Permissions

[fjsj]

We need a granular way to support permissioning, better than the current "callback" settings approach (like AI_ASSISTANT_CAN_CREATE_THREAD_FN).

Check how popular Django apps implement permission callbacks. Maybe they use something different than function paths at settings?

• https://docs.allauth.org/en/latest/index.html
• https://django-registration-redux.readthedocs.io/en/latest/index.html
• https://django-organizations.readthedocs.io/en/latest/index.html
• https://github.com/vintasoftware/django-templated-email

Perhaps a simpler approach for us is a single class to receive a user and check permissions for it on each method, a PermissionChecker class.

Edit: Check how Chainlit does it as well: https://docs.chainlit.io/authentication/overview

[joaopedroalbq]

Another suggestion: Django Ninja Extra. It is an extension for django ninja and it has permission classes. The required changes would be:

• Current views would become a controller class;
• Callback functions would be structured into permission classes;
• (Maybe) Would need to regenerate schema for TS client.

The permission classes can be applied to the controller (all endpoints) or for each endpoint.

[fjsj]

thanks @joaopedroalbq, that seems good too