fastapi-panel 0.1.0__tar.gz → 0.2.0__tar.gz

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes are listed here. The format follows [Keep a Changelog](https
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-11-04
+
+### Added
+
+- Password reset: `mount(password_reset=..., public_url=...)`, and a `changepassword` command
+- `RichTextField` and `sanitize_html`
+- Saved filters on every list, kept per user
+- An Activity page with everyone's changes, behind the `activity.view` permission
+- `log_values`, to keep old and new values of chosen fields in the history
+
+### Changed
+
+- Fixed: the many-to-many picker wrapped onto two rows when it had a **+** button
+- The panel now creates a second table, `fastapi_panel_saved_filter`. If your database user can't create tables, add it through your migrations. Lists keep working without it
+
 ## [0.1.0] - 2026-11-04
 
 First release.

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fastapi-panel
-Version: 0.1.0
+Version: 0.2.0
 Summary: An admin panel for FastAPI and SQLAlchemy. Register a model, get a secure back office.
 Project-URL: Homepage, https://github.com/zaman-labs/fastapi-panel
 Project-URL: Documentation, https://github.com/zaman-labs/fastapi-panel/tree/main/docs
@@ -92,14 +92,14 @@ Want to try it first? The [example shop](https://github.com/zaman-labs/fastapi-p
 
 | | |
 |---|---|
-| **Change lists** | Columns, computed columns, sorting, search across relations, sidebar filters, date drill-down, pagination, editing in the list |
-| **Forms** | Built from your models, with fieldsets, read-only fields, prefilled slugs, validation hooks, Pydantic schemas, foreign key autocomplete, many-to-many pickers, and a **+** button to create a related record on the spot |
+| **Change lists** | Columns, computed columns, sorting, search across relations, sidebar filters, saved filters, date drill-down, pagination, editing in the list |
+| **Forms** | Built from your models, with fieldsets, read-only fields, prefilled slugs, validation hooks, Pydantic schemas, a rich text editor, foreign key autocomplete, many-to-many pickers, and a **+** button to create a related record on the spot |
 | **Files and images** | Uploads with previews and thumbnails, stored on disk or anywhere else through a small storage class |
 | **Import and restore** | CSV import with a preview before anything is saved, and a Deleted page to restore soft-deleted records |
 | **Inlines** | Tabular and stacked, with add, edit and delete on the parent's page |
 | **Actions** | Your own bulk actions, plus delete with a summary of what cascades, CSV export and "select all across pages" |
-| **Permissions** | Per model and per action, row-level through `get_queryset` and `has_*_permission` |
-| **Audit log** | Who changed which fields and when, shown on each record's history page |
+| **Accounts and permissions** | Per model and per action, row-level through `get_queryset` and `has_*_permission`, with password reset by email |
+| **Audit log** | Who changed which fields and when, on each record's history and a site-wide Activity page, with old and new values for the fields you choose |
 | **Any SQLAlchemy setup** | Sync and async engines, SQLModel, composite primary keys |
 | **Timezones** | Show and enter times in your site's timezone, while the database stays in UTC |
 | **Interface** | Dark mode, works on a phone, keyboard friendly, no external assets |
@@ -144,7 +144,7 @@ The panel refuses to start without authentication or with a short secret key. Re
 
 ## Roadmap
 
-Translations, a saved-filters UI, password reset by email, two-factor login, and a Redis option for login throttling across workers. Ideas and pull requests are welcome, see [CONTRIBUTING](https://github.com/zaman-labs/fastapi-panel/blob/main/CONTRIBUTING.md).
+Translations, two-factor login, and a Redis option for login throttling across workers. Ideas and pull requests are welcome, see [CONTRIBUTING](https://github.com/zaman-labs/fastapi-panel/blob/main/CONTRIBUTING.md).
 
