wagtail 6.1.2__py3-none-any.whl → 6.2__py3-none-any.whl

wagtail/admin/views/editing_sessions.py

@@ -0,0 +1,191 @@
+from django.apps import apps
+from django.contrib.admin.utils import unquote
+from django.contrib.contenttypes.models import ContentType
+from django.core.exceptions import ValidationError
+from django.http import Http404, JsonResponse
+from django.shortcuts import get_object_or_404
+from django.urls import reverse
+from django.utils import timezone
+from django.views.decorators.http import require_POST
+
+from wagtail.admin.models import EditingSession
+from wagtail.admin.ui.editing_sessions import EditingSessionsList
+from wagtail.admin.utils import get_user_display_name
+from wagtail.models import Page, Revision, RevisionMixin
+from wagtail.permissions import page_permission_policy
+
+
+@require_POST
+def ping(request, app_label, model_name, object_id, session_id):
+    try:
+        model = apps.get_model(app_label, model_name)
+    except LookupError:
+        raise Http404
+
+    unquoted_object_id = unquote(object_id)
+
+    content_type = ContentType.objects.get_for_model(model)
+
+    obj = get_object_or_404(model, pk=unquoted_object_id)
+    if isinstance(obj, Page):
+        permission_policy = page_permission_policy
+    else:
+        try:
+            permission_policy = model.snippet_viewset.permission_policy
+        except AttributeError:
+            # model is neither a Page nor a snippet
+            raise Http404
+
+    if not permission_policy.user_has_permission_for_instance(
+        request.user, "change", obj
+    ):
+        raise Http404
+
+    try:
+        session = EditingSession.objects.get(
+            id=session_id,
+            user=request.user,
+            content_type=content_type,
+            object_id=unquoted_object_id,
+        )
+    except EditingSession.DoesNotExist:
+        session = EditingSession(
+            content_type=content_type,
+            object_id=unquoted_object_id,
+            user=request.user,
+        )
+
+    session.last_seen_at = timezone.now()
+    session.is_editing = request.POST.get("is_editing", False)
+    try:
+        session.full_clean()
+    except ValidationError:
+        return JsonResponse({"error": "Invalid data"}, status=400)
+    else:
+        session.save()
+
+    other_sessions = (
+        EditingSession.objects.filter(
+            content_type=content_type,
+            object_id=unquoted_object_id,
+            last_seen_at__gte=timezone.now() - timezone.timedelta(minutes=1),
+        )
+        .exclude(id=session.id)
+        .select_related("user", "user__wagtail_userprofile")
+        .order_by("-last_seen_at")
+    )
+
+    # create a lookup of sessions indexed by user ID. Multiple sessions from the same user
+    # are merged, such that the most recently seen one is reported, but is_editing is true
+    # if any session has the editing flag set (not just the latest one).
+    other_sessions_lookup = {}
+    for other_session in other_sessions:
+        try:
+            other_session_info = other_sessions_lookup[other_session.user.pk]
+        except KeyError:
+            other_sessions_lookup[other_session.user.pk] = {
+                "session_id": other_session.id,
+                "user": other_session.user,
+                "last_seen_at": other_session.last_seen_at,
+                "is_editing": other_session.is_editing,
+                "revision_id": None,
+            }
+        else:
+            if other_session.is_editing:
+                other_session_info["is_editing"] = True
+
+    revision_id = request.POST.get("revision_id", None)
+    if revision_id is not None and issubclass(model, RevisionMixin):
+        all_revisions = obj.revisions.defer("content")
+        try:
+            original_revision = all_revisions.get(id=revision_id)
+        except Revision.DoesNotExist:
+            raise Http404
+
+        newest_revision = (
+            all_revisions.filter(created_at__gt=original_revision.created_at)
+            .order_by("-created_at", "-pk")
+            .select_related("user")
+            .first()
+        )
+
+        if newest_revision:
+            try:
+                session_info = other_sessions_lookup[newest_revision.user_id]
+            except KeyError:
+                other_sessions_lookup[newest_revision.user_id] = {
+                    "session_id": None,
+                    "user": newest_revision.user,
+                    "last_seen_at": newest_revision.created_at,
+                    "is_editing": False,
+                    "revision_id": newest_revision.id,
+                }
+            else:
+                session_info["revision_id"] = newest_revision.id
+                if newest_revision.created_at > session_info["last_seen_at"]:
+                    session_info["last_seen_at"] = newest_revision.created_at
+
+    try:
+        users_other_session = other_sessions_lookup[request.user.pk]
+    except KeyError:
+        pass
+    else:
+        # If the user has a different session that is not editing and hasn't
+        # created the latest revision, hide it as it's not relevant.
+        if (
+            not users_other_session["is_editing"]
+            and not users_other_session["revision_id"]
+        ):
+            other_sessions_lookup.pop(request.user.pk)
+
+    # Sort the other sessions so that they are presented in the following order:
+    # 1. Prioritise any session with the latest revision. Then,
+    # 2. Prioritise any session that is currently editing. Then,
+    # 3. Prioritise any session with the smallest id, so that new sessions are
+    #    appended to the end of the list (they're shown last). We are not sorting
+    #    by last_seen_at to avoid shifting the order of the sessions as they
+    #    ping the server.
+    other_sessions = sorted(
+        other_sessions_lookup.values(),
+        key=lambda other_session: (
+            # We want to sort revision_id and is_editing in descending order,
+            # but we want to sort session_id in ascending order. To achieve this
+            # in a single pass, we negate the values of revision_id and is_editing.
+            # We can negate revision_id because there can only be one (at most)
+            # session with revision_id, so we only care about the presence and
+            # not the ID itself, thus we can treat it as a boolean flag.
+            not other_session["revision_id"],
+            not other_session["is_editing"],
+            other_session["session_id"],
+        ),
+    )
+
+    return JsonResponse(
+        {
+            "session_id": session.id,
+            "ping_url": reverse(
+                "wagtailadmin_editing_sessions:ping",
+                args=(app_label, model_name, object_id, session.id),
+            ),
+            "release_url": reverse(
+                "wagtailadmin_editing_sessions:release", args=(session.id,)
+            ),
+            "other_sessions": [
+                {
+                    "session_id": other_session["session_id"],
+                    "user": get_user_display_name(other_session["user"]),
+                    "last_seen_at": other_session["last_seen_at"].isoformat(),
+                    "is_editing": other_session["is_editing"],
+                    "revision_id": other_session["revision_id"],
+                }
+                for other_session in other_sessions
+            ],
+            "html": EditingSessionsList(session, other_sessions).render_html(),
+        }
+    )
+
+
+@require_POST
+def release(request, session_id):
+    EditingSession.objects.filter(id=session_id, user=request.user).delete()
+    return JsonResponse({})

