django-cross-tenancy 0.1.0a1__tar.gz

django_cross_tenancy-0.1.0a1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Miroslav Zvolský
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_cross_tenancy-0.1.0a1/PKG-INFO

@@ -0,0 +1,208 @@
+Metadata-Version: 2.4
+Name: django-cross-tenancy
+Version: 0.1.0a1
+Summary: Shared-database multi-tenancy for Django with controlled cross-tenant access
+Keywords: django,multi-tenancy,tenant,saas,row-level,permissions
+Author: Miroslav Zvolský
+Author-email: Miroslav Zvolský <zvolsky@seznam.cz>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Libraries
+Requires-Dist: django>=5.2
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+
+# django-cross-tenancy
+
+Shared-database multi-tenancy for Django with **controlled cross-tenant access**.
+
+Schema-per-tenant libraries (such as django-tenants) isolate tenants completely. Some applications need tenants
+that are mostly separate but sometimes reach into each other: a relative helps manage another household, a borrowed
+item is visible to the borrower, a consultant reads one client's data. django-cross-tenancy keeps all tenants in one
+database and decides access per record with plain querysets that you can extend.
+
+> Status: alpha (0.1.0a1). The API may change before 1.0.
+
+## Concepts
+
+- **Tenant**: your concrete model (household, company, team …) subclassing `AbstractTenant`.
+- **Membership** (`AbstractMembership`): a user belongs to a tenant with a role: `guest` (view), `member`
+  (view and change), `admin` (also manages the tenant and its members).
+- **Grant** (`AbstractTenantGrant`, optional): a user outside the tenant may view, or view and change, all its
+  records without being a member.
+- **Tenant-owned record** (`TenantModel`): has a `tenant` foreign key and `created_by`. A new record without
+  a tenant gets the current user's active tenant; a tenant set explicitly is kept.
+- **Access** is a method of the queryset, called with the user explicitly: `user_accessible(user)` (view),
+  `user_editable(user)` (change). Override `access_q(user, level)` to widen the reach of a model.
+
+The default manager is never filtered implicitly: admin, forms, migrations, `dumpdata` and background tasks keep
+working, and every filtered read names its user.
+
+## Installation
+
+```console
+pip install django-cross-tenancy
+```
+
+```python
+INSTALLED_APPS = [..., 'django_cross_tenancy', ...]
+MIDDLEWARE = [..., 'django.contrib.auth.middleware.AuthenticationMiddleware',
+              'django_cross_tenancy.middleware.CurrentTenantMiddleware', ...]
+CROSS_TENANCY_TENANT_MODEL = 'core.Household'
+CROSS_TENANCY_USER_TENANT_FIELD = 'current_tenant'  # the default: user attribute with the active tenant
+```
+
+```python
+from django_cross_tenancy.models import AbstractMembership, AbstractTenant, AbstractTenantGrant
+
+
+class Household(AbstractTenant):
+    pass
+
+
+class Membership(AbstractMembership):  # reverse name on the tenant: memberships
+    pass
+
+
+class HouseholdGrant(AbstractTenantGrant):  # reverse name on the tenant: grants
+    pass
+
+
+class User(AbstractUser):
+    current_tenant = models.ForeignKey(Household, models.SET_NULL, null=True, blank=True, related_name='+')
+```
+
+## Tenant-owned models and overlaps
+
+```python
+from django_cross_tenancy.models import VIEW, TenantModel, TenantQuerySet, TenantUniqueConstraint, tenants_for
+
+
+class ToolQuerySet(TenantQuerySet):
+    def access_q(self, user, level):
+        q = super().access_q(user, level)
+        if level == VIEW:  # a lent tool is visible (read only) to the borrowing household
+            lent = Loan.objects.filter(borrower__in=tenants_for(user, VIEW), returned=False)
+            q |= Q(pk__in=lent.values('tool'))
+        return q
+
+
+class Tool(TenantModel):
+    name = models.CharField(max_length=100)
+
+    objects = ToolQuerySet.as_manager()
+
+    class Meta:
+        constraints = [TenantUniqueConstraint(fields=['name'], name='tool_unique_name')]  # per tenant
+
+
+class Loan(TenantModel):  # tenant = the lender
+    tool = models.ForeignKey(Tool, models.CASCADE)
+    borrower = models.ForeignKey(Household, models.CASCADE, related_name='+')
+    returned = models.BooleanField(default=False)
+```
+
+```python
+Tool.objects.user_accessible(request.user)   # own, granted and borrowed tools
+Tool.objects.user_editable(request.user)     # own and granted with change
+```
+
+Prefer `pk__in` subqueries in `access_q` over joins: the result then needs no `distinct()`.
+
+Outside a request (tasks, commands, shell) set the tenant for new records explicitly:
+
+```python
+from django_cross_tenancy.context import use_tenant
+
+with use_tenant(household, user):
+    Tool.objects.create(name='drill')
+```
+
+`bulk_create` bypasses `save()`: set `tenant` yourself.
+
+## Global and private records in one table
+
+A code list can hold global records shared by everyone and private records each tenant adds:
+
+```python
+class MeterType(TenantModel):
+    global_and_private = True  # tenant becomes nullable: null = global record
+
+    name = models.CharField(max_length=100)
+
+    class Meta:
+        constraints = [TenantUniqueConstraint(fields=['name'], name='metertype_unique_name')]
+```
+
+- `user_accessible(user)` returns the tenant's records **and** the global ones (`tenant IS NULL`); only models with
+  `global_and_private = True` pay for the extra condition.
+- Only superusers change or delete global records.
+- New records: ordinary users always create in their active tenant; a superuser chooses in the admin form between
+  the active tenant and an empty value (global). In code, `use_tenant(None)` (or a superuser's request) keeps
+  a record without a tenant global; ordinary `TenantModel`s still refuse to be saved without a tenant.
+
+## Unique values: `TenantUniqueConstraint`
+
+`TenantUniqueConstraint(fields=[...], name=...)` keeps values unique among the records a user sees together:
+
+- within one tenant: no tenant has "Gas meter" twice,
+- with `global_and_private`, also between a tenant's records and the global ones: a private record may not repeat
+  a global one, a global record may not repeat another global one or any private one,
+- two tenants may each have a record with the same values ("Workshop gas meter" in both).
+
+Don't list `tenant` in `fields`; the constraint adds it. On PostgreSQL the database enforces it as an exclusion
+constraint (the tenant as an integer range, null = unbounded, so a global record overlaps every tenant), which
+needs the `btree_gist` extension created first:
+
+```python
+from django.contrib.postgres.operations import BtreeGistExtension
+
+class Migration(migrations.Migration):
+    operations = [BtreeGistExtension(), ...]  # before the migration that adds the constraint
+```
+
+Validation (admin forms, `full_clean`) checks the same rule with clear messages, also when the form leaves `tenant`
+out (the admin mixin sets the tenant before validation). Other databases get no constraint in the schema and rely on
+validation only. Like `unique`, null values never clash.
+
+## Admin
+
+```python
+from django_cross_tenancy.admin import ManagedTenantAdminMixin, TenantAdminMixin, TenantManagerInlineMixin
+
+
+@admin.register(Tool)
+class ToolAdmin(TenantAdminMixin, admin.ModelAdmin):
+    ...
+```
+
+- `TenantAdminMixin`: list and object permissions follow `user_accessible` / `user_editable`; new records go to the
+  user's active tenant (inline rows to their parent's tenant); relation choices are narrowed to records the user may
+  see.
+  For `global_and_private` models, superusers get the tenant field with two choices (the record's or the active
+  tenant, or empty = global); other users see it read only.
+- `ManagedTenantAdminMixin`: for the tenant model; users see their tenants, only administrators change them, the
+  creator of a tenant becomes its administrator.
+- `TenantManagerInlineMixin`: memberships and grants inlines, editable by the tenant's administrators only.
+
+The mixins only narrow what the admin allows: model permissions still apply.
+
+## Development
+
+```console
+uv run --package django-cross-tenancy pytest
+CROSS_TENANCY_TEST_POSTGRES=cross_tenancy uv run --package django-cross-tenancy pytest  # PostgreSQL (PGHOST, PGUSER …)
+```
+
+## License
+
+MIT

