fastapi-rtk 2.18.1__tar.gz → 2.18.3__tar.gz

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: fastapi-rtk
-Version: 2.18.1
+Version: 2.18.3
 Summary: A package that provides a set of tools to build a FastAPI application with a Class-Based CRUD API.
 Project-URL: Homepage, https://codeberg.org/datatactics/fastapi-rtk
 Project-URL: Issues, https://codeberg.org/datatactics/fastapi-rtk/issues
@@ -16,16 +16,24 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Requires-Python: >=3.11
 Requires-Dist: alembic>=1.17.0
 Requires-Dist: beautifulsoup4>=4.14.2
+Requires-Dist: cryptography>=50.0.1
 Requires-Dist: fastapi-babel>=1.0.0
 Requires-Dist: fastapi-users[oauth,sqlalchemy]>=15.0.5
 Requires-Dist: fastapi[standard]>=0.119.1
+Requires-Dist: idna>=3.15
 Requires-Dist: jsonschema2md>=1.7.0
+Requires-Dist: mako>=1.3.12
 Requires-Dist: marshmallow-sqlalchemy>=1.4.2
 Requires-Dist: pip-licenses>=5.5.1
 Requires-Dist: polib>=1.2.0
-Requires-Dist: prometheus-fastapi-instrumentator>=7.1.0
+Requires-Dist: prometheus-fastapi-instrumentator>=8.0.0
+Requires-Dist: pydantic-settings>=2.14.2
+Requires-Dist: pyjwt[crypto]>=2.13.0
+Requires-Dist: python-multipart>=0.0.31
 Requires-Dist: secweb<2,>=1.25.2
+Requires-Dist: soupsieve>=2.8.4
 Requires-Dist: sqlalchemy-utils>=0.42.0
+Requires-Dist: starlette>=1.3.1
 Requires-Dist: werkzeug>=3.1.5
 Provides-Extra: audit-bg
 Requires-Dist: apscheduler>=3.11.2; extra == 'audit-bg'
@@ -36,10 +44,12 @@ Requires-Dist: geoalchemy2>=0.18.1; extra == 'geometry'
 Requires-Dist: shapely>=2.1.2; extra == 'geometry'
 Provides-Extra: ldap
 Requires-Dist: ldap3>=2.9.1; extra == 'ldap'
+Requires-Dist: pyasn1>=0.6.4; extra == 'ldap'
 Provides-Extra: profiler
 Requires-Dist: pyinstrument>=5.1.2; extra == 'profiler'
 Provides-Extra: s3
 Requires-Dist: smart-open[s3]>=7.5.0; extra == 's3'
+Requires-Dist: urllib3>=2.7.0; extra == 's3'
 Provides-Extra: test
 Requires-Dist: aiosqlite>=0.21.0; extra == 'test'
 Requires-Dist: pytest-asyncio>=1.3.0; extra == 'test'

fastapi_rtk-2.18.3/fastapi_rtk/_version.py

@@ -0,0 +1 @@
+__version__ = "2.18.3"

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/fastapi_rtk/agent_docs/guide/backend.md

@@ -135,6 +135,8 @@ class Item(Model):
 
 `__repr__` is load-bearing: the frontend uses it as the label for related items in dropdowns and grid cells. If it returns nothing meaningful, users see `<Item object at 0x...>`.
 
