viur-core 3.9.0.dev1__tar.gz → 3.9.0.dev3__tar.gz

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: viur-core
-Version: 3.9.0.dev1
+Version: 3.9.0.dev3
 Summary: The core component of ViUR, a development framework for Google App Engine
 Author-email: Mausbrand Informationssysteme GmbH <devs@viur.dev>
 Maintainer-email: Jan Max Meyer <jm@mausbrand.de>

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/bones/base.py

@@ -1293,10 +1293,11 @@ class BaseBone(object):
                 the list may contain more than one hashed value.
         """
 
-        def hashValue(value: str | int | float | db.Key) -> str:
+        def hash_value(value: str | int | float | db.Key) -> str:
             h = hashlib.sha256()
             h.update(str(value).encode("UTF-8"))
             res = h.hexdigest()
+
             if isinstance(value, int | float):
                 return f"I-{res}"
             elif isinstance(value, str):
@@ -1307,27 +1308,32 @@ class BaseBone(object):
                 def keyHash(key):
                     if key is None:
                         return "-"
-                    return f"{hashValue(key.kind)}-{hashValue(key.id_or_name)}-<{keyHash(key.parent)}>"
+                    return f"{hash_value(key.kind)}-{hash_value(key.id_or_name)}-<{keyHash(key.parent)}>"
 
                 return f"K-{keyHash(value)}"
+
             raise NotImplementedError(f"Type {type(value)} can't be safely used in an uniquePropertyIndex")
 
+        # zero/empty string and these should not be locked
         if not value and not self.unique.lockEmpty:
-            return []  # We are zero/empty string and these should not be locked
-        if not self.multiple and not isinstance(value, list):
-            return [hashValue(value)]
-        # We have a multiple bone or multiple values here
+            return []
+
+        # Always work with list of values
         if not isinstance(value, list):
             value = [value]
-        tmpList = [hashValue(x) for x in value]
+
+        values = [hash_value(val) for val in value]
+
         if self.unique.method == UniqueLockMethod.SameValue:
-            # We should lock each entry individually; lock each value
-            return tmpList
+            # Lock each entry individually
+            return values
+
         elif self.unique.method == UniqueLockMethod.SameSet:
-            # We should ignore the sort-order; so simply sort that List
-            tmpList.sort()
-        # Lock the value for that specific list
-        return [hashValue(", ".join(tmpList))]
+            # Ignore the sort-order; so simply sort that list
+            values.sort()
+
+        # Lock the value for that specific list (equals to UniqueLockMethod.SameList)
+        return [hash_value(", ".join(values))]
 
     def getUniquePropertyIndexValues(self, skel: 'viur.core.skeleton.SkeletonInstance', name: str) -> list[str]:
         """
@@ -1343,10 +1349,9 @@ class BaseBone(object):
         """
         if self.compute:
             self.serialize_compute(skel, name)
-        val = skel[name]
-        if val is None:
-            return []
-        return self._hashValueForUniquePropertyIndex(val)
+
+        values = [value for _, _, value in self.iter_bone_value(skel, name) if value is not None]
+        return self._hashValueForUniquePropertyIndex(values) if values else []
 
     def getReferencedBlobs(self, skel: 'viur.core.skeleton.SkeletonInstance', name: str) -> set[str]:
         """

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/bones/boolean.py

@@ -1,7 +1,7 @@
 import typing as t
 
 from viur.core import conf, db, utils
-from viur.core.bones.base import BaseBone
+from viur.core.bones.base import BaseBone, ReadFromClientError, ReadFromClientErrorSeverity
 
 DEFAULT_VALUE_T: t.TypeAlias = bool | None | list[bool] | dict[str, list[bool] | bool]
 
@@ -36,7 +36,12 @@ class BooleanBone(BaseBone):
             raise ValueError("BooleanBone cannot be multiple")
 
     def singleValueFromClient(self, value, skel, bone_name, client_data):
-        return utils.parse.bool(value, conf.bone_boolean_str2true), None
+        value = utils.parse.bool(value, conf.bone_boolean_str2true)
+
+        if err := self.isInvalid(value):
+            return value, [ReadFromClientError(ReadFromClientErrorSeverity.Invalid, err)]
+
+        return value, None
 
     def getEmptyValue(self):
         """

