Mixin for views that need method-level permission enforcement. Supports two approaches for defining permissions: 1. Auto-generation (Recommended - DRY): Set permission_resource to auto-generate CRUD permissions based on HTTP methods: class MyView(PermissionMapMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView): permission_resource = Resources.LOG # Auto-generates: # GET -> log:read # PATCH -> log:update # DELETE -> log:delete Override specific methods via permission_map (always use constants): class MyView(PermissionMapMixin, ...): permission_resource = Resources.LOG permission_map: PermissionMap = { "GET": None, # Override: no permission required for GET "POST": make_permission(Resources.LOG, CRUDActions.READ), # POST acts as read } 2. Explicit mapping (for non-CRUD or complex cases - always use constants): class MyView(PermissionMapMixin, JWTAndAPIKeyAuthenticationViewMixin, APIView): permission_map: PermissionMap = { "GET": make_permission(Features.PROXY, Actions.ACCESS), "POST": make_permission(Features.PLAYGROUND, Actions.ACCESS), } 3. Dynamic logic (most flexible): def get_required_permission(self, method: str) -> str | None: if self.kwargs.get('public'): return None return "dataset:read" Notes: - permission_map acts as an override when permission_resource is set - If neither is defined, no permission check is performed (backward compatible) - HasJWTPermission automatically enforces permissions when defined