django-policy-tree 0.1.0__tar.gz

django_policy_tree-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gerardo Ballester Jr.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

django_policy_tree-0.1.0/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: django-policy-tree
+Version: 0.1.0
+Summary: Domain-agnostic, tree-based permissions for Django and DRF, with policies superusers edit in the admin.
+Author: Gerardo Ballester Jr.
+License: MIT
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Security
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 4.2
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: Django :: 6.1
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django>=4.2
+Provides-Extra: drf
+Requires-Dist: djangorestframework>=3.14; extra == "drf"
+Provides-Extra: test
+Requires-Dist: djangorestframework>=3.14; extra == "test"
+Requires-Dist: pytest>=8; extra == "test"
+Requires-Dist: pytest-django>=4.8; extra == "test"
+Requires-Dist: hypothesis>=6.100; extra == "test"
+Requires-Dist: pytest-cov>=5; extra == "test"
+Provides-Extra: docs
+Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
+Requires-Dist: mkdocs-material<10,>=9.5; extra == "docs"
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.1; extra == "postgres"
+Provides-Extra: mysql
+Requires-Dist: mysqlclient>=2.2; extra == "mysql"
+Dynamic: license-file
+
+# django-policy-tree
+
+Permissions for Django projects whose users belong to a **tree of organizational units**, with rules that **superusers edit in the admin**.
+
+Any hierarchy works. You name the levels, you name the roles, you point your models at the tree:
+
+| Domain | Tree | Roles |
+|---|---|---|
+| Company | Head office → Region → Branch → Team | admin, manager, member, viewer |
+| Retail | Chain → Region → Store | owner, area manager, store manager, cashier |
+| Healthcare | Hospital group → Hospital → Department → Ward | administrator, head nurse, doctor, nurse |
+| SaaS | Tenant → Workspace → Project | owner, admin, editor, guest |
+| Government | Ministry → Agency → Office | director, officer, clerk |
+| Education | School → Campus → Department | admin, registrar, professor, student |
+
+Wherever a user's role *in a unit* decides what they can do, django-policy-tree answers *"can this user do this, to this record, and with which fields?"* from one place, for lists, objects, creates, updates and fields alike.
+
+```python
+class Project(models.Model):
+    organization = models.ForeignKey(Organization, on_delete=models.CASCADE)   # the record's place in the tree
+    name = models.CharField(max_length=100)
+    budget = models.DecimalField(max_digits=12, decimal_places=2)
+
+
+class ProjectViewSet(PolicyQuerysetMixin, viewsets.ModelViewSet):
+    queryset = Project.objects.all()
+    serializer_class = ProjectSerializer
+    permission_classes = [PolicyPermission]
+```
+
+With the policy *"managers may update projects, scope tree"*, a manager of the North region sees only projects in North and the branches and teams below it, can't create or edit projects anywhere else, and can't move a project out of North. Add *"members may read projects, but not the `budget` field"* and the field disappears from their responses.
+
+## Features
+
+- **Default deny**, with allow and deny policies; deny wins
+- **Scopes:** `org`, `tree`, `below`, `ancestors`, `siblings`, `own`, and your own
+- **Conditions** written in code, picked per policy, checked before and/or after a change
+- **Roles** in code or managed by superusers in the admin, with inheritance
+- **Field rules** per record, on the way in and out
+- **DRF** (permission class, viewset and serializer mixins), **plain Django views**, a **template tag**, and an engine for everything else
+- **Audit log**, policies and roles as **JSON in git**, **system checks**
+- Works with **UUID** primary keys and **soft delete**
+
+## Install
+
+```bash
+pip install "django-policy-tree[drf]"
+```
+
+```python
+INSTALLED_APPS = [..., "rest_framework", "policytree", "core"]
+POLICYTREE_ORGANIZATION_MODEL = "core.Organization"
+POLICYTREE_MEMBER_MODEL = "core.Member"
+```
+
+Then follow the **[Quickstart](docs/quickstart.md)**.
+
+## Documentation
+
+- [Quickstart](docs/quickstart.md)
+- Concepts: [organizations](docs/concepts/organizations.md), [members and roles](docs/concepts/roles.md), [policies](docs/concepts/policies.md), [scopes](docs/concepts/scopes.md), [conditions](docs/concepts/conditions.md), [fields](docs/concepts/fields.md)
+- Guides: [DRF](docs/guides/drf.md), [plain views](docs/guides/views.md), [engine](docs/guides/engine.md), [UUIDs and soft delete](docs/guides/base-model.md), [operations](docs/guides/operations.md)
+- Recipes, one per domain: [company](docs/recipes/company.md), [retail](docs/recipes/retail.md), [healthcare](docs/recipes/healthcare.md), [SaaS](docs/recipes/saas.md), [education](docs/recipes/school.md)
+- [Security](docs/security.md) · [Performance](docs/performance.md) · [Changelog](CHANGELOG.md)
+
+Build the docs site with `pip install mkdocs-material && mkdocs serve`.
+
+## Status
+
+**0.1**: the API is intended to be the 1.0 API. Tested on Django 4.2, 5.2 and 6.1 with Python 3.10+, on SQLite, PostgreSQL and MariaDB, with property-based tests and an independent security review. It has not yet run in production; read [Security](docs/security.md) before relying on it.
+
+## Development
+
+```bash
+pip install -e ".[test]"
+pytest                        # SQLite
+DB=postgres pytest            # see tests/settings.py
+DB=mysql pytest
+pytest benchmarks -q -s       # timings
+mkdocs build --strict         # docs
+```
+
+`tests/testapp` holds the test fixtures. They model one sample domain so the tests read naturally; nothing in the package depends on it. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+MIT