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/bones/record.py

@@ -215,13 +215,18 @@ class RecordBone(BaseBone):
 
         return result
 
-    def getUniquePropertyIndexValues(self, valuesCache: dict, name: str) -> list[str]:
+    def getUniquePropertyIndexValues(self, skel: "SkeletonInstance", name: str) -> list[str]:
         """
-        This method is intentionally not implemented as it's not possible to determine how to derive
-        a key from the related skeleton being used (i.e., which fields to include and how).
-
+        Returns hashes over all fields of each record value, using the serialized form as canonical input.
         """
-        raise NotImplementedError()
+        values = []
+
+        for _, _, using_skel in self.iter_bone_value(skel, name):
+            if using_skel is None:
+                continue
+            values.append(json.dumps(using_skel.dump(), sort_keys=True, default=str))
+
+        return self._hashValueForUniquePropertyIndex(values) if values else []
 
     def structure(self) -> dict:
         return super().structure() | {

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/bones/relational.py

@@ -544,7 +544,12 @@ class RelationalBone(BaseBone):
             entity["viur_delayed_update_tag"] = now
             entity["viur_relational_updateLevel"] = self.updateLevel.value
             entity["viur_relational_consistency"] = self.consistency.value
-            entity["viur_foreign_keys"] = list(self.refKeys)
+            # Store expanded bone names, not raw refKeys patterns.
+            # refKeys may contain fnmatch wildcards (e.g. "delivery_time_*" matching
+            # "delivery_time_min", "delivery_time_max", "delivery_time_range").
+            # update_relations filters viur-relations via Datastore IN-query with the
+            # literal changed bone name — wildcard patterns would never match there.
+            entity["viur_foreign_keys"] = list(self._ref_keys)
             entity["viurTags"] = skel.dbEntity.get("viurTags") if skel.dbEntity else None
 
             db.put(entity)
@@ -640,6 +645,10 @@ class RelationalBone(BaseBone):
             dest_key = value
             value = {}
 
+        if not isinstance(dest_key, db.KeyType):
+            errors.append(ReadFromClientError(ReadFromClientErrorSeverity.Invalid))
+            return self.getEmptyValue(), errors
+
         if self.using:
             rel = self.using()
             if not rel.fromClient(value):
@@ -1066,8 +1075,12 @@ class RelationalBone(BaseBone):
                 # Reset the dbEntity for a clean rewrite
                 value["dest"].dbEntity = None
 
-                # Copy over the refKey values
-                for key in self.refKeys:
+                # Copy over the refKey values using expanded bone names (_ref_keys),
+                # not raw refKeys patterns. refKeys may contain fnmatch wildcards
+                # (e.g. "delivery_time_*" → "delivery_time_min", "delivery_time_max",
+                # "delivery_time_range"). Iterating raw patterns would attempt
+                # target_skel["delivery_time_*"] which doesn't exist → copies None.
+                for key in self._ref_keys:
                     value["dest"][key] = target_skel[key]
                     # logging.debug(f"Refreshed {key=} to {value["dest"][key]!r} ({str(value["dest"][key])!r})")
 
@@ -1258,24 +1271,32 @@ class RelationalBone(BaseBone):
 
         return result
 
-    def getUniquePropertyIndexValues(self, valuesCache: dict, name: str) -> list[str]:
+    def getUniquePropertyIndexValues(self, skel: "SkeletonInstance", name: str) -> list[str]:
         """
         Generates unique property index values for the RelationalBone based on the referenced keys.
         Can be overridden if different behavior is required (e.g., examining values from `prop:usingSkel`).
 
-        :param dict valuesCache: The cache containing the current values of the bone.
+        :param skel: The skeleton instance.
         :param str name: The name of the bone for which to generate unique property index values.
 
