flask-appbuilder 5.2.0__tar.gz → 5.2.1__tar.gz

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/CHANGELOG.rst

@@ -1,6 +1,13 @@
 Flask-AppBuilder ChangeLog
 ==========================
 
+Improvements and Bug fixes on 5.2.1
+-----------------------------------
+
+- fix: pass outer_default_load to apply_all (#2449) [skrepkaq]
+- feat: add missing CRUD hooks and auth event hooks (#2450) [Daniel Vaz Gaspar]
+- fix(security): remove OAuth token values from debug log statements (#2440) [Daniel Vaz Gaspar]
+
 Improvements and Bug fixes on 5.2.0
 -----------------------------------
 

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/Flask_AppBuilder.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: flask-appbuilder
-Version: 5.2.0
+Version: 5.2.1
 Summary: Simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.
 Home-page: https://github.com/dpgaspar/flask-appbuilder/
 Author: Daniel Vaz Gaspar

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/Flask_AppBuilder.egg-info/SOURCES.txt

@@ -782,11 +782,18 @@ tests/const.py
 tests/test_addon.py
 tests/test_api.py
 tests/test_custom_indexview.py
+tests/test_detached_user.py
 tests/test_fab_cli.py
+tests/test_hooks.py
+tests/test_json_coverage_fixes.py
+tests/test_json_edge_cases.py
+tests/test_json_support.py
 tests/test_menu.py
 tests/test_mvc.py
 tests/test_mvc_oauth.py
 tests/test_security_api.py
+tests/test_security_manager.py
+tests/test_security_signals.py
 tests/test_sqlalchemy.py
 tests/test_urltools.py
 tests/fixtures/__init__.py

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: flask_appbuilder
-Version: 5.2.0
+Version: 5.2.1
 Summary: Simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.
 Home-page: https://github.com/dpgaspar/flask-appbuilder/
 Author: Daniel Vaz Gaspar

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/flask_appbuilder/__init__.py

@@ -1,5 +1,5 @@
 __author__ = "Daniel Vaz Gaspar"
-__version__ = "5.2.0"
+__version__ = "5.2.1"
 
 from .actions import action  # noqa: F401
 from .api import ModelRestApi  # noqa: F401

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/flask_appbuilder/models/sqla/interface.py

@@ -569,6 +569,7 @@ class SQLAInterface(BaseInterface):
             page,
             page_size,
             select_columns,
+            outer_default_load,
         )
         query_results = query.all()
 

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/flask_appbuilder/security/manager.py

@@ -16,6 +16,7 @@ from flask_limiter.util import get_remote_address
 from flask_login import current_user, LoginManager
 import jwt
 from packaging.version import Version
+from sqlalchemy import inspect as sa_inspect
 from werkzeug.security import check_password_hash, generate_password_hash
 
 from .api import SecurityApi
@@ -134,7 +135,7 @@ def _oauth_tokengetter(token=None):
     from session cookie.
     """
     token = session.get("oauth")
-    log.debug("Token Get: %s", token)
+    log.debug("Token Get: retrieved OAuth token from session")
     return token
 
 
@@ -975,6 +976,27 @@ class BaseSecurityManager(AbstractSecurityManager):
         )
         self.update_user(user)
 
+    def on_user_login(self, user) -> None:
+        """Called after a successful user login.
+        Override to add custom logic (e.g., audit logging).
+
+        :param user: The authenticated user model
+        """
+
+    def on_user_login_failed(self, user) -> None:
+        """Called after a failed user login attempt.
+        Override to add custom logic (e.g., audit logging).
+
+        :param user: The identified (but not authenticated) user model
+        """
+
+    def on_user_logout(self, user) -> None:
+        """Called when a user logs out.
+        Override to add custom logic (e.g., audit logging).
+
+        :param user: The user model that is logging out
+        """
+
     def update_user_auth_stat(self, user, success=True):
         """
         Update user authentication stats upon successful/unsuccessful
@@ -1000,6 +1022,10 @@ class BaseSecurityManager(AbstractSecurityManager):
         else:
             user.fail_login_count += 1
         self.update_user(user)
+        if success:
+            self.on_user_login(user)
+        else:
+            self.on_user_login_failed(user)
 
     def auth_user_db(self, username, password):
         """
@@ -1867,21 +1893,47 @@ class BaseSecurityManager(AbstractSecurityManager):
 
         return result
 
+    def _is_user_detached(self, user) -> bool:
+        """Check if a SQLAlchemy user instance is detached from the session."""
+        try:
+            return sa_inspect(user).detached
+        except Exception:
+            return False
+
+    def _get_safe_user(self, user):
+        """Return an attached ORM user instance, re-fetching from DB if needed.
+        Handles detached ORM instances and non-ORM objects (e.g. LocalProxy).
+        Returns None if the user cannot be resolved.
+        """
+        if user is None:
+            return None
+        if self._is_user_detached(user):
+            try:
+                identity = sa_inspect(user).identity
+            except Exception:
+                return None
+            if identity:
+                return self.get_user_by_id(identity[0])
+            return None
+        return user
+
     def has_access(self, permission_name: str, view_name: str) -> bool:
         """
         Check if current user or public has access to view or menu
         """
         # Check API key authenticated user first
         if getattr(g, "_api_key_user", False) and hasattr(g, "user"):
-            user = g.user
+            user = self._get_safe_user(g.user)
+            if user and user.is_active:
+                return self._has_view_access(user, permission_name, view_name)
+        if current_user.is_authenticated:
+            user = self._get_safe_user(g.user)
             if user and user.is_active:
                 return self._has_view_access(user, permission_name, view_name)
-        if current_user.is_authenticated and current_user.is_active:
-            return self._has_view_access(g.user, permission_name, view_name)
-        elif current_user_jwt and current_user_jwt.is_active:
+            return False
+        if current_user_jwt and current_user_jwt.is_active:
             return self._has_view_access(current_user_jwt, permission_name, view_name)
-        else:
-            return self.is_item_public(permission_name, view_name)
+        return self.is_item_public(permission_name, view_name)
 
     def get_user_menu_access(self, menu_names: List[str] = None) -> Set[str]:
         if current_user.is_authenticated:

