fastapi-admin-kit 0.1.0__py3-none-any.whl

fastapi_admin_kit/views/roles.py

@@ -0,0 +1,230 @@
+"""Role management views — list, create, edit, delete."""
+
+from __future__ import annotations
+
+import json
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from fastapi.responses import HTMLResponse, JSONResponse, RedirectResponse
+from sqlalchemy import select
+
+from fastapi_admin_kit.auth.csrf import require_csrf_token
+from fastapi_admin_kit.auth.dependencies import get_current_admin_user
+from fastapi_admin_kit.auth.models import AdminPermission, AdminRole
+from fastapi_admin_kit.auth.protocol import AdminUserProtocol
+from fastapi_admin_kit.db import get_db_session
+from fastapi_admin_kit.views.sidebar import inject_sidebar_context
+
+router = APIRouter()
+
+
+async def _require_superuser(
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+) -> AdminUserProtocol:
+    if not getattr(user, "is_superuser", False):
+        raise HTTPException(status_code=403, detail="Superuser access required.")
+    return user
+
+
+@router.get("/tables/search")
+async def tables_search(
+    request: Request,
+    q: str = Query("", description="Search query"),
+    _: AdminUserProtocol = Depends(_require_superuser),
+):
+    """Search registered models for permission table picker."""
+    registry = request.app.state.admin_registry
+    models = registry.all()
+
+    results = [
+        {"id": m.table_name, "label": m.verbose_name}
+        for m in models
+    ]
+
+    if q:
+        q_lower = q.lower()
+        results = [
+            r for r in results
+            if q_lower in r["label"].lower() or q_lower in r["id"].lower()
+        ]
+
+    return JSONResponse(content=results)
+
+
+@router.get("/roles", response_class=HTMLResponse)
+async def role_list_view(
+    request: Request,
+    _: AdminUserProtocol = Depends(_require_superuser),
+):
+    """List roles with user counts."""
+    templates = request.app.state.admin_jinja_env
+    session = get_db_session(request)
+
+    result = await session.execute(select(AdminRole))
+    roles = list(result.scalars().all())
+
+    role_data = []
+    for role in roles:
+        user_count = len(role.users)
+        role_data.append({
+            "role": role,
+            "user_count": user_count,
+        })
+
+    return templates.TemplateResponse(
+        request,
+        "pages/roles.html",
+        await inject_sidebar_context(request, {
+            "roles": role_data,
+        }),
+    )
+
+
+@router.get("/roles/create", response_class=HTMLResponse)
+async def role_create_view(
+    request: Request,
+    _: AdminUserProtocol = Depends(_require_superuser),
+):
+    """Show empty role create form."""
+    templates = request.app.state.admin_jinja_env
+
+    return templates.TemplateResponse(
+        request,
+        "pages/role_form.html",
+        await inject_sidebar_context(request, {
+            "role": None,
+            "perm_data": {},
+            "search_url": "/admin/tables/search",
+        }),
+    )
+
+
+@router.get("/roles/{role_id}", response_class=HTMLResponse)
+async def role_edit_view(
+    request: Request,
+    role_id: int,
+    _: AdminUserProtocol = Depends(_require_superuser),
+):
+    """Show edit form with permission matrix."""
+    templates = request.app.state.admin_jinja_env
+    session = get_db_session(request)
+    registry = request.app.state.admin_registry
+
+    role = await session.get(AdminRole, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="Role not found")
+
+    models = registry.all()
+    model_map = {m.table_name: m.verbose_name for m in models}
+
+    perms = (
+        await session.execute(
+            select(AdminPermission).where(AdminPermission.role_id == role_id)
+        )
+    ).scalars().all()
+
+    perm_data = {}
+    for p in perms:
+        perm_data[p.table_name] = {
+            "_label": model_map.get(p.table_name, p.table_name),
+            "view": p.can_view,
+            "create": p.can_create,
+            "edit": p.can_edit,
+            "delete": p.can_delete,
+        }
+
+    return templates.TemplateResponse(
+        request,
+        "pages/role_form.html",
+        await inject_sidebar_context(request, {
+            "role": role,
+            "perm_data": perm_data,
+            "search_url": "/admin/tables/search",
+        }),
+    )
+
+
+@router.post("/roles/{role_id}", response_class=HTMLResponse)
+async def role_save_view(
+    request: Request,
+    role_id: int,
+    _: AdminUserProtocol = Depends(_require_superuser),
+    _csrf: bool = Depends(require_csrf_token),
+):
+    """Save role permissions from form submission."""
+    session = get_db_session(request)
+
+    role = await session.get(AdminRole, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="Role not found")
+
+    form = await request.form()
+    perm_data_raw = form.get("perm_data", "{}")
+
+    try:
+        perm_data = json.loads(perm_data_raw)
+    except (json.JSONDecodeError, TypeError):
+        perm_data = {}
+
+    existing_perms = (
+        await session.execute(
+            select(AdminPermission).where(AdminPermission.role_id == role_id)
+        )
+    ).scalars().all()
+    existing_perm_map = {p.table_name: p for p in existing_perms}
+
+    for table, data in perm_data.items():
+        if not any(data.get(a) for a in ["view", "create", "edit", "delete"]):
+            continue
+        if table in existing_perm_map:
+            perm = existing_perm_map[table]
+            perm.can_view = data.get("view", False)
+            perm.can_create = data.get("create", False)
+            perm.can_edit = data.get("edit", False)
+            perm.can_delete = data.get("delete", False)
+        else:
+            perm = AdminPermission(
+                role_id=role_id,
+                table_name=table,
+                can_view=data.get("view", False),
+                can_create=data.get("create", False),
+                can_edit=data.get("edit", False),
+                can_delete=data.get("delete", False),
+            )
+            session.add(perm)
+
+    tables_in_form = set(perm_data.keys())
+    for table, perm in existing_perm_map.items():
+        if table not in tables_in_form:
+            await session.delete(perm)
+
+    await session.flush()
+
+    return RedirectResponse(url="/admin/roles", status_code=302)
+
+
+@router.post("/roles/{role_id}/delete", response_class=RedirectResponse)
+async def role_delete_view(
+    request: Request,
+    role_id: int,
+    _: AdminUserProtocol = Depends(_require_superuser),
+    _csrf: bool = Depends(require_csrf_token),
+):
+    """Delete role (refuse if users assigned)."""
+    session = get_db_session(request)
+
+    role = await session.get(AdminRole, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="Role not found")
+
+    user_count = len(role.users)
+    if user_count > 0:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Cannot delete role. {user_count} user(s) are still assigned.",
+        )
+
+    await session.delete(role)
+    await session.flush()
+
+    return RedirectResponse(url="/admin/roles", status_code=302)

