fairdm.api.permissions#

FairDM API permission classes.

Module Contents#

Classes#

FairDMObjectPermissions

Object-level permission class for FairDM API endpoints.

API#

class FairDMObjectPermissions[source]#

Bases: rest_framework.permissions.DjangoObjectPermissions

Object-level permission class for FairDM API endpoints.

Extends DjangoObjectPermissions to:

  1. Add view permissions to perms_map (required for guardian integration).

  2. Return HTTP 404 (not 403) for objects the user cannot view — non-disclosure.

  3. Allow unauthenticated read access for public data.

  4. Require authentication for all write operations.

Integration:

  • :class:fairdm.api.filters.FairDMVisibilityFilter handles queryset-level list filtering so private objects never appear in list results.

  • The serializers of projects, datasets, samples and measurements list the creator at the manage level on create.

  • Calls user.has_perm() which routes through ModelBackend, guardian ObjectPermissionBackend, and any custom permission backends. For a project, dataset, sample or measurement the answer is the user’s contribution level (RecordLevelBackend).

perms_map#

None

authenticated_users_only#

False

has_permission(request: rest_framework.request.Request, view: rest_framework.views.APIView) → bool[source]#

Allow reads to anyone and writes to any signed-in user.

has_object_permission(request: rest_framework.request.Request, view: rest_framework.views.APIView, obj) → bool[source]#

Return 404 (not 403) when user lacks permission on an existing object.