fastapi-panel 0.1.0__tar.gz

fastapi_panel-0.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,28 @@
+name: Bug report
+description: Something doesn't work as documented
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: For security issues, please use a [private advisory](https://github.com/zaman-labs/fastapi-panel/security/advisories/new) instead.
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened, and what did you expect?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: How to reproduce
+      description: A small model and ModelAdmin help the most.
+      render: python
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: Versions
+      placeholder: fastapi-panel 0.1.0, SQLAlchemy 2.0, FastAPI 0.115, Python 3.12, PostgreSQL 16
+    validations:
+      required: true

fastapi_panel-0.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,18 @@
+name: Feature request
+description: Suggest something new
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What are you trying to do?
+      description: Describe the problem, not only the solution.
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: What would you like to happen?
+      description: If another admin tool has this, tell us how it works there.
+    validations:
+      required: true

fastapi_panel-0.1.0/.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: monthly
+  - package-ecosystem: uv
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: monthly

fastapi_panel-0.1.0/.github/pull_request_template.md

@@ -0,0 +1,10 @@
+## What and why
+
+<!-- What does this change, and what problem does it solve? Link the issue if there is one. -->
+
+## Checklist
+
+- [ ] Targets the `develop` branch
+- [ ] Tests added or updated
+- [ ] `uv run ruff format . && uv run ruff check . && uv run pytest` passes
+- [ ] Docs and `CHANGELOG.md` updated if users will notice

fastapi_panel-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv sync
+      - run: uv run ruff format --check .
+      - run: uv run ruff check .
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: uv sync
+      - run: uv run pytest
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv build
+      - name: Templates and static files are in the wheel
+        run: |
+          unzip -l dist/*.whl | grep -q 'templates/fastapi_panel/base.html'
+          unzip -l dist/*.whl | grep -q 'static/panel.css'

fastapi_panel-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,21 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - run: uv build
+      - run: uv publish

fastapi_panel-0.1.0/.gitignore

@@ -0,0 +1,15 @@
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+*.db
+.DS_Store
+.idea/
+.vscode/
+media/

fastapi_panel-0.1.0/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes are listed here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and versions follow [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-11-04
+
+First release.
+
+### Added
+
+- `AdminSite`, `ModelAdmin`, `register` and `autodiscover`, with startup checks for configuration mistakes
+- List pages with sorting, search, filters, date drill-down, pagination, list editing, bulk actions and CSV export
+- Forms generated from SQLAlchemy models, with fieldsets, read-only fields, validation hooks and Pydantic schemas
+- Foreign key dropdowns and autocomplete, many-to-many pickers, tabular and stacked inlines
+- `ModelAuth`, `StaticAuth`, and an `AuthBackend` base class for your own
+- Per-model, per-action and row-level permissions
+- Audit log and per-record history
+- CSRF protection, signed sessions, login throttling, a strict Content-Security-Policy
+- Sync and async engines, SQLModel, composite primary keys
+- Dark mode and a responsive layout
+- `FileField`, `ImageField`, `Storage` and `LocalStorage` for uploads, with previews, thumbnails and login-protected links
+- A **+** button next to relation fields, to create a related record in a dialog and select it
+- CSV import with `csv_import`: a preview first, updates through a primary key column, all or nothing
+- `soft_delete_field`, with a Deleted page to restore rows or remove them for good
+- `python -m fastapi_panel createuser`
+- `AdminSite(timezone=...)` and `naive_utc`
+- Collapsible sidebar groups

fastapi_panel-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,7 @@
+# Code of Conduct
+
+This project follows the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
+
+In short: be respectful, assume good intent, and keep criticism about the work. Harassment and personal attacks aren't tolerated in any project space.
+
+To report unacceptable behavior, contact the maintainers privately through the [zaman-labs organization](https://github.com/zaman-labs). Reports are handled in confidence.

