fastapi-admin-kit 0.2.0__tar.gz → 0.2.1__tar.gz

fastapi_admin_kit-0.2.1/CHANGELOG.md

@@ -0,0 +1,51 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.1] - 2026-07-20
+
+### Added
+- Zero-config auto-discovery of SQLAlchemy models
+- Built-in authentication with session-based cookies
+- Role-based access control (RBAC) with per-model permissions
+- Direct per-user permission overrides
+- Audit logging with full change diffs
+- Modern UI with Tailwind CSS, HTMX, and Alpine.js
+- Global search / command palette (`Cmd+K` / `Ctrl+K`)
+- Inline editing from list view with 3-dot action menu
+- CLI tools (`fak-admin` / `fak`) for user management
+- Async-first architecture with PostgreSQL, MySQL, and SQLite support
+- SQLModel support via optional extra
+- Custom widgets, themes, and templates
+- Search and filtering with relation field lookups
+- Bulk operations
+- Dark mode with theme presets
+- Pagination strategies (offset, cursor, dynamic)
+- File uploads with local storage backend
+- Plugin system for extensibility
+- CSRF protection on all state-changing requests
+- Rate limiting on authentication endpoints
+- Environment badge for staging/production identification
+
+### Security
+- SQL injection prevention via identifier validation in CLI migrate and auto-migrate
+- Secure session cookies with `SameSite=Strict` and `Secure` by default
+- CSRF protection on all state-changing requests
+- Rate limiting on authentication endpoints
+- bcrypt password hashing
+- Secret key validated to be >= 32 characters at startup
+- Removed weak default credentials from examples
+
+### Changed
+- `uvicorn` and `pyjwt` moved to optional `[full]` extra (no longer hard dependencies)
+- All library code uses `logging` instead of `print()` statements
+- Silent exception blocks now log at debug level instead of silently swallowing
+
+### Fixed
+- `__all__` in `views/__init__.py` no longer references undefined symbols
+- Debug print statement removed from `cli/helpers.py`
+- Line length violations in `admin/builtin_models.py`
+- Import sorting in `admin/admin_database.py` and `cli/migrate.py`

{fastapi_admin_kit-0.2.0 → fastapi_admin_kit-0.2.1}/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Borhan
+Copyright (c) 2024-2025 Borhan
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

{fastapi_admin_kit-0.2.0 → fastapi_admin_kit-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fastapi-admin-kit
-Version: 0.2.0
+Version: 0.2.1
 Summary: Drop-in admin panel for FastAPI + SQLAlchemy + SQLModel apps
 Project-URL: Homepage, https://github.com/borhanst/fastapi-admin-kit
 Project-URL: Documentation, https://borhanst.github.io/fastapi-admin-kit/
@@ -10,7 +10,7 @@ Author-email: Borhan <mdborhan.st@gmail.com>
 License: MIT
 License-File: LICENSE
 Keywords: admin,admin-panel,async,crud,dashboard,fastapi,rbac,sqlalchemy,sqlmodel
-Classifier: Development Status :: 4 - Beta
+Classifier: Development Status :: 5 - Production/Stable
 Classifier: Framework :: AsyncIO
 Classifier: Framework :: FastAPI
 Classifier: Intended Audience :: Developers
@@ -28,21 +28,25 @@ Requires-Dist: bcrypt>=4.0.0
 Requires-Dist: fastapi>=0.100.0
 Requires-Dist: itsdangerous>=2.2.0
 Requires-Dist: jinja2>=3.1.0
-Requires-Dist: pyjwt>=2.13.0
+Requires-Dist: pre-commit>=4.6.0
 Requires-Dist: python-multipart>=0.0.9
 Requires-Dist: sqlalchemy>=2.0.0
-Requires-Dist: uvicorn>=0.30.0
 Provides-Extra: dev
 Requires-Dist: hatch>=1.13.0; extra == 'dev'
 Requires-Dist: httpx>=0.27.0; extra == 'dev'
 Requires-Dist: pre-commit>=3.5.0; extra == 'dev'
+Requires-Dist: pyjwt>=2.13.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.23.0; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'
 Requires-Dist: ruff>=0.5.0; extra == 'dev'
 Provides-Extra: docs
 Requires-Dist: mkdocs-material>=9.5.0; extra == 'docs'
 Requires-Dist: mkdocs>=1.6.0; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.25.0; extra == 'docs'
+Provides-Extra: full
+Requires-Dist: pyjwt>=2.13.0; extra == 'full'
+Requires-Dist: uvicorn>=0.30.0; extra == 'full'
 Provides-Extra: mysql
 Requires-Dist: aiomysql>=0.2.0; extra == 'mysql'
 Provides-Extra: postgres
@@ -56,40 +60,74 @@ Description-Content-Type: text/markdown
 [![PyPI version](https://img.shields.io/pypi/v/fastapi-admin-kit.svg)](https://pypi.org/project/fastapi-admin-kit/)
 [![Python versions](https://img.shields.io/pypi/pyversions/fastapi-admin-kit.svg)](https://pypi.org/project/fastapi-admin-kit/)
 [![License](https://img.shields.io/pypi/l/fastapi-admin-kit.svg)](https://github.com/borhanst/fastapi-admin-kit/blob/main/LICENSE)
+[![Tests](https://github.com/borhanst/fastapi-admin-kit/actions/workflows/tests.yml/badge.svg)](https://github.com/borhanst/fastapi-admin-kit/actions/workflows/tests.yml)
 