django_cross_tenancy-0.1.0a1/README.md

@@ -0,0 +1,185 @@
+# django-cross-tenancy
+
+Shared-database multi-tenancy for Django with **controlled cross-tenant access**.
+
+Schema-per-tenant libraries (such as django-tenants) isolate tenants completely. Some applications need tenants
+that are mostly separate but sometimes reach into each other: a relative helps manage another household, a borrowed
+item is visible to the borrower, a consultant reads one client's data. django-cross-tenancy keeps all tenants in one
+database and decides access per record with plain querysets that you can extend.
+
+> Status: alpha (0.1.0a1). The API may change before 1.0.
+
+## Concepts
+
+- **Tenant**: your concrete model (household, company, team …) subclassing `AbstractTenant`.
+- **Membership** (`AbstractMembership`): a user belongs to a tenant with a role: `guest` (view), `member`
+  (view and change), `admin` (also manages the tenant and its members).
+- **Grant** (`AbstractTenantGrant`, optional): a user outside the tenant may view, or view and change, all its
+  records without being a member.
+- **Tenant-owned record** (`TenantModel`): has a `tenant` foreign key and `created_by`. A new record without
+  a tenant gets the current user's active tenant; a tenant set explicitly is kept.
+- **Access** is a method of the queryset, called with the user explicitly: `user_accessible(user)` (view),
+  `user_editable(user)` (change). Override `access_q(user, level)` to widen the reach of a model.
+
+The default manager is never filtered implicitly: admin, forms, migrations, `dumpdata` and background tasks keep
+working, and every filtered read names its user.
+
+## Installation
+
+```console
+pip install django-cross-tenancy
+```
+
+```python
+INSTALLED_APPS = [..., 'django_cross_tenancy', ...]
+MIDDLEWARE = [..., 'django.contrib.auth.middleware.AuthenticationMiddleware',
+              'django_cross_tenancy.middleware.CurrentTenantMiddleware', ...]
+CROSS_TENANCY_TENANT_MODEL = 'core.Household'
+CROSS_TENANCY_USER_TENANT_FIELD = 'current_tenant'  # the default: user attribute with the active tenant
+```
+
+```python
+from django_cross_tenancy.models import AbstractMembership, AbstractTenant, AbstractTenantGrant
+
+
+class Household(AbstractTenant):
+    pass
+
+
+class Membership(AbstractMembership):  # reverse name on the tenant: memberships
+    pass
+
+
+class HouseholdGrant(AbstractTenantGrant):  # reverse name on the tenant: grants
+    pass
+
+
+class User(AbstractUser):
+    current_tenant = models.ForeignKey(Household, models.SET_NULL, null=True, blank=True, related_name='+')
+```
+
+## Tenant-owned models and overlaps
+
+```python
+from django_cross_tenancy.models import VIEW, TenantModel, TenantQuerySet, TenantUniqueConstraint, tenants_for
+
+
+class ToolQuerySet(TenantQuerySet):
+    def access_q(self, user, level):
+        q = super().access_q(user, level)
+        if level == VIEW:  # a lent tool is visible (read only) to the borrowing household
+            lent = Loan.objects.filter(borrower__in=tenants_for(user, VIEW), returned=False)
+            q |= Q(pk__in=lent.values('tool'))
+        return q
+
+
+class Tool(TenantModel):
+    name = models.CharField(max_length=100)
+
+    objects = ToolQuerySet.as_manager()
+
+    class Meta:
+        constraints = [TenantUniqueConstraint(fields=['name'], name='tool_unique_name')]  # per tenant
+
+
+class Loan(TenantModel):  # tenant = the lender
+    tool = models.ForeignKey(Tool, models.CASCADE)
+    borrower = models.ForeignKey(Household, models.CASCADE, related_name='+')
+    returned = models.BooleanField(default=False)
+```
+
+```python
+Tool.objects.user_accessible(request.user)   # own, granted and borrowed tools
+Tool.objects.user_editable(request.user)     # own and granted with change
+```
+
+Prefer `pk__in` subqueries in `access_q` over joins: the result then needs no `distinct()`.
+
+Outside a request (tasks, commands, shell) set the tenant for new records explicitly:
+
+```python
+from django_cross_tenancy.context import use_tenant
+
+with use_tenant(household, user):
+    Tool.objects.create(name='drill')
+```
+
+`bulk_create` bypasses `save()`: set `tenant` yourself.
+
+## Global and private records in one table
+
+A code list can hold global records shared by everyone and private records each tenant adds:
+
+```python
