fastapi-rtk 0.2.60__py3-none-any.whl → 1.0.18__py3-none-any.whl

fastapi_rtk/fastapi_react_toolkit.py

@@ -16,13 +16,11 @@ from fastapi.templating import Jinja2Templates
 from fastapi_babel import BabelMiddleware
 from jinja2 import Environment, TemplateNotFound, select_autoescape
 from prometheus_fastapi_instrumentator import Instrumentator
-from sqlalchemy import and_, select
-from sqlalchemy.ext.asyncio import AsyncSession
-from sqlalchemy.orm import Session
 from starlette.routing import _DefaultLifespan
 
 from .api.model_rest_api import ModelRestApi
 from .auth import Auth
+from .backends.sqla.session import SQLASession
 from .cli.commands.db import upgrade
 from .cli.commands.translate import init_babel_cli
 from .const import (
@@ -56,7 +54,7 @@ from .security.sqla.apis import (
 from .security.sqla.models import Api, Permission, PermissionApi, Role
 from .security.sqla.security_manager import SecurityManager
 from .setting import Setting
-from .utils import deep_merge, multiple_async_contexts, safe_call, smart_run
+from .utils import deep_merge, lazy, multiple_async_contexts, safe_call, smart_run
 from .version import __version__
 
 __all__ = ["FastAPIReactToolkit"]
@@ -163,7 +161,11 @@ class FastAPIReactToolkit:
     # Public attributes
     apis: list[ModelRestApi] = None
     initialized = False
-    security: SecurityManager = None
+    sm: SecurityManager = None
+    security: SecurityManager = lazy(lambda self: self.sm)
+    """
+    Old attribute for `sm`, kept for backward compatibility.
+    """
     started = False
     """
     Indicates whether the application has been started.
@@ -219,7 +221,7 @@ class FastAPIReactToolkit:
         """
         g.current_app = self
         self.apis = []
-        self.security = SecurityManager(self)
+        self.sm = SecurityManager(self)
 
         # Database configuration
         self.create_tables = create_tables
@@ -418,175 +420,121 @@ class FastAPIReactToolkit:
 
         async with db.session() as session:
             logger.info("INITIALIZING DATABASE")
-            await self._insert_permissions(session)
-            await self._insert_apis(session)
-            await self._insert_roles(session)
-            await self._associate_permission_with_api(session)
-            await self._associate_permission_api_with_role(session)
+            permissions = await self._insert_permissions(session)
+            apis = await self._insert_apis(session)
+            roles = await self._insert_roles(session)
+            assert permissions is not None, "Permissions should not be None"
+            assert apis is not None, "APIs should not be None"
+            permission_apis = await self._associate_permission_with_api(
+                session, permissions, apis
+            )
+            assert roles is not None, "Roles should not be None"
+            assert permission_apis is not None, "PermissionApis should not be None"
+            await self._associate_role_with_permission_api(
+                session, roles, permission_apis
+            )
             if self.cleanup:
-                await self.security.cleanup()
+                await self.sm.cleanup()
             logger.info("DATABASE INITIALIZED")
 
-    async def _insert_permissions(self, session: AsyncSession | Session):
-        new_permissions = self.total_permissions()
-        stmt = select(Permission).where(Permission.name.in_(new_permissions))
-        result = await safe_call(session.scalars(stmt))
-        existing_permissions = [permission.name for permission in result.all()]
-        if len(new_permissions) == len(existing_permissions):
-            return
-
-        permission_objs = [
-            Permission(name=permission)
-            for permission in new_permissions
-            if permission not in existing_permissions
+    async def _insert_permissions(self, session: SQLASession):
+        permissions = self.total_permissions() + [
+            x[1] for x in self.sm.get_api_permission_tuples_from_builtin_roles()
         ]
-        for permission in permission_objs:
-            logger.info(f"ADDING PERMISSION {permission}")
-            session.add(permission)
-        await safe_call(session.commit())
-
-    async def _insert_apis(self, session: AsyncSession | Session):
-        new_apis = [api.__class__.__name__ for api in self.apis]
-        stmt = select(Api).where(Api.name.in_(new_apis))
-        result = await safe_call(session.scalars(stmt))
-        existing_apis = [api.name for api in result.all()]
-        if len(new_apis) == len(existing_apis):
-            return
-
-        api_objs = [Api(name=api) for api in new_apis if api not in existing_apis]
-        for api in api_objs:
-            logger.info(f"ADDING API {api}")
-            session.add(api)
-        await safe_call(session.commit())
-
-    async def _insert_roles(self, session: AsyncSession | Session):
-        new_roles = [x for x in [g.admin_role, g.public_role] if x is not None]
-        stmt = select(Role).where(Role.name.in_(new_roles))
-        result = await safe_call(session.scalars(stmt))
-        existing_roles = [role.name for role in result.all()]
-        if len(new_roles) == len(existing_roles):
-            return
+        permissions = list(dict.fromkeys(permissions))
+        return await self.sm.create_permissions(permissions, session=session)
 
