Group-based permissions in Django - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this Django group permission check?

Consider a Django view where a user belongs to a group named 'editors'. The view checks if the user has permission 'blog.change_post' via group membership. What will be the output of the permission check if the group 'editors' has the 'change_post' permission assigned?

Django

from django.contrib.auth.models import Group
user = request.user
has_perm = user.has_perm('blog.change_post')
print(has_perm)

A Raises AttributeError

B False

C True

D None

💡 Hint

Remember that Django checks user permissions including those granted by groups.

If the user belongs to a group that has the 'change_post' permission, user.has_perm('blog.change_post') returns True. Django automatically includes group permissions in this check.

📝 Syntax

intermediate

Identify the correct way to add a user to a group in Django

Which of the following code snippets correctly adds a user to a group named 'managers'?

A

group = Group.objects.get(name='managers')
user.groups.add(group)

B user.add_group('managers')

C Group.add_user(user, 'managers')

D user.groups.append('managers')

💡 Hint

Check the Django documentation for the correct method to add a group to a user's groups.

In Django, to add a user to a group, you first get the group object and then use user.groups.add(group). The other options use invalid methods or attributes.

🔧 Debug

advanced

Why does this permission check always return False?

A developer writes this code to check if a user has permission 'app.delete_item'. The user belongs to a group with this permission, but the check returns False. What is the likely cause?

Django

if request.user.has_perm('app.delete_item'):
    print('Permission granted')
else:
    print('Permission denied')

A User's group permissions are not automatically checked by has_perm

B The permission codename is incorrect or missing app label

C The user is not authenticated

D The permission is assigned to the user directly, not the group

💡 Hint

Check the exact permission string format: it must be '.'.

If the permission string is incorrect or missing the app label, has_perm will always return False even if the user belongs to a group with the correct permission.

❓ state_output

advanced

What is the number of permissions a user has after adding two groups with overlapping permissions?

A user belongs to two groups: 'writers' and 'editors'. Both groups have the permission 'blog.add_post'. The 'writers' group also has 'blog.view_post'. How many unique permissions does the user have?

Django

from django.contrib.auth.models import User
user = User.objects.get(username='alice')
permissions = user.get_all_permissions()
print(len(permissions))

A 4

B 3

C 1

D 2

💡 Hint

Remember that permissions are unique and duplicates from groups count only once.

The user has two unique permissions: 'blog.add_post' (from both groups, counted once) and 'blog.view_post' (from 'writers'). So total is 2.

🧠 Conceptual

expert

Which statement best describes Django's group-based permission inheritance?

Select the statement that correctly explains how Django handles permissions for users assigned to groups.

A Users inherit all permissions assigned to their groups automatically when checking permissions.

B Permissions assigned to groups override user permissions and cannot be combined.

C Group permissions are ignored unless explicitly checked with group.has_perm().

D Users must manually copy group permissions to their user permissions to inherit them.

💡 Hint

Think about how Django's has_perm method works with groups.

Django automatically includes permissions from all groups a user belongs to when checking user.has_perm(). No manual copying or separate checks are needed.

Practice

1. What is the main purpose of using groups in Django permissions?

easy

A. To create new database tables automatically

B. To speed up the Django server

C. To assign permissions to multiple users at once

D. To change the user password policy

Solution

1. Step 1: Understand the role of groups in Django

   Groups are used to organize users and assign permissions collectively.

2. Step 2: Identify the main benefit

   Assigning permissions to groups lets you manage many users easily without setting permissions individually.

3. Final Answer:

   To assign permissions to multiple users at once -> Option C

4. Quick Check:

   Groups simplify permission management = B [OK]

Hint: Groups bundle permissions for many users quickly [OK]

Common Mistakes:

• Thinking groups create database tables
• Believing groups affect server speed
• Confusing groups with password policies

2. Which of the following is the correct way to check if a user has a permission in Django?

easy

A. user.can('app_label.codename')

B. user.check_permission('app_label.codename')

C. user.permission('app_label.codename')

D. user.has_perm('app_label.codename')

Solution

1. Step 1: Recall Django's permission check method

   The correct method to check permissions is has_perm on the user object.

