statezero 0.1.0b17__py3-none-any.whl → 0.1.0b18__py3-none-any.whl

statezero/adaptors/django/orm.py

@@ -763,6 +763,7 @@ class DjangoORMAdapter(AbstractORMProvider):
     def get_fields(self, model: models.Model) -> Set[str]:
         """
         Return a set of the model fields.
+        Includes both database fields and additional_fields (computed fields).
         """
         model_config = registry.get_config(model)
         if model_config.fields and "__all__" != model_config.fields:
@@ -775,6 +776,14 @@ class DjangoORMAdapter(AbstractORMProvider):
             resolved_fields = resolved_fields.union(additional_fields)
         return resolved_fields
 
+    def get_db_fields(self, model: models.Model) -> Set[str]:
+        """
+        Return only actual database fields for the model.
+        Excludes read-only additional_fields (computed fields).
+        Used for deserialization - hooks can write to any DB field.
+        """
+        return set(field.name for field in model._meta.get_fields())
+
     def build_model_graph(
         self, model: Type[models.Model], model_graph: nx.DiGraph = None
     ) -> nx.DiGraph:

statezero/adaptors/django/schemas.py

@@ -41,9 +41,9 @@ class DjangoSchemaGenerator(AbstractSchemaGenerator):
         all_field_names: Set[str] = set()
         db_field_names: Set[str] = set()
 
-        if model_config.frontend_fields != "__all__":
+        if model_config.fields != "__all__":
             all_fields = [
-                field for field in all_fields if field.name in model_config.frontend_fields
+                field for field in all_fields if field.name in model_config.fields
             ]
 
         for field in all_fields:

statezero/adaptors/django/serializers.py

@@ -6,7 +6,7 @@ from rest_framework import serializers
 import contextvars
 from contextlib import contextmanager
 import logging
-from cytoolz import pluck
+from cytoolz import pluck, keyfilter
 from zen_queries import queries_disabled
 
 from statezero.adaptors.django.config import config, registry
@@ -484,33 +484,42 @@ class DRFDynamicSerializer(AbstractDataSerializer):
         # Serious security issue if fields_map is None
         assert fields_map is not None, "fields_map is required and cannot be None"
 
-        # Use the context manager for the duration of deserialization
-        with fields_map_context(fields_map):
-            # Create serializer class
-            serializer_class = DynamicModelSerializer.for_model(model)
-            available_fields = set(serializer_class().fields.keys())
+        # Get model name and allowed fields from fields_map
+        model_name = config.orm_provider.get_model_name(model)
+        allowed_fields = fields_map.get(model_name, set())
 
-            try:
-                model_config = registry.get_config(model)
-                if model_config.pre_hooks:
-                    for hook in model_config.pre_hooks:
-                        hook_result = hook(data, request=request)
-                        if settings.DEBUG:
-                            data = _check_pre_hook_result(
-                                original_data=data,
-                                result_data=hook_result,
-                                model=model,
-                                serializer_fields=available_fields
-                            )
-                        else:
-                            data = hook_result or data
-            except ValueError:
-                # No model config available
-                model_config = None
+        # Filter user input to only allowed fields (security boundary)
+        data = dict(keyfilter(lambda k: k in allowed_fields, data))
+
+        try:
+            model_config = registry.get_config(model)
+        except ValueError:
+            # No model config available
+            model_config = None
+
+        # Run pre-hooks on filtered data (hooks can add any DB fields)
+        if model_config and model_config.pre_hooks:
+            for hook in model_config.pre_hooks:
+                hook_result = hook(data, request=request)
+                if settings.DEBUG:
+                    # Note: available_fields check removed since hooks can add any DB field
+                    data = hook_result or data
+                else:
+                    data = hook_result or data
+
+        # Expand fields_map to all DB fields for serializer validation
+        # This allows hooks to add fields that aren't in the original fields_map
+        all_db_fields = config.orm_provider.get_db_fields(model)
+        expanded_fields_map = {model_name: all_db_fields}
+
+        # Use the context manager with expanded fields map
+        with fields_map_context(expanded_fields_map):
+            # Create serializer class with all DB fields available
+            serializer_class = DynamicModelSerializer.for_model(model)
 
             # Create serializer
             serializer = serializer_class(
-                data=data, 
+                data=data,
                 partial=partial,
                 request=request
             )

statezero/adaptors/django/views.py

@@ -570,11 +570,11 @@ class FieldPermissionsView(APIView):
                 # For read operations, default "__all__" to frontend_fields
                 if operation_type == "read":
                     # If frontend_fields is also "__all__", then return all fields
-                    if model_config.frontend_fields == "__all__":
+                    if model_config.fields == "__all__":
                         return all_fields
                     # Otherwise, use frontend_fields as the default for "__all__"
                     else:
-                        fields = model_config.frontend_fields
+                        fields = model_config.fields
                         fields &= all_fields  # Ensure fields actually exist
                         allowed_fields |= fields
                 else:

statezero/core/ast_parser.py

@@ -386,19 +386,8 @@ class ASTParser:
 
