Permission combinators

DRF supports boolean composition of permission classes through the &, |, and ~ operators with brackets for grouping. Operators follow Python's logical precedence (~ highest, then &, then |). Restflow ships async-native subclasses of DRF's combinator classes so combinator branches resolve through the async hook .

See the Permissions guide for short-circuit behaviour and worked examples.

AND

Bases: AND

Permission combinator produced by perm1 & perm2. Adds async ahas_permission and ahas_object_permission that short-circuit on the first denying operand.

ahas_permission async

ahas_permission(request, view)

Returns True only when both operands allow the request.

ahas_object_permission async

ahas_object_permission(request, view, obj)

Returns True only when both operands allow access to the object.

OR

Bases: OR

Permission combinator produced by perm1 | perm2. Adds async ahas_permission and ahas_object_permission that short-circuit on the first allowing operand.

ahas_permission async

ahas_permission(request, view)

Returns True when either operand allows the request.

ahas_object_permission async

ahas_object_permission(request, view, obj)

Returns True when either operand allows access to the object.

NOT

Bases: NOT

Permission combinator produced by ~perm. Adds async ahas_permission and ahas_object_permission that invert the wrapped permission's verdict.

ahas_permission async

ahas_permission(request, view)

Returns the negation of the wrapped operand's permission check.

ahas_object_permission async

ahas_object_permission(request, view, obj)

Returns the negation of the wrapped operand's object permission check.