wagtail/admin/views/generic/__init__.py

@@ -4,6 +4,7 @@ from .base import (  # noqa: F401
     BaseOperationView,
     WagtailAdminTemplateMixin,
 )
+from .history import HistoryView  # noqa: F401
 from .mixins import (  # noqa: F401
     BeforeAfterHookMixin,
     CreateEditViewOptionalFeaturesMixin,

wagtail/admin/views/generic/base.py

@@ -23,6 +23,7 @@ from wagtail.admin import messages
 from wagtail.admin.ui.tables import Column, Table
 from wagtail.admin.utils import get_valid_next_url_from_request
 from wagtail.admin.widgets.button import ButtonWithDropdown
+from wagtail.utils.utils import flatten_choices
 
 
 class WagtailAdminTemplateMixin(TemplateResponseMixin, ContextMixin):
@@ -288,7 +289,7 @@ class BaseListingView(WagtailAdminTemplateMixin, BaseListView):
                         )
                     )
             elif isinstance(filter_def, MultipleChoiceFilter):
-                choices = {str(id): label for id, label in filter_def.field.choices}
+                choices = flatten_choices(filter_def.field.choices)
                 for item in value:
                     filters.append(
                         ActiveFilter(
@@ -326,7 +327,7 @@ class BaseListingView(WagtailAdminTemplateMixin, BaseListView):
                     )
                 )
             elif isinstance(filter_def, ChoiceFilter):
-                choices = {str(id): label for id, label in filter_def.field.choices}
+                choices = flatten_choices(filter_def.field.choices)
                 filters.append(
                     ActiveFilter(
                         bound_field.auto_id,

wagtail/admin/views/generic/history.py

@@ -60,18 +60,24 @@ class HistoryFilterSet(WagtailFilterSet):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        actions = get_actions_for_filter(self.queryset)
+        actions = self.get_action_choices()
         if not actions:
             del self.filters["action"]
         else:
             self.filters["action"].extra["choices"] = actions
 