fastapi_admin_kit/views/search.py

@@ -0,0 +1,31 @@
+"""Search endpoint factory for FK/M2M relation pickers.
+
+Backward-compatible wrapper — delegates to SearchView class.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import Request
+
+from fastapi_admin_kit.registry import RegisteredModel
+
+
+def search_factory(registered: RegisteredModel):
+    """Create a search handler — delegates to SearchView.html_response."""
+    from fastapi_admin_kit.views.class_views import (
+        SearchView,
+        _resolve_view_class,
+    )
+
+    view_class = _resolve_view_class(
+        registered.admin, "search_view_class", SearchView
+    )
+    view_instance = view_class(registered)
+
+    async def _handler(request: Request, **kwargs: Any):
+        return await view_instance.html_response(request, **kwargs)
+
+    _handler.__name__ = f"search_{registered.table_name}"
+    return _handler

fastapi_admin_kit/views/settings.py

@@ -0,0 +1,31 @@
+"""Admin settings routes — theme builder."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+
+from fastapi_admin_kit.auth.dependencies import get_current_admin_user
+
+router = APIRouter()
+
+
+@router.get("/settings/theme", response_class=HTMLResponse)
+async def theme_settings(
+    request: Request,
+    current_user: Any = Depends(get_current_admin_user),
+):
+    """Render theme builder page."""
+    templates = request.app.state.admin_jinja_env
+    context: dict[str, Any] = {
+        "request": request,
+        "title": "Theme Settings",
+        "admin_config": request.app.state.admin_config,
+    }
+    from fastapi_admin_kit.views.sidebar import inject_sidebar_context
+    await inject_sidebar_context(request, context)
+    template = templates.get_template("pages/settings/theme.html")
+    html = template.render(**context)
+    return HTMLResponse(content=html)

