Skip to main content

Simple graphene-django permission system.

Project description

graphene-permissions

Permission system for graphene-django apps.

Build Status PyPI version Python 3.6 codecov Maintainability

Overview

DRF-inspired permission system based on classes for graphene-django. Allows easy customization of permission classes for for queries and mutations.

Requirements

  • Python 3.5+
  • Django 2.0+
  • graphene-django 2.0+

Installation

Install using pip:

pip install graphene-permissions

Example

To enforce permission system, add appropriate mixin and set attribute permission_classes.

### models.py
from django.db import models


class Pet(models.Model):
    name = models.CharField(max_length=32)
    race = models.CharField(max_length=64)
### schema.py
from graphene import relay
from graphene_django import DjangoObjectType
from graphene_permissions.mixins import AuthNode
from graphene_permissions.permissions import AllowAuthenticated


class PetNode(AuthNode, DjangoObjectType):
    permission_classes = (AllowAuthenticated,)

    class Meta:
        model = Pet
        filter_fields = ('name',)
        interfaces = (relay.Node,)

Docs

Setting up permission check

For queries use AuthNode mixin and inherite from AuthFilter class.

class AllowAuthenticatedPetNode(AuthNode, DjangoObjectType):
    permission_classes = (AllowAuthenticated,)

    class Meta:
        model = Pet
        filter_fields = ('name',)
        interfaces = (relay.Node,)


class AllowAuthenticatedFilter(AuthFilter):
    permission_classes = (AllowAuthenticated,)


class PetsQuery:
    user_pet = relay.Node.Field(AllowAuthenticatedPetNode)
    all_user_pets = AllowAuthenticatedFilter(AllowAuthenticatedPetNode)

For mutations use AuthMutation mixin.

class AuthenticatedAddPet(AuthMutation, ClientIDMutation):
    permission_classes = (AllowAuthenticated,)
    pet = graphene.Field(AllowAuthenticatedPetNode)

    class Input:
        name = graphene.String()
        race = graphene.String()
        owner = graphene.ID()

    @classmethod
    def mutate_and_get_payload(cls, root, info, **input):
        if cls.has_permission(root, info, input):
            owner = User.objects.get(pk=from_global_id(input['owner'])[1])
            pet = Pet.objects.create(name=input['name'], race=input['race'], owner=owner)
            return AuthenticatedAddPet(pet=pet)
        return AuthenticatedAddPet(pet=None)


class PetsMutation:
    authenticated_add_pet = AuthenticatedAddPet.Field()

Customizing permission classes

Default permission classes are: AllowAny, AllowAuthenticated, AllowStaff. You can set up equal permission for both queries and mutations with one class, simply subclass one of these classes and to limit access for given object, override appropriate method. Remember to return true if user should be given access and false, if denied.

class AllowMutationForStaff(AllowAuthenticated):
    @staticmethod
    def has_node_permission(info, id):
        # logic here 
        # return boolean

    @staticmethod
    def has_mutation_permission(root, info, input):
        if info.request.user.is_staff:
            return True
        return False

    @staticmethod
    def has_filter_permission(info):
        # logic here
        # return boolean

Multiple permissions

You can set up multiple permissions checks, simply adding more classes. Permission is evaluated for every class. If one of the checks fails, access is denied.

class CustomPetNode(AuthNode, DjangoObjectType):
    permission_classes = (AllowAuthenticated, AllowStaff, AllowCustom)

    class Meta:
        model = Pet
        interfaces = (relay.Node,)

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
graphene_permissions-1.1.2-py3-none-any.whl (5.3 kB) Copy SHA256 hash SHA256 Wheel py3
graphene-permissions-1.1.2.tar.gz (4.1 kB) Copy SHA256 hash SHA256 Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page