-A drop-in admin panel for FastAPI + SQLAlchemy apps, inspired by Django Unfold.
+A drop-in admin panel for FastAPI + SQLAlchemy + SQLModel apps, inspired by Django Unfold.
 
-> **⚠️ Important Notice:** This project is **not production-ready yet**. It is under active development, and the API and code may massive changes. Use it for development and testing purposes only.
+![FastAPI Admin Kit Dashboard](docs/assets/images/admin-dashboard.png)
 
 📖 **[Documentation](https://borhanst.github.io/fastapi-admin-kit/)** | 🚀 **[Quick Start](#quick-start)** | 📦 **[PyPI](https://pypi.org/project/fastapi-admin-kit/)**
 
 ## Features
 
-- Zero-config auto-discovery of SQLAlchemy models
-- Built-in authentication, RBAC, and audit logging
-- Modern UI with Tailwind CSS, HTMX, and Alpine.js
-- Fully customizable widgets, themes, and templates
-- Inline editing from list view with 3-dot action menu
-- CLI for user management (`fak-admin` / `fak` — create superusers, list users, change passwords)
-- Async-first with support for PostgreSQL, MySQL, and SQLite
+> See the **[Full Features List](https://borhanst.github.io/fastapi-admin-kit/guide/features/)** for every feature with detailed docs links.
+
+- **Zero-Config Auto-Discovery** — Register a model, get full CRUD UI automatically
+- **SQLAlchemy & SQLModel** — Works with both ORMs out of the box
+- **Built-in Auth & RBAC** — Session-based auth with role-based permissions per model
+- **Audit Logging** — Every create, update, and delete is recorded with full diffs
+- **Modern UI** — Tailwind CSS, HTMX, and Alpine.js with dark mode
+- **17 Built-in Widgets** — TextInput, Toggle, DatePicker, FileUpload, Wysiwyg, and more
+- **Inline Editing** — Edit records directly from list view with 3-dot action menu
+- **Command Palette** — `Cmd+K` / `Ctrl+K` global search across models and fields
+- **JSON API** — REST endpoints with JWT token auth for external frontends
+- **Dashboard** — Configurable stat cards, charts, tables, and progress bars
+- **CLI Tools** — `fak-admin` / `fak` for superuser management and project scaffolding
+- **Pagination** — Offset, cursor, or dynamic strategies per model
+- **Filters** — Text, boolean, relation, and enum sidebar filters
+- **File Uploads** — Built-in local storage backend with upload widgets
+- **Async-First** — PostgreSQL, MySQL, and SQLite with auto URL normalization
+- **CSRF & Rate Limiting** — Security built-in out of the box
 
