self.model_cls, field) for field in self.list_select_related])
 
+        if prefetch_related_fields:
+            qs = qs.prefetch(*[getattr(self.model_cls, field) for field in prefetch_related_fields])
+
         if offset is not None and limit is not None:
             qs = qs.limit(limit, offset=offset)
 
@@ -309,6 +323,54 @@ class PonyORMMixin:
         """
         return self.model_cls.select(**{self.get_model_pk_name(self.model_cls): id}).first()
 
+    @sync_to_async
+    @db_session
+    def orm_serialize_obj_by_id(self, id: UUID | int | str) -> dict | None:
+        """Serialize object by id in one db_session (avoids detached access)."""
+        obj = self.model_cls.select(**{self.get_model_pk_name(self.model_cls): id}).first()
+        if not obj:
+            return None
+
+        fields = self.get_model_fields_with_widget_types()
+        fields_for_serialize = self.get_fields_for_serialize()
+        obj_dict: dict[str, Any] = {}
+
+        for field in fields:
+            if field.name not in fields_for_serialize:
+                continue
+            if field.is_m2m:
+                rel_model_cls = getattr(self.model_cls, field.column_name).py_type
+                rel_key_id = self.get_model_pk_name(rel_model_cls)
+                obj_dict[field.name] = [getattr(o, rel_key_id) for o in getattr(obj, field.column_name)]
+            else:
+                relation_attr = getattr(self.model_cls, field.column_name, None)
+                if relation_attr and getattr(relation_attr, "is_relation", False):
+                    rel_obj = getattr(obj, field.column_name)
+                    if rel_obj is None:
+                        obj_dict[field.name] = None
+                    else:
+                        rel_model_cls = relation_attr.py_type
+                        rel_key_id = self.get_model_pk_name(rel_model_cls)
+                        obj_dict[field.name] = getattr(rel_obj, rel_key_id)
+                else:
+                    obj_dict[field.name] = getattr(obj, field.column_name)
+
+        obj_dict["__str__"] = str(obj)
+        proxy = SimpleNamespace(**obj_dict)
+        for field_name in fields_for_serialize:
+            display_field_function = getattr(self, field_name, None)
+            if not display_field_function or not hasattr(display_field_function, "is_display"):
+                continue
+            if inspect.iscoroutinefunction(display_field_function):
+                # Async display functions are not expected in Pony sync session context.
+                continue
+            try:
+                obj_dict[field_name] = display_field_function(proxy)
+            except (AttributeError, TypeError, KeyError):
+                obj_dict[field_name] = display_field_function(obj)
+
+        return obj_dict
+
     @sync_to_async
     @db_session
     def orm_save_obj(self, id: UUID | Any | None, payload: dict) -> Any:

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/models/orms/sqlalchemy.py

@@ -12,6 +12,66 @@ from fastadmin.settings import settings
 
 
 class SqlAlchemyMixin:
+    def _build_search_condition(self, field_path: str, search: str) -> Any | None:
+        """Build SQLAlchemy search condition for simple and nested fields.
+
+        Supports direct fields (e.g. ``name``) and relation paths using
+        Django-style separator (e.g. ``tournament__name``).
+        """
+
+        def recurse(model_cls: Any, parts: list[str]) -> Any | None:
+            attr = getattr(model_cls, parts[0], None)
+            if attr is None:
+                return None
+
+            if len(parts) == 1:
+                return attr.ilike(f"%{search}%")
+
+            rel_property = getattr(attr, "property", None)
+            if rel_property is None:
+                return None
+
+            related_model = getattrs(rel_property, "mapper.class_")
+            if related_model is None:
+                return None
+
+            nested_condition = recurse(related_model, parts[1:])
+            if nested_condition is None:
+                return None
+
+            if getattr(rel_property, "uselist", False):
+                return attr.any(nested_condition)
+            return attr.has(nested_condition)
+
+        return recurse(self.model_cls, field_path.split("__"))
+
+    def _resolve_ordering_field(self, ordering_field: str) -> str:
+        """Resolve ordering field for SQLAlchemy.
+
+        Relation keys (e.g. `tournament`) are not direct SQL columns.
+        For MANYTOONE/ONETOONE relations, sort by local FK column
+        (e.g. `tournament_id`) instead.
+        """
+        if not ordering_field:
+            return ordering_field
+
+        prefix = "-" if ordering_field.startswith("-") else ""
+        field_name = ordering_field.lstrip("-")
+
+        # Keep nested paths unchanged (join/loader strategy specific)
+        if "__" in field_name:
+            return ordering_field
+
+        mapper = inspect(self.model_cls)
+        relation = next((rel for rel in mapper.relationships if rel.key == field_name), None)
+        if relation and getattrs(relation, "direction.name") in ("MANYTOONE", "ONETOONE"):
+            local_columns = list(getattr(relation, "local_columns", []))
+            if local_columns:
+                return f"{prefix}{local_columns[0].key}"
+            return f"{prefix}{field_name}_id"
+
+        return ordering_field
+
     @staticmethod
     def get_model_pk_name(orm_model_cls: Any) -> str:
         """This method is used to get model pk name.
@@ -240,6 +300,8 @@ class SqlAlchemyMixin:
         search: str | None = None,
         sort_by: str | None = None,
         filters: dict | None = None,
+        prefetch_related_fields: list[str] | None = None,
+        additional_search_fields: list[str] | None = None,
     ) -> tuple[list[Any], int]:
         """This method is used to get list of orm/db model objects.
 
@@ -248,10 +310,13 @@ class SqlAlchemyMixin:
         :params search: a search query.
         :params sort_by: a sort by field name.
         :params filters: a dict of filters.
+        :params prefetch_related_fields: a list of related fields to prefetch.
+        :params additional_search_fields: a list of additional search fields.
         :return: A tuple of list of objects and total count.
         """
 
         def convert_sort_by(sort_by: str) -> str:
+            sort_by = self._resolve_ordering_field(sort_by)
             if sort_by.startswith("-"):
                 return sort_by[1:] + " desc"
             return sort_by
@@ -293,10 +358,18 @@ class SqlAlchemyMixin:
                             q.append(model_field.ilike(f"%{value}%"))
                 qs = qs.where(and_(*q))
 
-            if search and self.search_fields:
+            search_fields = list(self.search_fields)
+            if additional_search_fields:
+                search_fields.extend(additional_search_fields)
+
+            if search and search_fields:
                 q = []
-                for field in self.search_fields:
-                    q.append(getattr(self.model_cls, field).ilike(f"%{search}%"))
+                for field in search_fields:
+                    condition = self._build_search_condition(field, search)
+                    if condition is not None:
+                        q.append(condition)
+                if not q:
+                    return [], 0
                 qs = qs.where(or_(*q))
 
             if sort_by:
@@ -312,6 +385,28 @@ class SqlAlchemyMixin:
                 for field in self.list_select_related:
                     qs = qs.options(selectinload(getattr(self.model_cls, field)))
 
+            if prefetch_related_fields:
+                for field_path in prefetch_related_fields:
+                    parts = field_path.split("__")
+                    current_model = self.model_cls
+                    attr = getattr(current_model, parts[0], None)
+                    if attr is None:
+                        continue
+                    option = selectinload(attr)
+                    current_model = getattrs(attr, "property.mapper.class_")
+                    for part in parts[1:]:
+                        if current_model is None:
+                            break
+                        nested_attr = getattr(current_model, part, None)
+                        if nested_attr is None:
+                            break
+                        next_model = getattrs(nested_attr, "property.mapper.class_")
+                        if next_model is None:
+                            break
+                        option = option.selectinload(nested_attr)
+                        current_model = next_model
+                    qs = qs.options(option)
+
             if offset is not None and limit is not None:
                 qs = qs.offset(offset)
                 qs = qs.limit(limit)