+class MeterType(TenantModel):
+    global_and_private = True  # tenant becomes nullable: null = global record
+
+    name = models.CharField(max_length=100)
+
+    class Meta:
+        constraints = [TenantUniqueConstraint(fields=['name'], name='metertype_unique_name')]
+```
+
+- `user_accessible(user)` returns the tenant's records **and** the global ones (`tenant IS NULL`); only models with
+  `global_and_private = True` pay for the extra condition.
+- Only superusers change or delete global records.
+- New records: ordinary users always create in their active tenant; a superuser chooses in the admin form between
+  the active tenant and an empty value (global). In code, `use_tenant(None)` (or a superuser's request) keeps
+  a record without a tenant global; ordinary `TenantModel`s still refuse to be saved without a tenant.
+
+## Unique values: `TenantUniqueConstraint`
+
+`TenantUniqueConstraint(fields=[...], name=...)` keeps values unique among the records a user sees together:
+
+- within one tenant: no tenant has "Gas meter" twice,
+- with `global_and_private`, also between a tenant's records and the global ones: a private record may not repeat
+  a global one, a global record may not repeat another global one or any private one,
+- two tenants may each have a record with the same values ("Workshop gas meter" in both).
+
+Don't list `tenant` in `fields`; the constraint adds it. On PostgreSQL the database enforces it as an exclusion
+constraint (the tenant as an integer range, null = unbounded, so a global record overlaps every tenant), which
+needs the `btree_gist` extension created first:
+
+```python
+from django.contrib.postgres.operations import BtreeGistExtension
+
+class Migration(migrations.Migration):
+    operations = [BtreeGistExtension(), ...]  # before the migration that adds the constraint
+```
+
+Validation (admin forms, `full_clean`) checks the same rule with clear messages, also when the form leaves `tenant`
+out (the admin mixin sets the tenant before validation). Other databases get no constraint in the schema and rely on
+validation only. Like `unique`, null values never clash.
+
+## Admin
+
+```python
+from django_cross_tenancy.admin import ManagedTenantAdminMixin, TenantAdminMixin, TenantManagerInlineMixin
+
+
+@admin.register(Tool)
+class ToolAdmin(TenantAdminMixin, admin.ModelAdmin):
+    ...
+```
+
+- `TenantAdminMixin`: list and object permissions follow `user_accessible` / `user_editable`; new records go to the
+  user's active tenant (inline rows to their parent's tenant); relation choices are narrowed to records the user may
+  see.
+  For `global_and_private` models, superusers get the tenant field with two choices (the record's or the active
+  tenant, or empty = global); other users see it read only.
+- `ManagedTenantAdminMixin`: for the tenant model; users see their tenants, only administrators change them, the
+  creator of a tenant becomes its administrator.
+- `TenantManagerInlineMixin`: memberships and grants inlines, editable by the tenant's administrators only.
+
+The mixins only narrow what the admin allows: model permissions still apply.
+
+## Development
+
+```console
+uv run --package django-cross-tenancy pytest
+CROSS_TENANCY_TEST_POSTGRES=cross_tenancy uv run --package django-cross-tenancy pytest  # PostgreSQL (PGHOST, PGUSER …)
+```
+
+## License
+
+MIT

django_cross_tenancy-0.1.0a1/pyproject.toml

@@ -0,0 +1,49 @@
+[project]
+name = "django-cross-tenancy"
+version = "0.1.0a1"
+description = "Shared-database multi-tenancy for Django with controlled cross-tenant access"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.12"
+dependencies = ["django>=5.2"]
+keywords = [
+    "django",
+    "multi-tenancy",
+    "tenant",
+    "saas",
+    "row-level",
+    "permissions",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Framework :: Django",
+    "Framework :: Django :: 5.2",
+    "Framework :: Django :: 6.0",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries",
+]
+
+[[project.authors]]
+name = "Miroslav Zvolský"
+email = "zvolsky@seznam.cz"
+
+[dependency-groups]
+dev = [
+    "psycopg>=3.2",
+    "pytest>=8",
+    "pytest-django>=4.9",
+]
+
+[build-system]
+requires = ["uv_build>=0.12.13,<0.13.0"]
+build-backend = "uv_build"
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "tests.settings"
+pythonpath = ["."]
+testpaths = ["tests"]

