From 17bc2ca959cdf4e512b66ccff2d72e9385bdb31e Mon Sep 17 00:00:00 2001 From: pradeeppc Date: Thu, 8 Oct 2026 23:25:06 +0530 Subject: [PATCH 1/2] Add django-permission-tracer to third-party permission packages Adds django-permission-tracer to the Permissions section of the third-party packages page. It resolves DRF permissions the way the framework does at request time, per HTTP method and viewset action, including `@action(permission_classes=...)`, `get_permissions()` overrides and composed permissions (`&`, `|`, `~`). It provides a dashboard, a Markdown/CSV permission matrix, request tracing of which permission denied a request, and a management command that fails CI when an endpoint is reachable anonymously. - PyPI: https://pypi.org/project/django-permission-tracer/ - Tested on Python 3.9 to 3.13, Django 4.2 to 6.1, DRF 3.14 to 3.18 - MIT licensed I'm the author of the package. --- docs/community/third-party-packages.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/community/third-party-packages.md b/docs/community/third-party-packages.md index 2152c4d38b..fc1462ceaa 100644 --- a/docs/community/third-party-packages.md +++ b/docs/community/third-party-packages.md @@ -73,7 +73,8 @@ To submit new content, [create a pull request][drf-create-pr]. * [dry-rest-permissions][dry-rest-permissions] - Provides a simple way to define permissions for individual api actions. * [drf-access-policy][drf-access-policy] - Declarative and flexible permissions inspired by AWS' IAM policies. * [drf-psq][drf-psq] - An extension that gives support for having action-based **permission_classes**, **serializer_class**, and **queryset** dependent on permission-based rules. -* [axioms-drf-py][axioms-drf-py] - Supports authentication and claim-based fine-grained authorization (**scopes**, **roles**, **groups**, **permissions**, etc. including object-level checks) using JWT tokens issued by an OAuth2/OIDC Authorization Server. +* [axioms-drf-py][axioms-drf-py] - Supports authentication and claim-based fine-grained authorization (**scopes**, **roles**, **groups**, **permissions**, etc. including object-level checks) using JWT tokens issued by an OAuth2/OIDC Authorization Server. +* [django-permission-tracer] - Shows which permissions protect each endpoint and HTTP method, traces which permission denied a request, and flags endpoints open to anonymous users. Analyze and visualize permissions across your entire DRF project ### Serializers From ae97906009d807a785d67c118cfe5549ea73b889 Mon Sep 17 00:00:00 2001 From: pradeeppc Date: Thu, 8 Oct 2026 23:31:14 +0530 Subject: [PATCH 2/2] Update third-party-packages.md --- docs/community/third-party-packages.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/community/third-party-packages.md b/docs/community/third-party-packages.md index fc1462ceaa..aa3767cf48 100644 --- a/docs/community/third-party-packages.md +++ b/docs/community/third-party-packages.md @@ -74,7 +74,7 @@ To submit new content, [create a pull request][drf-create-pr]. * [drf-access-policy][drf-access-policy] - Declarative and flexible permissions inspired by AWS' IAM policies. * [drf-psq][drf-psq] - An extension that gives support for having action-based **permission_classes**, **serializer_class**, and **queryset** dependent on permission-based rules. * [axioms-drf-py][axioms-drf-py] - Supports authentication and claim-based fine-grained authorization (**scopes**, **roles**, **groups**, **permissions**, etc. including object-level checks) using JWT tokens issued by an OAuth2/OIDC Authorization Server. -* [django-permission-tracer] - Shows which permissions protect each endpoint and HTTP method, traces which permission denied a request, and flags endpoints open to anonymous users. Analyze and visualize permissions across your entire DRF project +* [django-permission-tracer][django-permission-tracer] - Analyzes and visualizes permissions across a DRF project: which permissions protect each endpoint and HTTP method, which permission denied a request, and which endpoints are open to anonymous users. ### Serializers @@ -277,5 +277,6 @@ To submit new content, [create a pull request][drf-create-pr]. [drf-shapeless-serializers]: https://github.com/khaledsukkar2/drf-shapeless-serializers [django-lisan]: https://github.com/Nabute/django-lisan [axioms-drf-py]: https://github.com/abhishektiwari/axioms-drf-py +[django-permission-tracer]: https://github.com/pradeeppc/django-permission-tracer [django-pydantic-field]: https://github.com/surenkov/django-pydantic-field [drf-pydantic]: https://github.com/georgebv/drf-pydantic