How to have a global authorization run before all the views without sacrificing the View level permission overrides?
So I wanted to enforce a check before all the APIs and wanted that approach scalable. There are some ways to do these but all have cons,
- Put the check/validation in decorator or mixin . Con - Requires that we put before all the views we need that check for.
- Add a global permission class. Con - View level permission overrides gets sacrificed, if we override then the global permission gets replaced.
Although the check/validation isn't needed in all the APIs but still large number of places we do need it and the validation function itself can filter out those Views that do not need it.
Have you considered using a custom global permission class that combines the global check with the view’s existingpermission_classes, rather than replacing them? That way the global authorization runs consistently, while individual views can still add/override their own permissions where needed. Seems like it could avoid repeating the check across decorators/mixins.
So after some research Approach 1 is the only one that reliably works, I did find some improvements to that, like instead of having decorator on individual views, we could create a custom router which would auto apply the decorator to all the view being registered by it, which solves our problem of code scalability as any new view which will be registered would have this auto applied.