+A bare relation in `list_columns` (`"category"`, no sub-column) loads every column of the related row, so a related model carrying a large column (a JSONB snapshot, a blob) is fetched in full once per row. Declare `__repr_columns__ = ["name"]` on the related model, naming the columns its `__repr__` reads: `/_info` dropdown values and the `/download` CSV then fetch only the primary key plus those columns, for a nested path ending in a relation (`"order.customer"`) as well as a top-level one. The list and show JSON still serialize the full related row, so a heavy column that no response needs is best marked `deferred=True` on its `mapped_column`.
+
 ### List columns
 
 For plain `Mapped[list[T] | None]` columns, use `ListColumn` (JSON-backed) or `JSONBListColumn` (Postgres JSONB-backed) from `fastapi_rtk` instead of `sqlalchemy.dialects.postgresql.JSONB` directly. The `TypeDecorator` enforces list-shape at bind time, optionally coerces each entry to a target Python type, and lets `ModelRestApi` recognize the column as a list (rendered as a tag-array field by the frontend, not a free-form JSON blob).
@@ -551,7 +553,7 @@ The task runs later, possibly after the loop has advanced or the enclosing funct
 
 ### Sizing the `/download` stream
 
-`/download` exports every row matching the query, so it ignores `page` and `page_size` from the request; they reach the handler and are overwritten. It reads the rows in chunks, and the `download_page_size` attribute on the Api decides how large a chunk is (since the first release after v2.15.0). It is either an int (a fixed chunk) or a resolver `(api, session, params) -> int`. It defaults to the `API_DOWNLOAD_PAGE_SIZE` config key, which is itself the built-in resolver: it counts the matching rows and takes a tenth of them, floored at the `API_DOWNLOAD_MIN_PAGE_SIZE` config key (default `100`) and capped at `API_DOWNLOAD_MAX_PAGE_SIZE` (default `1000`) so a large table cannot size the chunk into an out-of-memory read.
+`/download` exports every row matching the query, so it ignores `page` and `page_size` from the request; they reach the handler and are overwritten. It reads the rows from the database in chunks, and the `download_page_size` attribute on the Api decides how large a chunk is (since the first release after v2.15.0); the HTTP response is written separately, in pieces of `API_DOWNLOAD_RESPONSE_CHUNK_SIZE` characters of CSV text (default `8192`; `0` or a negative value sends one chunk per row). It is either an int (a fixed chunk) or a resolver `(api, session, params) -> int`. It defaults to the `API_DOWNLOAD_PAGE_SIZE` config key, which is itself the built-in resolver: it counts the matching rows and takes a tenth of them, floored at the `API_DOWNLOAD_MIN_PAGE_SIZE` config key (default `100`) and capped at `API_DOWNLOAD_MAX_PAGE_SIZE` (default `1000`) so a large table cannot size the chunk into an out-of-memory read.
 
 Set it to an int for a fixed chunk, which also skips the count query the default runs:
 

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/fastapi_rtk/api/model_rest_api/services/_download_service.py

@@ -108,6 +108,7 @@ class DownloadService:
                 return GeneralResponse(detail=translate("OK"))
 
             params = self.api._handle_query_params(q)
+            params["list_columns"] = self._repr_projection(params["list_columns"])
             page_size = self.api.download_page_size
             if callable(page_size):
                 page_size = await safe_call(page_size(self.api, session, params))
@@ -169,6 +170,10 @@ class DownloadService:
         writer.writerow(labels)
         yield line.read()
 
+        # Every yielded chunk crosses the globals middleware's memory stream and one ASGI send, so rows are batched.
+        chunk_size = Setting.API_DOWNLOAD_RESPONSE_CHUNK_SIZE
+        buffer: list[str] = []
+        buffered = 0
         async for chunk in data:
             for item in chunk:
                 row = await CSVJSONConverter.ajson_to_csv_single(
@@ -178,7 +183,15 @@ class DownloadService:
                     export_mode=export_mode,
                 )
                 writer.writerow(row)
-                yield line.read()
+                text = line.read()
+                buffer.append(text)
+                buffered += len(text)
+                if buffered >= chunk_size:
+                    yield "".join(buffer)
+                    buffer.clear()
+                    buffered = 0
+        if buffer:
+            yield "".join(buffer)
 
     async def import_data(  # pragma: no cover
         self,
@@ -278,6 +291,39 @@ class DownloadService:
 