 ## License
 

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/README.md

@@ -59,14 +59,14 @@ Want to try it first? The [example shop](https://github.com/zaman-labs/fastapi-p
 
 | | |
 |---|---|
-| **Change lists** | Columns, computed columns, sorting, search across relations, sidebar filters, date drill-down, pagination, editing in the list |
-| **Forms** | Built from your models, with fieldsets, read-only fields, prefilled slugs, validation hooks, Pydantic schemas, foreign key autocomplete, many-to-many pickers, and a **+** button to create a related record on the spot |
+| **Change lists** | Columns, computed columns, sorting, search across relations, sidebar filters, saved filters, date drill-down, pagination, editing in the list |
+| **Forms** | Built from your models, with fieldsets, read-only fields, prefilled slugs, validation hooks, Pydantic schemas, a rich text editor, foreign key autocomplete, many-to-many pickers, and a **+** button to create a related record on the spot |
 | **Files and images** | Uploads with previews and thumbnails, stored on disk or anywhere else through a small storage class |
 | **Import and restore** | CSV import with a preview before anything is saved, and a Deleted page to restore soft-deleted records |
 | **Inlines** | Tabular and stacked, with add, edit and delete on the parent's page |
 | **Actions** | Your own bulk actions, plus delete with a summary of what cascades, CSV export and "select all across pages" |
-| **Permissions** | Per model and per action, row-level through `get_queryset` and `has_*_permission` |
-| **Audit log** | Who changed which fields and when, shown on each record's history page |
+| **Accounts and permissions** | Per model and per action, row-level through `get_queryset` and `has_*_permission`, with password reset by email |
+| **Audit log** | Who changed which fields and when, on each record's history and a site-wide Activity page, with old and new values for the fields you choose |
 | **Any SQLAlchemy setup** | Sync and async engines, SQLModel, composite primary keys |
 | **Timezones** | Show and enter times in your site's timezone, while the database stays in UTC |
 | **Interface** | Dark mode, works on a phone, keyboard friendly, no external assets |
@@ -111,7 +111,7 @@ The panel refuses to start without authentication or with a short secret key. Re
 
 ## Roadmap
 
-Translations, a saved-filters UI, password reset by email, two-factor login, and a Redis option for login throttling across workers. Ideas and pull requests are welcome, see [CONTRIBUTING](https://github.com/zaman-labs/fastapi-panel/blob/main/CONTRIBUTING.md).
+Translations, two-factor login, and a Redis option for login throttling across workers. Ideas and pull requests are welcome, see [CONTRIBUTING](https://github.com/zaman-labs/fastapi-panel/blob/main/CONTRIBUTING.md).
 
 ## License
 

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/docs/auth-and-permissions.md

@@ -87,6 +87,41 @@ class LdapAuth(AuthBackend):
     def session_hash(self, user): ...  # sessions end when this value changes
 ```
 
+## Activity
+
+The Activity page needs the `activity.view` permission, so with `ModelAuth` that means superusers or a `permissions_field` that lists it. It only shows entries for models the person may view. Row-level rules from `get_queryset` don't apply to the log, so don't give this permission to someone who should only see some rows of a model.
+
+## Password reset
+
+Pass a function that delivers the link, and the panel's public address:
+
+```python
+def send_reset(user, url):
+    send_email(user.email, "Reset your password", f"Open this link to choose a new password: {url}")
+
+
+site.mount(
+    app,
+    engine=engine,
+    auth=ModelAuth(User),
+    secret_key=key,
+    password_reset=send_reset,
+    public_url="https://example.com/admin",
+)
+```
+
+A **Forgot your password?** link appears on the login page. `send_reset` can be sync or async, and runs after the response, so a slow mail server can't reveal which accounts exist. If it raises, the error goes to the `fastapi_panel` logger. People type their username, which is their email if that's your `username_field`.
+
+Links work for one hour and stop working once the password changes. Changing it also ends that user's open sessions. Each username and IP can request 3 links an hour.
+
+`public_url` is required because a link built from the request would use its `Host` header, which an attacker can set to their own site. `StaticAuth` has no reset, since its passwords live in your configuration.
+
+Without email, or if you've lost access, use the command line:
+
+```bash
+python -m fastapi_panel changepassword main --username ana
+```
+
 ## Sessions
 
 Sessions live in a signed cookie, so there's no session table. A session ends when it expires (`session_age`, 12 hours by default), on logout, when the password changes, or when the user is deactivated. The last two apply on the very next request.

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/docs/customizing.md

@@ -77,6 +77,8 @@ Settings for `mount`:
 | `secure_cookies` | automatic | Force the `Secure` flag on or off. Automatic follows the request scheme |
 | `trusted_origins` | `()` | Extra origins allowed to POST, see [Security](security.md) |
 | `max_body_size` | 10 MB | Largest POST body accepted |
+| `password_reset` | `None` | A function that delivers reset links, see [Password reset](auth-and-permissions.md#password-reset) |
+| `public_url` | `None` | The panel's public address, required with `password_reset` |
 
 ## Custom pages
 

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/docs/getting-started.md

@@ -94,7 +94,7 @@ auth = StaticAuth({"admin": settings.PANEL_PASSWORD_HASH})
 
 ## 4. Migrations
 
-The audit log uses one table, `fastapi_panel_log`. It's created on the first request if it doesn't exist. If your database user can't create tables, or you want Alembic to own it, add its metadata to `env.py` and generate a migration as usual:
+The panel uses two tables, `fastapi_panel_log` for the audit log and `fastapi_panel_saved_filter` for saved filters. They're created on the first request if they don't exist. If your database user can't create tables, or you want Alembic to own it, add its metadata to `env.py` and generate a migration as usual:
 
