Custom Permissions in Django

Django tip:

You can add custom permissions to a Django model (you still have to enforce it in the
views) 👇

from django.db import models

class Post(models.Model):
        title = models.CharField(max_length=400)
        body = models.TextField()
        is_published = models.Boolean(default=False)

        class Meta:
                permissions = [
            (
                                "set_published_status",
                                "Can set the status of the post to either publish or not"
            )
        ]
For more, check out Permissions in Django.

django
Posted on Twitter on July 26, 2022.

Check permission inside a Django template

Django tip:

A perms variable is available by default in a Django template, so you can render the

content based on the permissions:

{% if perms.store.view_inventory %}
        {{ all_inventory_items }}
{% endif %}
For more, check out Permissions in Django.

django
Posted on Twitter on July 25, 2022.

Permissions in Django - Enforcing Permissions with

permission_required()

Django tip:

To enforce permissions in function-based views, you can use

the permission_required decorator 👇

from django.contrib.auth.decorators import permission_required

@permission_required("blog.view_post")
def post_list_view(request):
        return HttpResponse()
For more, check out Permissions in Django.

django
Posted on Twitter on July 24, 2022.

Permissions in Django - Enforcing Permissions with

PermissionRequiredMixin

Django tip:

To enforce permissions in class-based views, you can use

the PermissionRequiredMixin from django.contrib.auth.mixins 👇
from django.contrib.auth.mixins import PermissionRequiredMixin
from django.views.generic import ListView

from blog.models import Post

class PostListView(PermissionRequiredMixin, ListView):

        permission_required = "blog.view_post"
        template_name = "post.html"
        model = Post
For more, check out Permissions in Django.

django
Posted on Twitter on July 23, 2022.

Permissions in Django - groups

Django tip:

Instead of handling permissions for a single user, you can use groups and group-level
permissions 👇

from django.contrib.auth.models import Group, User, Permission

from django.contrib.contenttypes.models import ContentType

manager_group, created = Group.objects.get_or_create(name="Library manager")

librarian_group, created = Group.objects.get_or_create(name="Librarian")

content_type = ContentType.objects.get_for_model(Book)
book_permission = Permission.objects.filter(content_type=content_type)

"""
print(post_permission)

<QuerySet [
        <Permission: library | book | Can add book>,
        <Permission: library | book | Can change book>,
        <Permission: library | book | Can delete book>,
        <Permission: library | book | Can view book>
]>
"""

for perm in book_permission:

        if perm.codename == "add_book":
                manager_group.permissions.add(perm)
        else:
                manager_group.permissions.add(perm)
                librarian_group.permissions.add(perm)

user = User.objects.get(username="librarian_jane_doe")
user.groups.add(librarian_group)

"""
print(user.has_perm("store.add_book")) => False
print(user.has_perm("library.delete_book")) => True
print(user.has_perm("library.change_book")) => True
print(user.has_perm("store.view_book")) => True
"""
For more, check out Permissions in Django.

django
Posted on Twitter on July 22, 2022.

Permissions in Django - has_perm()

Django tip:

You can check if a user has permission with the has_perm method:

user = User.objects.create_user(
        username="test",
        password="test",
        email="test@user.com"
)
print(user.has_perm("blog.view_post"))
# => False

superuser = User.objects.create_superuser(
        username="super",
        password="test",
      email="super@test.com"
)
print(superuser.has_perm("blog.view_post"))
# => True
For more, check out Permissions in Django.

django
Posted on Twitter on July 21, 2022.

Permissions in Django

Django tip:

With django.contrib.auth, Django automatically creates add, change, delete, and view

permissions for each Django model. Each permission is named like this:

{app}.{action}_{model_name}

You can also see (and set) those permissions in the Django admin.

For more, check out Permissions in Django.

django
Posted on Twitter on July 20, 2022.

Django REST Framework - writeable nested

serializers
DRF tip:
ModelSerializer's .create() method does not support writable
nested fields by default.
For the nested serializer to be writable, you'll need to
create create() and/or update() methods to explicitly specify how
the child relationships should be saved.