         return list_data
 
+    def _repr_projection(self, columns: list[str]) -> list[str]:
+        """
+        Narrow a column ending in a relation to the columns its CSV cell needs, when that model declares them.
+
+        A CSV cell renders a relation as ``str(item)`` (``name_``) or its primary key (``id_``), so a related model declaring ``__repr_columns__`` is fetched with its primary key plus those columns instead of every column, which is what a path ending in a relation loads otherwise. The path may be nested (``a.b.c``); only its last segment is narrowed.
+
+        Args:
+            columns (list[str]): The columns the export query fetches.
+
+        Returns:
+            list[str]: The same columns, with each qualifying relation path replaced by dotted sub-columns.
+        """
+        projected: list[str] = []
+        for col in columns:
+            interface = self.api.datamodel
+            *path, leaf = col.split(".")
+            for segment in path:
+                if not interface.is_relation(segment):
+                    interface = None
+                    break
+                interface = interface.get_related_interface(segment)
+            repr_columns = None
+            if interface is not None and interface.is_relation(leaf):
+                related = interface.get_related_interface(leaf)
+                repr_columns = getattr(related.obj, "__repr_columns__", None)
+            if not repr_columns:
+                projected.append(col)
+                continue
+            projected.extend(
+                f"{col}.{sub}" for sub in [*related.get_pk_attrs(), *repr_columns]
+            )
+        return projected
+
 
 async def default_download_page_size(
     api: "ModelRestApi", session: SQLASession, params: DBQueryParams

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/fastapi_rtk/backends/sqla/interface.py

@@ -152,19 +152,12 @@ class SQLAInterface(
             result = result.scalars()
         else:
             result = session.scalars(statement)
+        # No expunge: the identity map holds rows weakly, so a consumed chunk is freed once the caller drops it, and expunge_all() would swap the map the streaming result still holds.
         while True:
             chunk = await smart_run(result.fetchmany, page_size)
             if not chunk:
                 break
             yield chunk
-
-            # Expunge consumed rows one by one; expunge_all() swaps the identity
-            # map the streaming result still holds, killing mid-stream fetches.
-            def expunge_chunk() -> None:
-                for item in chunk:
-                    session.expunge(item)
-
-            await smart_run(expunge_chunk)
         await safe_call(self.close(session))
 
     async def add(self, session, item, *, flush=True, commit=True, refresh=True):

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/fastapi_rtk/const.py

@@ -74,6 +74,7 @@ DEFAULT_API_PAGE_SIZE = 25
 DEFAULT_API_MAX_PAGE_SIZE = 25
 DEFAULT_API_DOWNLOAD_MIN_PAGE_SIZE = 100
 DEFAULT_API_DOWNLOAD_MAX_PAGE_SIZE = 1000
+DEFAULT_API_DOWNLOAD_RESPONSE_CHUNK_SIZE = 8 * 1024
 DEFAULT_TOKEN_URL = "/api/v1/auth/jwt/login"
 DEFAULT_SECRET = "SUPERSECRET"
 DEFAULT_COOKIE_NAME = "dataTactics"

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/fastapi_rtk/setting.py

@@ -4,6 +4,7 @@ from .const import (
     DEFAULT_ADMIN_ROLE,
     DEFAULT_API_DOWNLOAD_MAX_PAGE_SIZE,
     DEFAULT_API_DOWNLOAD_MIN_PAGE_SIZE,
+    DEFAULT_API_DOWNLOAD_RESPONSE_CHUNK_SIZE,
     DEFAULT_API_MAX_PAGE_SIZE,
     DEFAULT_API_PAGE_SIZE,
     DEFAULT_LANG_FOLDER,
@@ -100,6 +101,13 @@ class _Setting:
             "API_DOWNLOAD_MAX_PAGE_SIZE", DEFAULT_API_DOWNLOAD_MAX_PAGE_SIZE
         )
 
