Built-in permission system in Django - Mini Project: Build & Apply

Built-in permission system

📖 Scenario: You are building a simple Django app to manage articles. You want to control who can add, change, or delete articles using Django's built-in permission system.

🎯 Goal: Create a Django model for articles, configure the built-in permission system, and check permissions in a view.

📋 What You'll Learn

Create a Django model named Article with a title and content field

Define a variable user representing the current user

Use Django's built-in permission system to check if user has permission to add an article

Use Django's built-in permission system to check if user has permission to change an article

Use Django's built-in permission system to check if user has permission to delete an article

💡 Why This Matters

🌍 Real World

Many web apps need to control who can add, edit, or delete content. Django's built-in permission system helps manage this easily.

💼 Career

Understanding Django permissions is important for backend developers working on secure web applications.

1

Create the Article model

Create a Django model named Article in models.py with a title field as CharField of max length 100 and a content field as TextField.

Django

from django.db import models

# Define the Article model
# Your code here

Hint

Use models.CharField for short text and models.TextField for longer text.

2

Set up the user variable

In your Django view file, create a variable named user that represents the current logged-in user by assigning request.user.

Django

from django.db import models

class Article(models.Model):
    title = models.CharField(max_length=100)
    content = models.TextField()

# Set the user variable to the current logged-in user
user = null  # Your code here

Hint

Use request.user to get the current user in a Django view.

3

Check add, change, and delete permissions

Use Django's built-in permission system to check if user has permission to add, change, and delete Article objects. Create three variables: can_add, can_change, and can_delete. Use user.has_perm() with the permission strings 'app_label.add_article', 'app_label.change_article', and 'app_label.delete_article' respectively. Replace app_label with myapp.

Django

from django.db import models

class Article(models.Model):
    title = models.CharField(max_length=100)
    content = models.TextField()

# In views.py
user = request.user

# Create variables can_add, can_change, can_delete to check permissions
# Your code here

Hint

Permission strings follow the pattern 'app_label.action_modelname'.

4

Use permissions to control access

In your Django view, use an if statement to check if can_add is true. If yes, create a variable message with the value 'User can add articles.'. Otherwise, set message to 'User cannot add articles.'.

Django

from django.db import models

class Article(models.Model):
    title = models.CharField(max_length=100)
    content = models.TextField()

# In views.py
user = request.user

can_add = user.has_perm('myapp.add_article')
can_change = user.has_perm('myapp.change_article')
can_delete = user.has_perm('myapp.delete_article')

# Set message based on can_add permission
# Your code here

Hint

Use a simple if statement to set the message based on permission.

Practice

1. What is the purpose of Django's built-in permission system?

easy

A. To control what actions users can perform in the application

B. To manage database migrations automatically

C. To style the user interface with CSS

D. To optimize query performance

Solution

1. Step 1: Understand the role of permissions

   Django's permission system is designed to control user access and actions within the app.

2. Step 2: Eliminate unrelated options

   Options about migrations, styling, and query optimization are unrelated to permissions.

3. Final Answer:

   To control what actions users can perform in the application -> Option A

4. Quick Check:

   Permission system controls user actions = D [OK]

Hint: Permissions control user actions, not database or styling [OK]

Common Mistakes:

• Confusing permissions with database migrations
• Thinking permissions handle UI styling
• Assuming permissions optimize queries

2. Which of the following is the correct way to check if a user has a permission in Django?

easy

A. user.permission('app_label.permission_codename')

B. user.check_permission('app_label.permission_codename')

C. user.has_perm('app_label.permission_codename')

D. user.can('app_label.permission_codename')

Solution

1. Step 1: Recall Django's permission check method

   The correct method to check permissions is has_perm on the user object.

2. Step 2: Verify method names

   Other options like check_permission, permission, or can do not exist in Django's user model.

3. Final Answer:

   user.has_perm('app_label.permission_codename') -> Option C

4. Quick Check:

   Use has_perm() to check permissions = A [OK]

Hint: Remember: user.has_perm() is the official permission check [OK]

Common Mistakes:

• Using incorrect method names like check_permission
• Trying to call permission as a property
• Assuming 'can' method exists on user

3. Given the following code snippet, what will be the output if the user has the permission 'blog.add_post'?

if user.has_perm('blog.add_post'):
    print('Permission granted')
else:
    print('Permission denied')

medium

A. Permission granted

B. Error: has_perm method not found

C. Permission denied

D. No output

Solution

1. Step 1: Understand the has_perm method behavior

   If the user has the permission 'blog.add_post', has_perm returns True.

2. Step 2: Follow the if-else logic

   Since has_perm returns True, the code prints 'Permission granted'.

3. Final Answer:

   Permission granted -> Option A

4. Quick Check:

   has_perm True prints 'Permission granted' = C [OK]

Hint: True from has_perm means permission granted message [OK]

Common Mistakes:

• Assuming has_perm returns False incorrectly
• Expecting an error from has_perm method
• Thinking no output occurs

4. Identify the error in this code snippet that checks user permissions:

if user.has_perm('blog.add_post'):
print('Allowed')
else:
print('Denied')

medium

A. Incorrect permission codename format

B. Using print instead of return

C. has_perm method does not exist on user

D. Missing indentation inside if and else blocks

Solution

1. Step 1: Check Python syntax rules for blocks

   Python requires indentation inside if and else blocks to define their scope.

2. Step 2: Identify the missing indentation

   The print statements are not indented, causing a syntax error.

3. Final Answer:

   Missing indentation inside if and else blocks -> Option D

4. Quick Check:

   Python needs indentation in blocks = B [OK]

Hint: Always indent code inside if/else blocks in Python [OK]

Common Mistakes:

• Ignoring indentation errors
• Thinking permission codename format is wrong
• Assuming has_perm method is missing
• Confusing print with return in this context

5. You want to assign the permission 'polls.change_vote' to a group named 'Editors'. Which is the correct way to do this in Django?

hard

A. group = Group.objects.create(name='Editors')
permission = Permission.objects.filter(codename='change_vote')
group.add_permission(permission)

B. group = Group.objects.get(name='Editors')
permission = Permission.objects.get(codename='change_vote', content_type__app_label='polls')
group.permissions.add(permission)

C. group = Group.get(name='Editors')
permission = Permission.get(codename='change_vote')
group.permissions.append(permission)

D. group = Group.objects.get(name='Editors')
permission = Permission.objects.get(name='change_vote')
group.permissions.add(permission)

Solution

1. Step 1: Retrieve the existing group and permission correctly

   Use Group.objects.get(name='Editors') to get the group. Use Permission.objects.get with codename and content_type__app_label to get the exact permission.

2. Step 2: Add the permission to the group's permissions

   Use group.permissions.add(permission) to assign the permission.

3. Final Answer:

   group = Group.objects.get(name='Editors') permission = Permission.objects.get(codename='change_vote', content_type__app_label='polls') group.permissions.add(permission) -> Option B

4. Quick Check:

   Use get() and add() with correct filters = A [OK]

Hint: Use get() with codename and add() to assign permission [OK]

Common Mistakes:

• Using create() instead of get() for existing group
• Using filter() without get() for single permission
• Wrong method names like add_permission or append
• Using name instead of codename for permission lookup