django_policy_tree-0.1.0/README.md

@@ -0,0 +1,87 @@
+# django-policy-tree
+
+Permissions for Django projects whose users belong to a **tree of organizational units**, with rules that **superusers edit in the admin**.
+
+Any hierarchy works. You name the levels, you name the roles, you point your models at the tree:
+
+| Domain | Tree | Roles |
+|---|---|---|
+| Company | Head office → Region → Branch → Team | admin, manager, member, viewer |
+| Retail | Chain → Region → Store | owner, area manager, store manager, cashier |
+| Healthcare | Hospital group → Hospital → Department → Ward | administrator, head nurse, doctor, nurse |
+| SaaS | Tenant → Workspace → Project | owner, admin, editor, guest |
+| Government | Ministry → Agency → Office | director, officer, clerk |
+| Education | School → Campus → Department | admin, registrar, professor, student |
+
+Wherever a user's role *in a unit* decides what they can do, django-policy-tree answers *"can this user do this, to this record, and with which fields?"* from one place, for lists, objects, creates, updates and fields alike.
+
+```python
+class Project(models.Model):
+    organization = models.ForeignKey(Organization, on_delete=models.CASCADE)   # the record's place in the tree
+    name = models.CharField(max_length=100)
+    budget = models.DecimalField(max_digits=12, decimal_places=2)
+
+
+class ProjectViewSet(PolicyQuerysetMixin, viewsets.ModelViewSet):
+    queryset = Project.objects.all()
+    serializer_class = ProjectSerializer
+    permission_classes = [PolicyPermission]
+```
+
+With the policy *"managers may update projects, scope tree"*, a manager of the North region sees only projects in North and the branches and teams below it, can't create or edit projects anywhere else, and can't move a project out of North. Add *"members may read projects, but not the `budget` field"* and the field disappears from their responses.
+
+## Features
+
+- **Default deny**, with allow and deny policies; deny wins
+- **Scopes:** `org`, `tree`, `below`, `ancestors`, `siblings`, `own`, and your own
+- **Conditions** written in code, picked per policy, checked before and/or after a change
+- **Roles** in code or managed by superusers in the admin, with inheritance
+- **Field rules** per record, on the way in and out
+- **DRF** (permission class, viewset and serializer mixins), **plain Django views**, a **template tag**, and an engine for everything else
+- **Audit log**, policies and roles as **JSON in git**, **system checks**
+- Works with **UUID** primary keys and **soft delete**
+
+## Install
+
+```bash
+pip install "django-policy-tree[drf]"
+```
+
+```python
+INSTALLED_APPS = [..., "rest_framework", "policytree", "core"]
+POLICYTREE_ORGANIZATION_MODEL = "core.Organization"
+POLICYTREE_MEMBER_MODEL = "core.Member"
+```
+
+Then follow the **[Quickstart](docs/quickstart.md)**.
+
+## Documentation
+
+- [Quickstart](docs/quickstart.md)
+- Concepts: [organizations](docs/concepts/organizations.md), [members and roles](docs/concepts/roles.md), [policies](docs/concepts/policies.md), [scopes](docs/concepts/scopes.md), [conditions](docs/concepts/conditions.md), [fields](docs/concepts/fields.md)
+- Guides: [DRF](docs/guides/drf.md), [plain views](docs/guides/views.md), [engine](docs/guides/engine.md), [UUIDs and soft delete](docs/guides/base-model.md), [operations](docs/guides/operations.md)
+- Recipes, one per domain: [company](docs/recipes/company.md), [retail](docs/recipes/retail.md), [healthcare](docs/recipes/healthcare.md), [SaaS](docs/recipes/saas.md), [education](docs/recipes/school.md)
+- [Security](docs/security.md) · [Performance](docs/performance.md) · [Changelog](CHANGELOG.md)
+
+Build the docs site with `pip install mkdocs-material && mkdocs serve`.
+
+## Status
+
+**0.1**: the API is intended to be the 1.0 API. Tested on Django 4.2, 5.2 and 6.1 with Python 3.10+, on SQLite, PostgreSQL and MariaDB, with property-based tests and an independent security review. It has not yet run in production; read [Security](docs/security.md) before relying on it.
+
+## Development
+
+```bash
+pip install -e ".[test]"
+pytest                        # SQLite
+DB=postgres pytest            # see tests/settings.py
+DB=mysql pytest
+pytest benchmarks -q -s       # timings
+mkdocs build --strict         # docs
+```
+
+`tests/testapp` holds the test fixtures. They model one sample domain so the tests read naturally; nothing in the package depends on it. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+MIT

