Built-in permission system in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Django permission check?

Consider a Django view where a user tries to access a resource. The code snippet below checks if the user has the permission 'app.view_resource'. What will be the output if the user does NOT have this permission?

Django

if request.user.has_perm('app.view_resource'):
    result = 'Access granted'
else:
    result = 'Access denied'
print(result)

A Access granted

B Access denied

C PermissionError exception raised

D False

💡 Hint

Remember that has_perm returns a boolean indicating if the user has the permission.

The has_perm method returns True if the user has the specified permission, otherwise False. Since the user lacks 'app.view_resource', the else branch runs, printing 'Access denied'.

❓ state_output

intermediate

What is the value of user.get_all_permissions() after adding a group?

Given a user with no permissions initially, you add the user to a group that has the permission 'app.change_item'. What will user.get_all_permissions() return?

Django

group = Group.objects.create(name='Editors')
permission = Permission.objects.get(codename='change_item')
group.permissions.add(permission)
user.groups.add(group)
perms = user.get_all_permissions()

A {'app.change_item'}

B {'change_item'}

C set()

D ['app.change_item']

💡 Hint

get_all_permissions returns a set of strings in the format 'app_label.codename'.

When a user is added to a group with permissions, get_all_permissions returns a set including those permissions with the format 'app_label.codename'.

📝 Syntax

advanced

Which option correctly assigns a permission to a user?

You want to assign the permission 'app.delete_post' to a user instance. Which code snippet correctly does this?

A user.user_permissions.add(Permission.objects.get(codename='delete_post'))

B user.user_permissions.add(Permission('app.delete_post'))

C user.user_permissions.add('app.delete_post')

D user.user_permissions.add('delete_post')

💡 Hint

user_permissions.add expects Permission model instances, not strings.

The add method requires Permission instances. Option A fetches the Permission object by codename and adds it correctly.

🔧 Debug

advanced

Why does this permission check always fail?

A developer writes this code to check if a user has permission to add an object: if user.has_perm('app.add_model'): print('Can add') else: print('Cannot add') But it always prints 'Cannot add' even though the user has the permission assigned. What is the likely cause?

A The user object is not authenticated, so has_perm always returns False.

B The has_perm method requires the full permission name including the app label and model name separated by a dot, but 'app.add_model' is missing the app label.

C The permission string should be 'app.add_models' plural, not singular.

D The permission codename is incorrect; it should be 'add_modelname' with the exact model name in lowercase.

💡 Hint

Check the exact permission codename format Django uses.

Django permission codenames follow the pattern 'action_modelname' where modelname is lowercase and exact. Using 'add_model' instead of 'add_modelname' causes the check to fail.

🧠 Conceptual

expert

Which statement about Django's built-in permission system is TRUE?

Select the correct statement about how Django's built-in permission system works.

A Custom permissions cannot be added to models without modifying Django's core code.

B Permissions are stored as strings and checked by comparing strings manually in views.

C Django automatically creates add, change, delete, and view permissions for each model.

D Permissions are only assigned directly to users; groups do not affect permissions.

💡 Hint

Think about what Django does automatically when you create models.

Django creates default permissions (add, change, delete, view) for each model automatically. Groups can have permissions, and custom permissions can be added via model Meta class.