Single table for file attachments

.github/actions/migration/action.yaml

@@ -13,5 +13,5 @@ runs:
           invoke export-records -f data.json
           python3 ./src/backend/InvenTree/manage.py flush --noinput
           invoke migrate
-          invoke import-records -f data.json
-          invoke import-records -f data.json
+          invoke import-records -c -f data.json
+          invoke import-records -c -f data.json

.github/workflows/docker.yaml

@@ -115,9 +115,10 @@ jobs:
       - name: Run Unit Tests
         run: |
           echo "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" >> contrib/container/docker.dev.env
-          docker compose --project-directory . -f contrib/container/dev-docker-compose.yml run inventree-dev-server invoke test --disable-pty
-          docker compose --project-directory . -f contrib/container/dev-docker-compose.yml run inventree-dev-server invoke test --migrations --disable-pty
-          docker compose --project-directory . -f contrib/container/dev-docker-compose.yml down
+          docker compose --project-directory . -f contrib/container/dev-docker-compose.yml run --rm inventree-dev-server invoke test --disable-pty
+      - name: Run Migration Tests
+        run: |
+          docker compose --project-directory . -f contrib/container/dev-docker-compose.yml run --rm inventree-dev-server invoke test --migrations
       - name: Clean up test folder
         run: |
           rm -rf InvenTree/_testfolder

src/backend/InvenTree/InvenTree/api.py

@@ -419,22 +419,6 @@ def download_queryset(self, queryset, export_format):
         raise NotImplementedError('download_queryset method not implemented!')
 
 
-class AttachmentMixin:
-    """Mixin for creating attachment objects, and ensuring the user information is saved correctly."""
-
-    permission_classes = [permissions.IsAuthenticated, RolePermission]
-
-    filter_backends = SEARCH_ORDER_FILTER
-
-    search_fields = ['attachment', 'comment', 'link']
-
-    def perform_create(self, serializer):
-        """Save the user information when a file is uploaded."""
-        attachment = serializer.save()
-        attachment.user = self.request.user
-        attachment.save()
-
-
 class APISearchViewSerializer(serializers.Serializer):
     """Serializer for the APISearchView."""
 

src/backend/InvenTree/InvenTree/api_version.py

@@ -1,11 +1,16 @@
 """InvenTree API version information."""
 
 # InvenTree API version
-INVENTREE_API_VERSION = 206
+INVENTREE_API_VERSION = 207
 
 """Increment this API version number whenever there is a significant change to the API that any clients need to know about."""
 
 INVENTREE_API_TEXT = """
+v207 - 2024-06-09 : https://github.com/inventree/InvenTree/pull/7420
+    - Moves all "Attachment" models into a single table
+    - All "Attachment" operations are now performed at /api/attachment/
+    - Add permissions information to /api/user/roles/ endpoint
+
 v206 - 2024-06-08 : https://github.com/inventree/InvenTree/pull/7417
     - Adds "choices" field to the PartTestTemplate model
 

src/backend/InvenTree/InvenTree/exchange.py

@@ -8,6 +8,7 @@
 from djmoney.contrib.exchange.models import ExchangeBackend, Rate
 
 from common.currency import currency_code_default, currency_codes
+from common.settings import get_global_setting
 
 logger = logging.getLogger('inventree')
 
@@ -22,14 +23,13 @@ class InvenTreeExchange(SimpleExchangeBackend):
 
     def get_rates(self, **kwargs) -> dict:
         """Set the requested currency codes and get rates."""
-        from common.models import InvenTreeSetting
         from plugin import registry
 
         base_currency = kwargs.get('base_currency', currency_code_default())
         symbols = kwargs.get('symbols', currency_codes())
 
         # Find the selected exchange rate plugin
-        slug = InvenTreeSetting.get_setting('CURRENCY_UPDATE_PLUGIN', '', create=False)
+        slug = get_global_setting('CURRENCY_UPDATE_PLUGIN', create=False)
 
         if slug:
             plugin = registry.get_plugin(slug)

src/backend/InvenTree/InvenTree/fields.py

@@ -33,7 +33,7 @@ def __init__(self, **kwargs):
 
     def run_validation(self, data=empty):
         """Override default validation behaviour for this field type."""
-        strict_urls = get_global_setting('INVENTREE_STRICT_URLS', True, cache=False)
+        strict_urls = get_global_setting('INVENTREE_STRICT_URLS', cache=False)
 
         if not strict_urls and data is not empty and '://' not in data:
             # Validate as if there were a schema provided

src/backend/InvenTree/InvenTree/middleware.py

@@ -12,6 +12,7 @@
 from allauth_2fa.middleware import AllauthTwoFactorMiddleware, BaseRequire2FAMiddleware
 from error_report.middleware import ExceptionProcessor
 
