Group-based permissions in Django - Mini Project: Build & Apply

Group-based permissions

📖 Scenario: You are building a Django web app where users belong to groups that control what they can do. You want to set up groups and assign permissions to control access.

🎯 Goal: Create groups with specific permissions and assign users to these groups to manage access control in your Django app.

📋 What You'll Learn

Create groups named exactly Editors and Viewers

Assign the permission add_article to the Editors group

Assign the permission view_article to the Viewers group

Assign a user named john to the Editors group

💡 Why This Matters

🌍 Real World

Many web apps need to control what users can do. Group-based permissions let you manage access easily by assigning users to groups with specific rights.

💼 Career

Understanding group-based permissions is essential for backend developers working with Django to build secure and maintainable applications.

1

Create groups

Create two groups named exactly Editors and Viewers using Django's Group model.

Django

from django.contrib.auth.models import Group

# Create groups Editors and Viewers
# Your code here

Hint

Use Group.objects.create(name='GroupName') to create groups.

2

Assign permissions to groups

Assign the permission add_article to the Editors group and the permission view_article to the Viewers group. Use Django's Permission model and add permissions to the groups.

Django

from django.contrib.auth.models import Group

Editors = Group.objects.create(name='Editors')
Viewers = Group.objects.create(name='Viewers')

from django.contrib.auth.models import Permission

# Assign add_article permission to Editors
# Assign view_article permission to Viewers
# Your code here

Hint

Use Permission.objects.get(codename='permission_codename') to get permissions and then add them to groups with group.permissions.add(permission).

3

Assign user to group

Assign the user named john to the Editors group. Use Django's User model to get the user and add the group.

Django

from django.contrib.auth.models import Group

Editors = Group.objects.create(name='Editors')
Viewers = Group.objects.create(name='Viewers')

from django.contrib.auth.models import Permission

add_article_perm = Permission.objects.get(codename='add_article')
view_article_perm = Permission.objects.get(codename='view_article')

Editors.permissions.add(add_article_perm)
Viewers.permissions.add(view_article_perm)

from django.contrib.auth.models import User

# Get user john and add to Editors group
# Your code here

Hint

Use User.objects.get(username='john') to get the user and then john.groups.add(Editors) to add the group.

4

Save changes and verify

Save the user john after adding the group and verify that john has the add_article permission through the group.

Django

from django.contrib.auth.models import Group

Editors = Group.objects.create(name='Editors')
Viewers = Group.objects.create(name='Viewers')

from django.contrib.auth.models import Permission

add_article_perm = Permission.objects.get(codename='add_article')
view_article_perm = Permission.objects.get(codename='view_article')

Editors.permissions.add(add_article_perm)
Viewers.permissions.add(view_article_perm)

from django.contrib.auth.models import User

john = User.objects.get(username='john')
john.groups.add(Editors)

# Save john and check if john has add_article permission
# Your code here

Hint

Call john.save() to save changes. Use john.has_perm('app_label.add_article') to check permission (replace app_label with your app's label).

Practice

1. What is the main purpose of using groups in Django permissions?

easy

A. To create new database tables automatically

B. To speed up the Django server

C. To assign permissions to multiple users at once

D. To change the user password policy

Solution

1. Step 1: Understand the role of groups in Django

   Groups are used to organize users and assign permissions collectively.

2. Step 2: Identify the main benefit

   Assigning permissions to groups lets you manage many users easily without setting permissions individually.

3. Final Answer:

   To assign permissions to multiple users at once -> Option C

4. Quick Check:

   Groups simplify permission management = B [OK]

Hint: Groups bundle permissions for many users quickly [OK]

Common Mistakes:

• Thinking groups create database tables
• Believing groups affect server speed
• Confusing groups with password policies

2. Which of the following is the correct way to check if a user has a permission in Django?

easy

A. user.can('app_label.codename')

B. user.check_permission('app_label.codename')

C. user.permission('app_label.codename')

D. user.has_perm('app_label.codename')

Solution

1. Step 1: Recall Django's permission check method

   The correct method to check permissions is has_perm on the user object.

