Registry /
auth-security / invenio-records-permissions
Install & Compatibility
Where this runs
tested against v3.0.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.920 runs
installs and imports cleanly · install 0.0s · import 0.000s · 256.1MB
glibcpy 3.10–3.920 runs
installs and imports cleanly · install 24.3s · import 0.000s · 255MB
256MB installed
● package 256MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Generator
✓ from invenio_records_permissions.generators import Generator
✗ from invenio_records_permissions.generators import Generator
This quickstart demonstrates how to define a custom permission factory using `invenio-access`'s `Permission` and `flask-principal`'s `UserNeed`, and how to structure a basic permission policy. The `invenio-records-permissions` library primarily provides `Generators` and `PermissionPolicy` classes to organize and apply these permission checks within an Invenio application.
from invenio_access import Permission
from flask_principal import UserNeed
from invenio_records_permissions.generators import AnyUser
# Example of a simple permission factory
def owner_permission_factory(record=None):
"""Grants permission if the current user is the record owner."""
if record and "owner" in record:
# In a real application, 'record["owner"]' would be the user ID
# and UserNeed would compare against the authenticated user's ID.
return Permission(UserNeed(record["owner"]))
return Permission()
# Example of a basic permission policy
class MyRecordPermissionPolicy:
can_read = [AnyUser()]
can_create = [AnyUser()] # For simplicity, usually restricted
can_update = [owner_permission_factory]
can_delete = [owner_permission_factory]
# How you might use a generator directly (e.g., in a Policy's can_read list)
# This is typically integrated into an Invenio application context.
print(f"Can any user read? {AnyUser().needs(record=None)}")
Debug
Known issues
gotchaUnderstanding the difference between a 'permission factory' and a 'search filter' is crucial. A permission factory processes a single record to determine access, while a search filter operates on the current user to filter search results efficiently across multiple records.fixConsult the Invenio documentation on 'Managing access to records' to understand their distinct roles and implementation patterns.
affects: All versions
gotchaInvenio-Records-Permissions, by design, does not automatically set permissions for files attached to records. It is the developer's responsibility to implement specific permission logic for file access based on the associated record's permissions.fixImplement a dedicated permission factory or policy method for file access that references the record's permission model.
affects: All versions
breakingMajor versions of the overarching InvenioRDM platform (e.g., v1.x to v2.x) can introduce significant changes to record serialization (e.g., for versioning) or core components, which might indirectly impact how permission policies are structured or how record data is accessed for permission checks.fixReview the release notes for InvenioRDM and relevant Invenio modules when upgrading, especially for changes in record data models or core APIs that permission logic might rely on. Ensure permission factories correctly handle updated record structures.
affects: InvenioRDM v2.0.0 and later (relevant for underlying Invenio functionality)
gotchaThe concepts of 'Needs' and 'Permissions' from `invenio-access` can initially be abstract. A 'Need' represents a specific requirement (e.g., 'user ID 1', 'admin role'), while a 'Permission' is a collection of Needs.fixFamiliarize yourself with the `invenio-access` documentation. Start with simple Needs and Permissions and gradually build complexity.
affects: All versions
Upgrade
Version history
3.0.0latest on PyPI · released May 29, 2026
Audit
Dependencies
invenio-accessoptionalProvides the core Permission object and Needs (e.g., UserNeed, RoleNeed) which are fundamental for defining permission policies.
flask-principaloptionalUsed in conjunction with Invenio-Access for identity management and defining 'Needs' for permission checks.