 ## Installation
 
 ```bash
+# pip
 pip install fastapi-admin-kit
+
+# uv
+uv add fastapi-admin-kit
 ```
 
 For database-specific async drivers:
 
 ```bash
+# pip
 pip install fastapi-admin-kit[postgres]  # PostgreSQL via asyncpg
 pip install fastapi-admin-kit[mysql]     # MySQL via aiomysql
+
+# uv
+uv add fastapi-admin-kit[postgres]  # PostgreSQL via asyncpg
+uv add fastapi-admin-kit[mysql]     # MySQL via aiomysql
+```
+
+For the full experience with uvicorn and JWT support:
+
+```bash
+# pip
+pip install fastapi-admin-kit[full]
+
+# uv
+uv add fastapi-admin-kit[full]
 ```
 
 ## Quick Start
 
 ```python
+import os
+import secrets
 from contextlib import asynccontextmanager
+
 from fastapi import FastAPI
 from sqlalchemy import Column, Float, Integer, String
 from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
@@ -123,8 +161,8 @@ class Product(Base):
     price = Column(Float, nullable=False)
 
 
-DATABASE_URL = "sqlite+aiosqlite:///./app.db"
-SECRET_KEY = "change-me-to-a-random-secret-key-in-production"
+DATABASE_URL = os.getenv("DATABASE_URL", "sqlite+aiosqlite:///./app.db")
+SECRET_KEY = os.getenv("SECRET_KEY", secrets.token_urlsafe(32))
 
 engine = create_async_engine(DATABASE_URL)
 async_session = sessionmaker(engine, class_=AsyncSession)
@@ -151,6 +189,21 @@ admin = Admin(
 admin.register(Product)
 ```
 
+Run with:
+
+```bash
+pip install fastapi-admin-kit[full]
+uvicorn main:app --reload
+```
+
+Open [http://localhost:8000/admin/](http://localhost:8000/admin/) and log in with:
+
+- **Email:** `admin@example.com`
+- **Password:** `admin`
+
+!!! warning
+    Change the default password immediately in production!
+
 ## CLI Usage
 
 Both the full name and the short alias work interchangeably:
@@ -167,6 +220,13 @@ fak users
 # Change a user's password
 fak-admin changepassword -e admin@example.com -p newpassword
 fak changepassword -e admin@example.com -p newpassword
+
+# Scaffold a new fastapi project
+fak init myproject
+
+# Permission management
+fak createpermissions --base myapp.models.Base
+fak createpermissions myapp.models.User myapp.models.Product
 ```
 
 All commands accept `-d DATABASE_URL` or read the `DATABASE_URL` environment variable.
@@ -178,11 +238,14 @@ All commands accept `-d DATABASE_URL` or read the `DATABASE_URL` environment var
 | Variable | Description | Default |
 |---|---|---|
 | `DATABASE_URL` | Async database connection string | `sqlite+aiosqlite:///./app.db` |
-| `SECRET_KEY` | Signing key for sessions/CSRF/JWT (min 32 chars) | Required in production |
+| `SECRET_KEY` | Signing key for sessions/CSRF/JWT (min 32 chars) | Auto-generated if unset |
 
 ### Admin Options
 