         :return: A list containing the unique property index values for the specified bone.
         :rtype: List[str]
         """
-        value = valuesCache.get(name)
-        if not value:  # We don't have a value to lock
-            return []
-        if isinstance(value, dict):
-            return self._hashValueForUniquePropertyIndex(value["dest"]["key"])
-        elif isinstance(value, list):
-            return self._hashValueForUniquePropertyIndex([entry["dest"]["key"] for entry in value if entry])
+        values = []
+
+        for _, _, v in self.iter_bone_value(skel, name):
+            if not v:
+                continue
+
+            if self.using and (rel_skel := v.get("rel")):
+                values.append(json.dumps(
+                    {"key": str(v["dest"]["key"]), "rel": rel_skel.dump()},
+                    sort_keys=True, default=str,
+                ))
+            else:
+                values.append(v["dest"]["key"])
+
+        return self._hashValueForUniquePropertyIndex(values) if values else []
 
     def structure(self) -> dict:
         return super().structure() | {
@@ -1287,7 +1308,7 @@ class RelationalBone(BaseBone):
         }
 
     def _atomic_dump(self, value: dict[str, "SkeletonInstance"]) -> dict | None:
-        if isinstance(value, dict):
+        if value and isinstance(value, dict):  # can be an empty dict due RelationalConsistency.SetNull
             return {
                 "dest": value["dest"].dump(),
                 "rel": value["rel"].dump() if value["rel"] else None,

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/bones/string.py

@@ -292,19 +292,15 @@ class StringBone(RawBone):
         :param skel: The skeleton instance.
         :param name: The name of the property.
         :return: A list of unique index values for the property.
-        :raises NotImplementedError: If the StringBone has languages and the implementation
-            for this case is not yet defined.
         """
-        if self.languages:
-            # Not yet implemented as it's unclear if we should keep each language distinct or not
-            raise NotImplementedError()
+        if not self.caseSensitive:
+            values = [
+                value.lower() if isinstance(value, str) else value
+                for _, _, value in self.iter_bone_value(skel, name)
+                if value is not None
+            ]
 
-        if not self.caseSensitive and (value := skel[name]) is not None:
-            if self.multiple:
-                value = [v.lower() for v in value]
-            else:
-                value = value.lower()
-            return self._hashValueForUniquePropertyIndex(value)
+            return self._hashValueForUniquePropertyIndex(values) if values else []
 
         return super().getUniquePropertyIndexValues(skel, name)
 

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/bones/text.py

@@ -438,25 +438,6 @@ class TextBone(RawBone):
             elif not self.languages and isinstance(val, str):
                 skel[boneName] = self.singleValueFromClient(val, skel, boneName, None)[0]
 
-    def getUniquePropertyIndexValues(self, valuesCache: dict, name: str) -> list[str]:
-        """
-        Retrieves the unique property index values for the TextBone.
-
-        If the TextBone supports multiple languages, this method raises a NotImplementedError, as it's unclear
-        whether each language should be kept distinct or not. Otherwise, it calls the superclass's
-        getUniquePropertyIndexValues method to retrieve the unique property index values.
-
-        :param valuesCache: A dictionary containing the cached values for the TextBone.
-        :param name: The name of the TextBone.
-        :return: A list of unique property index values for the TextBone.
-        :raises NotImplementedError: If the TextBone supports multiple languages.
-        """
-        if self.languages:
-            # Not yet implemented as it's unclear if we should keep each language distinct or not
-            raise NotImplementedError()
-
-        return super().getUniquePropertyIndexValues(valuesCache, name)
-
     def structure(self) -> dict:
         return super().structure() | {
             "valid_html": self.validHtml,

