Skip to main content

Permissions

Added in 1.0.1

Chassis checks Django permissions. It does not replace them. The default mode is group-only: a staff user must have the permission through a group. Active superusers bypass the check.

Request check​

from django_chassis.permissions import has_request_user_permission

if has_request_user_permission(request, 'catalog.view_book'):
    ...

Rules:

  • is_active and is_staff are required.
  • Superusers pass in the default mode.
  • Everyone else is checked against user.get_group_permissions().

Chassis uses the standard Django Admin user contract directly and does not replace or wrap request.user. A custom AUTH_USER_MODEL must therefore expose is_authenticated, is_active, is_staff, is_superuser, has_perm(), and get_group_permissions().

CHASSIS_PERMISSION_CHECK​

# settings.py
CHASSIS_PERMISSION_CHECK = 'group_only'  # default
# CHASSIS_PERMISSION_CHECK = 'user_has_perm'
ValueBehaviour
group_onlyGroup permissions only; superuser bypass
user_has_permStandard user.has_perm()

An unsupported value raises ImproperlyConfigured.

PermissionOption​

Declare extra permissions on the site. They are registered at construction and created after migrate by PermissionInitializationService.

from django.utils.translation import gettext_lazy as _

from django_chassis.options import PermissionOption

export_books = PermissionOption(app_label='catalog', model='book', codename='export_book', name=_('Can export book'))


class CustomAdminSite(ChassisAdminSiteMixin, AdminSite):
    chassis_permission_options = (export_books,)
ParameterType
app_labelDjango app label
modelModel name
codenamePermission codename
nameLocalized human name

PermissionAdminPage.permission must be a view_* permission. See Custom pages.

Actions and options​

Row, list, object, table, import, and export options accept a permission string: a standard view / add / change / delete codename, or a custom codename on the model. System checks validate those references.

Name normalization​

PermissionNameNormalizationService can normalize default Django permission names. The declared language is currently Russian. This is an operational detail of permission setup, not something ModelAdmins call directly.

See also​