fastapi_panel-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing
+
+Bug reports, ideas and pull requests are all welcome. For anything big, open an issue first so we can agree on the approach.
+
+## Setup
+
+You need [uv](https://docs.astral.sh/uv/).
+
+```bash
+git clone https://github.com/zaman-labs/fastapi-panel
+cd fastapi-panel
+uv sync
+uv run pytest
+```
+
+Before pushing:
+
+```bash
+uv run ruff format .
+uv run ruff check .
+uv run pytest
+```
+
+To see your changes in a browser, run the [example shop](examples/shop). To check the interface end to end and refresh the screenshots, keep the example running on port 8765 and run:
+
+```bash
+uv run --with playwright python scripts/screenshots.py
+```
+
+## Branches
+
+- `main` is what's released, and always stable.
+- `develop` is where work comes together. Open pull requests against it.
+- Name your branch `feature/<name>`, `fix/<name>` or `docs/<name>`.
+
+To release, merge `develop` into `main`, bump the version in `src/fastapi_panel/__init__.py`, update `CHANGELOG.md`, and publish a GitHub release tagged `vX.Y.Z`. That triggers the upload to PyPI.
+
+## Commits
+
+Use [Conventional Commits](https://www.conventionalcommits.org/): `feat: add radio fields`, `fix: keep filters after saving`, `docs: explain inlines`. Keep each commit about one thing.
+
+## What we look for
+
+- **Small and readable.** This library should stay easy to read in an afternoon. Prefer fewer options and plain code over flexibility nobody needs yet.
+- **Consistent.** New options follow the naming of the existing ones.
+- **Tested.** New behavior and bug fixes come with a test. Security behavior always does.
+- **Secure by default.** No inline scripts or styles, and no new way to write a field that isn't on the form. Anything that touches login, sessions or permissions gets extra attention.
+- **No new dependencies** unless there's really no other way.
+
+## Reporting security issues
+
+Please don't open a public issue. See [SECURITY.md](SECURITY.md).
+
+## Code of conduct
+
+Everyone taking part agrees to our [Code of Conduct](CODE_OF_CONDUCT.md).

fastapi_panel-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zaman Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

