Api Testsets Rows Retrieve 2

Mixin for views that need method-level permission enforcement.

Supports two approaches for defining permissions:

1. Auto-generation (Recommended - DRY): Set permission_resource to auto-generate CRUD permissions based on HTTP methods:

   class MyView(PermissionMapMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView): permission_resource = Resources.LOG # Auto-generates: # GET -> log:read # PATCH -> log:update # DELETE -> log:delete

   Override specific methods via permission_map (always use constants): class MyView(PermissionMapMixin, ...): permission_resource = Resources.LOG permission_map: PermissionMap = { "GET": None, # Override: no permission required for GET "POST": make_permission(Resources.LOG, CRUDActions.READ), # POST acts as read }

2. Explicit mapping (for non-CRUD or complex cases - always use constants): class MyView(PermissionMapMixin, JWTAndAPIKeyAuthenticationViewMixin, APIView): permission_map: PermissionMap = { "GET": make_permission(Features.PROXY, Actions.ACCESS), "POST": make_permission(Features.PLAYGROUND, Actions.ACCESS), }

3. Dynamic logic (most flexible): def get_required_permission(self, method: str) -> str | None: if self.kwargs.get('public'): return None return "dataset:read"

Notes:

• permission_map acts as an override when permission_resource is set
• If neither is defined, no permission check is performed (backward compatible)
• HasJWTPermission automatically enforces permissions when defined