Flexible permissions for Django REST Framework
Project description
drf-guard
Flexible and simple to use permissions for Django REST Framework(DRF). Works with both class based DRF permissions, Django permissions and Django groups.
Requirements
- Python >= 3.5
- Django >= 1.11
- Django REST Framework >= 3.5
Installing
pip install drf-guard
Getting started
Using drf-guard
is very simple, below is an example
# views.py
# Import operators & permissions from drf_guard
from drf_guard.operators import And, Or, Not
from drf_guard.permissions import HasRequiredGroups, HasRequiredPermissions
class UserViewSet(viewsets.ModelViewSet):
queryset = User.objects.all()
serializer_class = UserSerializer
# Use drf_guard permissions here
permission_classes = (HasRequiredGroups, HasRequiredPermissions)
# Now guard your API with groups and permissions as you wish
groups_and_permissions = {
'GET': {
'list': {
# To access this the user must belongs to admin or client group
'groups': ['admin', Or, 'client'],
'permissions': [IsAuthenticated] # Also the user must be authenticated
},
'retrieve': {
'groups': [Not, 'admin'], # The user must not be in admin group
'permissions': [IsAuthenticated, And, IsAllowedUser] # MUst be authenticated and allowed
},
},
'PUT': {
'groups': ['__all__'], # Belongs to any group
'permissions': [IsAuthenticated, And, IsAdmin] # By now this should be obvious
},
'PATCH': {
'groups': ['client', And, Not, 'admin'], # User belongs to client and not admin group
'permissions': [IsAuthenticated, IsAllowedUser] # This is = [IsAuthenticated, And, IsAllowedUser]
},
'DELETE': {
'groups': ['client', Or, [Not, 'client', And, 'admin']], # You can basically do any combination
'permissions': [IsAuthenticated]
}
}
What's important here is to know what goes into groups and permissions
- Groups takes group names and Django group objects, so you can use those operators however you want with these two, you can even mix the two types together, e.g
'groups': [Group.objects.get(name='admin'), Or, 'client']
- Permissions takes DRF permissions(class based), Django permission objects and Django permission names(codenames), so you can use those operators however you want with these three, you can even use all three types together, e.g
'permissions': [IsAuthenticated, And, Permissions.objects.get('view_user'), Or, 'change_user']
Note:
And
,Or
&Not
are the equvalent operators forand
,or
¬
respectively- Unlike
and
,or
¬
the operatorsAnd
,Or
&Not
have no precedence they are evaluated from left to right, if you want precedence use list or tuple to make one i.e[IsAuthenticated, And, [IsAdmin, Or, IsClient]]
- The
'__all__'
on groups stands for any group(or allow all groups) - The GET-list stands for permission & groups in
GET: /users/
route - The GET-retrieve stands for groups & permissions in
GET: /users/{id}/
routes - The POST stands for groups & permissions in
POST: /users/
route - The PUT stands for groups & permissions in
PUT: /users/{id}/
routes - The PATCH stands for groups & permissions in
PATCH: /users/{id}/
routes - The DELETE stands for groups & permissions in
DELETE: /users/{id}/
routes
Project details
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
drf-guard-0.1.2.tar.gz
(6.4 kB
view hashes)
Built Distribution
Close
Hashes for drf_guard-0.1.2-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 681b2f9d98cdad7a6462c0009ab0df72f99e7501af0bf1c53f1af6f2922cfb88 |
|
MD5 | 22697044a2b28fdc90a852a6a94b9dc9 |
|
BLAKE2b-256 | bd9b248062d4b0ac14d7a5e9d415ae1bfa1561464664c9025b63ae2ef0180f5e |