fastapi-admin-kit 0.1.0__py3-none-any.whl

fastapi_admin_kit/views/form.py

@@ -0,0 +1,159 @@
+"""Create and edit form handler factories.
+
+Backward-compatible wrappers — delegate to CreateView/EditView classes.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import Request
+from starlette.datastructures import UploadFile
+
+from fastapi_admin_kit.form.pipeline import build_form_context
+from fastapi_admin_kit.registry import RegisteredModel
+from fastapi_admin_kit.types import PermissionSet
+from fastapi_admin_kit.views.sidebar import inject_sidebar_context
+from fastapi_admin_kit.widgets.inputs import FileUploadWidget, ImageUploadWidget
+
+# Widgets that handle file uploads
+_FILE_WIDGET_TYPES = (FileUploadWidget, ImageUploadWidget)
+
+
+def _get_storage(request: Request):
+    """Get the storage backend from app.state, or None."""
+    return getattr(request.app.state, "admin_storage", None)
+
+
+async def _handle_file_field(
+    request: Request,
+    widget: Any,
+    field_meta: Any,
+    form_data: Any,
+    obj: Any | None,
+    action: str | None,
+    parsed: dict[str, Any],
+    errors: dict[str, list[str]],
+) -> None:
+    """Handle a file upload field during form submission.
+
+    For create: always save the new upload.
+    For edit: respect the ``action`` parameter:
+      - ``keep`` (default): keep existing file path unchanged
+      - ``replace``: save new upload, delete old file
+      - ``clear``: delete old file, set value to None
+    """
+    storage = _get_storage(request)
+    field_name = field_meta.name
+    raw = form_data.get(field_name)
+
+    if isinstance(raw, UploadFile) and raw.filename:
+        # New file uploaded
+        if widget.max_size_mb is not None:
+            content = await raw.read()
+            max_bytes = int(widget.max_size_mb * 1024 * 1024)
+            if len(content) > max_bytes:
+                errors[field_name] = [
+                    f"File size exceeds maximum allowed size ({widget.max_size_mb} MB)."
+                ]
+                # Reset file position for potential re-read
+                await raw.seek(0)
+                return
+            # Reset file position after size check
+            await raw.seek(0)
+
+        if storage is None:
+            errors[field_name] = ["No storage backend configured."]
+            return
+
+        try:
+            path = await storage.save(raw, directory=field_meta.name)
+        except ValueError as exc:
+            errors[field_name] = [str(exc)]
+            return
+
+        # Delete old file if replacing
+        if action == "replace" and obj is not None:
+            old_path = getattr(obj, field_name, None)
+            if old_path:
+                await storage.delete(old_path)
+
+        parsed[field_name] = path
+
+    elif action == "clear":
+        # User wants to remove the file
+        if storage is not None and obj is not None:
+            old_path = getattr(obj, field_name, None)
+            if old_path:
+                await storage.delete(old_path)
+        parsed[field_name] = None
+
+    elif action == "keep" or action is None:
+        # Keep existing value
+        if obj is not None:
+            parsed[field_name] = getattr(obj, field_name, None)
+
+    else:
+        # No new upload, no explicit action — keep existing
+        if obj is not None:
+            parsed[field_name] = getattr(obj, field_name, None)
+
+
+def create_form_factory(registered: RegisteredModel):
+    async def create_form(request: Request, _: Any = None):
+        templates = request.app.state.admin_jinja_env
+        ctx = build_form_context(registered, is_create=True)
+        context = await inject_sidebar_context(request, {
+            "form_context": ctx,
+            "is_create": True,
+            "permissions": PermissionSet(
+                can_view=True, can_create=True, can_edit=True, can_delete=True
+            ),
+        })
+        return templates.TemplateResponse(
+            request, "pages/form.html", context
+        )
+    create_form.__name__ = f"create_form_{registered.table_name}"
+    return create_form
+
+
+def create_submit_factory(registered: RegisteredModel):
+    """Create form submission handler — delegates to CreateView.html_response."""
+    from fastapi_admin_kit.views.class_views import CreateView, _resolve_view_class
+
+    view_class = _resolve_view_class(registered.admin, "create_view_class", CreateView)
+    view_instance = view_class(registered)
+
+    async def _handler(request: Request, **kwargs: Any):
+        return await view_instance.html_response(request, **kwargs)
+
+    _handler.__name__ = f"create_submit_{registered.table_name}"
+    return _handler
+
+
+def edit_form_factory(registered: RegisteredModel):
+    """Edit form display handler — delegates to EditView.html_response."""
+    from fastapi_admin_kit.views.class_views import EditView, _resolve_view_class
+
+    view_class = _resolve_view_class(registered.admin, "edit_view_class", EditView)
+    view_instance = view_class(registered)
+
+    async def _handler(request: Request, **kwargs: Any):
+        return await view_instance.html_response(request, **kwargs)
+
+    _handler.__name__ = f"edit_form_{registered.table_name}"
+    return _handler
+
+
+def edit_submit_factory(registered: RegisteredModel):
+    """Edit form submission handler — delegates to EditView.html_response."""
+    from fastapi_admin_kit.views.class_views import EditView, _resolve_view_class
+
+    view_class = _resolve_view_class(registered.admin, "edit_view_class", EditView)
+    view_instance = view_class(registered)
+
+    async def _handler(request: Request, **kwargs: Any):
+        return await view_instance.html_response(request, **kwargs)
+
+    _handler.__name__ = f"edit_submit_{registered.table_name}"
+    return _handler