+    @property
+    def API_DOWNLOAD_RESPONSE_CHUNK_SIZE(self) -> int:
+        return g.config.get(
+            "API_DOWNLOAD_RESPONSE_CHUNK_SIZE",
+            DEFAULT_API_DOWNLOAD_RESPONSE_CHUNK_SIZE,
+        )
+
     @property
     def API_DOWNLOAD_PAGE_SIZE(self) -> "int | DownloadPageSizeResolver":
         from .api.model_rest_api.services._download_service import (

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/fastapi_rtk/utils/csv_json_converter.py

@@ -1,12 +1,12 @@
 import abc
 import csv
 import enum
+import functools
 import inspect
 import json
+import types
 import typing
 
-from .run_utils import safe_call
-
 if typing.TYPE_CHECKING:
     from ..bases import BasicModel
 
@@ -118,7 +118,7 @@ class CSVJSONConverter:
 
     @classmethod
     def json_to_csv_single(
-        self,
+        cls,
         data: "dict[str, typing.Any] | BasicModel",
         /,
         *,
@@ -141,14 +141,12 @@ class CSVJSONConverter:
             str: The CSV data as a string.
         """
         csv_data: list[str] = []
-        data_pipeline = DataPipeline()
-        data_pipeline.add_processor(ColumnProcessor(relation_separator))
-        data_pipeline.add_processor(ModelProcessor())
-        data_pipeline.add_processor(
-            ListProcessor(delimiter=delimiter, export_mode=export_mode)
+        data_pipeline = cls.get_data_pipeline(
+            async_column=False,
+            relation_separator=relation_separator,
+            delimiter=delimiter,
+            export_mode=export_mode,
         )
-        data_pipeline.add_processor(EnumProcessor())
-        data_pipeline.add_processor(FallbackProcessor())
 
         for col in list_columns:
             value = data_pipeline.process(data, col)
@@ -181,14 +179,12 @@ class CSVJSONConverter:
             str: The CSV data as a string.
         """
         csv_data: list[str] = []
-        data_pipeline = DataPipeline()
-        data_pipeline.add_processor(AsyncColumnProcessor(relation_separator))
-        data_pipeline.add_processor(ModelProcessor())
-        data_pipeline.add_processor(
-            ListProcessor(delimiter=delimiter, export_mode=export_mode)
+        data_pipeline = cls.get_data_pipeline(
+            async_column=True,
+            relation_separator=relation_separator,
+            delimiter=delimiter,
+            export_mode=export_mode,
         )
-        data_pipeline.add_processor(EnumProcessor())
-        data_pipeline.add_processor(FallbackProcessor())
 
         for col in list_columns:
             value = await data_pipeline.aprocess(data, col)
@@ -196,6 +192,44 @@ class CSVJSONConverter:
 
         return csv_data
 
+    @classmethod
+    @functools.lru_cache(maxsize=64)
+    def get_data_pipeline(
+        cls,
+        *,
+        async_column: bool,
+        relation_separator: str,
+        delimiter: str,
+        export_mode: ExportMode,
+    ) -> "DataPipeline":
+        """
+        Build the row-conversion pipeline once per parameter set; its processors hold no per-row state.
+
+        Override to change the processor chain; the cache is keyed per class, so a subclass gets its own pipelines. The delimiter comes from the request, hence the bounded cache.
+
+        Args:
+            async_column (bool): Whether the column processor awaits coroutine-valued attributes.
+            relation_separator (str): The separator between a relation and its sub-column.
+            delimiter (str): The CSV delimiter, which picks the list separator.
+            export_mode (ExportMode): Export mode (simplified or detailed).
+
+        Returns:
+            DataPipeline: The shared pipeline for these parameters.
+        """
+        data_pipeline = DataPipeline()
+        data_pipeline.add_processor(
+            AsyncColumnProcessor(relation_separator)
+            if async_column
+            else ColumnProcessor(relation_separator)
+        )
+        data_pipeline.add_processor(ModelProcessor())
+        data_pipeline.add_processor(
+            ListProcessor(delimiter=delimiter, export_mode=export_mode)
+        )
+        data_pipeline.add_processor(EnumProcessor())
+        data_pipeline.add_processor(FallbackProcessor())
+        return data_pipeline
+
     @classmethod
     def _convert_nested_col_into_dict(
         cls,
@@ -254,15 +288,19 @@ class CSVJSONConverter:
 class DataPipeline:
     def __init__(self):
         self.processors = list[DataProcessor]()
+        self._steps = list[tuple[DataProcessor, bool]]()
 
