Scoping

OEP-66 record-visibility building blocks for DRF list endpoints: a ScopingPolicy structural interface (a typing.Protocol) and a ScopedQuerysetMixin that applies a configured policy in get_queryset().

class ScopedQuerysetMixin

Applies scoping_policy to a DRF view’s base queryset (OEP-66).

Mix into a GenericAPIView / ListAPIView (or GenericViewSet) and set scoping_policy to any object implementing the ScopingPolicy protocol. The mixin runs the policy on top of the view’s get_queryset() result so the list response contains only the rows within the requesting subject’s accessible scopes.

get_queryset() → QuerySet

Return the base queryset scoped to the rows the requesting subject may see.

scoping_policy: Optional[ScopingPolicy] = None

An object implementing the ScopingPolicy protocol.

class ScopingPolicy(*args, **kwargs)

Structural interface for an OEP-66 record-visibility policy.

Any object exposing a compatible scope method satisfies this protocol – implementers need not import or inherit from it. It documents the expected interface for static type checkers; ScopedQuerysetMixin verifies a configured policy with a lightweight duck-typed check at runtime.

A policy must not re-implement access rules; it delegates to the platform’s authorization engine to resolve the subject’s accessible scopes and translates that answer into a queryset filter. Keeping it separate from the view lets the same visibility rule be reused and unit-tested on its own.

scope(queryset: QuerySet, subject: Any) → QuerySet

Return queryset filtered to the rows visible to subject.