fastapi_admin_kit/views/list.py

@@ -0,0 +1,28 @@
+"""List view handler factory for registered models.
+
+Backward-compatible wrapper — delegates to ListView class.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi_admin_kit.registry import RegisteredModel
+
+
+def list_view_factory(registered: RegisteredModel):
+    """Create a list view handler — delegates to ListView.html_response."""
+    from fastapi_admin_kit.views.class_views import ListView, _resolve_view_class
+
+    view_class = _resolve_view_class(registered.admin, "list_view_class", ListView)
+    view_instance = view_class(registered)
+
+    async def _handler(request: Request, **kwargs: Any):
+        return await view_instance.html_response(request, **kwargs)
+
+    _handler.__name__ = f"list_{registered.table_name}"
+    return _handler
+
+
+# Need Request for type annotation in the wrapper
+from fastapi import Request  # noqa: E402

fastapi_admin_kit/views/profile.py

@@ -0,0 +1,219 @@
+"""Profile views — password change and profile editing."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+from sqlalchemy import select
+
+from fastapi_admin_kit.auth.csrf import require_csrf_token
+from fastapi_admin_kit.auth.dependencies import get_current_admin_user
+from fastapi_admin_kit.auth.protocol import AdminUserProtocol
+from fastapi_admin_kit.db import get_db_session
+from fastapi_admin_kit.views.sidebar import inject_sidebar_context
+
+router = APIRouter()
+
+
+@router.get("/profile", response_class=HTMLResponse)
+async def profile_view(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+):
+    """Show current user profile."""
+    templates = request.app.state.admin_jinja_env
+    return templates.TemplateResponse(
+        request,
+        "pages/profile/profile.html",
+        await inject_sidebar_context(
+            request,
+            {
+                "profile_user": user,
+            },
+        ),
+    )
+
+
+@router.post("/profile")
+async def profile_update(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+    _csrf: bool = Depends(require_csrf_token),
+):
+    """Update profile (full_name, email)."""
+    from fastapi_admin_kit.auth.backend import pwd_context
+
+    session = get_db_session(request)
+    form = await request.form()
+
+    email = form.get("email", "").strip()
+    full_name = form.get("full_name", "").strip()
+    password = form.get("password", "")
+
+    if not password:
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/profile/profile.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "profile_user": user,
+                    "error": "Password is required to save changes.",
+                },
+            ),
+        )
+
+    if not pwd_context.verify(password, user.hashed_password):
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/profile/profile.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "profile_user": user,
+                    "error": "Incorrect password.",
+                },
+            ),
+        )
+
+    if email:
+        existing = await session.execute(
+            select(type(user)).where(
+                type(user).email == email, type(user).id != user.id
+            )
+        )
+        if existing.scalar_one_or_none():
+            templates = request.app.state.admin_jinja_env
+            return templates.TemplateResponse(
+                request,
+                "pages/profile/profile.html",
+                await inject_sidebar_context(
+                    request,
+                    {
+                        "profile_user": user,
+                        "error": "Email already in use.",
+                    },
+                ),
+            )
+        user.email = email
+
+    user.full_name = full_name
+    await session.flush()
+
+    return RedirectResponse(url="/admin/profile", status_code=302)
+
+
+@router.get("/profile/password", response_class=HTMLResponse)
+async def password_change_view(
+    request: Request,
+    _: AdminUserProtocol = Depends(get_current_admin_user),
+):
+    """Show change password form."""
+    templates = request.app.state.admin_jinja_env
+    return templates.TemplateResponse(
+        request,
+        "pages/profile/password.html",