-        users = self.queryset.get_users()
+        users = self.get_users_queryset()
         if not users.exists():
             del self.filters["user"]
         else:
             self.filters["user"].extra["queryset"] = users
 
+    def get_action_choices(self):
+        return get_actions_for_filter(self.queryset)
+
+    def get_users_queryset(self):
+        return self.queryset.get_users()
+
 
 class ActionColumn(Column):
     def __init__(self, *args, object, url_names, user_can_unschedule, **kwargs):
@@ -221,7 +227,7 @@ class HistoryView(PermissionCheckedMixin, BaseObjectMixin, BaseListingView):
                 },
                 user_can_unschedule=self.user_can_unschedule(),
             ),
-            LogEntryUserColumn("user", width="25%"),
+            LogEntryUserColumn("user", label=gettext_lazy("User"), width="25%"),
             DateColumn("timestamp", label=gettext_lazy("Date"), width="15%"),
         ]
 

wagtail/admin/views/generic/mixins.py

@@ -2,6 +2,7 @@ import json
 
 from django.conf import settings
 from django.contrib.admin.utils import quote
+from django.contrib.contenttypes.models import ContentType
 from django.db import models, transaction
 from django.forms import Media
 from django.shortcuts import get_object_or_404
@@ -16,7 +17,9 @@ from django.utils.translation import gettext as _
 
 from wagtail import hooks
 from wagtail.admin import messages
+from wagtail.admin.models import EditingSession
 from wagtail.admin.templatetags.wagtailadmin_tags import user_display_name
+from wagtail.admin.ui.editing_sessions import EditingSessionsModule
 from wagtail.admin.ui.tables import TitleColumn
 from wagtail.admin.utils import get_latest_str, set_query_params
 from wagtail.locks import BasicLock, ScheduledForPublishLock, WorkflowLock
@@ -287,14 +290,19 @@ class CreateEditViewOptionalFeaturesMixin:
 
     def user_has_permission(self, permission):
         user = self.request.user
-        if user.is_superuser:
-            return True
-
         # Workflow lock/unlock methods take precedence before the base
         # "lock" and "unlock" permissions -- see PagePermissionTester for reference
         if permission == "lock" and self.current_workflow_task:
+            # Follow the logic in PagePermissionTester.user_can_lock()
+            # (superusers can always lock)
+            if user.is_superuser:
+                return True
             return self.current_workflow_task.user_can_lock(self.object, user)
         if permission == "unlock":
+            # Follow the logic in PagePermissionTester.user_can_unlock()
+            # (superusers can always unlock)
+            if user.is_superuser:
+                return True
             # Allow unlocking even if the user does not have the 'unlock' permission
             # if they are the user who locked the object
             if self.object.locked_by_id == user.pk:
@@ -677,6 +685,37 @@ class CreateEditViewOptionalFeaturesMixin:
 
         return context
 
+    def get_editing_sessions(self):
+        if self.view_name == "create":
+            return None
+        EditingSession.cleanup()
+        content_type = ContentType.objects.get_for_model(self.model)
+        session = EditingSession.objects.create(
+            user=self.request.user,
+            content_type=content_type,
+            object_id=self.object.pk,
+            last_seen_at=timezone.now(),
+        )
+        revision_id = self.object.latest_revision_id if self.revision_enabled else None
+        return EditingSessionsModule(
+            session,
+            reverse(
+                "wagtailadmin_editing_sessions:ping",
+                args=(
+                    self.model._meta.app_label,
+                    self.model._meta.model_name,
+                    quote(self.object.pk),
+                    session.id,
+                ),
+            ),
+            reverse(
+                "wagtailadmin_editing_sessions:release",
+                args=(session.id,),
+            ),
+            [],
+            revision_id,
+        )
+
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
         context.update(self.get_lock_context())
@@ -691,6 +730,7 @@ class CreateEditViewOptionalFeaturesMixin:
             settings, "WAGTAIL_WORKFLOW_CANCEL_ON_PUBLISH", True
         ) and bool(self.workflow_tasks)
         context["revisions_compare_url_name"] = self.revisions_compare_url_name
+        context["editing_sessions"] = self.get_editing_sessions()
         return context
 