2. Step 2: Match the method name exactly

   Only user.has_perm('app_label.codename') is valid syntax.

3. Final Answer:

   user.has_perm('app_label.codename') -> Option D

4. Quick Check:

   Permission check method = has_perm [OK]

Hint: Use user.has_perm() to check permissions [OK]

Common Mistakes:

• Using incorrect method names like check_permission
• Confusing method names with permission attributes
• Missing the app_label.codename format

3. Given the following code, what will print(user.has_perm('blog.add_post')) output if the user belongs to a group with the 'add_post' permission?

from django.contrib.auth.models import User, Group, Permission
user = User.objects.create(username='alice')
group = Group.objects.create(name='Editors')
permission = Permission.objects.get(codename='add_post')
group.permissions.add(permission)
user.groups.add(group)

medium

A. False

B. True

C. Raises AttributeError

D. None

Solution

1. Step 1: Understand group permission assignment

   The group 'Editors' has the 'add_post' permission added, and the user is added to this group.

2. Step 2: Check if user inherits group permissions

   Users automatically get permissions from their groups, so user.has_perm('blog.add_post') returns True.

3. Final Answer:

   True -> Option B

4. Quick Check:

   User in group with permission = True [OK]

Hint: User inherits group permissions automatically [OK]

Common Mistakes:

• Assuming user permissions must be assigned directly
• Expecting False because user has no direct permission
• Thinking code raises error due to missing user.save()

4. Identify the error in this code snippet that tries to add a user to a group and assign a permission:

user = User.objects.get(username='bob')
group = Group.objects.get(name='Authors')
permission = Permission.objects.get(codename='change_article')
group.permissions.add(permission)
user.groups.add(group)
print(user.has_perm('app.change_article'))

medium

A. The app label in has_perm is wrong

B. Group permissions cannot be added this way

C. User must be saved after adding group

D. The permission codename is incorrect

Solution

1. Step 1: Check the permission codename and app label

   The permission codename is 'change_article', but the app label used in has_perm is 'app', which is likely incorrect.

2. Step 2: Confirm correct app label usage

   The has_perm method requires the correct app label prefix matching the permission's app.

3. Final Answer:

   The app label in has_perm is wrong -> Option A

4. Quick Check:

   App label must match permission = D [OK]

Hint: Match app label exactly in has_perm string [OK]

Common Mistakes:

• Thinking user needs save() after group add
• Believing group.permissions.add() is invalid
• Assuming codename is always 'change_article' without app context

5. You want to create a group 'Moderators' that can both add and delete comments in your Django app 'forum'. Which of the following code snippets correctly assigns these permissions to the group and adds a user to it?

hard

A. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='add_comment')
del_perm = Permission.objects.get(codename='delete_comment')
group.permissions.add(add_perm, del_perm)
user.groups.add(group)

B. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='forum.add_comment')
del_perm = Permission.objects.get(codename='forum.delete_comment')
group.permissions.add(add_perm, del_perm)
user.groups.add(group)

C. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='add_comment')
del_perm = Permission.objects.get(codename='delete_comment')
group.permissions.set([add_perm])
user.groups.add(group)

D. group = Group.objects.create(name='Moderators')
add_perm = Permission.objects.get(codename='add_comment')
del_perm = Permission.objects.get(codename='delete_comment')
group.permissions.set(add_perm, del_perm)
user.groups.add(group)

Solution

1. Step 1: Identify correct permission codenames and usage

   Permission codenames do not include app label prefix in get(codename=...). The app label is used only in has_perm checks.

2. Step 2: Check correct method to add multiple permissions

   group.permissions.add() accepts multiple Permission objects; set() expects an iterable, not separate arguments.

3. Step 3: Verify user group addition

   user.groups.add(group) correctly adds the user to the group.

4. Final Answer:

   uses correct codenames and permissions.add() for multiple permissions -> Option A

5. Quick Check:

   Use codename only and add() for multiple permissions = C [OK]

Hint: Use codename only and add() for multiple permissions [OK]

Common Mistakes:

• Including app label in Permission.objects.get(codename=...)
• Using set() with multiple arguments instead of a list
• Confusing add() and set() method usage