fastapi-admin-kit 0.4.0__tar.gz → 0.5.0__tar.gz

{fastapi_admin_kit-0.4.0 → fastapi_admin_kit-0.5.0}/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Robust Django-style filtering system
+  ([#52](https://github.com/borhanst/fastapi-admin-kit/issues/52)):
+  - New lookup types for the JSON API and admin UI list views:
+    `icontains`, `startswith`, `endswith`, `gt`, `gte`, `lt`, `lte`,
+    `range`, and `in` — in addition to exact matches.
+  - New `ChoiceFilter` for relation/FK fields (auto-detected in
+    `FilterRegistry.auto_generate()`), plus `IntegerFilter` with full
+    numeric lookups.
+  - Admin UI now renders text-input filters (case-insensitive contains)
+    and min/max inputs for numeric fields.
+  - Filters are ORM-agnostic: `QueryBackend` gained an `and_` combinator
+    and the in-memory backend now handles `%`-anchored `ilike` patterns.
+- `Admin.setup()` now logs a non-blocking preflight warning naming any missing
+  `admin_ai_*` tables (with the command to fix them) when `ai_enabled=True`
+  but the schema is absent (Alembic / `SKIP_CREATE_TABLES=true` mode).
+- `fastapi_admin_kit.schemas.builtin.AI_TABLE_NAMES` and
+  `INTERNAL_TABLE_NAMES` constants for gating/identification.
+- `AdminRegistry.auto_discover(exclude_tables=...)` accepts a set of table
+  names to skip during discovery.
+
 ### Changed
 - **AI is now gated behind `ai_enabled` (default `False`).** When AI is
   disabled, the `admin_ai_*` tables are not created, and the AI models, nav
@@ -17,15 +38,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   JSON API (previously a latent security hole). They remain hidden from the
   sidebar.
 
-### Added
-- `Admin.setup()` now logs a non-blocking preflight warning naming any missing
-  `admin_ai_*` tables (with the command to fix them) when `ai_enabled=True`
-  but the schema is absent (Alembic / `SKIP_CREATE_TABLES=true` mode).
-- `fastapi_admin_kit.schemas.builtin.AI_TABLE_NAMES` and
-  `INTERNAL_TABLE_NAMES` constants for gating/identification.
-- `AdminRegistry.auto_discover(exclude_tables=...)` accepts a set of table
-  names to skip during discovery.
-
 ## [0.3.2] - 2026-07-31
 
 ### Changed

{fastapi_admin_kit-0.4.0 → fastapi_admin_kit-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fastapi-admin-kit
-Version: 0.4.0
+Version: 0.5.0
 Summary: Drop-in admin panel for FastAPI + SQLAlchemy + SQLModel apps
 Project-URL: Homepage, https://github.com/borhanst/fastapi-admin-kit
 Project-URL: Documentation, https://borhanst.github.io/fastapi-admin-kit/
@@ -39,6 +39,7 @@ Requires-Dist: pydantic-ai>=2.0.0; extra == 'ai-gemini'
 Provides-Extra: alembic
 Requires-Dist: alembic>=1.13.0; extra == 'alembic'
 Provides-Extra: dev
+Requires-Dist: fakeredis>=2.26.0; extra == 'dev'
 Requires-Dist: hatch>=1.13.0; extra == 'dev'
 Requires-Dist: httpx>=0.27.0; extra == 'dev'
 Requires-Dist: pre-commit>=3.5.0; extra == 'dev'
@@ -62,6 +63,8 @@ Provides-Extra: notifications
 Requires-Dist: twilio>=8.9.0; extra == 'notifications'
 Provides-Extra: postgres
 Requires-Dist: asyncpg>=0.29.0; extra == 'postgres'
+Provides-Extra: redis
+Requires-Dist: fastapi-redis-sdk>=0.8.0; extra == 'redis'
 Provides-Extra: sqlmodel
 Requires-Dist: sqlmodel>=0.0.39; extra == 'sqlmodel'
 Description-Content-Type: text/markdown