fastapi_panel-0.1.0/PKG-INFO

@@ -0,0 +1,151 @@
+Metadata-Version: 2.5
+Name: fastapi-panel
+Version: 0.1.0
+Summary: An admin panel for FastAPI and SQLAlchemy. Register a model, get a secure back office.
+Project-URL: Homepage, https://github.com/zaman-labs/fastapi-panel
+Project-URL: Documentation, https://github.com/zaman-labs/fastapi-panel/tree/main/docs
+Project-URL: Changelog, https://github.com/zaman-labs/fastapi-panel/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/zaman-labs/fastapi-panel/issues
+Author: Zaman Labs
+License-Expression: MIT
+License-File: LICENSE
+Keywords: admin,admin-panel,backoffice,crud,fastapi,sqlalchemy,sqlmodel
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Web Environment
+Classifier: Framework :: AsyncIO
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.110
+Requires-Dist: jinja2>=3.1
+Requires-Dist: python-multipart>=0.0.18
+Requires-Dist: sqlalchemy[asyncio]>=2.0.20
+Requires-Dist: starlette>=0.40
+Description-Content-Type: text/markdown
+
+<h1 align="center">FastAPI Panel</h1>
+
+<p align="center">
+  <strong>A modular admin panel for FastAPI.</strong><br>
+  Register a SQLAlchemy model, get a secure back office.
+</p>
+
+<p align="center">
+  <a href="https://github.com/zaman-labs/fastapi-panel/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/zaman-labs/fastapi-panel/actions/workflows/ci.yml/badge.svg"></a>
+  <a href="https://pypi.org/project/fastapi-panel/"><img alt="PyPI" src="https://img.shields.io/pypi/v/fastapi-panel"></a>
+  <img alt="Python 3.10+" src="https://img.shields.io/badge/python-3.10%2B-blue">
+  <a href="https://github.com/zaman-labs/fastapi-panel/blob/main/LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-green"></a>
+</p>
+
+![The product list, with search, filters, bulk actions and inline editing](https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/changelist.png)
+
+If you know `ModelAdmin`, you already know this library: `list_display`, `search_fields`, `list_filter`, `fieldsets`, `inlines`, actions and the rest work the way you expect. There is no frontend build, no Node and no extra service. It's server-rendered pages inside your FastAPI app.
+
+## Install
+
+```bash
+pip install fastapi-panel
+```
+
+## Quick start
+
+```python
+from fastapi import FastAPI
+from fastapi_panel import ModelAdmin, ModelAuth, register, site
+from sqlalchemy.ext.asyncio import create_async_engine
+
+from myapp.models import Product, User
+
+engine = create_async_engine("postgresql+asyncpg://...")
+app = FastAPI()
+
+
+@register(Product)
+class ProductAdmin(ModelAdmin):
+    list_display = ("name", "category", "price", "is_published")
+    list_filter = ("is_published", "category")
+    search_fields = ("name", "category__name")
+    ordering = ("-created_at",)
+
+
+site.mount(
+    app,
+    engine=engine,
+    auth=ModelAuth(User, superuser_field="is_superuser"),
+    secret_key=settings.PANEL_SECRET_KEY,
+)
+```
+
+Open `/admin`, log in, and you have a list page, add and edit forms, delete confirmation, bulk actions, CSV export and a change history. See the [getting started guide](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/getting-started.md) for creating your first user with `python -m fastapi_panel createuser` and setting up migrations.
+
+Want to try it first? The [example shop](https://github.com/zaman-labs/fastapi-panel/tree/main/examples/shop) runs in one command.
+
+## What you get
+
+| | |
+|---|---|
+| **Change lists** | Columns, computed columns, sorting, search across relations, sidebar filters, date drill-down, pagination, editing in the list |
+| **Forms** | Built from your models, with fieldsets, read-only fields, prefilled slugs, validation hooks, Pydantic schemas, foreign key autocomplete, many-to-many pickers, and a **+** button to create a related record on the spot |