     def add_processor(self, processor: "DataProcessor"):
         """
         Adds a data processor to the pipeline.
 
+        Whether ``process`` is a coroutine function is decided here, once, so ``aprocess`` awaits only the processors that need it.
+
         Args:
             processor (DataProcessor): The data processor to add.
         """
         self.processors.append(processor)
+        self._steps.append((processor, inspect.iscoroutinefunction(processor.process)))
 
     def process(self, data: typing.Any, col: str):
         """
@@ -292,8 +330,11 @@ class DataPipeline:
         Returns:
             typing.Any: The processed data.
         """
-        for processor in self.processors:
-            data, col, should_continue = await safe_call(processor.process(data, col))
+        for processor, is_async in self._steps:
+            if is_async:
+                data, col, should_continue = await processor.process(data, col)
+            else:
+                data, col, should_continue = processor.process(data, col)
             if not should_continue:
                 break
         return data
@@ -335,22 +376,23 @@ class ColumnProcessor(DataProcessor):
 class AsyncColumnProcessor(ColumnProcessor):
     async def process(self, data, col):
         data, col, continue_processing = super().process(data, col)
-        if inspect.iscoroutine(data):
+        if isinstance(data, types.CoroutineType):
             data = await data
         return data, col, continue_processing
 
 
 class ModelProcessor(DataProcessor):
     def __init__(self, attr="name_"):
+        from ..bases import BasicModel
+
         super().__init__()
         self.attr = attr
+        self.model_class = BasicModel
 
     def process(self, data, col):
-        from ..bases import BasicModel
-
         continue_processing = True
 
-        if isinstance(data, BasicModel):
+        if isinstance(data, self.model_class):
             data = getattr(data, self.attr, "")
             continue_processing = False
         return data, col, continue_processing
@@ -383,10 +425,9 @@ class ListProcessor(DataProcessor):
         self.dict_processor = DictProcessor(
             attr_detailed if export_mode == "detailed" else attr_simplified
         )
+        self.model_class = self.model_processor.model_class
 
     def process(self, data, col):
-        from ..bases import BasicModel
-
         continue_processing = True
 
         if isinstance(data, list):
@@ -394,7 +435,7 @@ class ListProcessor(DataProcessor):
             for item in data:
                 if isinstance(item, dict):
                     item_processed, _, _ = self.dict_processor.process(item, col)
-                elif isinstance(item, BasicModel):
+                elif isinstance(item, self.model_class):
                     item_processed, _, _ = self.model_processor.process(item, col)
                 else:
                     item_processed = str(item)