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/cache.py

@@ -553,6 +553,7 @@ def flushCache(prefix: str = None, key: db.Key | None = None, kind:  str | None
     """
     if prefix is None and key is None and kind is None:
         prefix = "/*"
+
     if prefix is not None:
         items = db.Query(CACHE_KINDNAME).filter("path =", prefix.rstrip("*")).iter()
         for item in items:
@@ -565,20 +566,20 @@ def flushCache(prefix: str = None, key: db.Key | None = None, kind:  str | None
             for item in items:
                 db.delete(item)
         logging.debug(f"Flushing cache succeeded. Everything matching {prefix=} is gone.")
+
     if key is not None:
         items = db.Query(CACHE_KINDNAME).filter("accessedEntries =", key).iter()
+
         for item in items:
             logging.info(f"""Deleted cache entry {item["path"]!r}""")
             db.delete(item.key)
-        if not isinstance(key, db.Key):
+
+        if kind is None and not isinstance(key, db.Key):
             key = db.Key.from_legacy_urlsafe(key)  # hopefully is a string
-        items = db.Query(CACHE_KINDNAME).filter("accessedEntries =", key.kind).iter()
-        for item in items:
-            logging.info(f"""Deleted cache entry {item["path"]!r}""")
-            db.delete(item.key)
+            kind = key.kind
+
     if kind is not None:
         items = db.Query(CACHE_KINDNAME).filter("accessedEntries =", kind).iter()
         for item in items:
             logging.info(f"""Deleted cache entry {item["path"]!r}""")
             db.delete(item.key)
-

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/modules/file.py

@@ -580,7 +580,10 @@ class File(Tree):
 
     @classmethod
     def hmac_verify(cls, data: t.Any, signature: str) -> bool:
-        return hmac.compare_digest(cls.hmac_sign(data.encode("ASCII")), signature)
+        try:
+            return hmac.compare_digest(cls.hmac_sign(data.encode("ASCII")), signature)
+        except (TypeError, UnicodeEncodeError):
+            return False
 
     @classmethod
     def create_internal_serving_url(
@@ -654,8 +657,7 @@ class File(Tree):
         if isinstance(expires, int):
             expires = datetime.timedelta(minutes=expires)
 
-        # Undo escaping on ()= performed on fileNames
-        filename = filename.replace("(", "(").replace(")", ")").replace("=", "=")
+        filename = html.unescape(filename)
         filepath = f"""{dlkey}/{"derived" if derived else "source"}/{filename}"""
 
         if download_filename:

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/utils/__init__.py

@@ -107,19 +107,21 @@ def normalizeKey(key: t.Union[None, db.Key]) -> t.Union[None, db.Key]:
 def get_base_url() -> str:
     """
     Retrieve current request's base URL with protocol.
+    The function enforces use of https-protocol on non-localhost hostnames.
 
     :returns: Returns the hostname, including the currently used protocol, e.g: https://www.example.com
     :rtype: str
     """
-    url = current.request.get().request.url  # retrireve URL by request
-    url = url[:url.find("/", url.find("://") + 5)]  # cut out base-url
+    base = urllib.parse.urlparse(current.request.get().request.url).netloc  # retrieve URL of request
 
     # Always enforce https!
-    if not any(url.startswith(f"http://{i}") for i in ("localhost", "127.0.0.1")):
-        url = "https://" + url[7:]
+    if any(base.startswith(i) for i in ("localhost", "127.0.0.1", "[::1]", "0.0.0.0")):
+        base = f"http://{base}"
+    else:
+        base = f"https://{base}"
 
     # Replace non-SSL-ready-"appspot.com"-URLs with their SSL-ready counterpart
-    return url.replace(f".{conf.instance.project_id}.", f"-dot-{conf.instance.project_id}.")
+    return base.replace(f".{conf.instance.project_id}.", f"-dot-{conf.instance.project_id}.")
 
 
 def ensure_iterable(

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur/core/version.py

@@ -3,7 +3,7 @@
 # This will mark it as a pre-release as well on PyPI.
 # See CONTRIBUTING.md for further information.
 
-__version__ = "3.9.0.dev1"
+__version__ = "3.9.0.dev3"
 
 assert __version__.count(".") >= 2 and "".join(__version__.split(".", 3)[:3]).isdigit(), \
     "Semantic __version__ expected!"

