Evaluators Tags Create
Mixin for views that need method-level permission enforcement.
Supports two approaches for defining permissions:
1. Auto-generation (Recommended - DRY):
Set permission_resource to auto-generate CRUD permissions based on HTTP methods:
class MyView(PermissionMapMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
permission_resource = Resources.LOG
# Auto-generates:
# GET -> log:read
# PATCH -> log:update
# DELETE -> log:delete
Override specific methods via permission_map (always use constants):
class MyView(PermissionMapMixin, ...):
permission_resource = Resources.LOG
permission_map: PermissionMap = {
"GET": None, # Override: no permission required for GET
"POST": make_permission(Resources.LOG, CRUDActions.READ), # POST acts as read
}
2. Explicit mapping (for non-CRUD or complex cases - always use constants):
class MyView(PermissionMapMixin, JWTAndAPIKeyAuthenticationViewMixin, APIView):
permission_map: PermissionMap = {
"GET": make_permission(Features.PROXY, Actions.ACCESS),
"POST": make_permission(Features.PLAYGROUND, Actions.ACCESS),
}
3. Dynamic logic (most flexible):
def get_required_permission(self, method: str) -> str | None:
if self.kwargs.get('public'):
return None
return "dataset:read"
Notes:
- permission_map acts as an override when permission_resource is set
- If neither is defined, no permission check is performed (backward compatible)
- HasJWTPermission automatically enforces permissions when defined
Authentication
AuthorizationBearer
JWT access token or Respan API key
Request
This endpoint expects an object.
organization
name
color
Response
id
created_at
updated_at
organization
name
color