django_cross_tenancy-0.1.0a1/pyproject.toml.orig

@@ -0,0 +1,43 @@
+[project]
+name = "django-cross-tenancy"
+version = "0.1.0a1"
+description = "Shared-database multi-tenancy for Django with controlled cross-tenant access"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [
+    { name = "Miroslav Zvolský", email = "zvolsky@seznam.cz" }
+]
+requires-python = ">=3.12"
+dependencies = [
+    "django>=5.2",
+]
+keywords = ["django", "multi-tenancy", "tenant", "saas", "row-level", "permissions"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Framework :: Django",
+    "Framework :: Django :: 5.2",
+    "Framework :: Django :: 6.0",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Libraries",
+]
+
+[dependency-groups]
+dev = [
+    "psycopg>=3.2",
+    "pytest>=8",
+    "pytest-django>=4.9",
+]
+
+[build-system]
+requires = ["uv_build>=0.12.13,<0.13.0"]
+build-backend = "uv_build"
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "tests.settings"
+pythonpath = ["."]
+testpaths = ["tests"]

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/__init__.py

@@ -0,0 +1 @@
+"""Shared-database multi-tenancy for Django with controlled cross-tenant access."""

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/admin.py

@@ -0,0 +1,165 @@
+"""
+Admin mixins (put them before ``admin.ModelAdmin`` / the inline class). They only narrow what the base class allows:
+model permissions still apply.
+
+- ``TenantAdminMixin``: tenant-owned records (``TenantModel``); also for inlines of such records. With
+  ``global_and_private`` models a superuser chooses between the active tenant and a global record (no tenant);
+  other users see the tenant read only.
+- ``ManagedTenantAdminMixin``: the tenant model itself (users see their tenants, administrators change them)
+- ``TenantManagerInlineMixin``: inlines of the tenant (memberships, grants) editable only by its administrators
+"""
+
+from django.core.exceptions import PermissionDenied
+
+from .conf import get_tenant_model, user_current_tenant
+from .context import use_request
+from .models import MANAGE, VIEW, CHANGE, Role, TenantModel, has_tenant_access, tenants_for
+
+
+def _narrow_choices(formfield, request):
+    """Choices of a relation only among records the user may see (else a foreign id could be submitted)"""
+    queryset = getattr(formfield, 'queryset', None)
+    if queryset is not None and hasattr(queryset, 'user_accessible'):
+        formfield.queryset = queryset.user_accessible(request.user)
+    return formfield
+
+
+class _ChoicesMixin:
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        return _narrow_choices(super().formfield_for_foreignkey(db_field, request, **kwargs), request)
+
+    def formfield_for_manytomany(self, db_field, request, **kwargs):
+        return _narrow_choices(super().formfield_for_manytomany(db_field, request, **kwargs), request)
+
+
+class TenantAdminMixin(_ChoicesMixin):
+    def get_queryset(self, request):
+        return super().get_queryset(request).user_accessible(request.user)
+
+    def _reaches(self, request, obj, method):
+        return getattr(self.model._default_manager.all(), method)(request.user).filter(pk=obj.pk).exists()
+
+    def has_view_permission(self, request, obj=None):
+        return super().has_view_permission(request, obj) and (
+            obj is None or self._reaches(request, obj, 'user_accessible'))
+
+    def has_change_permission(self, request, obj=None):
+        return super().has_change_permission(request, obj) and (
+            obj is None or self._reaches(request, obj, 'user_editable'))
+
+    def has_delete_permission(self, request, obj=None):
+        return super().has_delete_permission(request, obj) and (
+            obj is None or self._reaches(request, obj, 'user_editable'))
+
+    def has_add_permission(self, request, *args):
+        if not super().has_add_permission(request, *args):
+            return False
+        parent = args[0] if args else None  # inlines get the parent record: new rows join its tenant
+        if parent is not None and hasattr(type(parent)._default_manager.all(), 'user_editable'):
+            return type(parent)._default_manager.all().user_editable(request.user).filter(pk=parent.pk).exists()
+        return self.add_tenant(request) is not None or self._chooses_global(request)
+
+    def add_tenant(self, request):
+        """Tenant for a new record: the user's active tenant, if they may change its records"""
+        tenant = user_current_tenant(request.user)
+        return tenant if has_tenant_access(request.user, tenant, CHANGE) else None
+
+    def _chooses_global(self, request):
+        return getattr(self.model, 'global_and_private', False) and request.user.is_superuser
+
+    def get_readonly_fields(self, request, obj=None):
+        readonly = super().get_readonly_fields(request, obj)
+        if getattr(self.model, 'global_and_private', False) and not request.user.is_superuser:
+            return (*readonly, 'tenant')
+        return readonly
+
+    def get_form(self, request, obj=None, change=False, **kwargs):
+        form = super().get_form(request, obj, change, **kwargs)
+        field = form.base_fields.get('tenant')
+        if field is not None and self._chooses_global(request):
+            # two states: the record's own tenant (new record: the active one), or empty = global
+            tenant_id = obj.tenant_id if obj is not None and obj.tenant_id else getattr(
+                user_current_tenant(request.user), 'pk', None)
+            field.queryset = get_tenant_model()._default_manager.filter(pk=tenant_id)
+            field.required = False
+        if obj is None and issubclass(self.model, TenantModel):
+            # the tenant before validation, so unique constraints with tenant check the right records
+            # (get_form builds a new class on every call: patching it touches no other form)
+            post_clean = form._post_clean
+
+            def _post_clean(form_self):
+                self.assign_tenant(request, form_self.instance)
+                post_clean(form_self)
+
+            form._post_clean = _post_clean
+        return form
+
+    def assign_tenant(self, request, obj):
+        """
+        Tenant of a new record: other users always create in their active tenant; a superuser's choice is kept
+        (empty = global). False when there is no tenant to use.
+        """
+        if not request.user.is_superuser or (obj.tenant_id is None and not obj.global_and_private):
+            tenant = self.add_tenant(request)
+            if tenant is None:
+                return False
+            obj.tenant = tenant
+        return True
+
+    def save_model(self, request, obj, form, change):
+        if not change and isinstance(obj, TenantModel):
+            if not self.assign_tenant(request, obj):
+                raise PermissionDenied
+            if obj.created_by_id is None:
+                obj.created_by = request.user
+        with use_request(request):  # TenantModel.save sees this user even without CurrentTenantMiddleware
+            super().save_model(request, obj, form, change)
+
+    def save_formset(self, request, form, formset, change):
+        # nested records belong to the parent's tenant, not to the user's active one
+        parent_tenant_id = getattr(form.instance, 'tenant_id', None)
+        for inline_form in formset.forms:
+            instance = inline_form.instance
+            if isinstance(instance, TenantModel) and instance._state.adding:
+                if instance.tenant_id is None and parent_tenant_id is not None:
+                    instance.tenant_id = parent_tenant_id
+                if instance.created_by_id is None:
+                    instance.created_by = request.user
+        super().save_formset(request, form, formset, change)
+
+
+class ManagedTenantAdminMixin(_ChoicesMixin):
+    def get_queryset(self, request):
+        queryset = super().get_queryset(request)
+        if request.user.is_superuser:
+            return queryset
+        return queryset.filter(pk__in=tenants_for(request.user, VIEW))
+
+    def has_change_permission(self, request, obj=None):
+        return super().has_change_permission(request, obj) and (
+            obj is None or has_tenant_access(request.user, obj, MANAGE))
+
+    def has_delete_permission(self, request, obj=None):
+        return super().has_delete_permission(request, obj) and (
+            obj is None or has_tenant_access(request.user, obj, MANAGE))
+
+    def save_model(self, request, obj, form, change):
+        super().save_model(request, obj, form, change)
+        if not change:  # whoever creates a tenant administers it
+            obj.memberships.get_or_create(user=request.user, defaults={'role': Role.ADMIN})
+
+
+class TenantManagerInlineMixin:
+    """For inlines whose parent is the tenant (memberships, grants)"""
+
+    def _manages(self, request, obj):
+        return obj is None or has_tenant_access(request.user, obj, MANAGE)
+
+    def has_add_permission(self, request, obj=None):
+        return super().has_add_permission(request, obj) and self._manages(request, obj)
+
+    def has_change_permission(self, request, obj=None):
+        return super().has_change_permission(request, obj) and self._manages(request, obj)
+
+    def has_delete_permission(self, request, obj=None):
+        return super().has_delete_permission(request, obj) and self._manages(request, obj)