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/pyproject.toml

@@ -29,6 +29,7 @@ requires-python = ">=3.11"
 dependencies = [
   "alembic>=1.17.0",
   "beautifulsoup4>=4.14.2",
+  "cryptography>=50.0.1",
   "fastapi-babel>=1.0.0",
   "fastapi-users[oauth,sqlalchemy]>=15.0.5",
   "fastapi[standard]>=0.119.1",
@@ -36,10 +37,18 @@ dependencies = [
   "marshmallow-sqlalchemy>=1.4.2",
   "pip-licenses>=5.5.1",
   "polib>=1.2.0",
-  "prometheus-fastapi-instrumentator>=7.1.0",
+  "prometheus-fastapi-instrumentator>=8.0.0",
+  "pyjwt[crypto]>=2.13.0",
   "secweb>=1.25.2,<2",
   "sqlalchemy-utils>=0.42.0",
+  "starlette>=1.3.1",
   "werkzeug>=3.1.5",
+  # Security floors: transitive deps pinned above known-vulnerable versions.
+  "idna>=3.15",                 # IDNA decoder DoS on crafted input (CVE-2026-45409)
+  "mako>=1.3.12",               # TemplateLookup path traversal (CVE-2026-44307)
+  "pydantic-settings>=2.14.2",  # secrets_dir directory traversal (GHSA-4xgf-cpjx-pc3j)
+  "python-multipart>=0.0.31",   # multipart/urlencoded parser DoS (CVE-2026-53540)
+  "soupsieve>=2.8.4",           # CSS selector parser ReDoS (CVE-2026-49477)
 ]
 urls = { Homepage = "https://codeberg.org/datatactics/fastapi-rtk", Issues = "https://codeberg.org/datatactics/fastapi-rtk/issues" }
 scripts = { "fastapi-rtk" = "fastapi_rtk.cli:main" }
@@ -47,10 +56,16 @@ scripts = { "fastapi-rtk" = "fastapi_rtk.cli:main" }
 [project.optional-dependencies]
 fab = ["prison>=0.2.1"]
 geometry = ["geoalchemy2>=0.18.1", "shapely>=2.1.2"]
-s3 = ["smart-open[s3]>=7.5.0"]
+s3 = [
+  "smart-open[s3]>=7.5.0",
+  "urllib3>=2.7.0", # response decompression amplification (CVE-2026-44432)
+]
 audit-bg = ["apscheduler>=3.11.2"]
 profiler = ["pyinstrument>=5.1.2"]
-ldap = ["ldap3>=2.9.1"]
+ldap = [
+  "ldap3>=2.9.1",
+  "pyasn1>=0.6.4", # BER/CER/DER decoder DoS (CVE-2026-59884)
+]
 test = [
   "aiosqlite>=0.21.0",
   "pytest>=9.0.2",

