Retrieve Testset

Mixin that provides automatic organization injection and cross-org write protection.

This mixin handles ALL organization-related write behavior:

• CREATE: Injects organization (user's org for JWT, target org for API key superadmin)
• UPDATE/DELETE: Allows same-org writes; cross-org JWT writes require the caller's scope-aware is_superadmin() (active staff write scope). API key superadmin can write anywhere.

This is DATA SANITIZATION, not permission. Permission classes handle authentication and authorization (can they write at all?). This mixin handles where they write to.

Inherits from:

• JWTAuthUtils: is_jwt_auth(), is_jwt_token_format()
• PermissionUtils: is_read_operation(), is_write_operation(), is_same_org()
• OrgScopeMixin: is_superadmin(), get_organization(), inject_*_organization()

Behavior: - post(): Calls inject_target_organization() for CREATE operations - patch()/put(): Calls inject_user_organization() for UPDATE operations - perform_update(): Allows cross-org UPDATE for JWT auth only with active staff write scope - perform_destroy(): Allows cross-org DELETE for JWT auth only with active staff write scope

Usage: class MyView(OrganizationInjectionMixin, JWTAndAPIKeyAuthenticationViewMixin, ListCreateAPIView): # All org injection and cross-org protection automatic! pass

Note: SuperAdminMixin inherits from this mixin, so views using SuperAdminMixin automatically get these safe defaults.