Corp/docs/guides/DJANGO_RULES_INTEGRATION.md

Object permissions with django-rules

EUSRR combines Django model permissions, DRF permission classes and django-rules object predicates. Authentication alone never implies access to a domain object.

Rule modules currently exist in employees, communications, documents, feed, requests, procurement and scheduling. Each domain owns its predicates; do not create a central list that duplicates their implementation.

Usage

if request.user.has_perm("communications.change_chat", chat):
    ...

DRF viewsets must also restrict list querysets. An object permission applied only after get_object() does not protect list/search endpoints.

When adding a rule:

1. implement small predicates in the domain's rules.py;
2. register a namespaced rule or permission;
3. use it from the API permission layer and service boundary;
4. cover owner, allowed member, unrelated user and superuser behavior;
5. test list visibility separately from detail mutation.

Frontend flags may hide unavailable actions but are not an authorization boundary. See backend/docs/guides/CHAT_ROLES.md for the communications role mapping.