search

AACEngineering / django-permissions-auditor

Tool to audit access control on your django app.
https://django-permissions-auditor.readthedocs.io/en/latest/
MIT License
20 stars 4 forks source link

DRF metadata processor #3

Open jayvdb opened 4 years ago

jayvdb commented 4 years ago

It seems there isnt any DRF support yet.

There are lots of aspects to the DRF permissions system.

One re-usable method in DRF which can be used to determine broadly which actions are allowed is via the metadata https://github.com/encode/django-rest-framework/blob/335054a/rest_framework/metadata.py#L73

More info at https://github.com/encode/django-rest-framework/blob/master/docs/api-guide/metadata.md

kluchrj commented 4 years ago

DRF support would indeed be nice to have, though I do not have time to build out such a feature currently. I'd be willing to look over any PRs that add this.

It seems easy enough to read the permission_classes attribute on views and pull out the class -- one tricky bit being figuring out how to parse bitwise operations.