     def post(self, request, *args, **kwargs):

wagtail/admin/views/generic/models.py

@@ -73,7 +73,7 @@ class IndexView(
     copy_url_name = None
     inspect_url_name = None
     delete_url_name = None
-    any_permission_required = ["add", "change", "delete"]
+    any_permission_required = ["add", "change", "delete", "view"]
     search_fields = None
     search_backend_name = "default"
     is_searchable = None
@@ -249,15 +249,21 @@ class IndexView(
 
     def _get_title_column(self, field_name, column_class=TitleColumn, **kwargs):
         column_class = self._get_title_column_class(column_class)
+
+        def get_url(instance):
+            if edit_url := self.get_edit_url(instance):
+                return edit_url
+            return self.get_inspect_url(instance)
+
         if not self.model:
             return column_class(
                 "name",
                 label=gettext_lazy("Name"),
                 accessor=str,
-                get_url=self.get_edit_url,
+                get_url=get_url,
             )
         return self._get_custom_column(
-            field_name, column_class, get_url=self.get_edit_url, **kwargs
+            field_name, column_class, get_url=get_url, **kwargs
         )
 
     def _get_custom_column(self, field_name, column_class=Column, **kwargs):
@@ -320,27 +326,25 @@ class IndexView(
         return columns
 
     def get_edit_url(self, instance):
-        if self.edit_url_name:
+        if self.edit_url_name and self.user_has_permission("change"):
             return reverse(self.edit_url_name, args=(quote(instance.pk),))
 
     def get_copy_url(self, instance):
-        if self.copy_url_name:
+        if self.copy_url_name and self.user_has_permission("add"):
             return reverse(self.copy_url_name, args=(quote(instance.pk),))
 
     def get_inspect_url(self, instance):
-        if self.inspect_url_name:
+        if self.inspect_url_name and self.user_has_any_permission(
+            {"add", "change", "delete", "view"}
+        ):
             return reverse(self.inspect_url_name, args=(quote(instance.pk),))
 
     def get_delete_url(self, instance):
-        if self.delete_url_name:
+        if self.delete_url_name and self.user_has_permission("delete"):
             return reverse(self.delete_url_name, args=(quote(instance.pk),))
 
     def get_add_url(self):
-        if self.permission_policy and not self.permission_policy.user_has_permission(
-            self.request.user, "add"
-        ):
-            return None
-        if self.add_url_name:
+        if self.add_url_name and self.user_has_permission("add"):
             return self._set_locale_query_param(reverse(self.add_url_name))
 
     @cached_property
@@ -374,16 +378,11 @@ class IndexView(
 
     def get_list_more_buttons(self, instance):
         buttons = []
-        edit_url = self.get_edit_url(instance)
-        can_edit = (
-            not self.permission_policy
-            or self.permission_policy.user_has_permission(self.request.user, "change")
-        )
-        if edit_url and can_edit:
+        if edit_url := self.get_edit_url(instance):
             buttons.append(
                 ListingButton(
                     _("Edit"),
-                    url=self.get_edit_url(instance),
+                    url=edit_url,
                     icon_name="edit",
                     attrs={
                         "aria-label": _("Edit '%(title)s'") % {"title": str(instance)}
@@ -391,9 +390,7 @@ class IndexView(
                     priority=10,
                 )
             )
-        copy_url = self.get_copy_url(instance)
-        can_copy = self.permission_policy.user_has_permission(self.request.user, "add")
-        if copy_url and can_copy:
+        if copy_url := self.get_copy_url(instance):
             buttons.append(
                 ListingButton(
                     _("Copy"),
@@ -405,8 +402,7 @@ class IndexView(
                     priority=20,
                 )
             )
-        inspect_url = self.get_inspect_url(instance)
-        if inspect_url:
+        if inspect_url := self.get_inspect_url(instance):
             buttons.append(
                 ListingButton(
                     _("Inspect"),
@@ -419,12 +415,7 @@ class IndexView(
                     priority=20,
                 )
             )
-        delete_url = self.get_delete_url(instance)
-        can_delete = (
-            not self.permission_policy
-            or self.permission_policy.user_has_permission(self.request.user, "delete")
-        )
-        if delete_url and can_delete:
+        if delete_url := self.get_delete_url(instance):
             buttons.append(
                 ListingButton(
                     _("Delete"),
@@ -439,17 +430,20 @@ class IndexView(
         return buttons
 