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/src/viur_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: viur-core
-Version: 3.9.0.dev1
+Version: 3.9.0.dev3
 Summary: The core component of ViUR, a development framework for Google App Engine
 Author-email: Mausbrand Informationssysteme GmbH <devs@viur.dev>
 Maintainer-email: Jan Max Meyer <jm@mausbrand.de>

{viur_core-3.9.0.dev1 → viur_core-3.9.0.dev3}/tests/test_utils.py

@@ -1,4 +1,5 @@
 from datetime import timedelta as td
+from unittest import mock
 
 from abstract import ViURTestCase
 
@@ -17,6 +18,16 @@ class TestUtils(ViURTestCase):
         self.assertEqual(utils.string.unescape("Hello'World's"), "Hello'World's")
         self.assertEqual(utils.string.unescape(E), S.replace("\n", " "))
 
+    def test_string_unescape_filename_entities(self):
+        """unescape() must handle both 2- and 3-digit numeric HTML entities used in filenames."""
+        from viur.core import utils
+        # short-form: ( ) =
+        self.assertEqual(utils.string.unescape("file(1)=x.pdf"), "file(1)=x.pdf")
+        # long-form (leading zero): ( ) =
+        self.assertEqual(utils.string.unescape("file(1)=x.pdf"), "file(1)=x.pdf")
+        # mixed
+        self.assertEqual(utils.string.unescape("(test)=val"), "(test)=val")
+
     def test_string_escape(self):
         from viur.core import utils
         self.assertEqual("None", utils.string.escape(None))
@@ -76,3 +87,70 @@ class TestUtils(ViURTestCase):
         self.assertEqual(td(seconds=60), utils.parse.timedelta("60"))
         self.assertEqual(td(seconds=60), utils.parse.timedelta("60.0"))
         self.assertNotEqual(td(seconds=0), utils.parse.timedelta(60.0))
+
+
+def _make_request(url: str):
+    """Return a mock mimicking current.request.get() with .request.url set."""
+    req = mock.Mock()
+    req.request.url = url
+    ctx_var = mock.Mock()
+    ctx_var.get.return_value = req
+    return ctx_var
+
+
+class TestGetBaseUrl(ViURTestCase):
+
+    def _call(self, url: str, project_id: str = "myproject") -> str:
+        from viur.core import utils
+        from viur.core import current
+        from viur.core.config import conf
+
+        with mock.patch.object(current, "request", _make_request(url)), \
+             mock.patch.object(conf.instance, "project_id", project_id):
+            return utils.get_base_url()
+
+    # --- localhost variants → http ---
+
+    def test_localhost_plain(self):
+        self.assertEqual(self._call("http://localhost:8080/foo"), "http://localhost:8080")
+
+    def test_localhost_no_port(self):
+        self.assertEqual(self._call("http://localhost/"), "http://localhost")
+
+    def test_127_0_0_1(self):
+        self.assertEqual(self._call("http://127.0.0.1:8080/bar"), "http://127.0.0.1:8080")
+
+    def test_ipv4_all_interfaces(self):
+        self.assertEqual(self._call("http://0.0.0.0:8080/"), "http://0.0.0.0:8080")
+
+    def test_ipv6_loopback(self):
+        self.assertEqual(self._call("http://[::1]:8080/"), "http://[::1]:8080")
+
+    # --- non-localhost → https ---
+
+    def test_plain_domain(self):
+        self.assertEqual(self._call("http://www.example.com/path"), "https://www.example.com")
+
+    def test_already_https(self):
+        self.assertEqual(self._call("https://www.example.com/path"), "https://www.example.com")
+
+    def test_subdomain(self):
+        self.assertEqual(self._call("https://api.example.com/v1/endpoint"), "https://api.example.com")
+
+    # --- appspot.com dot-replacement ---
+
+    def test_appspot_dot_replaced(self):
+        # .myproject. in hostname → -dot-myproject.
+        result = self._call(
+            "https://default.myproject.appspot.com/",
+            project_id="myproject",
+        )
+        self.assertEqual(result, "https://default-dot-myproject.appspot.com")
+
+    def test_appspot_no_replacement_without_project_id_match(self):
+        # project_id does not appear in the host → no replacement
+        result = self._call(
+            "https://www.example.com/",
+            project_id="myproject",
+        )
+        self.assertEqual(result, "https://www.example.com")