Django permission row table to a determinate user - django

Question

i'm asking a questions about permissions, i have 2 table, AnagraficaCliente and Tracking with relation 1 to many, autentichate of user is default built in with a django.contrib.auth.urls.
I searched many forum and site but i d ont understand how set permission on row for determinate users. For example:
My site is a web track to show shipped items, if i search a tracking for a user it worked, but all tracking are visible (for all users), i want that only the tracking that belongs to user show to him.
I think that i use model user from
django.contrib.auth.models import User
i don't know how work with my code.
Thanks at all.
models.py
from django.db import models
from django.urls import reverse
# Create your models here.
class AnagraficaCliente(models.Model):
codice_cliente = models.CharField(max_length=20, primary_key=True, null=False, unique=True)
ragione_sociale = models.CharField(max_length=80)
#ragione_sociale_dest = models.CharField(max_length=40)
nome = models.CharField(max_length=40, blank=True)
cognome = models.CharField(max_length=20, blank=True)
#ragione_sociale = models.CharField(max_length=20)
indirizzo = models.TextField(blank=True)
cap = models.CharField(max_length=5, blank=True)
piva = models.CharField(max_length=20, blank=True)
vatnumber = models.CharField(max_length=20, blank=True)
#ragione_sociale_dest = models.CharField(max_length=40)
#indirizzo_dest = models.TextField(null=True)
def __str__(self):
#return self.ragione_sociale + " " + self.codice_cliente
#return self.ragione_sociale_dest + " - " + self.indirizzo_dest + " - " + self.codice_cliente
return self.codice_cliente + " - " + self.ragione_sociale
class Meta:
verbose_name = "AnagraficaCliente"
verbose_name_plural = "AnagraficaClienti"
class Tracking(models.Model):
track = models.CharField(max_length=11, null=False, unique=True, primary_key=True)
indirizzo_dest = models.TextField(null=False)
passaggio1 = models.CharField(max_length=50, blank=True)
data1 = models.DateField(blank=True, null=True)
passaggio2 = models.CharField(max_length=50, blank=True)
data2 = models.DateField(blank=True, null=True)
passaggio3 = models.CharField(max_length=50, blank=True)
data3 = models.DateField(blank=True, null=True)
passaggio4 = models.CharField(max_length=50, blank=True)
data4 = models.DateField(blank=True, null=True)
passaggio5 = models.CharField(max_length=50, blank=True)
data5 = models.DateField(blank=True, null=True)
consegna = (
('C', 'Consegnato'),
('N', 'Non consegnato'),
)
consegnato = models.CharField(
max_length=1, choices=consegna, blank=True, null=True)
#consegnato = models.BooleanField(blank=True)
#esito = models.CharField(max_length=10, blank=True)
flag = models.CharField(max_length=2, blank=True)
AnagraficaCliente = models.ForeignKey(AnagraficaCliente, on_delete=models.CASCADE, related_name='trackings')
def __str__(self):
return self.track
class Meta:
verbose_name = "Tracking"
verbose_name_plural = "Trackings"
admin.py
from django.contrib import admin
from .models import AnagraficaCliente, Tracking
from import_export.admin import ImportExportModelAdmin
#from import_export.admin import ImportExportActionModelAdmin
from import_export import resources
# Register your models here.
class ClientResource(resources.ModelResource):
class Meta:
model = AnagraficaCliente
skip_unchanged = True
report_skipped = True
#fields = ('id','codice_cliente','ragione_sociale','nome','cognome','ragione_sociale','indirizzo','cap','piva','vatnumber')
import_id_fields = ['codice_cliente']
#admin.register(AnagraficaCliente)#Decoratore per mostrare in admin anagraficacliente
class SearchCodice(admin.ModelAdmin):
search_fields = ('codice_cliente', 'ragione_sociale')#Ricerca in admin
list_display = ('codice_cliente','ragione_sociale','indirizzo')#Elenco nomi campo nelle tabelle
class ClientAdmin(ImportExportModelAdmin):
resource_class = ClientResource #Classe per import export csv punta alla classe ClientResource
class ClientResource(resources.ModelResource):
class Meta:
model = Tracking
skip_unchanged = True
report_skipped = True
#fields = ('id','codice_cliente','ragione_sociale','nome','cognome','ragione_sociale','indirizzo','cap','piva','vatnumber')
import_id_fields = ['track']
#admin.register(Tracking)
class SearchTrack(admin.ModelAdmin):
search_fields = ('track', 'consegnato')
list_display = ('track','indirizzo_dest','consegnato')

Answer 1

Ok, i solved in this way:
in models i have add a new field that will contain the exact name of user (see the comment):
user = models.CharField(max_length=20, blank=True)
in views in query objects i change this line:
def tracking_views(request):
query = request.GET.get('q', None)
context = {}
#query_anag = AnagraficaCliente.objects.all()
if query and request.method == 'GET':
#results = Tracking.objects.filter(track=query)#Old line, see next line
results = Tracking.objects.filter(track=query, user=request.user) #Line that
changed
print (type(results))
if results.exists():
context.update({'results': results})
print(context)
else:
return render(request,'tracking_not_found.html',context)
# return HttpResponse("<h1>post creato con successo!</h1>")
return render(request,'tracking.html',context)
So when user is authenticated only the query with number of tracking that belongs to a user will be showed, (of course in every record need to mapped the row of tacking to a new field "user")