     def get_list_buttons(self, instance):
-        buttons = self.get_list_more_buttons(instance)
-        return [
-            ButtonWithDropdown(
-                buttons=buttons,
-                icon_name="dots-horizontal",
-                attrs={
-                    "aria-label": _("More options for '%(title)s'")
-                    % {"title": str(instance)},
-                },
+        more_buttons = self.get_list_more_buttons(instance)
+        buttons = []
+        if more_buttons:
+            buttons.append(
+                ButtonWithDropdown(
+                    buttons=more_buttons,
+                    icon_name="dots-horizontal",
+                    attrs={
+                        "aria-label": _("More options for '%(title)s'")
+                        % {"title": str(instance)},
+                    },
+                )
             )
-        ]
+        return buttons
 
     @cached_property
     def add_item_label(self):
@@ -462,10 +456,7 @@ class IndexView(
     def get_context_data(self, *args, **kwargs):
         context = super().get_context_data(*args, **kwargs)
 
-        context["can_add"] = (
-            self.permission_policy is None
-            or self.permission_policy.user_has_permission(self.request.user, "add")
-        )
+        context["can_add"] = self.user_has_permission("add")
         if context["can_add"]:
             context["add_url"] = context["header_action_url"] = self.add_url
             context["header_action_label"] = self.add_item_label
@@ -741,9 +732,9 @@ class EditView(
         return self.actions
 
     def get_object(self, queryset=None):
-        if "pk" not in self.kwargs:
-            self.kwargs["pk"] = self.args[0]
-        self.kwargs["pk"] = unquote(str(self.kwargs["pk"]))
+        if self.pk_url_kwarg not in self.kwargs:
+            self.kwargs[self.pk_url_kwarg] = self.args[0]
+        self.kwargs[self.pk_url_kwarg] = unquote(str(self.kwargs[self.pk_url_kwarg]))
         return super().get_object(queryset)
 
     def get_page_subtitle(self):
@@ -874,11 +865,7 @@ class EditView(
         )
 
     def get_success_buttons(self):
-        return [
-            messages.button(
-                reverse(self.edit_url_name, args=(quote(self.object.pk),)), _("Edit")
-            )
-        ]
+        return [messages.button(self.get_edit_url(), _("Edit"))]
 
     def get_error_message(self):
         if self.error_message is None:
@@ -917,9 +904,8 @@ class EditView(
         context["side_panels"] = side_panels
         context["media"] += side_panels.media
         context["submit_button_label"] = self.submit_button_label
-        context["can_delete"] = (
-            self.permission_policy is None
-            or self.permission_policy.user_has_permission(self.request.user, "delete")
+        context["can_delete"] = self.user_has_permission_for_instance(
+            "delete", self.object
         )
         if context["can_delete"]:
             context["delete_url"] = self.get_delete_url()
@@ -1046,7 +1032,7 @@ class DeleteView(
 
 
 class InspectView(PermissionCheckedMixin, WagtailAdminTemplateMixin, TemplateView):
-    any_permission_required = ["add", "change", "delete"]
+    any_permission_required = ["add", "change", "delete", "view"]
     template_name = "wagtailadmin/generic/inspect.html"
     page_title = gettext_lazy("Inspecting")
     model = None
@@ -1149,24 +1135,12 @@ class InspectView(PermissionCheckedMixin, WagtailAdminTemplateMixin, TemplateVie
         return [self.get_context_for_field(field_name) for field_name in self.fields]
 