+from common.settings import get_global_setting
 from InvenTree.urls import frontendpatterns
 from users.models import ApiToken
 
@@ -153,11 +154,9 @@ class Check2FAMiddleware(BaseRequire2FAMiddleware):
 
     def require_2fa(self, request):
         """Use setting to check if MFA should be enforced for frontend page."""
-        from common.models import InvenTreeSetting
-
         try:
             if url_matcher.resolve(request.path[1:]):
-                return InvenTreeSetting.get_setting('LOGIN_ENFORCE_MFA')
+                return get_global_setting('LOGIN_ENFORCE_MFA')
         except Resolver404:
             pass
         return False

src/backend/InvenTree/InvenTree/models.py

@@ -1,9 +1,7 @@
 """Generic models which provide extra functionality over base Django model types."""
 
 import logging
-import os
 from datetime import datetime
-from io import BytesIO
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
@@ -20,11 +18,11 @@
 from mptt.exceptions import InvalidMove
 from mptt.models import MPTTModel, TreeForeignKey
 
+import common.settings
 import InvenTree.fields
 import InvenTree.format
 import InvenTree.helpers
 import InvenTree.helpers_model
-from InvenTree.sanitizer import sanitize_svg
 
 logger = logging.getLogger('inventree')
 
@@ -304,10 +302,7 @@ def get_reference_pattern(cls):
         if cls.REFERENCE_PATTERN_SETTING is None:
             return ''
 
-        # import at function level to prevent cyclic imports
-        from common.models import InvenTreeSetting
-
-        return InvenTreeSetting.get_setting(
+        return common.settings.get_global_setting(
             cls.REFERENCE_PATTERN_SETTING, create=False
         ).strip()
 
@@ -503,200 +498,64 @@ class Meta:
         abstract = True
 
 
-def rename_attachment(instance, filename):
-    """Function for renaming an attachment file. The subdirectory for the uploaded file is determined by the implementing class.
-
-    Args:
-        instance: Instance of a PartAttachment object
-        filename: name of uploaded file
-
-    Returns:
-        path to store file, format: '<subdir>/<id>/filename'
-    """
-    # Construct a path to store a file attachment for a given model type
-    return os.path.join(instance.getSubdir(), filename)
-
-
-class InvenTreeAttachment(InvenTreeModel):
+class InvenTreeAttachmentMixin:
     """Provides an abstracted class for managing file attachments.
 
-    An attachment can be either an uploaded file, or an external URL
+    Links the implementing model to the common.models.Attachment table,
+    and provides the following methods:
 
-    Attributes:
-        attachment: Upload file
-        link: External URL
-        comment: String descriptor for the attachment
-        user: User associated with file upload
-        upload_date: Date the file was uploaded
+    - attachments: Return a queryset containing all attachments for this model
     """
 
-    class Meta:
-        """Metaclass options. Abstract ensures no database table is created."""
-
-        abstract = True
-
-    def getSubdir(self):
-        """Return the subdirectory under which attachments should be stored.
+    def delete(self):
+        """Handle the deletion of a model instance.
 
-        Note: Re-implement this for each subclass of InvenTreeAttachment
+        Before deleting the model instance, delete any associated attachments.
         """
-        return 'attachments'
-
-    def save(self, *args, **kwargs):
-        """Provide better validation error."""
-        # Either 'attachment' or 'link' must be specified!
-        if not self.attachment and not self.link:
-            raise ValidationError({
-                'attachment': _('Missing file'),
-                'link': _('Missing external link'),
-            })
-
-        if self.attachment and self.attachment.name.lower().endswith('.svg'):
-            self.attachment.file.file = self.clean_svg(self.attachment)
-
-        super().save(*args, **kwargs)
-
-    def clean_svg(self, field):
-        """Sanitize SVG file before saving."""
-        cleaned = sanitize_svg(field.file.read())
-        return BytesIO(bytes(cleaned, 'utf8'))
-
-    def __str__(self):
-        """Human name for attachment."""
-        if self.attachment is not None:
-            return os.path.basename(self.attachment.name)
-        return str(self.link)
-
-    attachment = models.FileField(
-        upload_to=rename_attachment,
-        verbose_name=_('Attachment'),
-        help_text=_('Select file to attach'),
-        blank=True,
-        null=True,
-    )
-
-    link = InvenTree.fields.InvenTreeURLField(
-        blank=True,
-        null=True,
-        verbose_name=_('Link'),
-        help_text=_('Link to external URL'),
-    )
-
-    comment = models.CharField(
-        blank=True,
-        max_length=100,
-        verbose_name=_('Comment'),
-        help_text=_('File comment'),
-    )
-
-    user = models.ForeignKey(
-        User,
-        on_delete=models.SET_NULL,
-        blank=True,
-        null=True,
-        verbose_name=_('User'),
-        help_text=_('User'),
-    )
-
-    upload_date = models.DateField(
-        auto_now_add=True, null=True, blank=True, verbose_name=_('upload date')
-    )
+        self.attachments.all().delete()
+        super().delete()
 
