Who can read the inbox

Captured mail is sensitive: it holds password reset links, invite tokens and personal data. So by default only staff users can open the inbox. Visitors who are not logged in go to your login page, and logged in users without access get a “403 Forbidden”.

You decide who gets in with POSTBOX_PERMISSIONS: a list of permission classes, in the style of Django REST framework. Every class must say yes.

Staff only (the default) #

Nothing to configure. This is the same as:

POSTBOX_PERMISSIONS = ["django_postbox.permissions.IsStaff"]

Your QA team #

Write a class with a has_permission(request) method and point the setting at it:

from django_postbox.permissions import BasePermission


class IsQA(BasePermission):
    """Members of the "QA" group may read captured mail"""

    def has_permission(self, request):
        return request.user.groups.filter(name="QA").exists()

POSTBOX_PERMISSIONS = ["myproject.permissions.IsQA"]

Everyone, but only while debugging #

On a local machine or a throwaway review app you may not want a login at all. Combine the built-in classes:

POSTBOX_PERMISSIONS = ["django_postbox.permissions.DebugOnly"]

DebugOnly lets everyone in while DEBUG = True, and nobody once it is off. That makes a forgotten URL on a production server harmless.

Built-in classes #

All of them live in django_postbox.permissions. You can list classes or their dotted paths, and mix your own with the built-in ones.