[SCRUM-14] Improve admin graph lazy loading UI#131
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 914c6bfa02
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return response | ||
|
|
||
| def chart_data_view(self, request, chart_name): | ||
| queryset = self.get_changelist_instance(request).queryset |
There was a problem hiding this comment.
Enforce model permissions on chart data
When a logged-in staff user lacks the drf_api_logger.view_apilogsmodel permission, the normal changelist is blocked by Django's model-admin permission checks, but this custom endpoint is only wrapped in admin_site.admin_view and immediately builds the queryset. That lets any staff user fetch aggregate API-log volume/status/SQL data via /chart-data/.../ despite not being allowed to view API logs, so this view should check has_view_or_change_permission(request) before returning data.
Useful? React with 👍 / 👎.
914c6bf to
ada0ce4
Compare
Summary
This PR updates the Django admin API log graphs so the changelist stays fast and the graph UI is less intrusive.
Scope notes
Validation
python -m django test tests --settings=tests.test_settings --verbosity=1- passed, 256 tests.python -m django test tests.test_admin_templates tests.test_admin_charts --settings=tests.test_settings --verbosity=2- passed, 12 tests.python -m unittest tests.test_docs_content- passed, 12 tests.python -m django makemigrations drf_api_logger --check --dry-run --settings=tests.test_settings- no changes detected.python test_runner_simple.py- passed, 27 tests.git diff --check- passed.J:\projects\drf-demo: current branch installed editable,manage.py checkpassed,collectstatic --noinputpassed, rendered admin changelist confirmed lazy graph timeout, full width, and 200px height.