I have made a permission_required decorator

[baseplate-admin]

Hi, I needed a reusuable way to check for user permissions.

# decorator.py

from django.contrib.auth.models import AnonymousUser,User
from django.http import HttpRequest
from ninja.errors import HttpError

if TYPE_CHECKING:
    from .permissions import IsSuperUser

def permission_required(
    permissions: list[Callable[[HttpRequest, User], "IsSuperUser"]],
    key: str | None = "auth",  # To get request.auth
) -> Callable[[Callable[..., Any]], Callable[..., Any]]:
    def decorator(func: Callable[..., Any]) -> Callable[..., Any]:
        @wraps(func)
        def wrapper(request: HttpRequest, *args: Any, **kwargs: Any) -> Any:
            user = getattr(request, key, AnonymousUser)

            permission_granted = any(
                [permission(request, user).has_permissions() for permission in permissions]
            )
            if not permission_granted:
                raise HttpError(
                    HTTPStatus.UNAUTHORIZED,
                    "Superuser is required for this operation",
                )
            return func(request, *args, **kwargs)

        return wrapper

    return decorator

# permissions.py

from django.contrib.auth.models import User
from django.http import HttpRequest

SAFE_METHODS = ("GET", "HEAD", "OPTIONS")


class IsSuperUser:
    def __init__(self, request: HttpRequest, user: User) -> None:
        self.request = request
        self.user = user

    def has_permissions(self) -> bool:
        if self.user.is_superuser and self.request.method not in SAFE_METHODS:
            return True
        return False

@router.post("", response=SomeSchema, auth=AuthBearer())
@permission_required([IsSuperUser])
def hello(request:HttpRequest):
    return "World"
    

Couple of facts :

• It only works if and only if auth is passed inside router. Eg : This will work

  @router.post("", response=SomeSchema, auth=AuthBearer()) # Note the auth here ?

  This wont work

   @router.post("", response=SomeSchema, login=AuthBearer())# Note that theres no auth here. So we can't do `request.auth`

---

If there's enough interest. I can make it a 3rd party package that will help other developers on their journey

This decorator was mostly inspired from #580 (comment)

[OtherBarry]

I've implemented something similar here: https://github.com/OtherBarry/django-ninja-decorators/blob/master/ninja_decorators/permissions.py

This uses string based permissions rather than permission classses, because my use case was for granular permissions. It wouldn't be too difficult to combine the two methods though.

A third party package would be great!

[OtherBarry]

Idk if I can commit too much time to it, but more than happy to help out if that's something you want to organise.

[baseplate-admin]

I can commit too much time to it

Ah i see. No worries. Modules like these doesn't require much maintenance ( code it once and it probably wont break )

if that's something you want to organise.

I would love to. But need a bit more time to tidy up my schedules.

[vlada1g]

@OtherBarry can you give some examples how it works? I need permissions check on Router level, i have global JWT auth system but i need also permission check?

[OtherBarry]

@vlada1g it's intended to work with django's built in permissions system. Using the example from the docs, you'd use it like this:

from ninja import Router
from otherbarry_decorators import permission_required

from foo.models import Bar


@router.get("/bar")
@permission_required("foo.view_bar")
def get_all_bars(request):
    return Bar.objects.all()

Note that the default permission class assumes there's a user property representing an instance of the user model on request objects, which is something that your auth class would need to set.

Alternativelty, if you're not using django's permissions, you can create your own permissions class, and just update the PERMISSIONS_CLASS setting in your settings file. Usually when I'm using JWTs, I include the permissions in the JWT token, so that I can avoid the database hit.

This would look something like this:

class JWTTokenPermissions(BasePermission):
    def has_permissions(
        self, request: AuthenticatedHttpRequest, permissions: Tuple[str, ...]
    ) -> bool:
        jwt_permissions = request.jwt_token.claims.get("permissions", [])
        return all(perm in jwt_permissions for perm in permissions)

Obviously exact details will depend on exaclty how you've implemented JWT auth, but hopefully this gives you enough of an idea.

If you want your permissions to be at a Router level, rather than per-endpoint, you'd be better off subclassing your auth class to handle permissions. Something like

class JWTAuth(...):
    def authenticate(self, ...):
        ... # whatever your normal jwt flow is
        
        if not self.check_permissions(token):  # could pass user instead, if you are using user objects
            return False
        
    def check_permissions(self, token):
        return True
        
class PermissionJWTAuth(JWTAuth):
    def __init__(*permissions):
        self._permissions = permissions
        super().__init__()
        
    def check_permissions(self, token):
        jwt_permissions = request.jwt_token.claims.get("permissions", [])
        return all(perm in jwt_permissions for perm in self.permissions)
        
        # or use somethin like `return user.has_perms(self.permissions)` if passing user objects
        
        
router = Router(tags=["Foo"], auth=PermissionJWTAuth("foo_perm_a", "foo_perm_b"))

Then every user would need to have foo_perm_a and foo_perm_b to access endpoints in the router.

[vlada1g]

@OtherBarry Thanks! you give me a lot of ideas/

def ninja_permission_required(perm):
    def decorator(func):
        @wraps(func)
        def wrapper(request, *args, **kwargs):
            # Check if user has permission
            if request.user.has_perm(perm) is False:
                # Here, we're raising a 403 Forbidden
                raise HttpError(status_code=403, message="Permission Denied")

            return func(request, *args, **kwargs)

        return wrapper

    return decorator


@customer_router.get("/list", response=List[CustomerOut], tags=["customer"])
@paginate
@ninja_permission_required('customers.view_customer')
def get_all_customers(request, filters: CustomerFilters = Query(...)):

I have implemented decorator like this, its works good enough. I wanted to use it more django way