fastapi_rtk-2.18.3/tests/unit/api/model_rest_api/test_download_service.py

@@ -0,0 +1,204 @@
+"""`DownloadService`: chunked CSV output and the repr-column projection of relation paths."""
+
+import csv
+import io
+import types
+
+import pydantic
+import pytest
+import sqlalchemy
+import sqlalchemy.orm
+import sqlalchemy.pool
+
+from fastapi_rtk import Mapped, mapped_column, relationship
+from fastapi_rtk.api.model_rest_api.services._download_service import DownloadService
+from fastapi_rtk.backends.sqla.interface import SQLAInterface
+from fastapi_rtk.backends.sqla.model import Model
+
+LIST_COLUMNS = ["name", "description"]
+LABEL_COLUMNS = {"name": "Name", "description": "Description"}
+
+
+class _ExportSite(Model):
+    __tablename__ = "download_service_site"
+    __repr_columns__ = ["code"]
+    id: Mapped[int] = mapped_column(primary_key=True)
+    code: Mapped[str]
+    secret: Mapped[str | None]
+    runs: Mapped[list["_ExportRun"]] = relationship(back_populates="site")
+
+    def __repr__(self):
+        return self.code
+
+
+class _ExportRun(Model):
+    __tablename__ = "download_service_run"
+    __repr_columns__ = ["label"]
+    id: Mapped[int] = mapped_column(primary_key=True)
+    label: Mapped[str]
+    payload: Mapped[str | None]
+    site_id: Mapped[int | None] = mapped_column(
+        sqlalchemy.ForeignKey("download_service_site.id")
+    )
+    site: Mapped[_ExportSite | None] = relationship(back_populates="runs")
+    rows: Mapped[list["_ExportRow"]] = relationship(back_populates="run")
+
+    def __repr__(self):
+        return self.label
+
+
+class _ExportRow(Model):
+    __tablename__ = "download_service_row"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    name: Mapped[str]
+    run_id: Mapped[int] = mapped_column(
+        sqlalchemy.ForeignKey("download_service_run.id")
+    )
+    run: Mapped[_ExportRun] = relationship(back_populates="rows")
+
+
+@pytest.fixture
+def row_service():
+    return DownloadService(types.SimpleNamespace(datamodel=SQLAInterface(_ExportRow)))
+
+
+@pytest.fixture
+def seeded_session():
+    engine = sqlalchemy.create_engine(
+        "sqlite://",
+        connect_args={"check_same_thread": False},
+        poolclass=sqlalchemy.pool.StaticPool,
+    )
+    _ExportSite.__table__.create(engine)
+    _ExportRun.__table__.create(engine)
+    _ExportRow.__table__.create(engine)
+    with sqlalchemy.orm.Session(engine) as session:
+        site = _ExportSite(id=1, code="FRA", secret="s" * 1000)
+        run = _ExportRun(id=1, label="run 1", payload="x" * 1000, site=site)
+        session.add_all([run, _ExportRow(id=1, name="a", run=run)])
+        session.commit()
+        session.expunge_all()
+        yield session
+    engine.dispose()
+
+
+class TestReprProjection:
+    def test_bare_relation_with_repr_columns_becomes_pk_plus_repr_columns(
+        self, row_service
+    ):
+        assert row_service._repr_projection(["name", "run"]) == [
+            "name",
+            "run.id",
+            "run.label",
+        ]
+
+    def test_relation_without_repr_columns_is_kept_bare(self, row_service, monkeypatch):
+        monkeypatch.setattr(_ExportRun, "__repr_columns__", None)
+        assert row_service._repr_projection(["name", "run"]) == ["name", "run"]
+
+    def test_dotted_and_plain_columns_are_untouched(self, row_service):
+        assert row_service._repr_projection(
+            ["run.payload", "run.site.code", "name", "id"]
+        ) == ["run.payload", "run.site.code", "name", "id"]
+
+    def test_nested_path_ending_in_a_relation_is_narrowed(self, row_service):
+        assert row_service._repr_projection(["run.site"]) == [
+            "run.site.id",
+            "run.site.code",
+        ]
+
+    def test_unknown_segment_is_kept_as_is(self, row_service):
+        assert row_service._repr_projection(["nope.site", "run.nope"]) == [
+            "nope.site",
+            "run.nope",
+        ]
+
+    async def test_nested_projection_leaves_other_related_columns_unloaded(
+        self, row_service, seeded_session
+    ):
+        columns = row_service._repr_projection(["run.site"])
+        rows = await row_service.api.datamodel.get_many(
+            seeded_session, {"list_columns": columns}
+        )
+        site_state = sqlalchemy.inspect(rows[0].run.site)
+        assert "secret" in site_state.unloaded
+        assert {"id", "code"}.isdisjoint(site_state.unloaded)
+        assert str(rows[0].run.site) == "FRA"
+
+    async def test_projected_query_leaves_other_related_columns_unloaded(
+        self, row_service, seeded_session
+    ):
+        columns = row_service._repr_projection(["name", "run"])
+        rows = await row_service.api.datamodel.get_many(
+            seeded_session, {"list_columns": columns}
+        )
+        run_state = sqlalchemy.inspect(rows[0].run)
+        assert "payload" in run_state.unloaded
+        assert {"id", "label"}.isdisjoint(run_state.unloaded)
+        assert str(rows[0].run) == "run 1"
+
+
+class _RowSchema(pydantic.BaseModel):
+    name: str
+    description: str
+
+
+def _rows(count: int, description_length: int = 4):
+    return [
+        {"name": f"row_{i}", "description": "x" * description_length}
+        for i in range(count)
+    ]
+
+
+async def _chunks(rows, chunk_size: int):
+    for start in range(0, len(rows), chunk_size):
+        yield rows[start : start + chunk_size]
+
+
+def _expected_csv(rows):
+    buffer = io.StringIO()
+    writer = csv.writer(buffer)
+    writer.writerow([LABEL_COLUMNS[col] for col in LIST_COLUMNS])
+    for row in rows:
+        writer.writerow([row[col] for col in LIST_COLUMNS])
+    return buffer.getvalue()
+
+
+async def _export(rows, chunk_size: int = 2):
+    service = DownloadService(api=None)
+    pieces = []
+    async for piece in service.export_data(
+        _chunks(rows, chunk_size), LIST_COLUMNS, LABEL_COLUMNS, _RowSchema
+    ):
+        pieces.append(piece)
+    return pieces
+
+
+async def test_header_then_one_chunk_for_a_small_export():
+    rows = _rows(5)
+    pieces = await _export(rows)
+    assert len(pieces) == 2
+    assert "".join(pieces) == _expected_csv(rows)
+
+
+async def test_large_export_is_batched_but_byte_identical(config_setter):
+    config_setter("API_DOWNLOAD_RESPONSE_CHUNK_SIZE", 200)
+    rows = _rows(50, description_length=30)
+    pieces = await _export(rows, chunk_size=7)
+    body = pieces[1:]
+    assert len(body) > 1
+    assert all(len(piece) >= 200 for piece in body[:-1])
+    assert "".join(pieces) == _expected_csv(rows)
+
+
+async def test_negative_chunk_size_sends_one_chunk_per_row(config_setter):
+    config_setter("API_DOWNLOAD_RESPONSE_CHUNK_SIZE", -1)
+    rows = _rows(5)
+    pieces = await _export(rows)
+    assert len(pieces) == 1 + len(rows)
+    assert "".join(pieces) == _expected_csv(rows)
+
+
+async def test_empty_export_yields_only_the_header():
+    pieces = await _export([])
+    assert pieces == [_expected_csv([])]