-        role_objs = [
-            Role(name=role) for role in new_roles if role not in existing_roles
+    async def _insert_apis(self, session: SQLASession):
+        apis = [api.__class__.__name__ for api in self.apis] + [
+            x[0] for x in self.sm.get_api_permission_tuples_from_builtin_roles()
         ]
-        for role in role_objs:
-            logger.info(f"ADDING ROLE {role}")
-            session.add(role)
-        await safe_call(session.commit())
+        apis = list(dict.fromkeys(apis))
+        return await self.sm.create_apis(apis, session=session)
+
+    async def _insert_roles(self, session: SQLASession):
+        roles = self.sm.get_roles_from_builtin_roles()
+        if g.admin_role and g.admin_role not in roles:
+            roles.append(g.admin_role)
+        if g.public_role and g.public_role not in roles:
+            roles.append(g.public_role)
+        return await self.sm.create_roles(roles, session=session)
+
+    async def _associate_permission_with_api(
+        self,
+        session: SQLASession,
+        permissions: list[Permission],
+        apis: list[Api],
+    ):
+        permission_map = {permission.name: permission for permission in permissions}
+        api_map = {api.name: api for api in apis}
+        permission_api_tuples = list[tuple[Permission, Api]]()
+        added_permission_api = set[tuple[str, str]]()
 
-    async def _associate_permission_with_api(self, session: AsyncSession | Session):
         for api in self.apis:
-            new_permissions = getattr(api, "permissions", [])
-            if not new_permissions:
+            api_permissions = api.permissions
+            if not api_permissions:
                 continue
 
-            # Get the api object
-            api_stmt = select(Api).where(Api.name == api.__class__.__name__)
-            api_obj = await safe_call(session.scalar(api_stmt))
-
-            if not api_obj:
-                raise ValueError(f"API {api.__class__.__name__} not found")
-
-            permission_stmt = select(Permission).where(
-                and_(
-                    Permission.name.in_(new_permissions),
-                    ~Permission.id.in_([p.permission_id for p in api_obj.permissions]),
-                )
-            )
-            permission_result = await safe_call(session.scalars(permission_stmt))
-            new_permissions = permission_result.all()
-
-            if not new_permissions:
+            for permission_name in api_permissions:
+                if (permission_name, api.__class__.__name__) in added_permission_api:
+                    continue
+                permission = permission_map[permission_name]
+                api_obj = api_map[api.__class__.__name__]
+                permission_api_tuples.append((permission, api_obj))
+                added_permission_api.add((permission.name, api_obj.name))
+
+        for (
+            api_name,
+            perm_name,
+        ) in self.sm.get_api_permission_tuples_from_builtin_roles():
+            if (perm_name, api_name) in added_permission_api:
                 continue
+            permission = permission_map[perm_name]
+            api_obj = api_map[api_name]
+            permission_api_tuples.append((permission, api_obj))
+            added_permission_api.add((permission.name, api_obj.name))
 
-            for permission in new_permissions:
-                session.add(
-                    PermissionApi(permission_id=permission.id, api_id=api_obj.id)
-                )
-                logger.info(f"ASSOCIATING PERMISSION {permission} WITH API {api_obj}")
-            await safe_call(session.commit())
+        return await self.sm.associate_list_of_permission_with_api(
+            permission_api_tuples, session=session
+        )
 