 ```python
+from fastapi_admin_kit import Admin
+from fastapi_admin_kit.config import ThemeConfig
+
 admin = Admin(
     app=app,
     engine=engine,
@@ -191,8 +254,6 @@ admin = Admin(
     title="My Admin",           # Admin panel title
     admin_path="/admin",        # URL prefix
     dark_mode_default=False,    # Dark mode on by default
-    # Theme
-    theme=ThemeConfig(preset="modern", primary_color="#6366F1"),
     # Auth
     auth_backend=BuiltinAuthBackend(),
     # Environment badge
@@ -207,21 +268,42 @@ admin = Admin(
 - **PostgreSQL**: `pip install fastapi-admin-kit[postgres]` + set `DATABASE_URL=postgresql+asyncpg://...`
 - **MySQL**: `pip install fastapi-admin-kit[mysql]` + set `DATABASE_URL=mysql+aiomysql://...`
 
+### Optional Dependencies
+
+| Extra | Packages | When to use |
+|---|---|---|
+| `full` | `uvicorn`, `pyjwt` | Running the dev server or using JWT API auth |
+| `postgres` | `asyncpg` | PostgreSQL databases |
+| `mysql` | `aiomysql` | MySQL databases |
+| `sqlmodel` | `sqlmodel` | Using SQLModel models |
+| `docs` | `mkdocs`, `mkdocs-material` | Building documentation |
+
+## Security
+
+- Session cookies use `SameSite=Strict` and `Secure` by default
+- CSRF protection on all state-changing requests
+- Rate limiting on authentication endpoints
+- Passwords hashed with bcrypt
+- SQL injection prevention via identifier validation
+- Secret key validated to be >= 32 characters at startup
+
 ## Development
 
 ```bash
 # Install with dev dependencies
-pip install -e ".[dev]"
+uv sync
 
-# Run tests
-pytest
+# Run tests with coverage
+uv run pytest --cov=fastapi_admin_kit
 
 # Lint
-ruff check fastapi_admin_kit/
+uv run ruff check fastapi_admin_kit/
+
+# Format
+uv run ruff format fastapi_admin_kit/
 
 # Build distribution
-pip install hatch
-hatch build
+uv build
 ```
 
 ## License

{fastapi_admin_kit-0.2.0 → fastapi_admin_kit-0.2.1}/README.md

@@ -3,40 +3,74 @@
 [![PyPI version](https://img.shields.io/pypi/v/fastapi-admin-kit.svg)](https://pypi.org/project/fastapi-admin-kit/)
 [![Python versions](https://img.shields.io/pypi/pyversions/fastapi-admin-kit.svg)](https://pypi.org/project/fastapi-admin-kit/)
 [![License](https://img.shields.io/pypi/l/fastapi-admin-kit.svg)](https://github.com/borhanst/fastapi-admin-kit/blob/main/LICENSE)
+[![Tests](https://github.com/borhanst/fastapi-admin-kit/actions/workflows/tests.yml/badge.svg)](https://github.com/borhanst/fastapi-admin-kit/actions/workflows/tests.yml)
 
-A drop-in admin panel for FastAPI + SQLAlchemy apps, inspired by Django Unfold.
+A drop-in admin panel for FastAPI + SQLAlchemy + SQLModel apps, inspired by Django Unfold.
 
-> **⚠️ Important Notice:** This project is **not production-ready yet**. It is under active development, and the API and code may massive changes. Use it for development and testing purposes only.
+![FastAPI Admin Kit Dashboard](docs/assets/images/admin-dashboard.png)
 
 📖 **[Documentation](https://borhanst.github.io/fastapi-admin-kit/)** | 🚀 **[Quick Start](#quick-start)** | 📦 **[PyPI](https://pypi.org/project/fastapi-admin-kit/)**
 