django_policy_tree-0.1.0/pyproject.toml

@@ -0,0 +1,43 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "django-policy-tree"
+version = "0.1.0"
+description = "Domain-agnostic, tree-based permissions for Django and DRF, with policies superusers edit in the admin."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "Gerardo Ballester Jr." }]
+dependencies = ["Django>=4.2"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Topic :: Security",
+    "Framework :: Django",
+    "Framework :: Django :: 4.2",
+    "Framework :: Django :: 5.2",
+    "Framework :: Django :: 6.0",
+    "Framework :: Django :: 6.1",
+    "Programming Language :: Python :: 3",
+]
+
+[project.optional-dependencies]
+drf = ["djangorestframework>=3.14"]
+test = ["djangorestframework>=3.14", "pytest>=8", "pytest-django>=4.8", "hypothesis>=6.100", "pytest-cov>=5"]
+docs = ["mkdocs>=1.6,<2", "mkdocs-material>=9.5,<10"]
+postgres = ["psycopg[binary]>=3.1"]
+mysql = ["mysqlclient>=2.2"]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+policytree = ["migrations/*.py"]
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "tests.settings"
+pythonpath = ["src", "."]
+testpaths = ["tests"]

django_policy_tree-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

django_policy_tree-0.1.0/src/django_policy_tree.egg-info/PKG-INFO

@@ -0,0 +1,124 @@
+Metadata-Version: 2.4
+Name: django-policy-tree
+Version: 0.1.0
+Summary: Domain-agnostic, tree-based permissions for Django and DRF, with policies superusers edit in the admin.
+Author: Gerardo Ballester Jr.
+License: MIT
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Security
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 4.2
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: Django :: 6.1
+Classifier: Programming Language :: Python :: 3
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: Django>=4.2
+Provides-Extra: drf
+Requires-Dist: djangorestframework>=3.14; extra == "drf"
+Provides-Extra: test
+Requires-Dist: djangorestframework>=3.14; extra == "test"
+Requires-Dist: pytest>=8; extra == "test"
+Requires-Dist: pytest-django>=4.8; extra == "test"
+Requires-Dist: hypothesis>=6.100; extra == "test"
+Requires-Dist: pytest-cov>=5; extra == "test"
+Provides-Extra: docs
+Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
+Requires-Dist: mkdocs-material<10,>=9.5; extra == "docs"
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.1; extra == "postgres"
+Provides-Extra: mysql
+Requires-Dist: mysqlclient>=2.2; extra == "mysql"
+Dynamic: license-file
+
+# django-policy-tree
+
+Permissions for Django projects whose users belong to a **tree of organizational units**, with rules that **superusers edit in the admin**.
+
+Any hierarchy works. You name the levels, you name the roles, you point your models at the tree:
+
+| Domain | Tree | Roles |
+|---|---|---|
+| Company | Head office → Region → Branch → Team | admin, manager, member, viewer |
+| Retail | Chain → Region → Store | owner, area manager, store manager, cashier |
+| Healthcare | Hospital group → Hospital → Department → Ward | administrator, head nurse, doctor, nurse |
+| SaaS | Tenant → Workspace → Project | owner, admin, editor, guest |
+| Government | Ministry → Agency → Office | director, officer, clerk |
+| Education | School → Campus → Department | admin, registrar, professor, student |
+
+Wherever a user's role *in a unit* decides what they can do, django-policy-tree answers *"can this user do this, to this record, and with which fields?"* from one place, for lists, objects, creates, updates and fields alike.