2. Step 2: Match the method name exactly

   Only user.has_perm('app_label.codename') is valid syntax.

3. Final Answer:

   user.has_perm('app_label.codename') -> Option D

4. Quick Check:

   Permission check method = has_perm [OK]

Hint: Use user.has_perm() to check permissions [OK]

Common Mistakes:

• Using incorrect method names like check_permission
• Confusing method names with permission attributes
• Missing the app_label.codename format

3. Given the following code, what will print(user.has_perm('blog.add_post')) output if the user belongs to a group with the 'add_post' permission?

from django.contrib.auth.models import User, Group, Permission
user = User.objects.create(username='alice')
group = Group.objects.create(name='Editors')
permission = Permission.objects.get(codename='add_post')
group.permissions.add(permission)
user.groups.add(group)

medium

A. False

B. True

C. Raises AttributeError

D. None

Solution

1. Step 1: Understand group permission assignment

   The group 'Editors' has the 'add_post' permission added, and the user is added to this group.

2. Step 2: Check if user inherits group permissions

   Users automatically get permissions from their groups, so user.has_perm('blog.add_post') returns True.

3. Final Answer:

   True -> Option B

4. Quick Check:

   User in group with permission = True [OK]

Hint: User inherits group permissions automatically [OK]

Common Mistakes:

• Assuming user permissions must be assigned directly
• Expecting False because user has no direct permission
• Thinking code raises error due to missing user.save()

4. Identify the error in this code snippet that tries to add a user to a group and assign a permission:

user = User.objects.get(username='bob')
group = Group.objects.get(name='Authors')
permission = Permission.objects.get(codename='change_article')
group.permissions.add(permission)
user.groups.add(group)
print(user.has_perm('app.change_article'))

medium

A. The app label in has_perm is wrong

B. Group permissions cannot be added this way

C. User must be saved after adding group

D. The permission codename is incorrect

Solution

1. Step 1: Check the permission codename and app label

   The permission codename is 'change_article', but the app label used in has_perm is 'app', which is likely incorrect.

2. Step 2: Confirm correct app label usage

   The has_perm method requires the correct app label prefix matching the permission's app.

3. Final Answer:

   The app label in has_perm is wrong -> Option A

4. Quick Check:

   App label must match permission = D [OK]

Hint: Match app label exactly in has_perm string [OK]

Common Mistakes:

• Thinking user needs save() after group add
• Believing group.permissions.add() is invalid
• Assuming codename is always 'change_article' without app context

5. You want to create a group 'Moderators' that can both add and delete comments in your Django app 'forum'. Which of the following code snippets correctly assigns these permissions to the group and adds a user to it?

hard

A. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='add_comment')
del_perm = Permission.objects.get(codename='delete_comment')
group.permissions.add(add_perm, del_perm)
user.groups.add(group)

B. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='forum.add_comment')
del_perm = Permission.objects.get(codename='forum.delete_comment')
group.permissions.add(add_perm, del_perm)
user.groups.add(group)

C. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='add_comment')
del_perm = Permission.objects.get(codename='delete_comment')
group.permissions.set([add_perm])
user.groups.add(group)

D. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='add_comment')
del_perm = Permission.objects.get(codename='delete_comment')
group.permissions.set(add_perm, del_perm)
user.groups.add(group)

Solution

1. Step 1: Identify correct permission codenames and usage

   Permission codenames do not include app label prefix in get(codename=...). The app label is used only in has_perm checks.

2. Step 2: Check correct method to add multiple permissions

   group.permissions.add() accepts multiple Permission objects; set() expects an iterable, not separate arguments.

3. Step 3: Verify user group addition

   user.groups.add(group) correctly adds the user to the group.

4. Final Answer:

   uses correct codenames and permissions.add() for multiple permissions -> Option A

5. Quick Check:

   Use codename only and add() for multiple permissions = C [OK]

Hint: Use codename only and add() for multiple permissions [OK]

Common Mistakes:

• Including app label in Permission.objects.get(codename=...)
• Using set() with multiple arguments instead of a list
• Confusing add() and set() method usage