+| **Files and images** | Uploads with previews and thumbnails, stored on disk or anywhere else through a small storage class |
+| **Import and restore** | CSV import with a preview before anything is saved, and a Deleted page to restore soft-deleted records |
+| **Inlines** | Tabular and stacked, with add, edit and delete on the parent's page |
+| **Actions** | Your own bulk actions, plus delete with a summary of what cascades, CSV export and "select all across pages" |
+| **Permissions** | Per model and per action, row-level through `get_queryset` and `has_*_permission` |
+| **Audit log** | Who changed which fields and when, shown on each record's history page |
+| **Any SQLAlchemy setup** | Sync and async engines, SQLModel, composite primary keys |
+| **Timezones** | Show and enter times in your site's timezone, while the database stays in UTC |
+| **Interface** | Dark mode, works on a phone, keyboard friendly, no external assets |
+
+<table>
+  <tr>
+    <td><img alt="An order with its items edited inline" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/order-inline.png"></td>
+    <td><img alt="A product form with fieldsets and a many-to-many picker" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/product-form.png"></td>
+  </tr>
+  <tr>
+    <td><img alt="The dashboard with recent actions" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/dashboard.png"></td>
+    <td><img alt="The product list in dark mode" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/changelist-dark.png"></td>
+  </tr>
+  <tr>
+    <td><img alt="Adding a category in a dialog from the product form" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/related-popup.png"></td>
+    <td><img alt="A CSV import preview before anything is saved" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/import-preview.png"></td>
+  </tr>
+</table>
+
+## Security
+
+An admin panel can reach all your data, so these are on by default and have no off switch to forget:
+
+- CSRF tokens and `Origin` checks on every POST
+- Signed `HttpOnly`, `SameSite=Lax` session cookies, `Secure` on HTTPS, ended by a password change or by deactivating the user
+- Login throttling, no way to tell a wrong username from a wrong password, scrypt password hashing
+- A strict Content-Security-Policy with no inline scripts or styles, `X-Frame-Options: DENY`, `no-store` caching
+- Columns named like `password`, `token` or `secret` stay hidden unless you ask for them, and the audit log stores field names, never values
+- Only fields on the form can be written, and sort and filter parameters are allowlisted
+- Spreadsheet formulas are neutralised in CSV exports
+- Uploads get random names, images are checked against their contents, and files are only served behind login
+
+The panel refuses to start without authentication or with a short secret key. Read [the security guide](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/security.md) for what's left to you.
+
+## Documentation
+
+- [Getting started](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/getting-started.md)
+- [ModelAdmin reference](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/model-admin.md): lists, forms, inlines, actions, filters
+- [Authentication and permissions](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/auth-and-permissions.md)
+- [Modular projects and customizing](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/customizing.md): autodiscovery, multiple sites, custom pages, templates, themes
+- [Security](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/security.md)
+
+## Roadmap
+
+Translations, a saved-filters UI, password reset by email, two-factor login, and a Redis option for login throttling across workers. Ideas and pull requests are welcome, see [CONTRIBUTING](https://github.com/zaman-labs/fastapi-panel/blob/main/CONTRIBUTING.md).
+
+## License
+
+[MIT](https://github.com/zaman-labs/fastapi-panel/blob/main/LICENSE)