 ## Features
 
-- Zero-config auto-discovery of SQLAlchemy models
-- Built-in authentication, RBAC, and audit logging
-- Modern UI with Tailwind CSS, HTMX, and Alpine.js
-- Fully customizable widgets, themes, and templates
-- Inline editing from list view with 3-dot action menu
-- CLI for user management (`fak-admin` / `fak` — create superusers, list users, change passwords)
-- Async-first with support for PostgreSQL, MySQL, and SQLite
+> See the **[Full Features List](https://borhanst.github.io/fastapi-admin-kit/guide/features/)** for every feature with detailed docs links.
+
+- **Zero-Config Auto-Discovery** — Register a model, get full CRUD UI automatically
+- **SQLAlchemy & SQLModel** — Works with both ORMs out of the box
+- **Built-in Auth & RBAC** — Session-based auth with role-based permissions per model
+- **Audit Logging** — Every create, update, and delete is recorded with full diffs
+- **Modern UI** — Tailwind CSS, HTMX, and Alpine.js with dark mode
+- **17 Built-in Widgets** — TextInput, Toggle, DatePicker, FileUpload, Wysiwyg, and more
+- **Inline Editing** — Edit records directly from list view with 3-dot action menu
+- **Command Palette** — `Cmd+K` / `Ctrl+K` global search across models and fields
+- **JSON API** — REST endpoints with JWT token auth for external frontends
+- **Dashboard** — Configurable stat cards, charts, tables, and progress bars
+- **CLI Tools** — `fak-admin` / `fak` for superuser management and project scaffolding
+- **Pagination** — Offset, cursor, or dynamic strategies per model
+- **Filters** — Text, boolean, relation, and enum sidebar filters
+- **File Uploads** — Built-in local storage backend with upload widgets
+- **Async-First** — PostgreSQL, MySQL, and SQLite with auto URL normalization
+- **CSRF & Rate Limiting** — Security built-in out of the box
 
 ## Installation
 
 ```bash
+# pip
 pip install fastapi-admin-kit
+
+# uv
+uv add fastapi-admin-kit
 ```
 
 For database-specific async drivers:
 
 ```bash
+# pip
 pip install fastapi-admin-kit[postgres]  # PostgreSQL via asyncpg
 pip install fastapi-admin-kit[mysql]     # MySQL via aiomysql
+
+# uv
+uv add fastapi-admin-kit[postgres]  # PostgreSQL via asyncpg
+uv add fastapi-admin-kit[mysql]     # MySQL via aiomysql
+```
+
+For the full experience with uvicorn and JWT support:
+
+```bash
+# pip
+pip install fastapi-admin-kit[full]
+
+# uv
+uv add fastapi-admin-kit[full]
 ```
 
 ## Quick Start
 
 ```python
+import os
+import secrets
 from contextlib import asynccontextmanager
+
 from fastapi import FastAPI
 from sqlalchemy import Column, Float, Integer, String
 from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
@@ -70,8 +104,8 @@ class Product(Base):
     price = Column(Float, nullable=False)
 
 
-DATABASE_URL = "sqlite+aiosqlite:///./app.db"
-SECRET_KEY = "change-me-to-a-random-secret-key-in-production"
+DATABASE_URL = os.getenv("DATABASE_URL", "sqlite+aiosqlite:///./app.db")
+SECRET_KEY = os.getenv("SECRET_KEY", secrets.token_urlsafe(32))
 
 engine = create_async_engine(DATABASE_URL)
 async_session = sessionmaker(engine, class_=AsyncSession)
@@ -98,6 +132,21 @@ admin = Admin(
 admin.register(Product)
 ```
 
+Run with:
+
+```bash
+pip install fastapi-admin-kit[full]
+uvicorn main:app --reload
+```
+
+Open [http://localhost:8000/admin/](http://localhost:8000/admin/) and log in with:
+
+- **Email:** `admin@example.com`
+- **Password:** `admin`
+
+!!! warning
+    Change the default password immediately in production!
+
 ## CLI Usage
 