+        await inject_sidebar_context(request, {}),
+    )
+
+
+@router.post("/profile/password")
+async def password_change_post(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+    _csrf: bool = Depends(require_csrf_token),
+):
+    """Handle password change."""
+    from fastapi_admin_kit.auth.backend import pwd_context
+    from fastapi_admin_kit.auth.password import validate_password_strength
+
+    session = get_db_session(request)
+    form = await request.form()
+
+    current_password = form.get("current_password", "")
+    new_password = form.get("new_password", "")
+    confirm_password = form.get("confirm_password", "")
+
+    if not pwd_context.verify(current_password, user.hashed_password):
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/profile/password.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "error": "Current password is incorrect.",
+                },
+            ),
+        )
+
+    if new_password != confirm_password:
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/profile/password.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "error": "New passwords do not match.",
+                },
+            ),
+        )
+
+    password_errors = validate_password_strength(new_password)
+    if password_errors:
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/profile/password.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "error": password_errors[0],
+                },
+            ),
+        )
+
+    user.hashed_password = pwd_context.hash(new_password)
+    user.password_changed_at = datetime.now(UTC)
+    await session.flush()
+
+    # Revoke all refresh tokens for this user
+    from sqlalchemy import update
+
+    from fastapi_admin_kit.auth.models import AdminRefreshToken
+
+    await session.execute(
+        update(AdminRefreshToken)
+        .where(
+            AdminRefreshToken.user_id == user.id,
+            AdminRefreshToken.revoked_at.is_(None),
+        )
+        .values(revoked_at=datetime.now(UTC))
+    )
+    await session.flush()
+
+    # Clear session and redirect to login
+    from fastapi_admin_kit.auth.csrf import CSRF_COOKIE_NAME
+
+    response = RedirectResponse(url="/admin/login", status_code=302)
+    session_backend = request.app.state.admin_session_backend
+    samesite = getattr(
+        request.app.state.admin_state, "session_samesite", "strict"
+    )
+    response.delete_cookie(
+        key=session_backend.cookie_name,
+        path="/",
+        secure=session_backend.secure,
+        httponly=True,
+        samesite=samesite,
+    )
+    response.delete_cookie(
+        key=CSRF_COOKIE_NAME,
+        path="/",
+    )
+    return response

fastapi_admin_kit/views/protocols.py

@@ -0,0 +1,54 @@
+"""Protocol interfaces for SOLID class-based views.
+
+Each protocol has a single responsibility (ISP).
+View classes depend on these abstractions (DIP).
+"""
+
+from __future__ import annotations
+
+from typing import Any, Protocol, runtime_checkable
+
+from fastapi import Request
+from fastapi.responses import Response
+
+
+@runtime_checkable
+class QueryProvider(Protocol):
+    """Single responsibility: build and execute database queries."""
+
+    async def get_list(
+        self, request: Request, q: str, page: int
+    ) -> tuple[list[Any], int, int, int]:
+        """Return (items, total, page, per_page)."""
+        ...
+
+    async def get_object(self, request: Request, id: Any) -> Any | None:
+        """Return a single object or None."""
+        ...
+
+
+@runtime_checkable
+class FormParser(Protocol):
+    """Single responsibility: parse and validate form/request data."""
+
+    async def parse(
+        self, request: Request, obj: Any | None = None
+    ) -> tuple[dict[str, Any], dict[str, list[str]]]:
+        """Return (parsed_values, errors)."""
+        ...
+
+
+@runtime_checkable
+class HTMLRenderer(Protocol):
+    """Single responsibility: return an HTML TemplateResponse."""
+
+    async def render(
+        self, request: Request, context: dict[str, Any]
+    ) -> Response: ...
+
+
+@runtime_checkable
+class APIRenderer(Protocol):
+    """Single responsibility: return a JSON Response."""
+
+    async def render(self, request: Request, data: Any) -> Response: ...