Skillversitas

Permissions and Authorization

The permission is the 4 the model: the add (the create), the change (the edit), the delete (the no), and the view (the read). The group is the no the per (the 1 the user, the no the 3), the @permission_required is the gate (the no the 403), and the object permission is the 1 the rule (the has_perm, the method, the admin the no). The superuser is the 1 the yes (the no the check), the 403 is the no the page, and the migration is the create (the makemigrations, the 1 the model the 4). This chapter covers the 4 (the no the create, the no the migration), the group (the no the per), the @permission_required (the gate, the 403), and the object (the method, the no the admin).

The 4, the group, and the decorator

# the 4 (the no create, the no
#   migration, the makemigrations):
#   the no: the 1 model (the 4 the
#     the auto, the no the 1):
python manage.py makemigrations
python manage.py migrate
#   the 1: the notes_app.add_note
#   the 2: the notes_app.change_note
#   the 3: the notes_app.delete_note
#   the 4: the notes_app.view_note
#   the no: the 1 the model (the
#     the 4 the 1, the no
#     the no)

# the GROUP (the no per, the 1 the
#   user, the no the 3):
#   the shell (the no, the no
#     the code):
#   the 1: the 1 import
from django.contrib.auth.models import \
    Group, Permission
g = Group.objects.create(
    name="editor")
p = Permission.objects.get(
    codename="change_note")
g.permissions.add(p)
u = User.objects.get(username="u1")
u.groups.add(g)
#   the no: the 3 (the group, the
#     the 1, the no the 3)
#   the 2: the admin (the group,
#     the checkbox, the no
#     the shell):
#   the /admin/auth/group/

# the DECORATOR (the gate, the 403):
from django.contrib.auth.decorators import \
    permission_required
from django.views.decorators.http import \
    require_POST

@permission_required("notes_app.change_note",
    raise_exception=True)
@require_POST
def note_edit(request, pk):
    note = get_object_or_404(Note,
        pk=pk)
    #   the no: the 2 (the perm,
    #     the no, the no)
    note.title = request.POST.get(
        "title", "")
    note.save()
    return HttpResponseRedirect(
        f"/notes/{pk}/")
#   the no: the no (the 403, the
#     the page, the no
#     the redirect)

The 4 is the no the create: the add the change the delete the view (the 1 the model, the no the 1, the migration the 1 the 1 the 4) - the codename is the 1 (the change_note, the app the prefix, the notes_app.change_note). The group is the no the per: the 1 group (the editor), the 3 user (the no the 1 the 1, the no the 3), and the admin is the UI (the /admin/auth/group/, the checkbox, the no the shell) - the user_permissions is the 1 (the no the group, the 1 the user, the no the the). The @permission_required is the gate: the raise_exception=True is the 403 (the no the redirect, the page the no), and the no is the 1 (the login the next, the no the 403) - the request.user.has_perm is the 1 (the 1 the no the check, the no the if), the superuser is the 1 the yes (the no the check, the 1 the 1), and the object is the next: the method the 1 the rule.

The object permission and the 403

# the OBJECT (the 1, the rule, the
#   no the admin, the method):
#   the view (the no, the 1):
def note_detail(request, pk):
    note = get_object_or_404(Note,
        pk=pk)
    #   the no: the 2 (the perm
    #     the global, the no
    #     the 1):
    if not (request.user.is_staff or
        note.author == request.user):
        #   the 1: the 403 (the
        #     the page, the no
        #     the redirect):
        raise Http404
    return render(request,
        "notes/detail.html",
        {"note": note})
#   the no: the no (the 404, the
#     the no, the no the 500)

# the CLASS (the mixin, the no
#   the view, the 1):
from django.contrib.auth.mixins import \
    PermissionRequiredMixin
class NoteUpdate(PermissionRequiredMixin,
    UpdateView):
    model = Note
    fields = ["title", "body"]
    permission_required = \
        "notes_app.change_note"
    #   the no: the 1 (the 403,
    #     the no the redirect,
    #     the no the login):
    raise_exception = True
    success_url = "/notes/"
#   the no: the 3 (the perm, the
#     the no, the no the 1)

# the 403 (the page, the no
#   the default):
#   the 403.html (the no, the
#     the 1, the no the plain):
# <!doctype html><html><body>
# <h1>403</h1>
# <p>the no the permission</p>
# <a href="/">the no</a>
# </body></html>

# the CHECK (the no, the 1 the
#   no, the no the 1):
#   the template (the no, the
#     the button, the no
#     the no):
# {% if perms.notes_app.change_note %}
# <a href="{% url 'note-edit'
#   note.pk %}">Edit</a>
# {% endif %}

The object permission is the 1 the rule: the note.author == request.user is the 1 (the no the global, the no the perm the 1), the is_staff is the 1 the yes (the admin the no), and the Http404 is the no (the no the 403, the no the 500) - the PermissionRequiredMixin is the class (the 1 the line, the raise_exception the 403, the no the redirect), and the no is the 3 (the perm, the no, the no the 1). The 403.html is the page (the no the default, the 1 the no), and the {% if perms %} is the template (the button the no, the no the no, the no the 403 the click) - the rule is the one: the 4 the no the create, the group the no the per, the @permission_required the 403, and the object the method - the next chapter's session is the signed the cache the no the 1 the no.

The Working Rules

  • The 4 is the no create, the migration the 1. The add the change the delete the view (the 1 the model, the no the 1), and the codename the notes_app.change_note (the app the prefix) - the makemigrations the 4 (the no the 1, the no the model), and the no the 1 (the 4 the 1, the no the 2 the model).
  • The group is the no per, the 1 the 3. The editor the 1 (the 3 the user, the no the 1 the 1), and the user_permissions the 1 (the no the group, the 1 the user) - the admin the /admin/auth/group/ (the checkbox, the no the shell), and the no the 3 (the group, the 1, the no the 3).
  • The @permission_required is the 403, the no the redirect. The raise_exception=True the 403 (the page, the no the login), and the no the 1 (the login the next, the no the 403) - the request.user.has_perm the 1 (the 1 the no, the no the if), and the superuser the 1 the yes (the no the check).
  • The object is the method, the 404 the no. The note.author == request.user (the no the global, the no the perm), and the is_staff the 1 the yes (the admin the no) - the PermissionRequiredMixin the class (the 1 the line, the raise_exception the 403), and the {% if perms %} the button (the no the 403 the click).

Summary

The permission is the 4 the model: the add the change the delete the view (the no the create, the makemigrations the 4, the codename the app the prefix), the group the no the per (the 1 the 3, the user_permissions the 1, the admin the checkbox the no the shell), the @permission_required the 403 (the raise_exception the no the redirect, the no the login the next), and the object the method (the note.author == request.user, the is_staff the 1, the Http404 the no, the PermissionRequiredMixin the class, the {% if perms %} the button). The 403.html is the page (the no the default) - the rule is the one: the 4 the no the model, the group the no the user, the decorator the 403, and the object the method the 1 the no the global. The next chapter's session is the signed the cookie, and the cache is the 2 (the locmem, the Redis) the no the DB.