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/apps.py

@@ -0,0 +1,7 @@
+from django.apps import AppConfig
+from django.utils.translation import gettext_lazy as _
+
+
+class CrossTenancyConfig(AppConfig):
+    name = 'django_cross_tenancy'
+    verbose_name = _('Cross tenancy')

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/conf.py

@@ -0,0 +1,30 @@
+"""
+Settings:
+
+- ``CROSS_TENANCY_TENANT_MODEL`` (required): ``'app_label.ModelName'`` of the project's concrete tenant model
+  (a subclass of ``AbstractTenant``), like ``AUTH_USER_MODEL``.
+- ``CROSS_TENANCY_USER_TENANT_FIELD`` (default ``'current_tenant'``): attribute of the user holding the tenant that
+  new records are created in (the user's active tenant).
+"""
+
+from django.apps import apps
+from django.conf import settings
+from django.core.exceptions import ImproperlyConfigured
+
+
+def tenant_model_label():
+    try:
+        return settings.CROSS_TENANCY_TENANT_MODEL
+    except AttributeError:
+        raise ImproperlyConfigured('Set CROSS_TENANCY_TENANT_MODEL to the tenant model (app_label.ModelName)') from None
+
+
+def get_tenant_model():
+    return apps.get_model(tenant_model_label(), require_ready=False)
+
+
+def user_current_tenant(user):
+    """The user's active tenant (None for anonymous users or when not set)"""
+    if user is None or not user.is_authenticated:
+        return None
+    return getattr(user, getattr(settings, 'CROSS_TENANCY_USER_TENANT_FIELD', 'current_tenant'), None)

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/context.py

@@ -0,0 +1,60 @@
+"""
+The current user and tenant of the running code (request, task, shell). Used only to fill in defaults when records
+are created (``TenantModel.save``), never to filter reads: reading always names the user explicitly
+(``user_accessible(user)``).
+"""
+
+from contextlib import contextmanager
+from contextvars import ContextVar
+
+from .conf import user_current_tenant
+
+_state = ContextVar('django_cross_tenancy_state', default=None)
+
+
+class _Explicit:
+    def __init__(self, tenant, user):
+        self.tenant = tenant
+        self.user = user
+
+
+@contextmanager
+def use_tenant(tenant, user=None):
+    """Create records in ``tenant`` (and as ``user``) inside the block: tasks, commands, shell, tests"""
+    token = _state.set(_Explicit(tenant, user))
+    try:
+        yield
+    finally:
+        _state.reset(token)
+
+
+@contextmanager
+def use_request(request):
+    """The request's user and their active tenant, read lazily (DRF authenticates only inside the view)"""
+    token = _state.set(request)
+    try:
+        yield
+    finally:
+        _state.reset(token)
+
+
+def current_user():
+    state = _state.get()
+    user = getattr(state, 'user', None)
+    return user if user is not None and user.is_authenticated else None
+
+
+def current_tenant():
+    state = _state.get()
+    if isinstance(state, _Explicit):
+        return state.tenant
+    return user_current_tenant(current_user())
+
+
+def global_allowed():
+    """May a new record of a global_and_private model stay global? Inside use_tenant(None), or for a superuser"""
+    state = _state.get()
+    if isinstance(state, _Explicit):
+        return state.tenant is None
+    user = current_user()
+    return user is not None and user.is_superuser

