dry-rest-permissions

What it is and what it does

dry-rest-permissions provides a framework for defining access control rules in Django REST Framework by attaching permission logic directly to your models rather than storing explicit permission grants in a separate table. Instead of requiring you to maintain a permissions table that must be updated whenever relationships change (e.g., when a user's admin status changes or ownership transfers), you write methods on your model that evaluate the current database state to determine whether a user can perform an action.

The package supports both global permissions (whether a user can perform an action on any object in a table) and object-level permissions (whether a user can perform an action on a specific row). It groups actions into read (list, retrieve) and write (create, update, destroy) categories, but also lets you define permissions for specific custom actions. You add the DRYPermissions class to your viewset, then define methods like `has_read_permission()` and `has_object_update_permission()` on your model to control access.

Use it for:

• Build multi-tenant SaaS apps where permissions depend on ownership, association membership, or role relationships that change frequently.
• Define row-level access control for complex data models without maintaining explicit permission tables.
• Grant different permissions for different actions on the same model (e.g., allow all users to create but only owners to update).
• Implement permission rules that depend on related object state (e.g., a user can edit a project if they are an admin of the owning organization).

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Defines rules-based permissions for Django REST Framework APIs by writing permission logic directly on models, supporting both global (table-level) and object-level (row-level) access control.

No. The package is abandoned (last release 2018-01-31, no commits since 2022-12-26) and supports only Django 1.8–2.0 and DRF 3.5–3.7, which are far out of support. Modern Django and DRF projects have no upgrade path. Install only if maintaining legacy code on those exact versions.

Install

dry-rest-permissions on PyPI

pip install dry-rest-permissions

uv add dry-rest-permissions

poetry add dry-rest-permissions

Installing dry-rest-permissions

Before you install

Low install friction with no runtime dependencies. However, the package is abandoned—last release was 2018-01-31 and the repository has not received commits since 2022-12-26. Use only if your Django and DRF versions are pinned to the supported range (Django 1.8–2.0, DRF 3.5–3.7).

License in practice

BSD license is permissive and imposes minimal restrictions on use or modification. You may use, modify, and distribute this package freely in commercial and private projects.

Quickstart

# Install
pip install dry-rest-permissions

# In settings.py
INSTALLED_APPS = (
    ...,
    'dry_rest_permissions',
)

# In your model
from dry_rest_permissions.generics import DRYPermissions

class ProjectViewSet(viewsets.ModelViewSet):
    permission_classes = (DRYPermissions,)
    queryset = Project.objects.all()

# Define permissions on the model
class Project(models.Model):
    @staticmethod
    def has_read_permission(request):
        return True
    
    def has_object_read_permission(self, request):
        return True

Requires Django 1.8–2.0 and Django REST Framework 3.5–3.7. Modern Django/DRF versions are not supported.

Verify before relying

• Compatibility with Django versions beyond 2.0 and DRF versions beyond 3.7—the package has not been tested or updated for modern versions.
• Whether the package works reliably with Python 3.7+ despite classifiers only listing up to 3.6.

Package facts

Evidence: dry_rest_permissions-0.1.10-py2.py3-none-any.whl

Tags

More WWW/HTTP packages