     @property
-    def basename(self):
-        """Base name/path for attachment."""
-        if self.attachment:
-            return os.path.basename(self.attachment.name)
-        return None
-
-    @basename.setter
-    def basename(self, fn):
-        """Function to rename the attachment file.
-
-        - Filename cannot be empty
-        - Filename cannot contain illegal characters
-        - Filename must specify an extension
-        - Filename cannot match an existing file
-        """
-        fn = fn.strip()
-
-        if len(fn) == 0:
-            raise ValidationError(_('Filename must not be empty'))
+    def attachments(self):
+        """Return a queryset containing all attachments for this model."""
+        return self.attachments_for_model().filter(model_id=self.pk)
 
-        attachment_dir = settings.MEDIA_ROOT.joinpath(self.getSubdir())
-        old_file = settings.MEDIA_ROOT.joinpath(self.attachment.name)
-        new_file = settings.MEDIA_ROOT.joinpath(self.getSubdir(), fn).resolve()
+    @classmethod
+    def check_attachment_permission(cls, permission, user) -> bool:
+        """Check if the user has permission to perform the specified action on the attachment.
 
-        # Check that there are no directory tricks going on...
-        if new_file.parent != attachment_dir:
-            logger.error(
-                "Attempted to rename attachment outside valid directory: '%s'", new_file
-            )
-            raise ValidationError(_('Invalid attachment directory'))
+        The default implementation runs a permission check against *this* model class,
+        but this can be overridden in the implementing class if required.
 
-        # Ignore further checks if the filename is not actually being renamed
-        if new_file == old_file:
-            return
+        Arguments:
+            permission: The permission to check (add / change / view / delete)
+            user: The user to check against
 
-        forbidden = [
-            "'",
-            '"',
-            '#',
-            '@',
-            '!',
-            '&',
-            '^',
-            '<',
-            '>',
-            ':',
-            ';',
-            '/',
-            '\\',
-            '|',
-            '?',
-            '*',
-            '%',
-            '~',
-            '`',
-        ]
-
-        for c in forbidden:
-            if c in fn:
-                raise ValidationError(_(f"Filename contains illegal character '{c}'"))
-
-        if len(fn.split('.')) < 2:
-            raise ValidationError(_('Filename missing extension'))
-
-        if not old_file.exists():
-            logger.error(
-                "Trying to rename attachment '%s' which does not exist", old_file
-            )
-            return
+        Returns:
+            bool: True if the user has permission, False otherwise
+        """
+        perm = f'{cls._meta.app_label}.{permission}_{cls._meta.model_name}'
+        return user.has_perm(perm)
 
-        if new_file.exists():
-            raise ValidationError(_('Attachment with this filename already exists'))
+    def attachments_for_model(self):
+        """Return all attachments for this model class."""
+        from common.models import Attachment
 
-        try:
-            os.rename(old_file, new_file)
-            self.attachment.name = os.path.join(self.getSubdir(), fn)
-            self.save()
-        except Exception:
-            raise ValidationError(_('Error renaming file'))
+        model_type = self.__class__.__name__.lower()
 
-    def fully_qualified_url(self):
-        """Return a 'fully qualified' URL for this attachment.
+        return Attachment.objects.filter(model_type=model_type)
 
-        - If the attachment is a link to an external resource, return the link
-        - If the attachment is an uploaded file, return the fully qualified media URL
-        """
-        if self.link:
-            return self.link
+    def create_attachment(self, attachment=None, link=None, comment='', **kwargs):
+        """Create an attachment / link for this model."""
+        from common.models import Attachment
 
-        if self.attachment:
-            media_url = InvenTree.helpers.getMediaUrl(self.attachment.url)
-            return InvenTree.helpers_model.construct_absolute_url(media_url)
+        kwargs['attachment'] = attachment
+        kwargs['link'] = link
+        kwargs['comment'] = comment
+        kwargs['model_type'] = self.__class__.__name__.lower()
+        kwargs['model_id'] = self.pk
 
-        return ''
+        Attachment.objects.create(**kwargs)
 
 
 class InvenTreeTree(MetadataMixin, PluginValidationMixin, MPTTModel):