fastapi_admin_kit/views/sidebar.py

@@ -0,0 +1,101 @@
+"""Sidebar context helper for template views."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from fastapi import Request
+
+
+async def inject_sidebar_context(request: Request, context: dict[str, Any]) -> dict[str, Any]:
+    """Inject nav_groups + permissions_map into a template context dict."""
+    admin_instance: Any = request.app.state.admin
+    if hasattr(admin_instance, "build_sidebar_context"):
+        user = getattr(request.state, "admin_user", None)
+
+        snapshot = getattr(request.state, "admin_user_snapshot", None)
+        is_superuser = (
+            bool(snapshot.get("is_superuser", False))
+            if snapshot
+            else bool(getattr(user, "is_superuser", False))
+        ) if user else False
+
+        permissions_map: dict = {}
+        if user and not is_superuser:
+            try:
+                from sqlalchemy import select
+
+                from fastapi_admin_kit.auth.models import AdminPermission, AdminUserPermission
+                from fastapi_admin_kit.db import get_db_session
+                from fastapi_admin_kit.types import PermissionSet
+
+                snapshot = getattr(request.state, "admin_user_snapshot", None)
+                user_id = (
+                    snapshot.get("id")
+                    if snapshot
+                    else getattr(user, "id", None)
+                )
+                role_ids = (
+                    snapshot.get("role_ids", [])
+                    if snapshot
+                    else getattr(user, "role_ids", [])
+                )
+
+                session = get_db_session(request)
+
+                # Load permissions from all roles, merge with OR logic
+                if role_ids:
+                    result = await session.execute(
+                        select(AdminPermission).where(
+                            AdminPermission.role_id.in_(role_ids)
+                        )
+                    )
+                    for perm in result.scalars():
+                        if perm.table_name in permissions_map:
+                            existing = permissions_map[perm.table_name]
+                            permissions_map[perm.table_name] = PermissionSet(
+                                can_view=existing.can_view or perm.can_view,
+                                can_create=existing.can_create or perm.can_create,
+                                can_edit=existing.can_edit or perm.can_edit,
+                                can_delete=existing.can_delete or perm.can_delete,
+                            )
+                        else:
+                            permissions_map[perm.table_name] = PermissionSet(
+                                can_view=perm.can_view,
+                                can_create=perm.can_create,
+                                can_edit=perm.can_edit,
+                                can_delete=perm.can_delete,
+                            )
+
+                # Load direct user permission overrides, merge on top
+                if user_id is not None:
+                    result = await session.execute(
+                        select(AdminUserPermission).where(
+                            AdminUserPermission.user_id == user_id
+                        )
+                    )
+                    for perm in result.scalars():
+                        if perm.table_name in permissions_map:
+                            existing = permissions_map[perm.table_name]
+                            permissions_map[perm.table_name] = PermissionSet(
+                                can_view=existing.can_view or perm.can_view,
+                                can_create=existing.can_create or perm.can_create,
+                                can_edit=existing.can_edit or perm.can_edit,
+                                can_delete=existing.can_delete or perm.can_delete,
+                            )
+                        else:
+                            permissions_map[perm.table_name] = PermissionSet(
+                                can_view=perm.can_view,
+                                can_create=perm.can_create,
+                                can_edit=perm.can_edit,
+                                can_delete=perm.can_delete,
+                            )
+            except Exception:
+                pass
+
+        context.update(
+            admin_instance.build_sidebar_context(
+                request, user=user, permissions_map=permissions_map
+            )
+        )
+    return context

