Django form for creating users with different permissions - django

Question

I'm working on a Django system where there are four levels of users:
1. Basic (access only)
2. Admin (can update/change/delete)
3. Gatekeeper (can only create Admin users, cannot update/change/delete)
4. Developer (true superuser)
I think I have the permissions somewhat figured out:
from django.conf import settings
from django.contrib.auth.models import (
BaseUserManager, AbstractBaseUser
)
from django.core.validators import RegexValidator
from django.db import models
from django.db.models.signals import post_save
class CustomUserManager(BaseUserManager):
"""Customer User."""
def create_user(self, email, password=None):
"""Creates and saves a user."""
if not email:
raise ValueError('Users must have an email address')
user = self.model(
email=self.normalize_email(email),
)
user.set_password(password)
user.save(using=self._db)
return user
def create_admin(self, email):
"""Creates and saves an admin user with a temporary password."""
user = self.create_user(
email,
password=BaseUserManager.make_random_password(self, 12)
)
user.is_admin = True
user.save(using=self.db)
return user
def create_gatekeeper(self, email, password):
"""Creates and saves a gatekeeper."""
user = self.create_user(
email,
password=password,
)
user.is_admin = True
user.is_gatekeeper = True
user.save(using=self.db)
return user
def create_superuser(self, email, password):
"""Creates and saves a superuser."""
user = self.create_user(
email,
password=password,
)
user.is_admin = True
user.is_gatekeeper = True
user.is_developer = True
user.save(using=self._db)
return user
class CustomUser(AbstractBaseUser):
email = models.EmailField(
verbose_name='email address',
max_length=255,
unique=True,
)
is_active = models.BooleanField(default=True)
is_admin = models.BooleanField(default=False)
is_gatekeeper = models.BooleanField(default=False)
is_developer = models.BooleanField(default=False)
objects = CustomUserManager()
USERNAME_FIELD = 'email'
REQUIRED_FIELDS = []
# def __str__(self):
# return self.email
def __str__(self):
return self.email
def has_perm(self, perm, obj=None):
# Does the user have a specific permission?
# Simplest possible answer: Yes, always
return True
def has_module_perms(self, app_label):
# "Does the user have permissions to view the app `app_label`?"
# Simplest possible answer: Yes, always
return True
class Meta:
db_table = 'customuser'
verbose_name = 'CustomUser'
However, I'm not making the connection with how to create gatekeepers and admins. I know I can do it via the command line, but I want
a) a form where developers can create gatekeepers
b) a form where gatekeepers can create admins
Since our administrative site will need to be heavily customized, we will not be using the Django Admin and will likely be building our own functionality. How would I go about calling something like create_gatekeeper inside of a Django form? Would subclassing the Django Admin pages and customizing those be a better way to go?

Answer 1

You probabily should work with Groups and add permissions to those groups;;; but in 3 of yours Actors you can use django builtin attributes from User models...
User: You regular user just create as User class with anything else as is_something...
Admin You can use attribute is_staff that attribute comes from User Models, and allow your user to access django admin...
Developer You can create him as Super User, so all permissions is self added to your models
The thing is about gatekeeper, so if you start to create flags as is_admin, is_gatekeeper and etc... you will start to handle multiple attributes, and this is bad ideia, so when you are working with groups you can create User Group, Developer Group (since they are super admin you dont really need to do that), Admin Group (add each permission you want to give to this groups [Eg. Blog Models you can give to him blog add_blog, change_blog and delete_blog, but you can add your custom too]) same as other groups...
Eg.
# List of my Permissions that i want to add to my groups
PERMISSIONS = {
STUDENT : ['add_student', 'change_student',
'delete_student', 'editpreview_student'],
PROJECT: ['add_project', 'change_project', 'delete_project', 'editpreview_project'],
}
# Creating 2 Groups
grupo_admin, created = Group.objects.get_or_create(name='admin')
grupo_teachers, created = Group.objects.get_or_create(name='teacher')
for func_perm in PERMISSIONS [STUDENT]:
perm = Permission.objects.get(codename=func_perm)
grupo_admin.permissions.add(perm) # Adding Student Permission to my Admin Group
grupo_teachers.permissions.add(perm) # Adding Student Permission to my Teachers Group
for func_perm in PERMISSOES[PROJECT]:
perm = Permission.objects.get(codename=func_perm)
grupo_admin.permissions.add(perm) # Adding Project Permission only to my Admin Group
In your views you can check the permission like that
#user_passes_test(lambda u: u.has_perm('myapp.permission_code'))
def some_view(request):
# ...
And your HTML you can check like that
{% if perms.student.change_student %}
<li>
<a href="/admin/student/student/">
<i class="fa fa-graduation-cap" aria-hidden="true"></i>
<span>Students</span>
</a>
</li>
{% endif %}