fastapi_panel-0.1.0/README.md

@@ -0,0 +1,118 @@
+<h1 align="center">FastAPI Panel</h1>
+
+<p align="center">
+  <strong>A modular admin panel for FastAPI.</strong><br>
+  Register a SQLAlchemy model, get a secure back office.
+</p>
+
+<p align="center">
+  <a href="https://github.com/zaman-labs/fastapi-panel/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/zaman-labs/fastapi-panel/actions/workflows/ci.yml/badge.svg"></a>
+  <a href="https://pypi.org/project/fastapi-panel/"><img alt="PyPI" src="https://img.shields.io/pypi/v/fastapi-panel"></a>
+  <img alt="Python 3.10+" src="https://img.shields.io/badge/python-3.10%2B-blue">
+  <a href="https://github.com/zaman-labs/fastapi-panel/blob/main/LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-green"></a>
+</p>
+
+![The product list, with search, filters, bulk actions and inline editing](https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/changelist.png)
+
+If you know `ModelAdmin`, you already know this library: `list_display`, `search_fields`, `list_filter`, `fieldsets`, `inlines`, actions and the rest work the way you expect. There is no frontend build, no Node and no extra service. It's server-rendered pages inside your FastAPI app.
+
+## Install
+
+```bash
+pip install fastapi-panel
+```
+
+## Quick start
+
+```python
+from fastapi import FastAPI
+from fastapi_panel import ModelAdmin, ModelAuth, register, site
+from sqlalchemy.ext.asyncio import create_async_engine
+
+from myapp.models import Product, User
+
+engine = create_async_engine("postgresql+asyncpg://...")
+app = FastAPI()
+
+
+@register(Product)
+class ProductAdmin(ModelAdmin):
+    list_display = ("name", "category", "price", "is_published")
+    list_filter = ("is_published", "category")
+    search_fields = ("name", "category__name")
+    ordering = ("-created_at",)
+
+
+site.mount(
+    app,
+    engine=engine,
+    auth=ModelAuth(User, superuser_field="is_superuser"),
+    secret_key=settings.PANEL_SECRET_KEY,
+)
+```
+
+Open `/admin`, log in, and you have a list page, add and edit forms, delete confirmation, bulk actions, CSV export and a change history. See the [getting started guide](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/getting-started.md) for creating your first user with `python -m fastapi_panel createuser` and setting up migrations.
+
+Want to try it first? The [example shop](https://github.com/zaman-labs/fastapi-panel/tree/main/examples/shop) runs in one command.
+
+## What you get
+
+| | |
+|---|---|
+| **Change lists** | Columns, computed columns, sorting, search across relations, sidebar filters, date drill-down, pagination, editing in the list |
+| **Forms** | Built from your models, with fieldsets, read-only fields, prefilled slugs, validation hooks, Pydantic schemas, foreign key autocomplete, many-to-many pickers, and a **+** button to create a related record on the spot |
+| **Files and images** | Uploads with previews and thumbnails, stored on disk or anywhere else through a small storage class |
+| **Import and restore** | CSV import with a preview before anything is saved, and a Deleted page to restore soft-deleted records |
+| **Inlines** | Tabular and stacked, with add, edit and delete on the parent's page |
+| **Actions** | Your own bulk actions, plus delete with a summary of what cascades, CSV export and "select all across pages" |
+| **Permissions** | Per model and per action, row-level through `get_queryset` and `has_*_permission` |
+| **Audit log** | Who changed which fields and when, shown on each record's history page |
+| **Any SQLAlchemy setup** | Sync and async engines, SQLModel, composite primary keys |
+| **Timezones** | Show and enter times in your site's timezone, while the database stays in UTC |
+| **Interface** | Dark mode, works on a phone, keyboard friendly, no external assets |
+
+<table>
+  <tr>
+    <td><img alt="An order with its items edited inline" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/order-inline.png"></td>
+    <td><img alt="A product form with fieldsets and a many-to-many picker" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/product-form.png"></td>
+  </tr>
+  <tr>
+    <td><img alt="The dashboard with recent actions" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/dashboard.png"></td>
+    <td><img alt="The product list in dark mode" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/changelist-dark.png"></td>
+  </tr>
+  <tr>
+    <td><img alt="Adding a category in a dialog from the product form" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/related-popup.png"></td>
+    <td><img alt="A CSV import preview before anything is saved" src="https://raw.githubusercontent.com/zaman-labs/fastapi-panel/main/docs/screenshots/import-preview.png"></td>
+  </tr>
+</table>
+
+## Security
+
+An admin panel can reach all your data, so these are on by default and have no off switch to forget:
+
+- CSRF tokens and `Origin` checks on every POST
+- Signed `HttpOnly`, `SameSite=Lax` session cookies, `Secure` on HTTPS, ended by a password change or by deactivating the user
+- Login throttling, no way to tell a wrong username from a wrong password, scrypt password hashing
+- A strict Content-Security-Policy with no inline scripts or styles, `X-Frame-Options: DENY`, `no-store` caching
+- Columns named like `password`, `token` or `secret` stay hidden unless you ask for them, and the audit log stores field names, never values
+- Only fields on the form can be written, and sort and filter parameters are allowlisted
+- Spreadsheet formulas are neutralised in CSV exports
+- Uploads get random names, images are checked against their contents, and files are only served behind login
+
+The panel refuses to start without authentication or with a short secret key. Read [the security guide](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/security.md) for what's left to you.
+
+## Documentation
+
+- [Getting started](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/getting-started.md)
+- [ModelAdmin reference](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/model-admin.md): lists, forms, inlines, actions, filters
+- [Authentication and permissions](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/auth-and-permissions.md)
+- [Modular projects and customizing](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/customizing.md): autodiscovery, multiple sites, custom pages, templates, themes
+- [Security](https://github.com/zaman-labs/fastapi-panel/blob/main/docs/security.md)
+
+## Roadmap
+
+Translations, a saved-filters UI, password reset by email, two-factor login, and a Redis option for login throttling across workers. Ideas and pull requests are welcome, see [CONTRIBUTING](https://github.com/zaman-labs/fastapi-panel/blob/main/CONTRIBUTING.md).
+
+## License
+
+[MIT](https://github.com/zaman-labs/fastapi-panel/blob/main/LICENSE)

fastapi_panel-0.1.0/SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+## Supported versions
+
+Security fixes go into the latest release.
+
+## Reporting a vulnerability
+
+Please report it privately through [GitHub's advisory form](https://github.com/zaman-labs/fastapi-panel/security/advisories/new), not in a public issue.
+
+Include what you found, how to reproduce it, and the impact you expect. You'll get a reply within a week, and we'll keep you updated until there's a fix. If you'd like credit, we'll name you in the advisory.
+
+For how the panel protects itself and what's left to you, see the [security guide](docs/security.md).