-    async def _associate_permission_api_with_role(
-        self, session: AsyncSession | Session
+    async def _associate_role_with_permission_api(
+        self,
+        session: SQLASession,
+        roles: list[Role],
+        permission_apis: list[PermissionApi],
     ):
-        # Read config based roles
-        roles_dict = Setting.ROLES
-
-        for role_name, role_permissions in roles_dict.items():
-            role_stmt = select(Role).where(Role.name == role_name)
-            role_result = await safe_call(session.scalars(role_stmt))
-            role = role_result.first()
-            if not role:
-                role = Role(name=role_name)
-                logger.info(f"ADDING ROLE {role}")
-                session.add(role)
-
-            for api_name, permission_name in role_permissions:
-                permission_api_stmt = (
-                    select(PermissionApi)
-                    .where(
-                        and_(Api.name == api_name, Permission.name == permission_name)
-                    )
-                    .join(Permission)
-                    .join(Api)
-                )
-                permission_api = await safe_call(session.scalar(permission_api_stmt))
-                if not permission_api:
-                    permission_stmt = select(Permission).where(
-                        Permission.name == permission_name
-                    )
-                    permission = await safe_call(session.scalar(permission_stmt))
-                    if not permission:
-                        permission = Permission(name=permission_name)
-                        logger.info(f"ADDING PERMISSION {permission}")
-                        session.add(permission)
-
-                    stmt = select(Api).where(Api.name == api_name)
-                    api = await safe_call(session.scalar(stmt))
-                    if not api:
-                        api = Api(name=api_name)
-                        logger.info(f"ADDING API {api}")
-                        session.add(api)
-
-                    permission_api = PermissionApi(permission=permission, api=api)
-                    logger.info(f"ADDING PERMISSION-API {permission_api}")
-                    session.add(permission_api)
-
-                # Associate role with permission-api
-                if role not in permission_api.roles:
-                    permission_api.roles.append(role)
-                    logger.info(
-                        f"ASSOCIATING {role} WITH PERMISSION-API {permission_api}"
-                    )
-
-                await safe_call(session.commit())
-
-        # Get admin role
-        if g.admin_role is None:
-            logger.warning("Admin role is not set, skipping admin role association")
-            return
-
-        admin_role_stmt = select(Role).where(Role.name == g.admin_role)
-        admin_role = await safe_call(session.scalar(admin_role_stmt))
-
-        if admin_role:
-            # Get list of permission-api.assoc_permission_api_id of the admin role
-            stmt = (
-                select(PermissionApi)
-                .where(~PermissionApi.roles.contains(admin_role))
-                .join(Api)
-            )
-            result = await safe_call(session.scalars(stmt))
-            existing_assoc_permission_api_roles = result.all()
-
-            # Add admin role to all permission-api objects
-            for permission_api in existing_assoc_permission_api_roles:
-                permission_api.roles.append(admin_role)
-                logger.info(
-                    f"ASSOCIATING {admin_role} WITH PERMISSION-API {permission_api}"
-                )
-            await safe_call(session.commit())
+        role_map = {role.name: role for role in roles}
+        permission_api_map = {
+            (pa.permission.name, pa.api.name): pa for pa in permission_apis
+        }
+        permission_apis_to_exclude_from_admin = list[PermissionApi]()
+        role_permission_api_tuples = list[tuple[Role, PermissionApi]]()
+
+        for (
+            role_name,
+            role_api_permissions,
+        ) in self.sm.get_role_and_api_permission_tuples_from_builtin_roles():
+            for api_name, permission_name in role_api_permissions:
+                role = role_map[role_name]
+                permission_api = permission_api_map[(permission_name, api_name)]
+                role_permission_api_tuples.append((role, permission_api))
+                if "|" in permission_name and role_name != g.public_role:
+                    # Exclude multi-tenant permissions from admin role if not explicitly set
+                    permission_apis_to_exclude_from_admin.append(permission_api)
+
+        if g.admin_role:
+            admin_role = role_map[g.admin_role]
+            for permission_api in [
+                pa
+                for pa in permission_apis
+                if pa not in permission_apis_to_exclude_from_admin
+            ]:
+                role_permission_api_tuples.append((admin_role, permission_api))
+
+        await self.sm.associate_list_of_role_with_permission_api(
+            role_permission_api_tuples, session=session
+        )
 
     def _mount_static_folder(self):
         """
@@ -673,14 +621,6 @@ class FastAPIReactToolkit:
             # Add the endpoint for the metrics
             self.instrumentator.expose(app, **Setting.INSTRUMENTATOR_EXPOSE_CONFIG)
 
-            # Add the JS manifest route
-            self._init_js_manifest()
-
-            # Mount the static and template folders
-            self._mounted = True
-            self._mount_static_folder()
-            self._mount_template_folder()
-
             await db.init_fastapi_rtk_tables()
 
             if self.upgrade_db:
@@ -707,8 +647,6 @@ class FastAPIReactToolkit:
                 if hasattr(api, "datamodel"):
                     await safe_call(api.datamodel.on_startup())
 