 ```python
 from fastapi_panel.log import Base as PanelBase
@@ -102,7 +102,7 @@ from fastapi_panel.log import Base as PanelBase
 target_metadata = [Base.metadata, PanelBase.metadata]
 ```
 
-If you create the table by hand and don't include that metadata, tell Alembic to leave it alone with `include_name`, or autogenerate will want to drop it. To turn the log off, use `AdminSite(audit_log=False)`.
+If you create them by hand and don't include that metadata, tell Alembic to leave it alone with `include_name`, or autogenerate will want to drop them. To turn the log off, use `AdminSite(audit_log=False)`.
 
 ## 5. Try the example
 

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/docs/model-admin.md

@@ -100,6 +100,43 @@ Without `field` the error shows at the top of the form. `data` holds clean value
 
 Field validators work too: `CharField(validators=[check_sku])`. To validate with an existing schema, set `form_schema = ProductCreate`, and its errors appear next to the matching fields.
 
+## Rich text
+
+```python
+from fastapi_panel import ModelAdmin, RichTextField
+
+
+class ArticleAdmin(ModelAdmin):
+    field_overrides = {"body": RichTextField()}
+```
+
+The column holds HTML, edited with a small toolbar: bold, italic, underline, headings, lists, quotes and links. There's nothing to install and no external script. Without JavaScript it falls back to a plain text box.
+
+Whatever is submitted gets rebuilt from a short allowlist of tags, and only `http`, `https` and `mailto` links survive, so a script can't get in through this field. **Sanitize when you print it on your own site too**, in case a row was written some other way: `sanitize_html(article.body)`.
+
+Lists show the text without tags. CSV import goes through the same sanitizing. Images and tables aren't supported.
+
+## Saved filters
+
+Once someone has searched or filtered a list, **Save this view** keeps the search, filters and sorting under a name. Saved views appear above the list as links, and belong to that user and that model. There's nothing to configure.
+
+## History
+
+Each record's history lists who changed which fields. To also keep old and new values, name the fields:
+
+```python
+class OrderAdmin(ModelAdmin):
+    log_values = ("status", "total")
+```
+
+```
+Changed status. Status: Paid → Shipped
+```
+
+This is opt-in because those values stay in the log for good, so think before listing personal data. Fields named like credentials are refused at startup. Long values are cut at 200 characters. Inlines take `log_values` too.
+
+Everyone's changes are on the **Activity** page, filterable by user, model and action. See [who can open it](auth-and-permissions.md#activity).
+
 ## Files and images
 
 A file lives in a string column that holds its stored name. Set a storage on the site, then use `FileField` or `ImageField` for the column:

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/docs/security.md

@@ -25,7 +25,9 @@ An admin panel can reach all your data, so its defaults are strict and don't dep
 | Rows from another parent or tenant | Inline rows must belong to the parent, and all access goes through `get_queryset` |
 | Open redirects | `next` must stay inside the panel |
 | Secrets on screen | Columns named like credentials are hidden unless listed explicitly |
-| Secrets in logs | The audit log records field names, not values |
+| Secrets in logs | The audit log records field names, not values, unless you list a field in `log_values`. Fields named like credentials are refused |
+| Scripts in rich text | `RichTextField` rebuilds submitted HTML from an allowlist, and only `http`, `https` and `mailto` links survive |
+| Password reset abuse | Links use your configured `public_url`, never the `Host` header. They're signed, expire in an hour and stop working after use. Responses don't reveal which accounts exist, and requests are limited per username and IP |
 | Spreadsheet formula injection | CSV cells starting with `=`, `+`, `-` or `@` are prefixed with `'` |
 | Oversized requests | POST bodies have a size limit, counted as they arrive so chunked requests can't avoid it. Inline forms, bulk actions and CSV imports have row limits |
 | Misconfiguration | It won't start without an auth backend, or with a secret under 32 characters. Plain text passwords are refused in `StaticAuth`, and `ModelAuth` won't guess whether someone is staff |
@@ -42,6 +44,10 @@ An admin panel can reach all your data, so its defaults are strict and don't dep
 
 **Consider limiting who can reach it.** Serve the panel on a VPN or restrict it by IP if you can. There's no built-in two-factor login yet, so a reverse proxy with SSO in front is the best way to add one today.
 
+**Sanitize rich text on your own pages.** The panel sanitizes `RichTextField` when it saves and displays it, but your site prints the column itself. Use `sanitize_html`, because rows can be written without going through the panel.
+
+**Protect reset emails.** A reset link gives access to the account for an hour, so keep it out of your logs and error reports, and use a mail provider you trust.
+
 **Mind the database user.** Actions run with your app's database credentials. Foreign key and unique rules still apply, and the panel shows a generic message if they fail.
 
 ## Known limits

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/examples/shop/README.md

@@ -1,6 +1,6 @@
 # Example shop
 
-A small store with products, categories, tags, customers and orders. It uses most features: list editing, custom filters, date drill-down, fieldsets, inlines, autocomplete, the **+** button, image uploads, CSV import, soft delete with restore, custom actions and permissions.
+A small store with products, categories, tags, customers and orders. It uses most features: list editing, custom filters, date drill-down, fieldsets, inlines, autocomplete, the **+** button, image uploads, rich text, saved filters, values in the history, CSV import, soft delete with restore, custom actions and permissions. The password reset link is printed to the console instead of emailed.
 
