TurboDRF
Django REST APIs with permissions declared on the model.
Add a mixin and a turbodrf() method to a Django model to get list, detail, create, update and delete endpoints. Permissions cover roles, rows scoped to a tenant, and which fields each role can read or write. Wealth MS and the bynoon CRM both use it for their APIs.
- Three permission layers on every request: roles, row scoping behind a mandatory tenant wall, and field-level read and write rules.
- Startup checks that refuse to boot on a misconfiguration, such as a model with no tenancy declared.
- Rows a caller can't see return 404, not 403, so their existence doesn't leak.
- A compiled read path, per-role OpenAPI docs, and custom endpoints that inherit the same scoping.
$ pip install turbodrf $ pip install "turbodrf[fast]" # msgspec JSON
class Project(models.Model, TurboDRFMixin):
title = models.CharField(max_length=200)
workspace = models.ForeignKey(Workspace, CASCADE)
owner = models.ForeignKey(User, CASCADE)
@classmethod
def turbodrf(cls):
return {
"fields": ["title", "workspace", "owner"],
"tenant_field": "workspace", # tenant wall
"owner_field": "owner", # own rows only
}