                 # If any permission allows all fields
                 if fields == "__all__":
-                    # NEW: For read operations, default "__all__" to frontend_fields
-                    if operation_type == "read":
-                        # If frontend_fields is also "__all__", then return all fields
-                        if model_config.frontend_fields == "__all__":
-                            return all_fields
-                        # Otherwise, use frontend_fields as the default for "__all__"
-                        else:
-                            fields = model_config.frontend_fields
-                            fields &= all_fields  # Ensure fields actually exist
-                            allowed_fields |= fields
-                    else:
-                        # For create/update operations, "__all__" means truly all fields
-                        return all_fields
+                    return all_fields
+
                 # Add allowed fields from this permission
                 else:  # Ensure we're not operating on the string "__all__"
                     fields &= all_fields  # Ensure fields actually exist

statezero/core/config.py

@@ -181,7 +181,6 @@ class ModelConfig:
         searchable_fields: Optional[Union[Set[str], Literal["__all__"]]] = None,
         ordering_fields: Optional[Union[Set[str], Literal["__all__"]]] = None,
         fields: Optional[Union[Set[str], Literal["__all__"]]] = None,
-        frontend_fields: Optional[Union[Set[str], Literal["__all__"]]] = None,
         display: Optional[Any] = None,
         DEBUG: bool = False,
     ):
@@ -196,7 +195,6 @@ class ModelConfig:
         self.searchable_fields = searchable_fields or set()
         self.ordering_fields = ordering_fields or set()
         self.fields = fields or "__all__"
-        self.frontend_fields = frontend_fields or self.fields
         self.display = display
         self.DEBUG = DEBUG or False
 

statezero/core/interfaces.py

@@ -70,6 +70,16 @@ class AbstractORMProvider(ABC):
     def get_fields(self, model: ORMModel) -> Set[str]:
         """
         Get all of the model fields - doesn't apply permissions check.
+        Includes both database fields and additional_fields (computed fields).
+        """
+        pass
+
+    @abstractmethod
+    def get_db_fields(self, model: ORMModel) -> Set[str]:
+        """
+        Get only the actual database fields for a model.
+        Excludes read-only additional_fields (computed fields).
+        Used for deserialization - hooks can write to any DB field.
         """
         pass
 

{statezero-0.1.0b17.dist-info → statezero-0.1.0b18.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: statezero
-Version: 0.1.0b17
+Version: 0.1.0b18
 Summary: Connect your Python backend to a modern JavaScript SPA frontend with 90% less complexity.
 Author-email: Robert <robert.herring@statezero.dev>
 Project-URL: homepage, https://www.statezero.dev