 ```bash
 # from the repository root

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/examples/shop/admin.py

@@ -8,6 +8,7 @@ from fastapi_panel import (
     ImageField,
     LocalStorage,
     ModelAdmin,
+    RichTextField,
     SimpleFilter,
     TabularInline,
     ValidationError,
@@ -52,9 +53,11 @@ class ProductAdmin(ModelAdmin):
     actions = ("publish", "unpublish")
     soft_delete_field = "deleted_at"
     csv_import = True
+    log_values = ("price", "stock", "is_published")
     field_overrides = {
         "price": DecimalField(min_value=Decimal(0), max_digits=10, decimal_places=2),
         "image": ImageField(help_text="PNG, JPG, GIF or WEBP, up to 5 MB."),
+        "description": RichTextField(),
     }
     fieldsets = (
         (None, {"fields": ("name", "slug", "category", "image")}),

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/examples/shop/main.py

@@ -118,4 +118,16 @@ async def home() -> dict[str, str]:
     return {"admin": "/admin"}
 
 
-site.mount(app, engine=engine, auth=ModelAuth(Staff, superuser_field="is_superuser"), secret_key=SECRET_KEY)
+def print_reset_link(user: Staff, url: str) -> None:
+    # Demo only. A real app emails this to the user.
+    print(f"Password reset link for {user.username}: {url}")
+
+
+site.mount(
+    app,
+    engine=engine,
+    auth=ModelAuth(Staff, superuser_field="is_superuser"),
+    secret_key=SECRET_KEY,
+    password_reset=print_reset_link,
+    public_url="http://127.0.0.1:8000/admin",
+)

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/scripts/screenshots.py

@@ -103,9 +103,6 @@ def main() -> int:
         page.wait_for_selector(".message-success")
         assert page.locator("[data-inline-row]").count() >= before + 1
 