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/locale/cs/LC_MESSAGES/django.po

@@ -0,0 +1,74 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: django-cross-tenancy\n"
+"Language: cs\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=4; plural=(n == 1 && n % 1 == 0) ? 0 : (n >= 2 && n <= 4 && n % 1 == 0) ? 1: (n % 1 != 0 ) ? 2 : 3;\n"
+
+msgid "Cross tenancy"
+msgstr "Sdílení mezi tenanty"
+
+msgid "administrator"
+msgstr "správce"
+
+msgid "member"
+msgstr "člen"
+
+msgid "guest"
+msgstr "host"
+
+msgid "view"
+msgstr "čtení"
+
+msgid "view and change"
+msgstr "čtení a úpravy"
+
+msgid "name"
+msgstr "název"
+
+msgid "created"
+msgstr "vytvořeno"
+
+msgid "tenant"
+msgstr "tenant"
+
+msgid "tenants"
+msgstr "tenanti"
+
+msgid "membership"
+msgstr "členství"
+
+msgid "memberships"
+msgstr "členství"
+
+msgid "user"
+msgstr "uživatel"
+
+msgid "role"
+msgstr "role"
+
+msgid "tenant access"
+msgstr "přístup"
+
+msgid "tenant accesses"
+msgstr "přístupy"
+
+msgid "access"
+msgstr "přístup"
+
+msgid "created by"
+msgstr "autor"
+
+#, python-format
+msgid "The record cannot be saved: %(tenant)s is missing."
+msgstr "Záznam nelze uložit, chybí %(tenant)s."
+
+#, python-format
+msgid "%(model_name)s with this %(field_labels)s already exists as a shared record."
+msgstr "%(model_name)s s touto hodnotou pole %(field_labels)s už existuje jako společný záznam."
+
+#, python-format
+msgid "%(model_name)s with this %(field_labels)s already exists as a private record (%(tenants)s)."
+msgstr "%(model_name)s s touto hodnotou pole %(field_labels)s už existuje jako soukromý záznam (%(tenants)s)."

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/middleware.py

@@ -0,0 +1,12 @@
+from .context import use_request
+
+
+class CurrentTenantMiddleware:
+    """The request's user and active tenant become the defaults for new records (after AuthenticationMiddleware)"""
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        with use_request(request):
+            return self.get_response(request)

