core.permissions
Overview
Object-level and row-level permission classes for CRUDL and workflow integration.
Classes
filter_rows_for_user
Apply row-level and workflow-aware queryset filters for the given perm_type. Calls RowLevelPermissions.check_queryset and, when the model has a workflow, also annotates state permission info and calls check_queryset_workflow.
This is the single row-visibility rule. A viewset reaches it through apply_row_level_filter; history reaches it directly, so an event about a related row follows the same rule as reading that row.
Signature
filter_rows_for_user(queryset, user, perm_type)
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| queryset | yes | ||
| user | yes | ||
| perm_type | yes |
Source
server/vueda/core/permissions.py:296
has_matching_state_grant
Whether a workflow state of model grants user any of required_permissions.
This is the one model-scope deferral rule. A model-level denial stands unless a state rule matches the caller's groups, a requested codename, the model's content type, and the model's own workflow, and that rule grants rather than denies.
The answer says only that an object's state can still admit the request. It does not say that any particular object does. Call it only from a path that goes on to make that per-object decision, and let the object decision, including a matching deny, settle the request.
Signature
has_matching_state_grant(model, user, required_permissions)
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| model | yes | ||
| user | yes | ||
| required_permissions | yes |
Returns
<class 'bool'>
Source
server/vueda/core/permissions.py:21
has_row_dependent_authorization
Whether reading a row of model depends on the row rather than only on the model.
A model is row-dependent when it declares RowLevelPermissions or participates in a configured workflow. History uses this to decide whether an event about a row that has since been deleted can still be authorized. When the row is gone there is nothing left to evaluate, so a row-dependent model fails closed.
Signature
has_row_dependent_authorization(model)
Parameters
| Name | Type | Required | Description |
|---|---|---|---|
| model | yes |
Returns
<class 'bool'>
Source
server/vueda/core/permissions.py:273
Source
server/vueda/core/permissions.py