As a developer, I can make permission object filtering chainable

Author: @bmbouter (bmbouter)

Redmine Issue: 9613, https://pulp.plan.io/issues/9613

Motivation

As a developer with the new Roles facilities in pulpcore==3.17, you likely will want to filter by permissions with something like this example taken from this PR.

current_user = get_current_authenticated_user()
qs = Task.objects.filter(finished_at__lt=finished_before, state__in=states)
units_deleted, details = get_objects_for_user(current_user, "core.delete_task", qs=qs).delete()

As you can see, this needs to determine who the current user is, and you can't build the queryset in one go by using chaining.

Proposal

Introduce a with_perm chainable call on all querysets for Pulp objects. It could be used like this:

• qs.with_perm("core.task_delete")
• qs.with_perm("core.task_delete", "core.task_view")
• qs.with_perms(["core.task_delete", "core.task_view"])
• qs.with_perm("core.task_delete").with_perm( "core.task_view")

Start from the get_objects_for_user example and the Task.objects queryset shown in the issue. Determine how Pulp object querysets currently apply permission filtering and how a chainable with_perm or with_perms API should compose multiple permissions. Done means permission-filtered querysets support the listed chained and multi-permission forms.