+
+```python
+class Project(models.Model):
+    organization = models.ForeignKey(Organization, on_delete=models.CASCADE)   # the record's place in the tree
+    name = models.CharField(max_length=100)
+    budget = models.DecimalField(max_digits=12, decimal_places=2)
+
+
+class ProjectViewSet(PolicyQuerysetMixin, viewsets.ModelViewSet):
+    queryset = Project.objects.all()
+    serializer_class = ProjectSerializer
+    permission_classes = [PolicyPermission]
+```
+
+With the policy *"managers may update projects, scope tree"*, a manager of the North region sees only projects in North and the branches and teams below it, can't create or edit projects anywhere else, and can't move a project out of North. Add *"members may read projects, but not the `budget` field"* and the field disappears from their responses.
+
+## Features
+
+- **Default deny**, with allow and deny policies; deny wins
+- **Scopes:** `org`, `tree`, `below`, `ancestors`, `siblings`, `own`, and your own
+- **Conditions** written in code, picked per policy, checked before and/or after a change
+- **Roles** in code or managed by superusers in the admin, with inheritance
+- **Field rules** per record, on the way in and out
+- **DRF** (permission class, viewset and serializer mixins), **plain Django views**, a **template tag**, and an engine for everything else
+- **Audit log**, policies and roles as **JSON in git**, **system checks**
+- Works with **UUID** primary keys and **soft delete**
+
+## Install
+
+```bash
+pip install "django-policy-tree[drf]"
+```
+
+```python
+INSTALLED_APPS = [..., "rest_framework", "policytree", "core"]
+POLICYTREE_ORGANIZATION_MODEL = "core.Organization"
+POLICYTREE_MEMBER_MODEL = "core.Member"
+```
+
+Then follow the **[Quickstart](docs/quickstart.md)**.
+
+## Documentation
+
+- [Quickstart](docs/quickstart.md)
+- Concepts: [organizations](docs/concepts/organizations.md), [members and roles](docs/concepts/roles.md), [policies](docs/concepts/policies.md), [scopes](docs/concepts/scopes.md), [conditions](docs/concepts/conditions.md), [fields](docs/concepts/fields.md)
+- Guides: [DRF](docs/guides/drf.md), [plain views](docs/guides/views.md), [engine](docs/guides/engine.md), [UUIDs and soft delete](docs/guides/base-model.md), [operations](docs/guides/operations.md)
+- Recipes, one per domain: [company](docs/recipes/company.md), [retail](docs/recipes/retail.md), [healthcare](docs/recipes/healthcare.md), [SaaS](docs/recipes/saas.md), [education](docs/recipes/school.md)
+- [Security](docs/security.md) · [Performance](docs/performance.md) · [Changelog](CHANGELOG.md)
+
+Build the docs site with `pip install mkdocs-material && mkdocs serve`.
+
+## Status
+
+**0.1**: the API is intended to be the 1.0 API. Tested on Django 4.2, 5.2 and 6.1 with Python 3.10+, on SQLite, PostgreSQL and MariaDB, with property-based tests and an independent security review. It has not yet run in production; read [Security](docs/security.md) before relying on it.
+
+## Development
+
+```bash
+pip install -e ".[test]"
+pytest                        # SQLite
+DB=postgres pytest            # see tests/settings.py
+DB=mysql pytest
+pytest benchmarks -q -s       # timings
+mkdocs build --strict         # docs
+```
+
+`tests/testapp` holds the test fixtures. They model one sample domain so the tests read naturally; nothing in the package depends on it. See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## License
+
+MIT