 Both the full name and the short alias work interchangeably:
@@ -114,6 +163,13 @@ fak users
 # Change a user's password
 fak-admin changepassword -e admin@example.com -p newpassword
 fak changepassword -e admin@example.com -p newpassword
+
+# Scaffold a new fastapi project
+fak init myproject
+
+# Permission management
+fak createpermissions --base myapp.models.Base
+fak createpermissions myapp.models.User myapp.models.Product
 ```
 
 All commands accept `-d DATABASE_URL` or read the `DATABASE_URL` environment variable.
@@ -125,11 +181,14 @@ All commands accept `-d DATABASE_URL` or read the `DATABASE_URL` environment var
 | Variable | Description | Default |
 |---|---|---|
 | `DATABASE_URL` | Async database connection string | `sqlite+aiosqlite:///./app.db` |
-| `SECRET_KEY` | Signing key for sessions/CSRF/JWT (min 32 chars) | Required in production |
+| `SECRET_KEY` | Signing key for sessions/CSRF/JWT (min 32 chars) | Auto-generated if unset |
 
 ### Admin Options
 
 ```python
+from fastapi_admin_kit import Admin
+from fastapi_admin_kit.config import ThemeConfig
+
 admin = Admin(
     app=app,
     engine=engine,
@@ -138,8 +197,6 @@ admin = Admin(
     title="My Admin",           # Admin panel title
     admin_path="/admin",        # URL prefix
     dark_mode_default=False,    # Dark mode on by default
-    # Theme
-    theme=ThemeConfig(preset="modern", primary_color="#6366F1"),
     # Auth
     auth_backend=BuiltinAuthBackend(),
     # Environment badge
@@ -154,21 +211,42 @@ admin = Admin(
 - **PostgreSQL**: `pip install fastapi-admin-kit[postgres]` + set `DATABASE_URL=postgresql+asyncpg://...`
 - **MySQL**: `pip install fastapi-admin-kit[mysql]` + set `DATABASE_URL=mysql+aiomysql://...`
 
+### Optional Dependencies
+
+| Extra | Packages | When to use |
+|---|---|---|
+| `full` | `uvicorn`, `pyjwt` | Running the dev server or using JWT API auth |
+| `postgres` | `asyncpg` | PostgreSQL databases |
+| `mysql` | `aiomysql` | MySQL databases |
+| `sqlmodel` | `sqlmodel` | Using SQLModel models |
+| `docs` | `mkdocs`, `mkdocs-material` | Building documentation |
+
+## Security
+
+- Session cookies use `SameSite=Strict` and `Secure` by default
+- CSRF protection on all state-changing requests
+- Rate limiting on authentication endpoints
+- Passwords hashed with bcrypt
+- SQL injection prevention via identifier validation
+- Secret key validated to be >= 32 characters at startup
+
 ## Development
 
 ```bash
 # Install with dev dependencies
-pip install -e ".[dev]"
+uv sync
 
-# Run tests
-pytest
+# Run tests with coverage
+uv run pytest --cov=fastapi_admin_kit
 
 # Lint
-ruff check fastapi_admin_kit/
+uv run ruff check fastapi_admin_kit/
+
+# Format
+uv run ruff format fastapi_admin_kit/
 
 # Build distribution
-pip install hatch
-hatch build
+uv build
 ```
 
 ## License

{fastapi_admin_kit-0.2.0 → fastapi_admin_kit-0.2.1}/fastapi_admin_kit/__init__.py

@@ -75,4 +75,4 @@ __all__ = [
     # Per-model assets
     "AdminExtra",
 ]
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{fastapi_admin_kit-0.2.0 → fastapi_admin_kit-0.2.1}/fastapi_admin_kit/admin/admin_database.py

