Can we allow the smart select at the frontend, but just store only the ForeignKey to the "smart selected" dropdown?

[KommuSoft]

Something I think is missing in the package is to present the chained foreignkey in the (Model)Form, but not storing both ForeignKeys in the model, so it would be nice if we somehow can work with the smart select at the frontend, but at the same time store only the chained ForeignKey, so:

class Location(models.Model):
    country = ForeignKey(
        Country,
        chained_field="continent",
        chained_model_field="continent",
        show_all=False,
        auto_choose=True,
        sort=True)

and in the ModelForm with:

class ChainForm(forms.Form):
    continent = forms.ModelChoiceField(queryset=Continent.objects.all())
    country = ChainedModelChoiceField(queryset=Country.objects.all(), chained_field='continent', chained_model_field='continent', show_all=False, auto_choose=False, sort=True, to_app_name='my_app', to_model_name='Country', foreign_key_app_name='my_app', foreign_key_model_name='Continent', foreign_key_field_name='continent')

or something similar.

If I try this, it does not work, and for good reasons: it checks if there is a ChainedForeignKey, and that is not the case, so it is a security mechanism.

I'm wondering however if we can add some sort of exception to the security to allow both?

[maxb]

This used to work just fine... as I discovered when I upgraded django-smart-selects in an old app, and it became broken by the security change from #201.

I rewrote the security condition as an explicit allowlist referencing a list in my settings file, and that was not only more secure, but allowed this pattern to work again.

[KommuSoft]

@maxb : but this is not (yet) in the django-smart-selects if I'm not mistaken? Perhaps you can add it as a pull request. Evidently the security is a good idea, but if it prevents one from "having the cake and eat it too", then it has to be modified imho.