django_policy_tree-0.1.0/src/django_policy_tree.egg-info/SOURCES.txt

@@ -0,0 +1,48 @@
+LICENSE
+README.md
+pyproject.toml
+src/django_policy_tree.egg-info/PKG-INFO
+src/django_policy_tree.egg-info/SOURCES.txt
+src/django_policy_tree.egg-info/dependency_links.txt
+src/django_policy_tree.egg-info/requires.txt
+src/django_policy_tree.egg-info/top_level.txt
+src/policytree/__init__.py
+src/policytree/admin.py
+src/policytree/apps.py
+src/policytree/audit.py
+src/policytree/cache.py
+src/policytree/checks.py
+src/policytree/conf.py
+src/policytree/drf.py
+src/policytree/engine.py
+src/policytree/models.py
+src/policytree/registry.py
+src/policytree/roles.py
+src/policytree/targets.py
+src/policytree/views.py
+src/policytree/management/__init__.py
+src/policytree/management/commands/__init__.py
+src/policytree/management/commands/policytree_export.py
+src/policytree/management/commands/policytree_import_roles.py
+src/policytree/management/commands/policytree_rebuild_paths.py
+src/policytree/management/commands/policytree_seed.py
+src/policytree/migrations/0001_initial.py
+src/policytree/migrations/0002_effect_condition_audit.py
+src/policytree/migrations/0003_roles.py
+src/policytree/migrations/__init__.py
+src/policytree/templatetags/__init__.py
+src/policytree/templatetags/policytree.py
+tests/test_base_model.py
+tests/test_edges.py
+tests/test_features.py
+tests/test_hardening.py
+tests/test_policies.py
+tests/test_properties.py
+tests/test_review_regressions.py
+tests/test_review_round2.py
+tests/test_review_round3.py
+tests/test_review_round4.py
+tests/test_review_round5.py
+tests/test_roles_admin.py
+tests/test_spaces.py
+tests/test_two_models.py

django_policy_tree-0.1.0/src/django_policy_tree.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

django_policy_tree-0.1.0/src/django_policy_tree.egg-info/requires.txt

@@ -0,0 +1,21 @@
+Django>=4.2
+
+[docs]
+mkdocs<2,>=1.6
+mkdocs-material<10,>=9.5
+
+[drf]
+djangorestframework>=3.14
+
+[mysql]
+mysqlclient>=2.2
+
+[postgres]
+psycopg[binary]>=3.1
+
+[test]
+djangorestframework>=3.14
+pytest>=8
+pytest-django>=4.8
+hypothesis>=6.100
+pytest-cov>=5

django_policy_tree-0.1.0/src/django_policy_tree.egg-info/top_level.txt

@@ -0,0 +1 @@
+policytree

django_policy_tree-0.1.0/src/policytree/__init__.py

@@ -0,0 +1,3 @@
+"""Organization-tree permissions with database-driven policies for Django and DRF."""
+
+__version__ = "0.1.0"