{statezero-0.1.0b17.dist-info → statezero-0.1.0b18.dist-info}/RECORD

@@ -10,13 +10,13 @@ statezero/adaptors/django/exception_handler.py,sha256=SHIg-A1hiMql1pb026DxkUijUU
 statezero/adaptors/django/f_handler.py,sha256=yvITFj9UAnz8-r-aLEcWoz48tBhZ08-VMq9Fsm2uiN8,12305
 statezero/adaptors/django/helpers.py,sha256=0Dyq5vboDuTUaH-KpS3oVDjastA9yv6xI6XpBuvRM3I,5974
 statezero/adaptors/django/middleware.py,sha256=YVr8fkqCk51xJQM-ovtrUiB9Kt9H81cLd9xv4cM9YlM,410
-statezero/adaptors/django/orm.py,sha256=Z62XheCvuKIpKOoIIiLLOwrpJ5jPhv-BGxg-pqPgNaU,40757
+statezero/adaptors/django/orm.py,sha256=NjxZQDI0r5Ccl5bPxFcPxnao2oJlN0k5_RdGs4kCWAo,41191
 statezero/adaptors/django/permissions.py,sha256=fU2c4bKK0zX2uuVB0UazZHTI-5OkiI5-BtPNcPEWmW0,9525
 statezero/adaptors/django/query_optimizer.py,sha256=-iAh5kyE8WNZdjb_qBbNag_nxKzejroUYPBdwG_uVaQ,41462
-statezero/adaptors/django/schemas.py,sha256=YpmXd3XMZpkjPiHB_3OMnDgc1thgOj3RgFx-YXhScqs,14058
-statezero/adaptors/django/serializers.py,sha256=YFFDu6bzoWkSEOVH5Wmc4yJ8SaOkUA6HbXXYt6djlfc,23296
+statezero/adaptors/django/schemas.py,sha256=cnDzfUWS_oH16kEc0cy6h7tNmBSPpNp_Rz3sH0vU2Ak,14040
+statezero/adaptors/django/serializers.py,sha256=lvcO4Vn9UM8TD28pse1XxrQugkFlzSeL8rYDHRU5bpk,23722
 statezero/adaptors/django/urls.py,sha256=bLn_kL5a5VBQfhl2-UCpLmguSenjJ7bouPoKMKNTX5M,1054
-statezero/adaptors/django/views.py,sha256=RKReFV3AiMT_5jL5fVbPDnSnKfhpBtVt5FlzL4psWhw,24201
+statezero/adaptors/django/views.py,sha256=rALVs8McRzgf-YhLoq7GqisjKiLxaq2k0WUrcGhmRvA,24183
 statezero/adaptors/django/extensions/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 statezero/adaptors/django/extensions/custom_field_serializers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 statezero/adaptors/django/extensions/custom_field_serializers/file_fields.py,sha256=BaOaJPmyzCp-YFwpsTOvGHjHpk6s8UJuZ5JsF-PEGV4,4518
@@ -29,20 +29,20 @@ statezero/adaptors/django/search_providers/basic_search.py,sha256=5_GJ1r_B6JdIYX
 statezero/adaptors/django/search_providers/postgres_search.py,sha256=IMoHxzfi-Y3hAxPND4Xc6GatrPs1eXAqpmcfwt5Zr14,2459
 statezero/core/__init__.py,sha256=Z6RTutAAElLMEjBFphVVmpySPdJBA55j-Uo0BtR7c5E,1040
 statezero/core/actions.py,sha256=eq4zuDhK1h-nZ24jUQhiWL6BcMqq-W4BhdVNdYegymw,2969
-statezero/core/ast_parser.py,sha256=QTFRDwanN2jJJOs4SeRdRPiVZWlK-tkmwZBlQNByew0,39321
+statezero/core/ast_parser.py,sha256=QHpwWlVQTrxE1xen4xMZcALDn7eEl4CL5PoVfGQg_c4,38539
 statezero/core/ast_validator.py,sha256=YZAflPyba0kXWBNhd1Z_XeEk-_zUzM6MkY9zSlX1PMs,11582
 statezero/core/classes.py,sha256=TlJYUhiYniTJqZCSVo_-85mgJ4muhCPpJWxlgG-Vph8,6996
-statezero/core/config.py,sha256=kOcQPzBA06d8EliP2bVY0daFlt8bm-8ZOsqb5x7-8JA,11822
+statezero/core/config.py,sha256=RNRujZg393a2B_uj4isUUIhwEUZFAfSlafKHu_O3EAs,11679
 statezero/core/context_storage.py,sha256=DVx525ZMRorj41kg5K0N6pPdGkQ5_XEJcBucpH5ChxQ,162
 statezero/core/event_bus.py,sha256=2IFLBHSkLzpm1AX0MfSXSmF2X-lXK-gOoODZCtB2Jdw,6284
 statezero/core/event_emitters.py,sha256=qjMbeUmdn4bG7WiVfqTmNdaflEea5amnTEpOn5X0J44,2046
 statezero/core/exceptions.py,sha256=_krMHWW9qBbMXvvqFdWf85a3Kayn7XbJczfC3x3gmBI,3330
 statezero/core/hook_checks.py,sha256=uqtvwRx1qGsF7Vc49elAWdOjMzhuv3RADKY1wiLvhK4,3425
-statezero/core/interfaces.py,sha256=kVkNWyh52tUlzD02CRheLJof3DyQoVcPuvX33fL6sn8,20544
+statezero/core/interfaces.py,sha256=YgONfBl8PY0sLLILMMmBAJ84xJS-rNCVjhXtsCzoOAE,20938
 statezero/core/process_request.py,sha256=dwIeBEVOE8zA-oE1h65XNOGiVqFbbXA7SzTAguLNgZk,8060
 statezero/core/types.py,sha256=mMtqK3fGhEM6LtzUgQrxlyP-V0VgVqc-1eVKgRjTzp0,913
-statezero-0.1.0b17.dist-info/licenses/license.md,sha256=0uKjybTt9K_YbEmYgf25JN292qjjJ-BPofvIZ3wdtX4,7411
-statezero-0.1.0b17.dist-info/METADATA,sha256=OTnEueJ01hbh4EwG6LzpGxgdF4HzCg0sxXb4QpXfeKM,6704
-statezero-0.1.0b17.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-statezero-0.1.0b17.dist-info/top_level.txt,sha256=UAuZYPKczradU1kcMQxsGjUzEW0qdgsqzhXyscrcLpw,10
-statezero-0.1.0b17.dist-info/RECORD,,
+statezero-0.1.0b18.dist-info/licenses/license.md,sha256=0uKjybTt9K_YbEmYgf25JN292qjjJ-BPofvIZ3wdtX4,7411
+statezero-0.1.0b18.dist-info/METADATA,sha256=XIu8HuwWqs4D4Iq-nCRr8mIPG-hlSxAa_2E9w2zCmvE,6704
+statezero-0.1.0b18.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+statezero-0.1.0b18.dist-info/top_level.txt,sha256=UAuZYPKczradU1kcMQxsGjUzEW0qdgsqzhXyscrcLpw,10
+statezero-0.1.0b18.dist-info/RECORD,,