fastapi_admin_kit-0.5.0/SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Reporting Security Issues
+
+**DO NOT report security vulnerabilities via public GitHub issues.**
+
+Instead, please report them by emailing security@fastapi-admin-kit.com with:
+
+- A detailed description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact and affected versions
+- Any proof-of-concept code (if applicable)
+
+## What to Include
+
+Please include the following in your report:
+
+1. **Vulnerability type** (e.g., XSS, SQL injection, authentication bypass, etc.)
+2. **Affected components** or endpoints
+3. **Steps to reproduce**
+4. **Expected vs. actual behavior**
+5. **Environment details** (OS, Python version, framework version)
+6. **Suggested fix** (optional but appreciated)
+
+
+## Security Policy
+
+This project follows responsible disclosure. We will:
+
+- Credit reporters in the release notes (unless requested otherwise)
+- Fix security issues in a timely manner
+- Publish security advisories via the GitHub Security tab

{fastapi_admin_kit-0.4.0 → fastapi_admin_kit-0.5.0}/fastapi_admin_kit/__init__.py

@@ -1,7 +1,7 @@
 """FastAPI Admin Kit — Drop-in admin panel for FastAPI + SQLAlchemy apps."""
 
 from fastapi_admin_kit.admin import Admin
-from fastapi_admin_kit.admin.decorators import column
+from fastapi_admin_kit.admin.decorators import column, endpoint
 from fastapi_admin_kit.auth.mixins import AuthModelMixin
 from fastapi_admin_kit.config import DatabaseConfig, DatabaseType
 from fastapi_admin_kit.exceptions import ConfigError
@@ -74,6 +74,7 @@ __all__ = [
     "RegisteredModel",
     "ModelAdmin",
     "column",
+    "endpoint",
     "BuiltNavGroup",
     "BuiltNavItem",
     "DefaultSidebarBuilder",
@@ -133,4 +134,4 @@ __all__ = [
     "configure_notifications",
     "notifications_router",
 ]
-__version__ = "0.4.0"
+__version__ = "0.5.0"

{fastapi_admin_kit-0.4.0 → fastapi_admin_kit-0.5.0}/fastapi_admin_kit/admin/admin_config.py

@@ -7,6 +7,7 @@ from fastapi_admin_kit.config import (
     AuditConfig,
     AuthConfig,
     BehaviorConfig,
+    CacheConfig,
     NavConfig,
     StorageConfig,
     UIConfig,
@@ -29,6 +30,7 @@ class AdminConfig:
         nav: NavConfig | None = None,
         template_dirs: list[str] | None = None,
         ai_chat: AIChatConfig | None = None,
+        cache: CacheConfig | None = None,
     ):
         self.ui = ui or UIConfig()
         self.auth = auth or AuthConfig()
@@ -38,6 +40,7 @@ class AdminConfig:
         self.nav = nav or NavConfig()
         self.template_dirs = template_dirs or []
         self.ai_chat = ai_chat or AIChatConfig()
+        self.cache = cache or CacheConfig()
 
     def validate_all(self) -> None:
         """Validate all configuration components."""
@@ -45,6 +48,7 @@ class AdminConfig:
         self.audit.validate_audit_config()
         self.storage.validate_storage_config()
         self.nav.validate_nav_config()
+        self.cache.validate_cache_config()
 
     def get_ui_context(self) -> dict:
         """Get UI configuration for template context."""

{fastapi_admin_kit-0.4.0 → fastapi_admin_kit-0.5.0}/fastapi_admin_kit/admin/admin_database.py

@@ -43,13 +43,31 @@ class AdminDatabase:
             admin_database=self, database_config=database_config
         )
 
+    @property
+    def resolved_engine(self) -> Any:
+        """Return the SQLAlchemy engine, lazily creating it from
+        ``database_config`` if no engine was passed at construction time.
+
+        This is the property to use everywhere a backend call needs an
+        engine. Reading the raw ``self.engine`` attribute can be ``None``
+        when the project supplied a ``database_config`` instead of an
+        ``engine`` — calling methods on it then surfaces a confusing
+        ``AttributeError: 'NoneType' object has no attribute
+        '_run_ddl_visitor'`` from deep inside SQLAlchemy.
+        """
+        return self._ensure_engine()
+
     def _ensure_engine(self) -> Any:
         """Create the async engine from ``database_config`` if no engine is set."""
         if self.engine is None and self.database_config is not None:
             self.engine = self.database_config.create_engine()
         return self.engine
 
-    async def _create_tables(self, include_ai_tables: bool = True) -> None:
+    async def _create_tables(
+        self,
+        include_ai_tables: bool = True,
+        extra_exclude_tables: list[str] | None = None,
+    ) -> None:
         """Create all admin database tables (async-safe).
 