     def get_edit_url(self):
-        if not self.edit_url_name or (
-            self.permission_policy
-            and not self.permission_policy.user_has_permission(
-                self.request.user, "change"
-            )
-        ):
-            return None
-        return reverse(self.edit_url_name, args=(quote(self.object.pk),))
+        if self.edit_url_name and self.user_has_permission("change"):
+            return reverse(self.edit_url_name, args=(quote(self.object.pk),))
 
     def get_delete_url(self):
-        if not self.delete_url_name or (
-            self.permission_policy
-            and not self.permission_policy.user_has_permission(
-                self.request.user, "delete"
-            )
-        ):
-            return None
-        return reverse(self.delete_url_name, args=(quote(self.object.pk),))
+        if self.delete_url_name and self.user_has_permission("delete"):
+            return reverse(self.delete_url_name, args=(quote(self.object.pk),))
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)

wagtail/admin/views/generic/permissions.py

@@ -19,21 +19,31 @@ class PermissionCheckedMixin:
     any_permission_required = None
 
     def dispatch(self, request, *args, **kwargs):
-        if self.permission_policy is not None:
-            if self.permission_required is not None:
-                if not self.user_has_permission(self.permission_required):
-                    raise PermissionDenied
+        if self.permission_required is not None:
+            if not self.user_has_permission(self.permission_required):
+                raise PermissionDenied
 
-            if self.any_permission_required is not None:
-                if not self.user_has_any_permission(self.any_permission_required):
-                    raise PermissionDenied
+        if self.any_permission_required is not None:
+            if not self.user_has_any_permission(self.any_permission_required):
+                raise PermissionDenied
 
         return super().dispatch(request, *args, **kwargs)
 
     def user_has_permission(self, permission):
-        return self.permission_policy.user_has_permission(self.request.user, permission)
+        return not self.permission_policy or (
+            self.permission_policy.user_has_permission(self.request.user, permission)
+        )
+
+    def user_has_permission_for_instance(self, permission, instance):
+        return not self.permission_policy or (
+            self.permission_policy.user_has_permission_for_instance(
+                self.request.user, permission, instance
+            )
+        )
 
     def user_has_any_permission(self, permissions):
-        return self.permission_policy.user_has_any_permission(
-            self.request.user, permissions
+        return not self.permission_policy or (
+            self.permission_policy.user_has_any_permission(
+                self.request.user, permissions
+            )
         )

wagtail/admin/views/home.py

@@ -1,5 +1,3 @@
-import itertools
-import re
 from typing import Any, Mapping, Union
 
 from django.conf import settings
@@ -9,11 +7,11 @@ from django.db.models import Exists, IntegerField, Max, OuterRef, Q
 from django.db.models.functions import Cast
 from django.forms import Media
 from django.http import Http404, HttpResponse
-from django.template.loader import render_to_string
 from django.utils.translation import gettext_lazy
 from django.views.generic.base import TemplateView
 
 from wagtail import hooks
+from wagtail.admin.icons import get_icons
 from wagtail.admin.navigation import get_site_for_user
 from wagtail.admin.site_summary import SiteSummaryPanel
 from wagtail.admin.ui.components import Component
@@ -350,32 +348,5 @@ def default(request):
     raise Http404
 
 
-icon_comment_pattern = re.compile(r"<!--.*?-->")
-_icons_html = None
-
-
-def icons():
-    global _icons_html
-    if _icons_html is None:
-        icon_hooks = hooks.get_hooks("register_icons")
-        all_icons = sorted(
-            itertools.chain.from_iterable(hook([]) for hook in icon_hooks)
-        )
-        combined_icon_markup = ""
-        for icon in all_icons:
-            symbol = (
-                render_to_string(icon)
-                .replace('xmlns="http://www.w3.org/2000/svg"', "")
-                .replace("svg", "symbol")
-            )
-            symbol = icon_comment_pattern.sub("", symbol)
-            combined_icon_markup += symbol
-
-        _icons_html = render_to_string(
-            "wagtailadmin/shared/icons.html", {"icons": combined_icon_markup}
-        )
-    return _icons_html
-
-
 def sprite(request):
-    return HttpResponse(icons())
+    return HttpResponse(get_icons(), content_type="image/svg+xml; charset=utf-8")