django_policy_tree-0.1.0/src/policytree/admin.py

@@ -0,0 +1,159 @@
+from django import forms
+from django.contrib import admin
+
+from .audit import PolicyAudit
+from .models import Policy, PolicyChange, Role
+from .registry import ConditionRegistry, ScopeRegistry
+from .roles import Roles, RoleTree
+
+
+class PolicyForm(forms.ModelForm):
+    class Meta:
+        model = Policy
+        fields = "__all__"
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        roles = Roles.choices()
+        if roles or Roles.uses_model():
+            self.fields["role"] = forms.ChoiceField(choices=[("", "---------")] + roles)
+        self.fields["scope"] = forms.ChoiceField(choices=ScopeRegistry.choices(), initial="org")
+        self.fields["condition"] = forms.ChoiceField(
+            choices=[("", "— none —")] + ConditionRegistry.choices(), required=False
+        )
+
+
+class RoleForm(forms.ModelForm):
+    class Meta:
+        model = Role
+        fields = ["code", "name", "description", "is_active", "includes"]
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        if "includes" in self.fields and self.instance.pk:
+            self.fields["includes"].queryset = Role.objects.exclude(pk=self.instance.pk)
+
+    def clean(self):
+        cleaned = super().clean()
+        code = cleaned.get("code") or self.instance.code
+        includes = cleaned.get("includes")
+        if code and includes is not None:
+            graph = {
+                role.code: list(role.includes.values_list("code", flat=True))
+                for role in Role.objects.exclude(code=code)
+            }
+            graph[code] = [role.code for role in includes]
+            cycle = RoleTree.find_cycle(graph)
+            if cycle:
+                self.add_error("includes", f"That would make roles include each other: {' -> '.join(cycle)}.")
+        return cleaned
+
+
+class SuperuserOnlyAdmin(admin.ModelAdmin):
+    def has_module_permission(self, request):
+        return request.user.is_active and request.user.is_superuser
+
+    def has_view_permission(self, request, obj=None):
+        return self.has_module_permission(request)
+
+    def has_add_permission(self, request):
+        return self.has_module_permission(request)
+
+    def has_change_permission(self, request, obj=None):
+        return self.has_module_permission(request)
+
+    def has_delete_permission(self, request, obj=None):
+        return self.has_module_permission(request)
+
+
+@admin.register(Role)
+class RoleAdmin(SuperuserOnlyAdmin):
+    """Shown only when the member model's `role` is a RoleField."""
+
+    form = RoleForm
+    list_display = ["name", "code", "is_active", "included_roles", "policies", "members", "updated_at"]
+    list_filter = ["is_active"]
+    search_fields = ["code", "name"]
+    filter_horizontal = ["includes"]
+    readonly_fields = ["updated_at"]
+
+    def has_module_permission(self, request):
+        return super().has_module_permission(request) and Roles.uses_model()
+
+    def has_delete_permission(self, request, obj=None):
+        if not super().has_delete_permission(request, obj):
+            return False
+        return obj is None or not obj.in_use()
+
+    def get_readonly_fields(self, request, obj=None):
+        fields = list(super().get_readonly_fields(request, obj))
+        return fields + ["code"] if obj is not None else fields
+
+    @admin.display(description="Includes")
+    def included_roles(self, obj):
+        return ", ".join(obj.includes.values_list("code", flat=True)) or "—"
+
+    @admin.display(description="Policies")
+    def policies(self, obj):
+        return obj.policy_count()
+
+    @admin.display(description="Members")
+    def members(self, obj):
+        return obj.member_count()
+
+    def save_model(self, request, obj, form, change):
+        PolicyAudit.set_actor(obj, request.user, source="admin", defer=True)
+        super().save_model(request, obj, form, change)
+
+    def save_related(self, request, form, formsets, change):
+        super().save_related(request, form, formsets, change)
+        kind = PolicyChange.Kind.UPDATED if change else PolicyChange.Kind.CREATED
+        PolicyAudit.record_role(form.instance, kind)
+
+    def delete_model(self, request, obj):
+        PolicyAudit.set_actor(obj, request.user, source="admin")
+        super().delete_model(request, obj)
+
+    def delete_queryset(self, request, queryset):
+        # The admin refuses bulk deletes that include roles in use (see
+        # has_delete_permission), and Role.delete() refuses them too.
+        for obj in queryset:
+            self.delete_model(request, obj)
+
+
+@admin.register(Policy)
+class PolicyAdmin(SuperuserOnlyAdmin):
+    form = PolicyForm
+    list_display = ["code", "role", "content_type", "action", "effect", "scope", "condition", "updated_at"]
+    list_filter = ["effect", "role", "content_type", "action", "scope"]
+    search_fields = ["code", "name", "role"]
+    readonly_fields = ["updated_at"]
+
+    def save_model(self, request, obj, form, change):
+        PolicyAudit.set_actor(obj, request.user, source="admin")
+        super().save_model(request, obj, form, change)
+
+    def delete_model(self, request, obj):
+        PolicyAudit.set_actor(obj, request.user, source="admin")
+        super().delete_model(request, obj)
+
+    def delete_queryset(self, request, queryset):
+        for obj in queryset:
+            self.delete_model(request, obj)
+
+
+@admin.register(PolicyChange)
+class PolicyChangeAdmin(SuperuserOnlyAdmin):
+    list_display = ["changed_at", "target", "policy_code", "kind", "source", "changed_by"]
+    list_filter = ["target", "kind", "source"]
+    search_fields = ["policy_code"]
+    readonly_fields = ["target", "policy_code", "kind", "data", "source", "changed_by", "changed_at"]
+
+    def has_add_permission(self, request):
+        return False
+
+    def has_change_permission(self, request, obj=None):
+        return False
+
+    def has_delete_permission(self, request, obj=None):
+        return False

django_policy_tree-0.1.0/src/policytree/apps.py

@@ -0,0 +1,18 @@
+from django.apps import AppConfig
+from django.utils.module_loading import autodiscover_modules
+
+
+class PolicyTreeConfig(AppConfig):
+    name = "policytree"
+    verbose_name = "Policy tree"
+    default_auto_field = "django.db.models.BigAutoField"
+
+    def ready(self):
+        from .audit import PolicyAudit
+        from .checks import PolicyTreeChecks
+
+        PolicyTreeChecks.register()
+        PolicyAudit.connect()
+
+        # Each app may register scopes and conditions in a `policies.py` module.
+        autodiscover_modules("policies")