django_cross_tenancy-0.1.0a1/src/django_cross_tenancy/models.py

@@ -0,0 +1,304 @@
+"""
+Tenants share one database. Every tenant-owned record has a ``tenant`` foreign key; a user reaches a tenant's records
+through a membership (role) or a grant (access to a whole tenant without being its member). A model can widen the
+reach by overriding ``TenantQuerySet.access_q`` (e.g. a lent item is visible to the borrower).
+
+Access levels: ``VIEW`` (read), ``CHANGE`` (read and write), ``MANAGE`` (administer the tenant and its members).
+"""
+
+from django.conf import settings
+from django.core.exceptions import NON_FIELD_ERRORS, FieldDoesNotExist, ValidationError
+from django.db import DEFAULT_DB_ALIAS, models
+from django.db.models import Q
+from django.db.models.signals import class_prepared
+from django.utils.functional import lazy
+from django.utils.text import capfirst, get_text_list
+from django.utils.translation import gettext_lazy as _
+
+from .conf import get_tenant_model, tenant_model_label
+from .context import current_tenant, current_user, global_allowed
+
+VIEW, CHANGE, MANAGE = 'view', 'change', 'manage'
+LEVELS = (VIEW, CHANGE, MANAGE)
+
+
+def _tenant_verbose_name():
+    return str(get_tenant_model()._meta.verbose_name)
+
+
+# labels of tenant fields follow the project's tenant model (e.g. "household"), evaluated when displayed
+tenant_verbose_name = lazy(_tenant_verbose_name, str)
+
+
+class Role(models.TextChoices):
+    ADMIN = 'admin', _('administrator')
+    MEMBER = 'member', _('member')
+    GUEST = 'guest', _('guest')
+
+
+class GrantLevel(models.TextChoices):
+    VIEW = VIEW, _('view')
+    CHANGE = CHANGE, _('view and change')
+
+
+ROLES_FOR = {
+    VIEW: (Role.ADMIN, Role.MEMBER, Role.GUEST),
+    CHANGE: (Role.ADMIN, Role.MEMBER),
+    MANAGE: (Role.ADMIN,),
+}
+GRANT_LEVELS_FOR = {
+    VIEW: (GrantLevel.VIEW, GrantLevel.CHANGE),
+    CHANGE: (GrantLevel.CHANGE,),
+    MANAGE: (),
+}
+
+
+class AbstractTenant(models.Model):
+    name = models.CharField(_('name'), max_length=200)
+    created = models.DateTimeField(_('created'), auto_now_add=True)
+
+    class Meta:
+        abstract = True
+        verbose_name = _('tenant')
+        verbose_name_plural = _('tenants')
+
+    def __str__(self):
+        return self.name
+
+
+class AbstractMembership(models.Model):
+    """A user belongs to a tenant; the role sets the level (guest: view, member: change, admin: manage)"""
+
+    tenant = models.ForeignKey(tenant_model_label(), models.CASCADE, related_name='memberships',
+                               verbose_name=tenant_verbose_name())
+    user = models.ForeignKey(settings.AUTH_USER_MODEL, models.CASCADE, related_name='tenant_memberships',
+                             verbose_name=_('user'))
+    role = models.CharField(_('role'), max_length=20, choices=Role.choices, default=Role.MEMBER)
+
+    class Meta:
+        abstract = True
+        verbose_name = _('membership')
+        verbose_name_plural = _('memberships')
+        constraints = [
+            models.UniqueConstraint(fields=['tenant', 'user'], name='%(app_label)s_%(class)s_unique'),
+        ]
+
+    def __str__(self):
+        return f'{self.user} – {self.tenant}'
+
+
+class AbstractTenantGrant(models.Model):
+    """A user outside the tenant may view (or change) all its records, without being a member (optional model)"""
+
+    tenant = models.ForeignKey(tenant_model_label(), models.CASCADE, related_name='grants',
+                               verbose_name=tenant_verbose_name())
+    user = models.ForeignKey(settings.AUTH_USER_MODEL, models.CASCADE, related_name='tenant_grants',
+                             verbose_name=_('user'))
+    level = models.CharField(_('access'), max_length=20, choices=GrantLevel.choices, default=GrantLevel.VIEW)
+
+    class Meta:
+        abstract = True
+        verbose_name = _('tenant access')
+        verbose_name_plural = _('tenant accesses')
+        constraints = [
+            models.UniqueConstraint(fields=['tenant', 'user'], name='%(app_label)s_%(class)s_unique'),
+        ]
+
+    def __str__(self):
+        return f'{self.user} → {self.tenant}'
+
+
+def _related_model(Model, name):
+    try:
+        return Model._meta.get_field(name).related_model
+    except FieldDoesNotExist:
+        return None
+
+
+def tenants_for(user, level=VIEW):
+    """Ids of tenants the user reaches at ``level`` (a subquery for ``__in``); superusers get no extra tenants here"""
+    Tenant = get_tenant_model()
+    if user is None or not user.is_authenticated:
+        return Tenant.objects.none().values('pk')
+    Membership = _related_model(Tenant, 'memberships')
+    q = Q(pk__in=Membership.objects.filter(user=user, role__in=ROLES_FOR[level]).values('tenant'))
+    Grant = _related_model(Tenant, 'grants')
+    if Grant is not None and GRANT_LEVELS_FOR[level]:
+        q |= Q(pk__in=Grant.objects.filter(user=user, level__in=GRANT_LEVELS_FOR[level]).values('tenant'))
+    return Tenant.objects.filter(q).values('pk')
+
+
+def has_tenant_access(user, tenant, level=VIEW):
+    if tenant is None or user is None or not user.is_authenticated:
+        return False
+    return user.is_superuser or tenants_for(user, level).filter(pk=tenant.pk).exists()
+
+
+class TenantQuerySet(models.QuerySet):
+    """
+    Records a user may see or change. Superusers reach everything. Override ``access_q`` to widen (or narrow) the
+    reach of a model; prefer ``pk__in`` subqueries over joins there, so the result needs no ``distinct()``.
+    """
+
+    def access_q(self, user, level):
+        q = Q(tenant__in=tenants_for(user, level))
+        if level == VIEW and getattr(self.model, 'global_and_private', False):
+            q |= Q(tenant__isnull=True)  # global records: everyone reads them, only superusers change them
+        return q
+
+    def user_accessible(self, user):
+        return self._for_user(user, VIEW)
+
+    def user_editable(self, user):
+        return self._for_user(user, CHANGE)
+
+    def _for_user(self, user, level):
+        if user is None or not user.is_authenticated:
+            return self.none()
+        if user.is_superuser:
+            return self
+        return self.filter(self.access_q(user, level))
+
+
+class TenantModel(models.Model):
+    """
+    A record owned by a tenant. A new record without a tenant gets the current one (``CurrentTenantMiddleware``,
+    ``use_tenant``); a tenant set explicitly is kept. ``bulk_create`` bypasses ``save``: set the tenant yourself.
+
+    ``global_and_private = True``: the table also holds global records (``tenant`` is null), which every user reads
+    along with their tenant's private records. ``tenant`` then becomes nullable and editable (superusers choose,
+    other users always create in their active tenant). A new record without a tenant stays global only for
+    a superuser or inside ``use_tenant(None)``.
+
