Clickhouse Customer Users List List
Mixin for views that need superadmin access to all resources.
Provides FOUR key features (all bundled - no separate mixins needed):
1. Queryset routing (superadmin sees all, regular user sees own org)
2. Organization injection (post/patch/put auto-inject org)
3. Object ownership checking (auto-registers ObjectOwnershipPermission)
4. Superadmin-only field protection (certain fields can only be modified by superadmins)
Inherits from:
- ObjectOwnershipMixin: Config attributes + auto-permission registration
- OrganizationInjectionMixin: Cross-org write protection + org injection
Config attributes (inherited from ObjectOwnershipMixin):
- ownership_object_field_name: Field on object (default: "organization_id")
- ownership_user_field_name: Field on user (default: "curr_org_id")
- is_allowing_global_object_read: Allow reading global objects (default: False)
- is_allowing_org_admin_access: Allow org admins access to any object in their org (default: False)
- is_requiring_org_admin_for_write: Require org admin for writes (default: False)
Config attributes (superadmin-only fields):
- superadmin_only_fields: List of field names that only superadmins can modify (default: [])
On CREATE: Fields are stripped from non-superadmin requests (model defaults apply)
On UPDATE: Non-superadmins trying to change these fields get PermissionDenied
- superadmin_lock_field: Field name that locks the entire object for non-superadmins (default: None)
When this field is truthy on the instance, non-superadmins cannot modify ANY field.
Common use case: is_managed=True means Keywords AI manages this resource, users can't edit it.
Note: Writing to global objects (ownership field is None) always requires superadmin.
Usage (detail view):
class MyDetailView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
# Optional: customize ownership config (inherited from ObjectOwnershipMixin)
is_allowing_global_object_read = True
def get_regular_user_queryset(self):
return MyModel.objects.filter(organization_id=self.request.user.curr_org_id)
def get_superadmin_queryset(self):
return MyModel.objects.all()
Usage (superadmin-only fields):
class IntegrationView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
superadmin_only_fields = ['is_managed'] # Only superadmins can modify is_managed
superadmin_lock_field = 'is_managed' # When is_managed=True, object is locked for non-superadmins
def get_regular_user_queryset(self):
return Integration.objects.filter(organization_id=self.request.user.curr_org_id)
def get_superadmin_queryset(self):
return Integration.objects.all()
Usage (related-object org pattern like PromptVersion - PREFERRED: annotate queryset):
from django.db.models import F
class PromptVersionView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
def get_regular_user_queryset(self):
# Annotate organization_id so ownership checks work automatically
return PromptVersion.objects.filter(
prompt__organization_id=self.request.user.curr_org_id
).annotate(organization_id=F("prompt__organization_id"))
def get_superadmin_queryset(self):
return PromptVersion.objects.annotate(organization_id=F("prompt__organization_id"))
Alternative (override method - only if annotation not possible):
class PromptVersionView(SuperAdminMixin, JWTAndAPIKeyAuthenticationViewMixin, RetrieveUpdateDestroyAPIView):
def get_affiliated_object_organization_id(self, instance):
return instance.prompt.organization_id # Org is on parent object
DO NOT use inline checks like this:
# ❌ BAD - easy to forget in branching code
def get_queryset(self):
if has_staff_role(self.request.user):
return MyModel.objects.all()
return MyModel.objects.filter(...)
Authentication
AuthorizationBearer
JWT access token or Respan API key
Query parameters
page
A page number within the paginated result set.
page_size
Number of results to return per page.
Response
count
results
next
previous
total_count
current_filters
Pydantic model for FilterParamDict. A dictionary that maps metric names to their filter parameters.
Each key is a metric name (str), and each value can be:
- A single MetricFilterParamPydantic (one condition)
- A List[MetricFilterParamPydantic] (multiple conditions for same metric)
- A FilterBundlePydantic (nested filter bundle with connector)
Note: Uses extra=“allow” for dynamic metric name fields. The pydantic_extra annotation tells Pydantic what types to expect for extra fields, and generates typed additionalProperties in JSON Schema.
filters_data