read permissions in django

Question

I am confused about my permissions options. It seems I can write permissions directly on the model, I can use the permission_required decorator on my view, and I can use the {{ perms }} variable in my template.

Q1: Are these intended to all be used together, reinforcing each other, or are they separate options that may even be mutually exclusive, or redundant and therefore not DRY?

Q2: What happens when a user has access to model 1, but not model 2, where 1 and 2 have a foreign key relation to each other? Are lookups automatically blocked (permission denied) even when the user does not access Model 2 directly? What if some of that content comes up in an onsite search request?

Q3: I’m pretty sure I don’t need or want object or field or row level permissions – unless that’s the best way to deny access to the FK?

Answer 1

A1: Django comes with three default permissions "add", "change" and "delete". From the admin site each permission could allow you to access the "add", "change" and "delete" form respectively. Therefore, one has nothing to do with the other. This is how these three permissions have been implemented in the Django core. However, you can add your own custom permissions as you like such as "view", "foo", "can_search" and etc. Permissions are nothing but a flag, what is important is how you implement the behavior to respond to those custom defined permissions. For example you can say test user.has_perm(myapp.can_search.MyModel) and if it passes then user can search this if not then user cannot search. Therefore, for custom permissions implementation is up to you.

A2: To answer this question again it depends on the implementation.

A3:Why would you want to deny access to FK? You need to define access to Model I think that would solve your problem. By the way object level permissions are defined per object instance and has noting to do with FK. For instance if you have 200 projects and you have an instance of project#10 then by means of object permission you can test to see if a user has permission for that specific project instance.

Anyways you can read more about permissions here https://docs.djangoproject.com/en/dev/topics/auth/default/#topic-authorization and also for object permissions you can look at https://pythonhosted.org/django-guardian/. Additionally, there are ton of posts here in this site about Django permissions.