Mixin for views that need superadmin access to all resources. Provides FOUR key features (all bundled - no separate mixins needed): 1. Queryset routing (superadmin sees all, regular user sees own org) 2. Organization injection (post/patch/put auto-inject org) 3. Object ownership checking (auto-registers ObjectOwnershipPermission) 4. Superadmin-only field protection (certain fields can only be modified by superadmins) Inherits from: - ObjectOwnershipMixin: Config attributes + auto-permission registration - OrganizationInjectionMixin: Cross-org write protection + org injection Config attributes (inherited from ObjectOwnershipMixin): - ownership_object_field_name: Field on object (default: "organization_id") - ownership_user_field_name: Field on user (default: "curr_org_id") - is_allowing_global_object_read: Allow reading global objects (default: False) - is_allowing_org_admin_access: Allow org admins access to any object in their org (default: False) - is_requiring_org_admin_for_write: Require org admin for writes (default: False) Config attributes (superadmin-only fields): - superadmin_only_fields: List of field names that only superadmins can modify (default: []) On CREATE: Fields are stripped from non-superadmin requests (model defaults apply) On UPDATE: Non-superadmins trying to change these fields get PermissionDenied - superadmin_lock_field: Field name that locks the entire object for non-superadmins (default: None) When this field is truthy on the instance, non-superadmins cannot modify ANY field. Common use case: is_managed=True means Keywords AI manages this resource, users can't edit it. Note: Writing to global objects (ownership field is None) always requires superadmin. Usage (detail view): class MyDetailView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView): # Optional: customize ownership config (inherited from ObjectOwnershipMixin) is_allowing_global_object_read = True def get_regular_user_queryset(self): return MyModel.objects.filter(organization_id=self.request.user.curr_org_id) def get_superadmin_queryset(self): return MyModel.objects.all() Usage (superadmin-only fields): class IntegrationView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView): superadmin_only_fields = ['is_managed'] # Only superadmins can modify is_managed superadmin_lock_field = 'is_managed' # When is_managed=True, object is locked for non-superadmins def get_regular_user_queryset(self): return Integration.objects.filter(organization_id=self.request.user.curr_org_id) def get_superadmin_queryset(self): return Integration.objects.all() Usage (related-object org pattern like PromptVersion - PREFERRED: annotate queryset): from django.db.models import F class PromptVersionView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView): def get_regular_user_queryset(self): # Annotate organization_id so ownership checks work automatically return PromptVersion.objects.filter( prompt__organization_id=self.request.user.curr_org_id ).annotate(organization_id=F("prompt__organization_id")) def get_superadmin_queryset(self): return PromptVersion.objects.annotate(organization_id=F("prompt__organization_id")) Alternative (override method - only if annotation not possible): class PromptVersionView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView): def get_affiliated_object_organization_id(self, instance): return instance.prompt.organization_id # Org is on parent object DO NOT use inline checks like this: # ❌ BAD - easy to forget in branching code def get_queryset(self): if has_staff_role(self.request.user): return MyModel.objects.all() return MyModel.objects.filter(...)