@@ -2,10 +2,23 @@
 
 from __future__ import annotations
 
+import logging
+import re
 from typing import Any
 
 from fastapi_admin_kit.config.database import DatabaseConfig
 
+logger = logging.getLogger(__name__)
+
+_TABLE_NAME_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
+
+
+def _validate_identifier(name: str, kind: str = "table") -> str:
+    """Validate a SQL identifier to prevent injection."""
+    if not _TABLE_NAME_RE.match(name):
+        raise ValueError(f"Invalid {kind} name: {name!r}")
+    return name
+
 
 class AdminDatabase:
     """Handles database setup, table creation, and role seeding."""
@@ -71,9 +84,11 @@ class AdminDatabase:
         for table_name, table in metadata.tables.items():
             if not inspector.has_table(table_name):
                 continue
+            safe_table = _validate_identifier(table_name)
             existing_cols = {c["name"] for c in inspector.get_columns(table_name)}
             for col in table.columns:
                 if col.name not in existing_cols:
+                    safe_col = _validate_identifier(col.name, "column")
                     col_type = col.type.compile(self.engine.dialect)
                     nullable = "NULL" if col.nullable else "NOT NULL"
                     default = ""
@@ -85,8 +100,8 @@ class AdminDatabase:
                     elif col.default is not None and col.default.is_seq:
                         pass
                     sql = text(
-                        f"""ALTER TABLE {table_name}
-                        ADD COLUMN {col.name} {col_type}
+                        f"""ALTER TABLE {safe_table}
+                        ADD COLUMN {safe_col} {col_type}
                         {nullable}{default}"""
                     )
                     with self.engine.begin() as conn:
@@ -107,9 +122,11 @@ class AdminDatabase:
         for table_name, table in metadata.tables.items():
             if not inspector.has_table(table_name):
                 continue
+            safe_table = _validate_identifier(table_name)
             existing_cols = {c["name"] for c in inspector.get_columns(table_name)}
             for col in table.columns:
                 if col.name not in existing_cols:
+                    safe_col = _validate_identifier(col.name, "column")
                     col_type = col.type.compile(dialect)
                     nullable = "NULL" if col.nullable else "NOT NULL"
                     default = ""
@@ -121,16 +138,20 @@ class AdminDatabase:
                     elif not col.nullable:
                         # SQLite requires a default for NOT NULL columns being added
                         type_defaults = {
-                            "VARCHAR": "''", "TEXT": "''", "INTEGER": "0",
-                            "FLOAT": "0.0", "BOOLEAN": "0", "DATETIME": "''",
+                            "VARCHAR": "''",
+                            "TEXT": "''",
+                            "INTEGER": "0",
+                            "FLOAT": "0.0",
+                            "BOOLEAN": "0",
+                            "DATETIME": "''",
                         }
                         sql_type = col_type.upper().split("(")[0]
                         temp_val = type_defaults.get(sql_type, "''")
                         default = f" DEFAULT {temp_val}"
                     sql = text(
-                        f"""ALTER TABLE {table_name}
+                        f"""ALTER TABLE {safe_table}
                         ADD COLUMN
-                        {col.name} {col_type} {nullable}{default}
+                        {safe_col} {col_type} {nullable}{default}
                         """
                     )
                     sync_conn.execute(sql)

{fastapi_admin_kit-0.2.0 → fastapi_admin_kit-0.2.1}/fastapi_admin_kit/admin/admin_template.py

@@ -65,6 +65,7 @@ class AdminTemplate:
             user = getattr(request.state, "admin_user", None)
 
         snapshot = getattr(request.state, "admin_user_snapshot", None)
+        user_for_template = snapshot if snapshot else user
         is_superuser = (
             (
                 bool(snapshot.get("is_superuser", False))
@@ -120,8 +121,10 @@ class AdminTemplate:
                                         can_edit=perm.can_edit,
                                         can_delete=perm.can_delete,
                                     )
-                    except Exception:
-                        pass
+                    except Exception as exc:
+                        import logging
+
+                        logging.getLogger(__name__).debug("Permission query failed: %s", exc)
 
         def _item_visible(item: Any) -> bool:
             return (
@@ -181,7 +184,7 @@ class AdminTemplate:
         return {
             "nav_groups": filtered_groups,
             "permissions_map": permissions_map,
-            "current_user": user,
+            "current_user": user_for_template,
             "dashboard_visible": dashboard_visible,
             "settings_visible": settings_visible,
         }