fastapi_admin_kit/views/totp.py

@@ -0,0 +1,249 @@
+"""TOTP 2FA management views."""
+
+from __future__ import annotations
+
+import json
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+from sqlalchemy import select
+
+from fastapi_admin_kit.auth.csrf import require_csrf_token
+from fastapi_admin_kit.auth.dependencies import get_current_admin_user
+from fastapi_admin_kit.auth.models import AdminUserTOTP
+from fastapi_admin_kit.auth.protocol import AdminUserProtocol
+from fastapi_admin_kit.auth.totp import (
+    generate_backup_codes,
+    generate_secret,
+    get_totp_uri,
+    hash_backup_code,
+    verify_totp,
+)
+from fastapi_admin_kit.db import get_db_session
+from fastapi_admin_kit.views.sidebar import inject_sidebar_context
+
+router = APIRouter()
+
+
+@router.get("/profile/2fa", response_class=HTMLResponse)
+async def totp_setup_view(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+):
+    """Show 2FA setup page with QR code."""
+    templates = request.app.state.admin_jinja_env
+    session = get_db_session(request)
+
+    result = await session.execute(
+        select(AdminUserTOTP).where(AdminUserTOTP.user_id == user.id)
+    )
+    totp_record = result.scalar_one_or_none()
+
+    secret = None
+    qr_uri = None
+    enabled = False
+
+    if totp_record and totp_record.enabled:
+        enabled = True
+    else:
+        if totp_record is None:
+            secret = generate_secret()
+            totp_record = AdminUserTOTP(
+                user_id=user.id,
+                secret_key=secret,
+                enabled=False,
+            )
+            session.add(totp_record)
+            await session.flush()
+        else:
+            secret = totp_record.secret_key
+
+        qr_uri = get_totp_uri(secret, user.email) if secret else None
+
+    return templates.TemplateResponse(
+        request,
+        "pages/2fa/setup.html",
+        await inject_sidebar_context(
+            request,
+            {
+                "secret": secret,
+                "qr_uri": qr_uri,
+                "totp_enabled": enabled,
+            },
+        ),
+    )
+
+
+@router.post("/profile/2fa/enable")
+async def totp_enable_post(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+    _csrf: bool = Depends(require_csrf_token),
+):
+    """Verify TOTP code and enable 2FA."""
+    session = get_db_session(request)
+    form = await request.form()
+
+    code = form.get("code", "").strip()
+
+    result = await session.execute(
+        select(AdminUserTOTP).where(AdminUserTOTP.user_id == user.id)
+    )
+    totp_record = result.scalar_one_or_none()
+
+    if totp_record is None:
+        raise HTTPException(status_code=400, detail="No TOTP setup found.")
+
+    if not verify_totp(totp_record.secret_key, code):
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/2fa/setup.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "secret": totp_record.secret_key,
+                    "qr_uri": get_totp_uri(totp_record.secret_key, user.email),
+                    "totp_enabled": False,
+                    "error": "Invalid TOTP code. Please try again.",
+                },
+            ),
+        )
+
+    backup_codes = generate_backup_codes()
+    hashed_codes = [hash_backup_code(c) for c in backup_codes]
+
+    totp_record.enabled = True
+    totp_record.backup_codes = json.dumps(hashed_codes)
+    await session.flush()
+
+    templates = request.app.state.admin_jinja_env
+    return templates.TemplateResponse(
+        request,
+        "pages/2fa/setup.html",
+        await inject_sidebar_context(
+            request,
+            {
+                "secret": None,
+                "qr_uri": None,
+                "totp_enabled": True,
+                "backup_codes": backup_codes,
+                "success": "2FA enabled successfully. Save your backup codes!",
+            },
+        ),
+    )
+
+
+@router.post("/profile/2fa/disable")
+async def totp_disable_post(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+    _csrf: bool = Depends(require_csrf_token),
+):
+    """Disable 2FA after verifying TOTP code and password."""
+    from fastapi_admin_kit.auth.backend import pwd_context
+
+    session = get_db_session(request)
+    form = await request.form()
+
+    code = form.get("code", "").strip()
+    password = form.get("password", "")
+
+    if not pwd_context.verify(password, user.hashed_password):
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/2fa/setup.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "totp_enabled": True,
+                    "error": "Incorrect password.",
+                },
+            ),
+        )
+
+    result = await session.execute(
+        select(AdminUserTOTP).where(AdminUserTOTP.user_id == user.id)
+    )
+    totp_record = result.scalar_one_or_none()
+
+    if totp_record is None or not totp_record.enabled:
+        raise HTTPException(status_code=400, detail="2FA is not enabled.")
+
+    if not verify_totp(totp_record.secret_key, code):
+        templates = request.app.state.admin_jinja_env
+        return templates.TemplateResponse(
+            request,
+            "pages/2fa/setup.html",
+            await inject_sidebar_context(
+                request,
+                {
+                    "totp_enabled": True,
+                    "error": "Invalid TOTP code.",
+                },
+            ),
+        )
+
+    totp_record.enabled = False
+    totp_record.backup_codes = None
+    await session.flush()
+
+    return RedirectResponse(url="/admin/profile/2fa", status_code=302)
+
+
+@router.post("/profile/2fa/backup-codes")
+async def totp_regenerate_backup_codes(
+    request: Request,
+    user: AdminUserProtocol = Depends(get_current_admin_user),
+    _csrf: bool = Depends(require_csrf_token),
+):
+    """Generate new backup codes (invalidates old ones)."""
+    session = get_db_session(request)
+
+    result = await session.execute(
+        select(AdminUserTOTP).where(AdminUserTOTP.user_id == user.id)
+    )
+    totp_record = result.scalar_one_or_none()
+
+    if totp_record is None or not totp_record.enabled:
+        raise HTTPException(status_code=400, detail="2FA is not enabled.")
+
+    backup_codes = generate_backup_codes()
+    hashed_codes = [hash_backup_code(c) for c in backup_codes]
+
+    totp_record.backup_codes = json.dumps(hashed_codes)
+    await session.flush()
+
+    templates = request.app.state.admin_jinja_env
+    return templates.TemplateResponse(
+        request,
+        "pages/2fa/setup.html",
+        await inject_sidebar_context(
+            request,
+            {
+                "totp_enabled": True,
+                "backup_codes": backup_codes,
+                "success": "New backup codes generated. Old codes are now invalid.",
+            },
+        ),
+    )
+
+
+@router.get("/verify-2fa", response_class=HTMLResponse)
+async def totp_verify_view(
+    request: Request,
+    temp_token: str | None = None,
+):
+    """Show 2FA verification page during login."""
+    templates = request.app.state.admin_jinja_env
+    return templates.TemplateResponse(
+        request,
+        "pages/2fa/verify.html",
+        await inject_sidebar_context(
+            request,
+            {
+                "temp_token": temp_token,
+            },
+        ),
+    )