Django authentication and authorization utilities.
Contents
pip install django-auth-utilsSupported and tested on:
- Python: 2.7, 3.4, 3.5, 3.6, PyPy, PyPy3
- Django: 1.8, 1.10, 1.11
In order to use the auth_utils template tag library, add auth_utils to your INSTALLED_APPS.
Alternatively, since Django 1.9, you can add auth_utils.templatetags.auth_utils to your
DjangoTemplates OPTIONS.
The ObjectPermissionRequiredMixin view combines Django's PermissionRequiredMixin and
SingleObjectMixin views, and performs the permission check against the object that was looked up.
Use it like the base classes:
from auth_utils.views import ObjectPermissionRequiredMixin
class ArticleDetail(ObjectPermissionRequiredMixin, generic.DetailView):
model = Article
permission_required = ['news.read_article']
class ArticleUpdate(ObjectPermissionRequiredMixin, generic.UpdateView):
model = Article
permission_required = ['news.change_article']Load the template tag library:
{% load auth_utils %}The perms filter allows checking object-level permissions with a convenient syntax:
{% if perm in user|perms:object %} ... {% endif %}The object argument is optional. If omitted, the global permission is checked,
similar to Django's perms object.
Examples:
{% if 'news.read_article' in user|perms:article %}
{{ article.text }}
{% else %}
You do not have permission to read this article.
{% endif %}
{% if 'news.change_article' in user|perms:article %}
<a href="...">Edit article</a>
{% endif %}
{% if 'news.delete_article' in user|perms:article %}
<a href="...">Delete article</a>
{% endif %}The library provides can_change and can_delete shorthands for checking Django's default
app.change_model and app.delete_model model permissions:
{% if user|can_change:article %} <a href="...">Edit</a> {% endif %}
{% if user|can_delete:article %} <a href="...">Delete</a> {% endif %}This base class provides all the boilerplate code necessary for a Django authentication backend to work, without performing any user authentication or permission authorization itself.
This is intended to make it easy to write custom authorization policies that only implement the backend methods they're interested in:
from auth_utils.backends import BaseAuthorizationBackend
class ArticleEditPolicy(BaseAuthorizationBackend):
"""
Allow authors to change and delete their own articles.
"""
def get_user_permissions(self, user_obj, obj=None):
is_author = isinstance(obj, Article) and article.author == user_obj
if user_obj.is_active and is_author:
return {'news.change_article', 'news.delete_article'}
else:
return set()
class GuestAccessPolicy(BaseAuthorizationBackend):
"""
Allow anonymous users to read non-premium articles.
"""
def get_user_permissions(self, user_obj, obj=None):
guest_readable = isinstance(obj, Article) and not article.is_premium
if not user_obj.is_authenticated() and guest_readable:
return {'news.read_article'}
else:
return set()Once defined, these policies can be enabled in AUTHENTICATION_BACKENDS:
AUTHENTICATION_BACKENDS = [
'django.contrib.auth.backends.ModelBackend',
# Custom authorization policies
'news.auth.ArticleEditPolicy',
'news.auth.GuestAccessPolicy',
]Inspiration: django-model-utils
django-guardian provides object-based permission checking utilities:
- View: An alternative PermissionRequiredMixin, predating Django's one
- Template tag: get_obj_perms, using somewhat clunkier assignment syntax