DRF Access Policy

1.5.0 verified Fri May 01 auth: no python

Declarative access policies/permissions modeled after AWS' IAM policies for Django REST Framework. Current version 1.5.0, with active development and periodic releases.

pip install drf-access-policy

Common errors

error ModuleNotFoundError: No module named 'drf_access_policy' ↓

cause Incorrect import path; the correct package is 'rest_framework_access_policy'.

fix

Replace 'import drf_access_policy' with 'import rest_framework_access_policy' or use 'from rest_framework_access_policy import AccessPolicy'.

error KeyError: 'condition_expression' ↓

cause Using 'condition' with boolean logic in version 1.0.0+; the syntax changed.

fix

Rename 'condition' to 'condition_expression' and adjust boolean expressions.

error ImportError: cannot import name 'AccessPolicy' from 'rest_framework_access_policy' ↓

cause Package not installed or installed under different name. Possibly installed 'drf-access-policy' but import path is correct.

fix

Run 'pip install drf-access-policy' and check your Python environment.

Warnings

breaking Version 1.0.0 changed condition evaluation: 'condition' no longer supports multiple methods with boolean logic. Use 'condition_expression' instead. ↓

fix Replace 'condition' elements with 'condition_expression' and use Python-style boolean operators.

gotcha Import path is 'rest_framework_access_policy', not 'drf_access_policy'. Many users mistakenly use the latter. ↓

fix Use 'from rest_framework_access_policy import AccessPolicy'.

deprecated Python 3.5 support dropped in version 1.5.0. Use Python 3.6+. ↓

fix Upgrade your Python environment to 3.6 or newer.

Imports

AccessPolicy

wrong

from drf_access_policy import AccessPolicy

correct

from rest_framework_access_policy import AccessPolicy

The import path uses 'rest_framework_access_policy', not 'drf_access_policy'.

FieldAccessMixin

from rest_framework_access_policy import FieldAccessMixin

PermittedPkRelatedField

from rest_framework_access_policy import PermittedPkRelatedField

PermittedSlugRelatedField

from rest_framework_access_policy import PermittedSlugRelatedField

Statement

from rest_framework_access_policy import Statement

Quickstart

Define an access policy as a dictionary on the view. The policy controls actions allowed for principals.

from rest_framework.views import APIView
from rest_framework_access_policy import AccessPolicy

class MyView(APIView):
    access_policy = {
        "statements": [
            {
                "action": ["list"],
                "principal": "*",
                "effect": "allow",
            },
        ]
    }