-        page.goto(f"{BASE}/order/1/history")
-        shot("history")
-
         page.goto(f"{BASE}/order/1/delete")
         shot("delete")
 
@@ -198,6 +195,63 @@ def main() -> int:
         page.wait_for_selector(".message-success")
         assert page.locator("button[name=_restore]").count() == 1
 
+        # The rich text editor: formatting and a link go through the toolbar and survive a save.
+        page.goto(f"{BASE}/product/2/change")
+        page.locator("details.fieldset summary").click()
+        editor = page.locator(".rich-editor")
+        editor.click()
+        page.keyboard.press("ControlOrMeta+A")
+        page.keyboard.type("Made to last for years.")
+        page.keyboard.press("ControlOrMeta+A")
+        page.click("button[aria-label=Bold]")
+        page.click("button[aria-label=Link]")
+        page.fill(".rich-link input", "example.com/care")
+        page.keyboard.press("Enter")
+        page.wait_for_selector(".rich-editor a")
+        shot("rich-text", full_page=True)
+        page.click("button[name=_continue]")
+        page.wait_for_selector(".message-success")
+        saved = page.locator(".rich-editor").inner_html()
+        assert "<strong>" in saved and 'href="https://example.com/care"' in saved, saved
+
+        # Old and new values in the history, for the fields listed in log_values.
+        page.fill("#id_price", "12.50")
+        page.click("button[name=_continue]")
+        page.wait_for_selector(".message-success")
+        page.goto(f"{BASE}/product/2/history")
+        assert "→ 12.50" in page.inner_text(".card")
+        shot("history")
+
+        # A saved filter: keep this view, then open it again from the list.
+        page.goto(f"{BASE}/product?is_published=1&stock_level=low")
+        page.locator(".save-filter summary").click()
+        page.fill(".save-filter input[name=name]", "Low stock, live")
+        page.click(".save-filter button")
+        page.wait_for_selector(".message-success")
+        page.goto(f"{BASE}/product")
+        page.locator(".saved-filters").get_by_text("Low stock, live").click()
+        page.wait_for_url("**stock_level=low**")
+        assert page.locator(".chip-active").count() == 1
+        shot("saved-filters")
+
+        # Everyone's activity, with filters.
+        page.goto(f"{BASE}/activity")
+        shot("activity")
+        page.select_option("#activity-action", "delete")
+        page.click(".activity-filters button")
+        page.wait_for_url("**action=delete**")
+        assert page.locator(".tag-delete").count() >= 1 and page.locator("tbody .tag-add").count() == 0
+
+        # Forgotten password, from a browser that isn't logged in.
+        visitor = browser.new_context(locale="en-US").new_page()
+        visitor.on("console", lambda m: problems.append(m.text) if m.type == "error" else None)
+        visitor.goto(f"{BASE}/login")
+        visitor.click("text=Forgot your password?")
+        visitor.fill("#username", "admin")
+        visitor.click("button[type=submit]")
+        visitor.wait_for_selector(".message-success")
+        visitor.close()
+
         page.goto(f"{BASE}/")
         shot("dashboard")
 

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/src/fastapi_panel/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 from .auth import AuthBackend, ModelAuth, StaticAuth
 from .filters import Filter, SimpleFilter
@@ -16,6 +16,7 @@ from .forms import (
     ImageField,
     IntegerField,
     JSONField,
+    RichTextField,
     TextField,
     TimeField,
     UUIDField,
@@ -31,6 +32,7 @@ from .options import (
     action,
     display,
 )
+from .richtext import sanitize_html
 from .security import hash_password, verify_password
 from .site import AdminSite, autodiscover, register, site
 from .storage import LocalStorage, Storage
@@ -58,6 +60,7 @@ __all__ = [
     "LocalStorage",
     "ModelAdmin",
     "ModelAuth",
+    "RichTextField",
     "SimpleFilter",
     "StackedInline",
     "StaticAuth",
@@ -72,6 +75,7 @@ __all__ = [
     "display",
     "hash_password",
     "register",
+    "sanitize_html",
     "site",
     "verify_password",
 ]

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/src/fastapi_panel/__main__.py

