CODEWITHSUNDEEP
djangopermissionssystemauthentication
Arya Mz
Arya Mz

Reputation: 591

Differences between various permission levels in Django

As far as I know, there are 3 permission levels available to use in django (whether by django itself or by using 3rd party apps). 1) Model-based permission 2) Object based permission 3) Row-based permission

It would be great if you tell me the exact differences between these 3 levels of permission system.

Upvotes: 0

Views: 503

Answers (1)

Chris Pratt
Chris Pratt

Reputation: 239380

Not sure where you got that info, but it's not even remotely correct. Django technically doesn't have any permission system. The auth contrib app adds a system of "permissions" but it's optional and could be replaced entirely with something else. The admin app (also a contrib package, and optional) uses auth, so if you're talking about the Django admin, or using the auth package with your own app(s), then we can talk.

In auth, you have Users, Groups and Permissions. Users come in either "superuser" or "regular" user flavors, and every model in your project gets three Permissions automatically when you run syncdb (with auth included in INSTALLED_APPS): can_add, can_change, and can_delete. Users marked as "superusers" (is_superuser == True), can take any action on any model. Other users need to have Permissions explicitly assigned to them. Further, Groups may have Permissions assigned to them, and then, any User assigned to that Group inherits those permissions.

So, a user could have no ability to do anything with any model, some combination of add, change or delete capability with some or all models or complete access to do anything with any model. There's no concept of "object-based" permissions, in the sense of an "instance". You can either either edit every instance of an model or none. There's also no concept of "row-based" permission. A row in the database table is merely an instance of the model, anyways.

Upvotes: 2

Related Questions