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/tests/unit/backends/sqla/test_interface.py

@@ -379,18 +379,11 @@ class TestCRUD:
         total = sum(len(c) for c in chunks)
         assert total == 3
 
-    async def test_yield_per_expunges_consumed_rows(self, session, iface, monkeypatch):
-        expunged = []
-        original = session.expunge
-
-        def expunge(item):
-            expunged.append(item)
-            original(item)
-
-        monkeypatch.setattr(session, "expunge", expunge)
-        async for _chunk in iface.yield_per(session, {"page_size": 2}):
-            pass
-        assert len(expunged) == 3
+    async def test_yield_per_does_not_retain_consumed_rows(self, session, iface):
+        async for chunk in iface.yield_per(session, {"page_size": 2}):
+            assert len(session.identity_map) >= len(chunk)
+            del chunk
+        assert len(session.identity_map) == 0
 
     async def test_yield_per_async_survives_chunk_boundary(self):
         engine = sqlalchemy.ext.asyncio.create_async_engine("sqlite+aiosqlite://")

{fastapi_rtk-2.18.1 → fastapi_rtk-2.18.3}/tests/unit/test_const.py

@@ -1,7 +1,6 @@
 import logging
 
 import pytest
-
 from fastapi_rtk import const
 
 
@@ -60,6 +59,7 @@ class TestDefaults:
         assert const.DEFAULT_API_MAX_PAGE_SIZE == 25
         assert const.DEFAULT_API_DOWNLOAD_MIN_PAGE_SIZE == 100
         assert const.DEFAULT_API_DOWNLOAD_MAX_PAGE_SIZE == 1000
+        assert const.DEFAULT_API_DOWNLOAD_RESPONSE_CHUNK_SIZE == 8192
 
     def test_default_token_url(self):
         assert const.DEFAULT_TOKEN_URL.startswith("/")