-            self.started = True
-
             yield
 
             # On shutdown
@@ -729,11 +667,24 @@ class FastAPIReactToolkit:
             # Run when the app is shutting down
             await db.close()
 
+        @asynccontextmanager
+        async def mount_lifespan(app: FastAPI):
+            # Mount the js manifest, static, and template folders
+            self._init_js_manifest()
+            self._mount_static_folder()
+            self._mount_template_folder()
+            self._mounted = True
+            self.started = True
+            yield
+
         # Combine with other lifespans
         @asynccontextmanager
         async def combined_lifespan(app: FastAPI):
             async with multiple_async_contexts(
-                [lifespan(app) for lifespan in [lifespan] + self.lifespans]
+                [
+                    lifespan(app)
+                    for lifespan in [lifespan] + self.lifespans + [mount_lifespan]
+                ]
             ):
                 yield
 

fastapi_rtk/file_managers/s3_file_manager.py

@@ -1,3 +1,5 @@
+import typing
+
 from ..bases.file_manager import AbstractFileManager
 from ..const import logger
 from ..utils import smart_run
@@ -12,20 +14,58 @@ class S3FileManager(AbstractFileManager):
 
     def __init__(
         self,
-        base_path=None,
-        allowed_extensions=None,
-        namegen=None,
-        permission=None,
-        bucket_name=None,
-        bucket_subfolder=None,
-        access_key=None,
-        secret_key=None,
+        base_path: str | None = None,
+        allowed_extensions: list[str] | None = None,
+        namegen: typing.Callable[[str], str] | None = None,
+        permission: int | None = None,
+        bucket_name: str | None = None,
+        bucket_subfolder: str | None = None,
+        access_key: str | None = None,
+        secret_key: str | None = None,
+        open_params: dict[str, typing.Any] | None = None,
+        boto3_client: typing.Any | None = None,
     ):
+        """
+        Initializes the S3FileManager.
+
+        Args:
+            base_path (str | None, optional): URL path to the S3 bucket. Defaults to None.
+            allowed_extensions (list[str] | None, optional): Allowed file extensions. Defaults to None.
+            namegen (typing.Callable[[str], str] | None, optional): Callable for generating file names. Defaults to None.
+            permission (int | None, optional): File permission settings. Defaults to None.
+            bucket_name (str | None, optional): Name of the S3 bucket. Defaults to None.
+            bucket_subfolder (str | None, optional): Subfolder within the S3 bucket. Defaults to None.
+            access_key (str | None, optional): AWS access key. Needed for default boto3 client in order to delete files. Defaults to None.
+            secret_key (str | None, optional): AWS secret key. Needed for default boto3 client in order to delete files. Defaults to None.
+            open_params (dict[str, typing.Any] | None, optional): Parameters for opening files. Defaults to None.
+            boto3_client (typing.Any | None, optional): Boto3 client instance. If None, a new client will be created. Defaults to None.
+        Raises:
+            ImportError: If required libraries are not installed.
+        """
         super().__init__(base_path, allowed_extensions, namegen, permission)
+
+        try:
+            import boto3
+            import smart_open
+
+            self.smart_open = smart_open
+            self.boto3 = boto3
+        except ImportError:
+            raise ImportError(
+                "smart_open is required for S3FileManager. "
+                "Please install it with 'pip install smart_open[s3]'."
+            )
+
         self.bucket_name = bucket_name
         self.bucket_subfolder = bucket_subfolder
         self.access_key = access_key
         self.secret_key = secret_key
+        self.open_params = open_params or {}
+        self.boto3_client = boto3_client or self.boto3.client(
+            "s3",
+            aws_access_key_id=self.access_key,
+            aws_secret_access_key=self.secret_key,
+        )
 
         if not self.bucket_name:
             logger.warning(
@@ -39,52 +79,41 @@ class S3FileManager(AbstractFileManager):
                 "Files may not be able to be deleted"
             )
 
