simple-permissions.py

GateNotDefined = type('GateNotDefined', (Exception,), {})

class Gatekeeper:
    def __init__(self, gates={}, before=None):
        self.gates = gates
        self.before = before

    def define(self, name, fn):
        self.gates[name] = fn

    def allows(self, name, user, entity):
        if self.before and self.before(user):
            return True

        gate = self.gates.get(name)
        if not gate:
            raise GateNotDefined('No gate named {} is defined.'.format(name))
        return gate(user, entity)

    def denies(self, name, user, entity):
        return not self.allows(name, user, entity)

    
# Define permissions
gate = Gatekeeper(before=lambda user: user.is_admin)
gate.define('post.update', lambda user, post: user.id == post.user_id)
gate.define('post.delete', lambda user, post: user.id == post.user_id)


# Check permissions
if gate.denies('post.update', current_user, post):
    # not allowed
else:
    # allowed