[feat] add superuser session authentication only

[areski]

I have some use cases where some APIs are only for some privileged root user and it quite helpful to have an helper to add this extra security.

Let me know

[areski]

There is still an error with codestyle: https://github.com/areski/django-ninja/actions/runs/1813501165

Related issue: typeddjango/django-stubs#402

• https://github.com/typeddjango/django-stubs#how-can-i-create-a-httprequest-thats-guaranteed-to-have-an-authenticated-user

Any hints how to fix this, I'm not super familiar with mypy?

[SmileyChris]

Well, mypy is correct -- AbstractBaseUser doesn't provide an is_superuser attribute. You're making the assumption that all user backends need to provide is_superuser (inferred from the base class, they don't).

I'd just do:

if request.user.is_authenticated and getattr(request.user, 'is_superuser', None):

[areski]

Thanks for the pointer @SmileyChris

All tests are now passing: https://github.com/areski/django-ninja/actions/runs/1847443859