-        try:
-            import boto3
-            import smart_open
-
-            self.smart_open = smart_open
-            self.boto3 = boto3
-        except ImportError:
-            raise ImportError(
-                "smart_open is required for S3FileManager. "
-                "Please install it with 'pip install smart_open[s3]'."
-            )
-
     def get_path(self, filename):
         return self.base_path + "/" + filename
 
     def get_file(self, filename):
-        with self.smart_open.open(self.get_path(filename), "rb") as f:
+        with self.smart_open.open(
+            self.get_path(filename), "rb", **self.open_params
+        ) as f:
             return f.read()
 
     async def stream_file(self, filename):
-        with self.smart_open.open(self.get_path(filename), "rb") as f:
+        with self.smart_open.open(
+            self.get_path(filename), "rb", **self.open_params
+        ) as f:
             while chunk := await smart_run(f.read, 8192):
                 yield chunk
 
     def save_file(self, file_data, filename):
         path = self.get_path(filename)
-        with self.smart_open.open(path, "wb") as f:
+        with self.smart_open.open(path, "wb", **self.open_params) as f:
             f.write(file_data.file.read())
         return path
 
     def save_content_to_file(self, content, filename):
         path = self.get_path(filename)
-        with self.smart_open.open(path, "wb") as f:
+        with self.smart_open.open(path, "wb", **self.open_params) as f:
             f.write(content)
         return path
 
     def delete_file(self, filename):
         path = self.get_path(filename)
         try:
-            self.smart_open.open(path, "rb").close()  # Check if file exists
-            s3 = self.boto3.client(
-                "s3",
-                aws_access_key_id=self.access_key,
-                aws_secret_access_key=self.secret_key,
-            )
-            s3.delete_object(
+            self.smart_open.open(
+                path, "rb", **self.open_params
+            ).close()  # Check if file exists
+            self.boto3_client.delete_object(
                 Bucket=self.bucket_name,
                 Key=f"{self.bucket_subfolder}/{filename}"
                 if self.bucket_subfolder
@@ -96,7 +125,7 @@ class S3FileManager(AbstractFileManager):
     def file_exists(self, filename):
         path = self.get_path(filename)
         try:
-            with self.smart_open.open(path, "rb"):
+            with self.smart_open.open(path, "rb", **self.open_params):
                 return True
         except FileNotFoundError:
             return False
@@ -110,6 +139,8 @@ class S3FileManager(AbstractFileManager):
             else subfolder,
             access_key=self.access_key,
             secret_key=self.secret_key,
+            open_params=self.open_params,
+            boto3_client=self.boto3_client,
             *args,
             **kwargs,
         )

fastapi_rtk/lang/messages.pot

@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: PROJECT VERSION\n"
 "Report-Msgid-Bugs-To: EMAIL@ADDRESS\n"
-"POT-Creation-Date: 2025-10-16 13:49+0200\n"
+"POT-Creation-Date: 2025-10-30 10:07+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -53,52 +53,52 @@ msgstr ""
 msgid "Invalid opr_filters: Not a valid JSON string"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:461
+#: fastapi_rtk/api/model_rest_api.py:476
 #, python-brace-format
 msgid "List {ModelName}"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:470
+#: fastapi_rtk/api/model_rest_api.py:485
 #, python-brace-format
 msgid "Show {ModelName}"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:479
+#: fastapi_rtk/api/model_rest_api.py:494
 #, python-brace-format
 msgid "Add {ModelName}"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:488
+#: fastapi_rtk/api/model_rest_api.py:503
 #, python-brace-format
 msgid "Edit {ModelName}"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:1338
+#: fastapi_rtk/api/model_rest_api.py:1395
 msgid "OK"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:2354
-#: fastapi_rtk/api/model_rest_api.py:2753
+#: fastapi_rtk/api/model_rest_api.py:2411
+#: fastapi_rtk/api/model_rest_api.py:2810
 #, python-brace-format
 msgid "Number of items in '{column}' does not match the number of items found."
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:2375
+#: fastapi_rtk/api/model_rest_api.py:2432
 #, python-brace-format
 msgid "Could not find related item for column '{column}'"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:2407
+#: fastapi_rtk/api/model_rest_api.py:2464
 #, python-brace-format
 msgid "File type from '{filename}' is not allowed."
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:2815
+#: fastapi_rtk/api/model_rest_api.py:2872
 #, python-brace-format
 msgid "Invalid column: {column}"
 msgstr ""
 
-#: fastapi_rtk/api/model_rest_api.py:2825
+#: fastapi_rtk/api/model_rest_api.py:2882
 #, python-brace-format
 msgid "Invalid filter: {column}"
 msgstr ""