Permissions¶

The drf_corekit.permissions module provides reusable permission utilities and focuses on composable building blocks rather than app specific roles.

Role Based Permissions¶

RolePermission¶

from drf_corekit.permissions import RolePermission

Generic role based permission checker.

Supports simple attribute based authorization using:

• is_staff
• is_superuser
• user_type (optional)

Behavior¶

This permission:

• Verifies the user is authenticated
• Evaluates configured role requirements
• Applies the same checks at both view and object level
• Supports composition with other DRF permissions

This permission does NOT:

• Check object ownership
• Inspect object state
• Define application specific roles

Configuration¶

Subclasses define one or more role requirements.

Require staff access:

class IsStaff(RolePermission):
    require_staff = True

Require superuser access:

class IsSuperuser(RolePermission):
    require_superuser = True

Require a specific user type:

class IsUserType(RolePermission):
    require_user_type = 1

Multiple requirements can be combined:

class IsStaffUserType(RolePermission):
    require_staff = True
    require_user_type = 1

Permission Composition¶

Role permissions work seamlessly with DRF permission operators.

Allow staff or object owners:

permission_classes = [
    IsStaff | IsOwner,
]

Require both admin access and ownership:

permission_classes = [
    IsAdmin & IsOwner,
]

Require authentication and either staff access or ownership:

permission_classes = [
    IsAuthenticated & (IsStaff | IsOwner),
]

Role Composition¶

RolesOrReadOnly¶

from drf_corekit.permissions import RolesOrReadOnly

Allows unrestricted read access while restricting unsafe methods to configured roles.

Configuration¶

class AdminOrReadOnly(RolesOrReadOnly):
    role_permission_classes = [IsAdmin]

Multiple role permissions can be configured:

class StaffOrAdminReadOnly(RolesOrReadOnly):
    role_permission_classes = [
        IsStaff,
        IsAdmin,
    ]

Behavior¶

Ownership Permissions¶

OwnershipPermission¶

from drf_corekit.permissions import OwnershipPermission

Generic object level permission based on ownership rules.

Features¶

• Attribute based ownership resolution
• Callable based ownership resolution
• Support for multiple owners
• Optional admin bypass
• No dependency on a specific user model structure

Configuration¶

Basic ownership check:

class IsOwner(OwnershipPermission):
    ownership_attr = "owner"

Custom ownership resolution:

class IsTicketParticipant(OwnershipPermission):
    ownership_attr = lambda obj: (
        obj.created_by,
        obj.assigned_to,
    )

Owner or admin:

class IsOwnerOrAdmin(OwnershipPermission):
    ownership_attr = "owner"
    allow_admin_bypass = True
    admin_checker = lambda user: user.is_superuser

Behavior¶

This permission:

• Verifies the user is authenticated
• Resolves ownership using ownership_attr
• Supports single or multiple owners
• Supports callable ownership resolution
• Supports configurable admin bypass

This permission does NOT:

• Depend on profiles or custom user model structures
• Define what an administrator is
• Implement application specific role logic

Ownership Resolution¶

ownership_attr may be:

• An attribute name

ownership_attr = "owner"

• A callable

ownership_attr = lambda obj: obj.created_by

• A callable returning multiple owners

ownership_attr = lambda obj: (
    obj.created_by,
    obj.assigned_to,
)

Action Based Permissions¶

ActionRolePermission¶

from drf_corekit.permissions import ActionRolePermission

Maps DRF ViewSet actions to permission classes.

Example¶

class MyPermissions(ActionRolePermission):
    ACTION_ROLE_MAP = {
        "list": [IsAdmin],
        "create": [IsAdmin],
        "retrieve": [IsOwner, IsAdmin],
    }

Behavior¶

• Selects permissions based on view.action
• Grants access if ANY mapped permission allows it
• Supports both permission level and object level checks