fastapi_panel-0.1.0/docs/auth-and-permissions.md

@@ -0,0 +1,94 @@
+# Authentication and permissions
+
+`site.mount` requires an `auth` backend. There's no anonymous mode.
+
+## ModelAuth
+
+```python
+ModelAuth(
+    User,
+    username_field="email",
+    password_field="hashed_password",
+    active_field="is_active",  # None to skip
+    staff_field="is_staff",  # None to skip
+    superuser_field="is_superuser",
+    permissions_field="permissions",
+)
+```
+
+`active_field` and `staff_field` must exist on the model or be passed as `None`. That's deliberate. If your `users` table also holds customers, a missing staff check would let all of them log in, so the panel refuses to start until you decide.
+
+## Permissions
+
+Permissions are strings in the form `<slug>.<action>`, where the action is `view`, `add`, `change` or `delete`.
+
+| Configuration | Who can do what |
+|---|---|
+| No `superuser_field`, no `permissions_field` | Everyone who can log in can do everything |
+| `superuser_field` only | Superusers can do everything, other staff can do nothing |
+| `permissions_field` | Superusers can do everything, others get what's in the list |
+
+`permissions_field` points at something iterable on the user, usually a JSON column:
+
+```python
+["product.view", "product.change", "order.*"]
+```
+
+`order.*` covers all actions on orders and `*` covers everything. Having `change` implies `view`.
+
+For roles or groups, subclass the backend. Load what you need in `get_user`, because the database session is closed by the time `has_perm` runs:
+
+```python
+class RoleAuth(ModelAuth):
+    def get_user(self, session, user_id):
+        user = super().get_user(session, user_id)
+        if user is not None:
+            user.granted = {p.code for role in user.roles for p in role.permissions}
+        return user
+
+    def has_perm(self, user, perm):
+        return user.is_superuser or perm in user.granted
+```
+
+## Per-model and per-row rules
+
+```python
+class InvoiceAdmin(ModelAdmin):
+    def get_queryset(self, request):
+        user = request.state.user
+        stmt = super().get_queryset(request)
+        return stmt if user.is_superuser else stmt.where(Invoice.team_id == user.team_id)
+
+    def has_delete_permission(self, request, obj=None):
+        return obj is None or obj.status == "draft"
+```
+
+`get_queryset` is the safest place for row-level rules. Lists, edit pages, deletes, history, bulk actions, autocomplete and foreign key validation all go through it, and a row outside it returns 404.
+
+Inline rows follow the parent's change permission by default. Override `has_add_permission`, `has_change_permission` and `has_delete_permission` on the inline to change that.
+
+The current user is `request.state.user` in every hook and view.
+
+## Your own backend
+
+Single sign-on, LDAP or anything else: subclass `AuthBackend`.
+
+```python
+from fastapi_panel import AuthBackend
+
+
+class LdapAuth(AuthBackend):
+    def find_user(self, session, username): ...
+    def get_user(self, session, user_id): ...
+    def check_password(self, user, password): ...  # user may be None. Runs in a worker thread
+    def user_id(self, user): ...
+    def is_allowed(self, user): ...
+    def has_perm(self, user, perm): ...
+    def session_hash(self, user): ...  # sessions end when this value changes
+```
+
+## Sessions
+
+Sessions live in a signed cookie, so there's no session table. A session ends when it expires (`session_age`, 12 hours by default), on logout, when the password changes, or when the user is deactivated. The last two apply on the very next request.
+
+Logout clears the cookie in that browser. A stolen cookie stays valid until one of the other conditions is met, so changing the password is how you revoke every session of one user, and changing `secret_key` revokes everyone's.