@@ -38,9 +38,9 @@ def find_site(target: str) -> AdminSite:
     return next((value for value in vars(module).values() if isinstance(value, AdminSite)), site)
 
 
-async def save_user(panel: AdminSite, *args: Any, **kwargs: Any) -> Any:
+async def on_database(panel: AdminSite, fn: Any) -> Any:
     try:
-        return await panel.db.run(lambda session: panel.auth.create_user(session, *args, **kwargs))
+        return await panel.db.run(fn)
     finally:
         # An open async connection would keep the process from exiting.
         bind = panel.db.maker.kw.get("bind")
@@ -48,13 +48,48 @@ async def save_user(panel: AdminSite, *args: Any, **kwargs: Any) -> Any:
             await bind.dispose()
 
 
-def create_user(args: argparse.Namespace) -> int:
+def mounted_site(args: argparse.Namespace) -> AdminSite:
     panel = find_site(args.target)
     if not hasattr(panel, "db"):
         raise SystemExit(f"{args.target} doesn't call site.mount(), so there's no database to use.")
+    if not isinstance(panel.auth, ModelAuth):
+        raise SystemExit(f"{args.command} only works with ModelAuth. Other backends keep their users elsewhere.")
+    return panel
+
+
+def new_password() -> str:
+    password = os.environ.get("FASTAPI_PANEL_PASSWORD") or read_password()
+    if len(password) < MIN_PASSWORD_LENGTH:
+        raise SystemExit(f"Use at least {MIN_PASSWORD_LENGTH} characters.")
+    return password
+
+
+def change_password(args: argparse.Namespace) -> int:
+    panel = mounted_site(args)
+    username = args.username or input("Username: ").strip()
+    password = new_password()
+
+    def change(session: Any) -> bool:
+        user = panel.auth.find_user(session, username)
+        if user is None:
+            return False
+        panel.auth.set_password(session, user, password)
+        session.commit()
+        return True
+
+    try:
+        found = asyncio.run(on_database(panel, change))
+    except DBAPIError as exc:
+        raise SystemExit(f"Couldn't change the password: {exc.orig}") from None
+    if not found:
+        raise SystemExit(f"There's no user called {username}.")
+    print(f"Changed the password of {username}. Their open sessions have ended.")
+    return 0
+
+
+def create_user(args: argparse.Namespace) -> int:
+    panel = mounted_site(args)
     auth = panel.auth
-    if not isinstance(auth, ModelAuth):
-        raise SystemExit("createuser only works with ModelAuth. Other backends keep their users elsewhere.")
 
     username = args.username or input("Username: ").strip()
     if not username:
@@ -65,12 +100,13 @@ def create_user(args: argparse.Namespace) -> int:
             extra[prop.key] = coerce_to_column(prop.columns[0], input(f"{prop.key}: ").strip())
         except ValueError:
             raise SystemExit(f"That's not a valid value for {prop.key}.") from None
-    password = os.environ.get("FASTAPI_PANEL_PASSWORD") or read_password()
-    if len(password) < MIN_PASSWORD_LENGTH:
-        raise SystemExit(f"Use at least {MIN_PASSWORD_LENGTH} characters.")
+    password = new_password()
+
+    def create(session: Any) -> Any:
+        return auth.create_user(session, username, password, superuser=not args.no_superuser, **extra)
 
     try:
-        asyncio.run(save_user(panel, username, password, superuser=not args.no_superuser, **extra))
+        asyncio.run(on_database(panel, create))
     except DBAPIError as exc:
         raise SystemExit(f"Couldn't create the user: {exc.orig}. Do the tables exist, and is the name free?") from None
     print(f"Created {username}.")
@@ -85,10 +121,15 @@ def main() -> int:
     creating.add_argument("target", help="the module that mounts the panel, like main or app.main:panel")
     creating.add_argument("--username")
     creating.add_argument("--no-superuser", action="store_true", help="create a regular staff user")
+    changing = commands.add_parser("changepassword", help="set a new password for a user behind ModelAuth")
+    changing.add_argument("target", help="the module that mounts the panel, like main or app.main:panel")
+    changing.add_argument("--username")
     args = parser.parse_args()
 
     if args.command == "createuser":
         return create_user(args)
+    if args.command == "changepassword":
+        return change_password(args)
     print(hash_password(read_password()))
     return 0
 