         If ``use_alembic=True`` (production mode), this method does nothing
@@ -59,6 +77,13 @@ class AdminDatabase:
         ``admin_ai_*`` tables are skipped. This is safe because the AI schemas
         declare ``relations=[]`` and no FK columns (the "log pattern"), so
         excluding them cannot break ``create_all`` dependency sorting.
+
+        ``extra_exclude_tables`` lets callers (typically the ``Admin`` setup
+        path) drop built-in tables that should not be created for this
+        installation — most notably the default ``admin_users`` /
+        ``admin_user_roles`` tables when a project supplies a custom
+        ``auth_model``. Filtering at ``create_all`` time avoids mutating the
+        shared ``AdminBase.metadata`` (whose FacadeDict is immutable).
         """
         if self.use_alembic:
             logger.info("use_alembic=True: skipping create_all; schema managed by Alembic")
@@ -67,24 +92,42 @@ class AdminDatabase:
         from fastapi_admin_kit.migrations.models import Base as AdminBase
         from fastapi_admin_kit.schemas.builtin import AI_TABLE_NAMES
 
+        exclude = set(extra_exclude_tables or ())
+
         def _filtered(metadata: Any) -> Any:
-            if include_ai_tables:
+            drop = exclude | (set() if include_ai_tables else AI_TABLE_NAMES)
+            if not drop:
                 return None  # create_all(tables=None) == all tables
-            return [t for name, t in metadata.tables.items() if name not in AI_TABLE_NAMES]
+            return [t for name, t in metadata.tables.items() if name not in drop]
 
         ai_filtered_admin = _filtered(AdminBase.metadata)
         ai_filtered_base = _filtered(self.base.metadata) if self.base is not None else None
 
+        engine = self.resolved_engine
+        if engine is None:
+            raise RuntimeError(
+                "AdminDatabase has no engine: pass `engine=` or "
+                "`database_config=` to Admin() so the admin tables can be "
+                "created. If you manage schema via Alembic, set "
+                "`use_alembic=True` on Admin() to skip create_all."
+            )
+
         await self._run_backend(
-            self._backend.create_tables, self.engine, AdminBase.metadata, ai_filtered_admin
+            self._backend.create_tables,
+            engine,
+            AdminBase.metadata,
+            ai_filtered_admin,
         )
         if self.base is not None:
             await self._run_backend(
-                self._backend.create_tables, self.engine, self.base.metadata, ai_filtered_base
+                self._backend.create_tables,
+                engine,
+                self.base.metadata,
+                ai_filtered_base,
             )
-        await self._run_backend(self._backend.auto_migrate, self.engine, AdminBase.metadata)
+        await self._run_backend(self._backend.auto_migrate, engine, AdminBase.metadata)
         if self.base is not None:
-            await self._run_backend(self._backend.auto_migrate, self.engine, self.base.metadata)
+            await self._run_backend(self._backend.auto_migrate, engine, self.base.metadata)
 
     async def _missing_tables(self, ai_enabled: bool, names: list[str]) -> set[str]:
         """Return the subset of ``names`` whose tables do not exist yet.