+    Unique values within a tenant (and, with global records, across them too): ``TenantUniqueConstraint``.
+    """
+
+    global_and_private = False
+
+    tenant = models.ForeignKey(tenant_model_label(), models.PROTECT, editable=False,
+                               verbose_name=tenant_verbose_name())
+    created_by = models.ForeignKey(settings.AUTH_USER_MODEL, models.SET_NULL, null=True, blank=True, editable=False,
+                                   related_name='+', verbose_name=_('created by'))
+
+    objects = TenantQuerySet.as_manager()
+
+    class Meta:
+        abstract = True
+
+    def save(self, *args, **kwargs):
+        if self._state.adding:
+            if self.tenant_id is None and not (self.global_and_private and global_allowed()):
+                tenant = current_tenant()
+                if tenant is None:
+                    raise ValidationError(_('The record cannot be saved: %(tenant)s is missing.'),
+                                          params={'tenant': tenant_verbose_name()})
+                self.tenant = tenant
+            if self.created_by_id is None:
+                self.created_by = current_user()
+        super().save(*args, **kwargs)
+
+
+class TenantUniqueConstraint(models.BaseConstraint):
+    """
+    ``fields`` unique among the records a user sees together: within one tenant, and for ``global_and_private``
+    models also between a tenant's records and the global ones (a private "Gas meter" next to a global "Gas meter"
+    is refused, as is a second global one or a global one repeating any private one). Two tenants may each have
+    a record with the same values.
+
+    PostgreSQL enforces it as an exclusion constraint (the tenant as a range, null = unbounded, overlapping any
+    tenant), which needs the ``btree_gist`` extension: put ``BtreeGistExtension()`` in a migration before it. Other
+    databases get no constraint in the schema and rely on validation (forms, ``full_clean``), which also gives
+    clear messages and works when the form leaves ``tenant`` out (the admin mixin sets it before validation).
+    """
+
+    def __init__(self, *, fields, name, violation_error_code=None, violation_error_message=None):
+        if not fields:
+            raise ValueError('TenantUniqueConstraint needs at least one field.')
+        self.fields = tuple(fields)
+        super().__init__(name=name, violation_error_code=violation_error_code,
+                         violation_error_message=violation_error_message)
+
+    def _exclude_sql(self, model, schema_editor):
+        quote = schema_editor.quote_name
+        tenant = quote(model._meta.get_field('tenant').column)
+        elements = [f'{quote(model._meta.get_field(name).column)} WITH =' for name in self.fields]
+        elements.append(f"int8range({tenant}, {tenant}, '[]') WITH &&")
+        return f'CONSTRAINT {quote(self.name)} EXCLUDE USING gist ({", ".join(elements)})'
+
+    @staticmethod
+    def _supported(schema_editor):
+        return schema_editor.connection.vendor == 'postgresql'
+
+    def constraint_sql(self, model, schema_editor):
+        return self._exclude_sql(model, schema_editor) if self._supported(schema_editor) else None
+
+    def create_sql(self, model, schema_editor):
+        if not self._supported(schema_editor):
+            return None
+        table = schema_editor.quote_name(model._meta.db_table)
+        return f'ALTER TABLE {table} ADD {self._exclude_sql(model, schema_editor)}'
+
+    def remove_sql(self, model, schema_editor):
+        if not self._supported(schema_editor):
+            return None
+        quote = schema_editor.quote_name
+        return f'ALTER TABLE {quote(model._meta.db_table)} DROP CONSTRAINT {quote(self.name)}'
+
+    def validate(self, model, instance, exclude=None, using=DEFAULT_DB_ALIAS):
+        if exclude and set(self.fields) & set(exclude):
+            return
+        fields = [model._meta.get_field(name) for name in self.fields]
+        values = {field.attname: getattr(instance, field.attname) for field in fields}
+        if any(value is None for value in values.values()):
+            return  # like unique: null values never clash
+        tenant_id = instance.tenant_id
+        if tenant_id is None and not getattr(model, 'global_and_private', False):
+            return  # the tenant is assigned on save
+        clashes = model._default_manager.using(using).filter(**values)
+        if not instance._state.adding and instance.pk is not None:
+            clashes = clashes.exclude(pk=instance.pk)
+        same = clashes.filter(tenant=tenant_id) if tenant_id is not None else clashes.filter(tenant__isnull=True)
+        if same.exists():
+            raise instance.unique_error_message(model, self.fields)
+        params = {
+            'model_name': capfirst(model._meta.verbose_name),
+            'field_labels': get_text_list([capfirst(field.verbose_name) for field in fields], _('and')),
+        }
+        if tenant_id is not None:
+            if not clashes.filter(tenant__isnull=True).exists():
+                return
+            error = ValidationError(_('%(model_name)s with this %(field_labels)s already exists as a shared record.'),
+                                    code='unique_with_global', params=params)
+        else:
+            owners = get_tenant_model()._default_manager.using(using).filter(pk__in=clashes.values('tenant'))
+            tenants = [str(tenant) for tenant in owners.order_by('pk')[:5]]
+            if not tenants:
+                return
+            error = ValidationError(
+                _('%(model_name)s with this %(field_labels)s already exists as a private record (%(tenants)s).'),
+                code='unique_with_global', params={**params, 'tenants': ', '.join(tenants)})
+        raise ValidationError({self.fields[0] if len(self.fields) == 1 else NON_FIELD_ERRORS: [error]})
+
+    def __eq__(self, other):
+        if isinstance(other, TenantUniqueConstraint):
+            return (self.name, self.fields, self.violation_error_code, self.violation_error_message) == (
+                other.name, other.fields, other.violation_error_code, other.violation_error_message)
+        return super().__eq__(other)
+
+    def __repr__(self):
+        return f'<{self.__class__.__qualname__}: fields={self.fields!r} name={self.name!r}>'
+
+    def deconstruct(self):
+        path, args, kwargs = super().deconstruct()
+        kwargs['fields'] = self.fields
+        return path, args, kwargs
+
+
+def _allow_global_records(sender, **kwargs):
+    """global_and_private models: a nullable tenant that superusers may edit (each model has its own field copy)"""
+    if issubclass(sender, TenantModel) and sender.global_and_private and not sender._meta.abstract:
+        field = sender._meta.get_field('tenant')
+        field.null = field.blank = field.editable = True
+
+
+class_prepared.connect(_allow_global_records)