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/src/fastapi_panel/forms.py

@@ -21,6 +21,7 @@ from sqlalchemy.orm import MANYTOMANY, MANYTOONE
 from starlette.datastructures import UploadFile
 
 from .introspect import coerce_to_column, humanize, object_label
+from .richtext import plain_text, sanitize_html
 
 SENSITIVE_NAME = re.compile(r"password|passwd|secret|token|api_?key|private_?key", re.I)
 EMAIL = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")
@@ -109,6 +110,12 @@ class Field:
     def to_python(self, raw: str) -> Any:
         return raw
 
+    def describe(self, formatted: Any) -> str:
+        """How a value reads in the history, when `log_values` asks to keep it."""
+        labels = dict(getattr(self, "choices", []))
+        values = formatted if isinstance(formatted, list) else [formatted]
+        return ", ".join(str(labels.get(value, value)) for value in values)
+
     def clean(self, raw: Any) -> Any:
         if isinstance(raw, str):
             raw = raw.strip()
@@ -139,6 +146,27 @@ class TextField(CharField):
     widget = "textarea"
 
 
+class RichTextField(TextField):
+    """Formatted text, stored as HTML. Only a small set of tags survives, whatever gets submitted."""
+
+    def __init__(self, **kwargs: Any) -> None:
+        super().__init__(**kwargs)
+        self.attrs = {"data-richtext": "", **self.attrs}
+
+    def format(self, value: Any) -> str:
+        return sanitize_html(value) if value else ""
+
+    def extract(self, data: Any) -> str:
+        return self.format(data.get(self.html_name, ""))
+
+    def clean(self, raw: Any) -> Any:
+        # An editor left empty still holds markup such as <br>.
+        return super().clean(raw if plain_text(raw).strip() else "")
+
+    def describe(self, formatted: Any) -> str:
+        return plain_text(formatted)
+
+
 class EmailField(CharField):
     input_type = "email"
 
@@ -217,6 +245,9 @@ class BooleanField(Field):
     def format(self, value: Any) -> str:
         return "on" if value else ""
 
+    def describe(self, formatted: Any) -> str:
+        return "Yes" if formatted else "No"
+
     def clean(self, raw: Any) -> bool:
         return bool(raw)
 
@@ -551,6 +582,7 @@ class Form:
         self.cleaned: dict[str, Any] = {}
         self.fieldsets: list[dict[str, Any]] = []
         self.delete_requested = False
+        self.diffs: list[tuple[Field, Any, Any]] = []
         for field in self.editable:
             source = field.read(obj) if persisted else field.initial
             field.value = field.format(source)
@@ -604,8 +636,10 @@ class Form:
                 continue
             before = field.format(field.read(obj)) if self.persisted else None
             field.write(obj, value)
-            if self.persisted and before != field.format(value):
+            after = field.format(value)
+            if self.persisted and before != after:
                 changed.append(field.label)
+                self.diffs.append((field, before, after))
         return changed
 
 

{fastapi_panel-0.1.0 → fastapi_panel-0.2.0}/src/fastapi_panel/log.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 import datetime as dt
 from typing import Any
 
-from sqlalchemy import DateTime, Index, String, Text
+from sqlalchemy import DateTime, Index, String, Text, UniqueConstraint
 from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
 
 from .introspect import object_label, pk_string
@@ -34,6 +34,17 @@ class AdminLog(Base):
     message: Mapped[str] = mapped_column(Text, default="")
 
 
+class SavedFilter(Base):
+    __tablename__ = "fastapi_panel_saved_filter"
+    __table_args__ = (UniqueConstraint("user_id", "model", "name", name="uq_fastapi_panel_saved_filter"),)
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    user_id: Mapped[str] = mapped_column(String(255))
+    model: Mapped[str] = mapped_column(String(100))
+    name: Mapped[str] = mapped_column(String(100))
+    query: Mapped[str] = mapped_column(Text)
+
+
 def record(session: Any, request: Any, admin: Any, obj: Any, action: str, message: str = "") -> None:
     if not admin.site.audit_log:
         return