django-ninja-rbac 1.0.0

A simple, light-weight privilege checker decorator for Django Ninja APIs.

django-ninja-rbac

A lightweight RBAC (Role-Based Access Control) decorator for Django Ninja APIs.

Protect your endpoints using simple privilege strings with support for wildcard permissions.

Installation

pip install django-ninja-rbac

Quick Start

Attach permissions to your authenticated user:

request.user.permissions = [
    "customers:view",
    "customers:update",
]

Protect your Django Ninja endpoints:

from ninja_rbac import require_permissions


@api.get("/customers")
@require_permissions(["customers:view"])
def get_customers(request):
    return {"success": True}

If the user does not have the required permission, a 403 Forbidden response is returned:

{
  "message": "You are not authorized to perform this action"
}

Multiple Permissions

By default, the user must have at least one of the specified permissions.

@require_permissions([
    "customers:view",
    "customers:update",
])
def endpoint(request):
    ...

Equivalent to:

customers:view OR customers:update

Require All Permissions

Set require_all=True to require every permission.

@require_permissions(
    [
        "customers:view",
        "customers:update",
    ],
    require_all=True,
)
def endpoint(request):
    ...

Equivalent to:

customers:view AND customers:update

Wildcard Permissions

Resource Wildcards

user.permissions = [
    "customers:*"
]

Allows:

customers:view
customers:create
customers:update
customers:delete

Global Wildcard

user.permissions = [
    "*:*"
]

Allows access to all resources and actions.

Permission Examples

customers:view
customers:create
customers:update
customers:delete

orders:view
orders:create
orders:update
orders:delete

customers:*
orders:*

*:*

How It Works

Given a required permission:

customers:view

The package checks the user's permissions in the following order:

customers:view
customers:*
*:*

The first matching permission grants access.

Requirements

• Python 3.11+
• Django Ninja 1.5+

License

MIT