Built-in permission system in Django - Step-by-Step Execution

Concept Flow - Built-in permission system

Define Model

↓

Django auto-creates permissions

↓

Assign permissions to Users/Groups

↓

Check permissions in views/templates

↓

Allow or deny access based on permission

Django creates default permissions for each model, which you assign to users or groups. Then you check these permissions to control access.

Execution Sample

Django

from django.contrib.auth.models import User
user = User.objects.get(username='alice')
if user.has_perm('app.view_model'):
    print('Access granted')
else:
    print('Access denied')

This code checks if user 'alice' has the permission to view a model in 'app'.

Execution Table

Step	Action	Evaluation	Result
1	Get user 'alice'	User object fetched	user = User object
2	Check permission 'app.view_model'	user.has_perm('app.view_model')	True or False
3	If True	Print 'Access granted'	Output: Access granted
4	If False	Print 'Access denied'	Output: Access denied

💡 Permission check ends with either access granted or denied message

Variable Tracker

Variable	Start	After Step 1	After Step 2	Final
user	None	User object for 'alice'	User object for 'alice'	User object for 'alice'
permission_check	None	None	True or False	True or False
output	None	None	None	'Access granted' or 'Access denied'

Key Moments - 3 Insights

Why does Django create permissions automatically for models?

Django auto-creates 'add', 'change', 'delete', and 'view' permissions for each model to simplify access control, as shown in the concept flow after defining the model.

How does user.has_perm('app.view_model') know if permission is granted?

It checks the user's assigned permissions and group permissions in the database, as seen in step 2 of the execution table.

What happens if the user does not have the permission?

The code prints 'Access denied' as shown in step 4 of the execution table, preventing unauthorized access.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of 'permission_check' after Step 2?

A Always True

B True or False depending on user permissions

C User object

D None

💡 Hint

Check the 'permission_check' variable in variable_tracker after Step 2

At which step does the program decide what message to print?

A Step 1

B Step 2

C Step 3 or Step 4

D After Step 4

💡 Hint

Look at the 'Action' and 'Result' columns in execution_table rows 3 and 4

If the user is not found, what would happen in this code?

A An error occurs at Step 1

B Permission check runs normally

C Output is 'Access granted'

D Output is 'Access denied'

💡 Hint

Step 1 fetches the user object; if user does not exist, it raises an error before permission check

Concept Snapshot

Django creates default permissions (add, change, delete, view) for each model.
Assign these permissions to users or groups.
Use user.has_perm('app.permission_codename') to check permissions.
Control access in views or templates based on these checks.
If permission is missing, deny access gracefully.

Full Transcript

Django's built-in permission system automatically creates four permissions for each model: add, change, delete, and view. These permissions can be assigned to users or groups to control what actions they can perform. In code, you retrieve a user object and check if they have a specific permission using user.has_perm('app.permission_codename'). Depending on the result, you allow or deny access, for example by printing 'Access granted' or 'Access denied'. This system helps keep your app secure by controlling access based on assigned permissions.

Practice

1. What is the purpose of Django's built-in permission system?

easy

A. To control what actions users can perform in the application

B. To manage database migrations automatically

C. To style the user interface with CSS

D. To optimize query performance

Solution

1. Step 1: Understand the role of permissions

   Django's permission system is designed to control user access and actions within the app.

2. Step 2: Eliminate unrelated options

   Options about migrations, styling, and query optimization are unrelated to permissions.

3. Final Answer:

   To control what actions users can perform in the application -> Option A

4. Quick Check:

   Permission system controls user actions = D [OK]

Hint: Permissions control user actions, not database or styling [OK]

Common Mistakes:

• Confusing permissions with database migrations
• Thinking permissions handle UI styling
• Assuming permissions optimize queries

2. Which of the following is the correct way to check if a user has a permission in Django?

easy

A. user.permission('app_label.permission_codename')

B. user.check_permission('app_label.permission_codename')

C. user.has_perm('app_label.permission_codename')

D. user.can('app_label.permission_codename')

Solution

1. Step 1: Recall Django's permission check method

   The correct method to check permissions is has_perm on the user object.

2. Step 2: Verify method names

   Other options like check_permission, permission, or can do not exist in Django's user model.

3. Final Answer:

   user.has_perm('app_label.permission_codename') -> Option C

4. Quick Check:

   Use has_perm() to check permissions = A [OK]

Hint: Remember: user.has_perm() is the official permission check [OK]

Common Mistakes:

• Using incorrect method names like check_permission
• Trying to call permission as a property
• Assuming 'can' method exists on user

3. Given the following code snippet, what will be the output if the user has the permission 'blog.add_post'?

if user.has_perm('blog.add_post'):
    print('Permission granted')
else:
    print('Permission denied')

medium

A. Permission granted

B. Error: has_perm method not found

C. Permission denied

D. No output

Solution

1. Step 1: Understand the has_perm method behavior

   If the user has the permission 'blog.add_post', has_perm returns True.

2. Step 2: Follow the if-else logic

   Since has_perm returns True, the code prints 'Permission granted'.

3. Final Answer:

   Permission granted -> Option A

4. Quick Check:

   has_perm True prints 'Permission granted' = C [OK]

Hint: True from has_perm means permission granted message [OK]

Common Mistakes:

• Assuming has_perm returns False incorrectly
• Expecting an error from has_perm method
• Thinking no output occurs

4. Identify the error in this code snippet that checks user permissions:

if user.has_perm('blog.add_post'):
print('Allowed')
else:
print('Denied')

medium

A. Incorrect permission codename format

B. Using print instead of return

C. has_perm method does not exist on user

D. Missing indentation inside if and else blocks

Solution

1. Step 1: Check Python syntax rules for blocks

   Python requires indentation inside if and else blocks to define their scope.

2. Step 2: Identify the missing indentation

   The print statements are not indented, causing a syntax error.

3. Final Answer:

   Missing indentation inside if and else blocks -> Option D

4. Quick Check:

   Python needs indentation in blocks = B [OK]

Hint: Always indent code inside if/else blocks in Python [OK]

Common Mistakes:

• Ignoring indentation errors
• Thinking permission codename format is wrong
• Assuming has_perm method is missing
• Confusing print with return in this context

5. You want to assign the permission 'polls.change_vote' to a group named 'Editors'. Which is the correct way to do this in Django?

hard

A. group = Group.objects.create(name='Editors')
permission = Permission.objects.filter(codename='change_vote')
group.add_permission(permission)

B. group = Group.objects.get(name='Editors')
permission = Permission.objects.get(codename='change_vote', content_type__app_label='polls')
group.permissions.add(permission)

C. group = Group.get(name='Editors')
permission = Permission.get(codename='change_vote')
group.permissions.append(permission)

D. group = Group.objects.get(name='Editors')
permission = Permission.objects.get(name='change_vote')
group.permissions.add(permission)

Solution

1. Step 1: Retrieve the existing group and permission correctly

   Use Group.objects.get(name='Editors') to get the group. Use Permission.objects.get with codename and content_type__app_label to get the exact permission.

2. Step 2: Add the permission to the group's permissions

   Use group.permissions.add(permission) to assign the permission.

3. Final Answer:

   group = Group.objects.get(name='Editors') permission = Permission.objects.get(codename='change_vote', content_type__app_label='polls') group.permissions.add(permission) -> Option B

4. Quick Check:

   Use get() and add() with correct filters = A [OK]

Hint: Use get() with codename and add() to assign permission [OK]

Common Mistakes:

• Using create() instead of get() for existing group
• Using filter() without get() for single permission
• Wrong method names like add_permission or append
• Using name instead of codename for permission lookup