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/flask_appbuilder/security/sqla/apis/group/api.py

@@ -120,6 +120,7 @@ class GroupApi(ModelRestApi):
 
             self.pre_add(model)
             self.datamodel.add(model)
+            self.post_add(model)
 
             return self.response(201, id=model.id)
 
@@ -216,6 +217,7 @@ class GroupApi(ModelRestApi):
                 model.users = users
             self.pre_update(model)
             self.datamodel.edit(model)
+            self.post_update(model)
             return self.response(
                 200,
                 **{API_RESULT_RES_KEY: self.edit_model_schema.dump(item, many=False)},

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/flask_appbuilder/security/sqla/apis/user/api.py

@@ -165,6 +165,7 @@ class UserApi(ModelRestApi):
 
             self.pre_add(model)
             self.datamodel.add(model)
+            self.post_add(model)
             return self.response(201, id=model.id)
         except ValidationError as error:
             return self.response_400(message=error.messages)
@@ -281,6 +282,7 @@ class UserApi(ModelRestApi):
 
             self.pre_update(model, item)
             self.datamodel.edit(model)
+            self.post_update(model)
             return self.response(
                 200,
                 **{API_RESULT_RES_KEY: self.edit_model_schema.dump(item, many=False)},

{flask_appbuilder-5.2.0 → flask_appbuilder-5.2.1}/flask_appbuilder/security/views.py

@@ -577,9 +577,33 @@ class AuthView(BaseView):
     def login(self):
         pass
 
+    def _get_authenticated_user(self):
+        """Resolve the current user before logout clears the session.
+        Returns a fresh User model from DB, or None if not authenticated.
+        Note: g.user may be a LocalProxy that becomes anonymous after
+        logout_user(), or a detached ORM instance whose attribute access
+        raises DetachedInstanceError. We extract the id and re-fetch
+        a concrete, session-bound instance before logout.
+        """
+        user = getattr(g, "user", None)
+        if user is None:
+            return None
+        try:
+            if not user.is_authenticated:
+                return None
+            user_id = user.id
+        except Exception:
+            return None
+        if user_id is not None:
+            return self.appbuilder.sm.get_user_by_id(user_id)
+        return None
+
     @expose("/logout/")
     def logout(self):
+        user = self._get_authenticated_user()
         logout_user()
+        if user is not None:
+            self.appbuilder.sm.on_user_logout(user)
         return redirect(
             current_app.config.get(
                 "LOGOUT_REDIRECT_URL", self.appbuilder.get_url_for_index
@@ -698,7 +722,7 @@ class AuthOAuthView(AuthView):
         if resp is None:
             flash("You denied the request to sign in.", "warning")
             return redirect(self.appbuilder.get_url_for_login)
-        log.debug("OAUTH Authorized resp: %s", resp)
+        log.debug("OAUTH Authorized resp received for provider: %s", provider)
         # Retrieves specific user info from the provider
         try:
             self.appbuilder.sm.set_oauth_session(provider, resp)
@@ -865,7 +889,10 @@ class AuthSAMLView(AuthView):
         try:
             idp = session.get("saml_idp")
             if not idp:
+                user = self._get_authenticated_user()
                 logout_user()
+                if user is not None:
+                    self.appbuilder.sm.on_user_logout(user)
                 return redirect(self.appbuilder.get_url_for_index)
 
             url, should_logout = self.appbuilder.sm.get_saml_logout_redirect_url(
@@ -874,16 +901,25 @@ class AuthSAMLView(AuthView):
                 session_index=session.get("saml_session_index"),
             )
             if should_logout:
+                user = self._get_authenticated_user()
                 logout_user()
+                if user is not None:
+                    self.appbuilder.sm.on_user_logout(user)
             return redirect(url or self.appbuilder.get_url_for_index)
 
         except (OneLogin_Saml2_Error, OneLogin_Saml2_ValidationError) as e:
             log.error("SAML SLO validation error: %s", e)
+            user = self._get_authenticated_user()
             logout_user()
+            if user is not None:
+                self.appbuilder.sm.on_user_logout(user)
             return redirect(self.appbuilder.get_url_for_index)
         except ValueError as e:
             log.error("SAML SLO configuration error: %s", e)
+            user = self._get_authenticated_user()
             logout_user()
+            if user is not None:
+                self.appbuilder.sm.on_user_logout(user)
             return redirect(self.appbuilder.get_url_for_index)
 
     @expose("/logout/")
@@ -895,7 +931,10 @@ class AuthSAMLView(AuthView):
                 return redirect(url_for(".slo"))
             except Exception:
                 pass
+        user = self._get_authenticated_user()
         logout_user()
+        if user is not None:
+            self.appbuilder.sm.on_user_logout(user)
         return redirect(
             current_app.config.get(
                 "LOGOUT_REDIRECT_URL", self.appbuilder.get_url_for_index