{fastadmin-0.3.3 → fastadmin-0.3.5}/fastadmin/models/orms/tortoise.py

@@ -11,6 +11,31 @@ from fastadmin.settings import settings
 
 
 class TortoiseMixin:
+    def _resolve_ordering_field(self, ordering_field: str) -> str:
+        """Resolve ordering field for Tortoise.
+
+        Tortoise 1.x does not allow ordering by relation names directly
+        (e.g. `tournament`). For FK/O2O relation fields, order by their
+        backing id field instead (e.g. `tournament_id`).
+        """
+        if not ordering_field:
+            return ordering_field
+
+        prefix = "-" if ordering_field.startswith("-") else ""
+        field_name = ordering_field.lstrip("-")
+
+        # Respect explicit nested ordering (e.g. relation__name)
+        if "__" in field_name:
+            return ordering_field
+
+        orm_field = self.model_cls._meta.fields_map.get(field_name)
+        if not orm_field:
+            return ordering_field
+
+        if orm_field.__class__.__name__ in ("ForeignKeyFieldInstance", "OneToOneFieldInstance"):
+            return f"{prefix}{field_name}_id"
+        return ordering_field
+
     @staticmethod
     def get_model_pk_name(orm_model_cls: Any) -> str:
         """This method is used to get model pk name.
@@ -229,6 +254,8 @@ class TortoiseMixin:
         search: str | None = None,
         sort_by: str | None = None,
         filters: dict | None = None,
+        prefetch_related_fields: list[str] | None = None,
+        additional_search_fields: list[str] | None = None,
     ) -> tuple[list[Any], int]:
         """This method is used to get list of orm/db model objects.
 
@@ -237,29 +264,38 @@ class TortoiseMixin:
         :params search: a search query.
         :params sort_by: a sort by field name.
         :params filters: a dict of filters.
+        :params prefetch_related_fields: a list of related fields to prefetch.
+        :params additional_search_fields: a list of additional search fields.
         :return: A tuple of list of objects and total count.
         """
         qs = self.model_cls.all()
 
+        if prefetch_related_fields:
+            qs = qs.prefetch_related(*prefetch_related_fields).distinct()
+
         if filters:
             for field_with_condition, value in filters.items():
                 field = field_with_condition[0]
                 condition = field_with_condition[1]
                 qs = qs.filter(**{f"{field}__{condition}" if condition != "exact" else field: value})
 
-        if search and self.search_fields:
+        search_fields = list(self.search_fields)
+        if additional_search_fields:
+            search_fields.extend(additional_search_fields)
+
+        if search and search_fields:
             qs = qs.filter(
                 functools.reduce(
                     operator.or_,
-                    (Q(**{f + "__icontains": search}) for f in self.search_fields),
+                    (Q(**{f + "__icontains": search}) for f in search_fields),
                     Q(),
                 )
             )
 
         if sort_by:
-            qs = qs.order_by(sort_by)
+            qs = qs.order_by(self._resolve_ordering_field(sort_by))
         elif self.ordering:
-            qs = qs.order_by(*self.ordering)
+            qs = qs.order_by(*(self._resolve_ordering_field(field) for field in self.ordering))
 
         total = await qs.count()
 

{fastadmin-0.3.3 → fastadmin-0.3.5}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "fastadmin"
-version = "0.3.3"
+version = "0.3.5"
 description = "FastAdmin is an easy-to-use Admin Dashboard App for FastAPI/Flask/Django inspired by Django Admin."
 authors = ["Seva D <vsdudakov@gmail.com>"]
 license = "MIT"
@@ -61,6 +61,7 @@ isort = "^6.0.1"
 python-dotenv = "^1.0.0"
 jinja2 = "^3.1.2"
 pytest-xdist = "^3.6.1"
+typing-extensions = "^4.15.0"
 
 [build-system]
 requires = ["poetry-core"]