Django Permafrost
Django Permafrost is an extension to Django's Permissions framework. It's goal is to allow developers to expose some permissions to Client Users on the site so they can create and manage custom User Roles.
It adds:
- A View Mixin that supports user permissions based on different HTTP method types (GET, POST, PUT, etc) for extra granular control.
- A View Mixin that captures into Django's logging setup any failed permission checks.
- An App that supports Client User definable roles and permissions. This uses the underlying Django Permission system and controls which permissions are exposed to the users.
- Developers can have both require permissions for the permission classes or optional permission that can be set by the Client.
For example, you have a SAAS platform where you have Administrators Clients. They manage the other users on their master account in the system (like Employees, etc) and want to be able to define different permissions for various users. They might have one Employee they want to be able to manage email lists but not let them invite users but both are considered in the staff category.
Installation
To install, just use pip
> pip install django-permafrost
To add it to your project, add it to the list of install apps in you settings.py...
INSTALLED_APPS = [
...
'permafrost',
...
]
... and migrate
> ./manage.py migrate
Setup
The Goal of Django Permafrost is to allow Clients to create their own Permafrost Roles, under developer defined Categories with developer defined required and optional permissions.
An example of a developer defined categories looks like this:
Sample Category Permission Format:
PERMAFROST_CATEGORIES = {
'user': {
'label': _("User"),
'access_level': 1,
'optional': [
{'label':_('Can Add Users to Role'), 'permission': ('add_user_to_role', 'permafrost', 'permafrostrole')},
],
'required': [
{'label':_('Can add Role'), 'permission': ('add_permafrostrole', 'permafrost', 'permafrostrole')},
],
},
}
This would be added to your Django settings.py file (or, at least, included into).
In the above, we define the User category, give it the localizable label of "User" and provide two permissions in the "Natural Key" format (since PKs can be unreliable with permissions), the first is optional and the second is required.
There is also an access_level setting to help make sorting access levels more easily.
Context model
Permafrost roles are scoped to a context object. By default, that context is Django's Site model, which preserves the original subdomain/site-per-client behavior:
PERMAFROST_CONTEXT_MODEL = "sites.Site"
PERMAFROST_CONTEXT_REQUEST_ATTR = "site"
Projects that use a different tenant model can set the context model once at the beginning of the project, similar to how a custom user model is configured:
PERMAFROST_CONTEXT_MODEL = "accounts.Organization"
PERMAFROST_CONTEXT_REQUEST_ATTR = "organization"
Permafrost expects the current context object to be available on the request using PERMAFROST_CONTEXT_REQUEST_ATTR. For example, middleware might attach request.organization. If no request context is available, the configured context model must provide a manager method named get_current(). The built-in Site default uses Site.objects.get_current().
Internally, Permafrost stores the context through Django's content type framework, but each project should configure exactly one context model for the lifetime of that project.
Recommendations
It is recommended that you update your code to use PermafrotRole's built-in functions to add users and permissions. They add an extra level of checking to make sure the permissions passed in are allowed by the PERMAFROST_CATEGORIES configuration.
For example, permissions on a Group:
group.permissions.set([permission_list])
group.permissions.add(permission, permission, ...)
group.permissions.remove(permission, permission, ...)
group.permissions.clear()
Can be replaced with:
PermafrostRole.permissions_set([permission_list])
PermafrostRole.permissions_add(permission, permission, ...)
PermafrostRole.permissions_remove(permission, permission, ...)
PermafrostRole.permissions_clear()
Convenience tools
There is a tool to help the developer list out the permissions available in the format permafrost expects.
> ./manage permlist
using the command will produce a list like this
> ./manage.py permlist
Permlist formatted for your PermafrostRoles configuration
{'label':_('Can add email address'), 'permission': ('add_emailaddress', 'account', 'emailaddress')},
{'label':_('Can change email address'), 'permission': ('change_emailaddress', 'account', 'emailaddress')},
{'label':_('Can delete email address'), 'permission': ('delete_emailaddress', 'account', 'emailaddress')},
...
Each line can be copied into the PERMAFROST_CATEGORIES config in the correct format.
1 maintainer
Metadata
1 maintainer
Release files for django-permafrost 0.4.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| django_permafrost-0.4.0.tar.gz | 35.6 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| django_permafrost-0.4.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 88.5 kB
Release files / django_permafrost-0.4.0.tar.gz
| Download URL | django_permafrost-0.4.0.tar.gz |
|---|---|
| Size | 35.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
3b77a0c134b72f270fb03292386b81ccfe1fa437b82e4b11d3dd73c908eee06c
|
|
BLAKE2b-256 checksum How to use checksums |
482d27572fc9c2e11f5f50b43e27dcdd1150f4f9d3d8e2ac600baa89c8f97a9c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.8
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 14, 2026.
Transparency logRelease files / django_permafrost-0.4.0-py3-none-any.whl
| Download URL | django_permafrost-0.4.0-py3-none-any.whl |
|---|---|
| Size | 52.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
41c15663a721f6f58dc28c91ddce7ad63e3ea46a4836845f34e0876fb5193dd1
|
|
BLAKE2b-256 checksum How to use checksums |
9ffecdca6d2455230871a1d51398a7ac9789a740fe63f994bf38aa6b26ead69f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.8
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 14, 2026.
Transparency log
