olp 0.3.0

Object-level permissions (OLP)

Django has supported object-level permissions since Django 1.2, but it requires a custom authentication backend to implement it. There are tons of implementations out there, but most of them are meant to handle specific situations.

Features

Like most other implementations, OLP is meant to handle a few specific cases which we encountered.

Settings

OLP determines the settings from the Django settings file using the key OLP_SETTINGS. This must be a dictionary which contains the key models, as shown below.

OLP_SETTINGS = {
    "models": (
    ),
}

The models key should contain a tuple of tuples containing the string path to the model and the queryset filter used to filter by a user.

Example

example/settings.py

OLP_SETTINGS = {
    "models": (
        ("django.contrib.auth.models.Group", "users"),
    ),
}

example/models.py

from django.db import models

class Apple(models.Model):
    owner = models.ForeignKey("auth.User")

    class Meta:
        permissions = (
            ("can_see_apple", "User can see the apple."),
        )

python shell

>>> from olp.utils import patch_models
>>> patch_models()
>>> from example.models import Apple
>>> from django.contrib.auth import Group, User
>>> user = User.objects.all()[0]
>>> group = Group.objects.all()[0]
>>> apple = Apple(owner=user)
>>> apple.save()
>>> user.has_perm("example.can_see_apple", apple)
False
>>> user.assign_perm("can_see_apple", apple)
True
>>> user.has_perm("example.can_see_apple", apple)
True
>>> user.remove_perm("example.can_see_apple", apple)
True
>>> user.has_perm("example.can_see_apple", apple)
False
>>> group.has_perm("example.can_see_apple", apple)
False
>>> group.assign_perm("example.can_see_apple", apple)
True
>>> group.has_perm("example.can_see_apple", apple)
True
>>> user.has_perm("example.can_see_apple", apple)
True