{fastapi_admin_kit-0.4.0 → fastapi_admin_kit-0.5.0}/fastapi_admin_kit/admin/admin_router.py

@@ -31,7 +31,12 @@ class AdminRouter:
         for registered in registry.all():
             if getattr(registered.admin, "skip_auto_routes", False):
                 continue
+            # API-only models (export_endpoint="api") get no admin HTML router.
+            if getattr(registered.admin, "export_endpoint", None) == "api":
+                continue
             model_router = build_model_router(registered)
+            if model_router is None:
+                continue
             app.include_router(model_router, prefix=self.admin_path)
 
         # Auth routes (login/logout)

{fastapi_admin_kit-0.4.0 → fastapi_admin_kit-0.5.0}/fastapi_admin_kit/admin/builtin_models.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 from typing import Any
 
+from fastapi_admin_kit.inspection.types import SENSITIVE_FIELDS
 from fastapi_admin_kit.modeladmin import ModelAdmin
 from fastapi_admin_kit.types import ExtraField
 from fastapi_admin_kit.widgets.inputs import AutocompleteWidget, PasswordWidget
@@ -70,7 +71,7 @@ async def flush_pending_perm_ops(request):
     from fastapi_admin_kit.db import get_db_session
 
     perm_ids = getattr(request.state, "_admin_perm_perm_ids", None)
-    if not perm_ids or not isinstance(perm_ids, list):
+    if perm_ids is None or not isinstance(perm_ids, list):
         return
 
     # Get the user object from request state
@@ -107,7 +108,7 @@ class UserAdmin(ModelAdmin):
     list_display = ["id", "email", "full_name", "is_superuser", "is_active"]
     search_fields = ["email", "full_name"]
     inline_edit = True
-    exclude = ["hashed_password", "password_changed_at"]
+    exclude = ["password", "password_changed_at"]
     extra_fields = [
         ExtraField(
             name="password",
@@ -124,14 +125,40 @@ class UserAdmin(ModelAdmin):
         ),
     }
 
+    def _actor_is_superuser(self, request) -> bool:
+        """Return True if the acting user may modify privileged user fields."""
+        if request is None:
+            return False
+        snapshot = getattr(request.state, "admin_user_snapshot", None) or {}
+        return bool(snapshot.get("is_superuser", False))
+
+    def _strip_privileged_fields(self, data, request):
+        """Remove privilege-granting fields unless a superuser is acting.
+
+        Prevents privilege escalation via mass assignment: a non-superuser
+        with edit permission on admin_users must not grant themselves
+        ``is_superuser``, toggle ``is_active``, change ``roles``, or write
+        secret columns (``password`` etc.) directly.
+        """
+        if self._actor_is_superuser(request):
+            return data
+        from fastapi_admin_kit.inspection.types import PRIVILEGED_ASSIGNMENT_FIELDS
+
+        for field in SENSITIVE_FIELDS | PRIVILEGED_ASSIGNMENT_FIELDS:
+            data.pop(field, None)
+        return data
+
     def prepare_create_data(self, data, request=None):
         from fastapi_admin_kit.auth.models import User
 
+        # Strip first so a direct password injection is removed,
+        # then derive password from the (validated) password field.
+        self._strip_privileged_fields(data, request)
         password = data.pop("password", None)
         if password:
-            data["hashed_password"] = User.hash_password(password)
+            data["password"] = User.hash_password(password)
         else:
-            data["hashed_password"] = ""
+            data["password"] = ""
         return data
 
     def validate_create(self, data, request=None):
@@ -162,6 +189,12 @@ class UserAdmin(ModelAdmin):
                 raise FieldError({"password": errors})
         return data
 
+    def prepare_update_data(self, data: dict[str, Any], request: Any = None) -> dict[str, Any]:
+        """Strip extra fields and privileged fields before an update."""
+        extra_names = {f.name for f in self.extra_fields}
+        data = {k: v for k, v in data.items() if k not in extra_names}
+        return self._strip_privileged_fields(data, request)
+
     def on_update(self, obj, data, request=None):
         pass
 
@@ -169,7 +202,7 @@ class UserAdmin(ModelAdmin):
         if request is None:
             return
         perm_data = getattr(request.state, "_admin_perm_data", None)
-        if perm_data:
+        if perm_data is not None:
             request.state._admin_perm_perm_ids = perm_data
             request.state._admin_perm_user_obj = obj
 
@@ -177,7 +210,7 @@ class UserAdmin(ModelAdmin):
         if request is None:
             return
         perm_data = getattr(request.state, "_admin_perm_data", None)
-        if perm_data:
+        if perm_data is not None:
             request.state._admin_perm_perm_ids = perm_data
             request.state._admin_perm_user_obj = obj