Giving default permissions or a default group to new users

djangodjango-permissionspython-social-auth

Default behaviour seems to be new users have no permissions and no groups. However I'd like not to have to manually grant every single new users basic permissions, and I'd assume they'd like not to have to wait for me to do so.

How should I assign default permissions for new users?

Some similar questions have been asked but with no clear answer for the general case:

I'm using python-social-auth so I don't have my own create-user form and view which I guess is where everyone else sets default permissions. I assume I need an on-user-create hook of some sort but not sure what the cleanest approach is.

This is unrelated to creating the default possible permissions that may be granted to users, although for reference,

Best Answer

You can subscribe to post_save signal on User model and put newly created user to desired group or add permissions.

from django.contrib.auth.models import Group

def add_to_default_group(sender, **kwargs):
    user = kwargs["instance"]
    if kwargs["created"]:
        group = Group.objects.get(name='groupname')
        user.groups.add(group)

And on django 1.8+ put following code into your AppConfig.ready()

from django.conf import settings

post_save.connect(add_to_default_group, sender=settings.AUTH_USER_MODEL)

Related Solutions

How to use Django permissions without defining a content type or model

For those of you, who are still searching:

You can create an auxiliary model with no database table. That model can bring to your project any permission you need. There is no need to deal with ContentType or create Permission objects explicitly.

from django.db import models
        
class RightsSupport(models.Model):
            
    class Meta:
        
        managed = False  # No database table creation or deletion  \
                         # operations will be performed for this model. 
                
        default_permissions = () # disable "add", "change", "delete"
                                 # and "view" default permissions

        permissions = ( 
            ('customer_rights', 'Global customer rights'),  
            ('vendor_rights', 'Global vendor rights'), 
            ('any_rights', 'Global any rights'), 
        )

Right after manage.py makemigrations and manage.py migrate you can use these permissions like any other.

# Decorator

@permission_required('app.customer_rights')
def my_search_view(request):
    …

# Inside a view

def my_search_view(request):
    request.user.has_perm('app.customer_rights')

# In a template
# The currently logged-in user’s permissions are stored in the template variable {{ perms }}

{% if perms.app.customer_rights %}
    <p>You can do any customer stuff</p>
{% endif %}

Django REST Framework viewset per-action permissions

In DRF documentation,

Note: The instance-level has_object_permission method will only be called if the view-level has_permission checks have already passed

Let's assume following permission about user object

List : staff only
Create : anyone
Retrieve : own self or staff
Update, Partial update : own self or staff
Destroy : staff only

permissons.py

from rest_framework import permissions

class UserPermission(permissions.BasePermission):

    def has_permission(self, request, view):
        if view.action == 'list':
            return request.user.is_authenticated() and request.user.is_admin
        elif view.action == 'create':
            return True
        elif view.action in ['retrieve', 'update', 'partial_update', 'destroy']:
            return True
        else:
            return False
                                                                                                
    def has_object_permission(self, request, view, obj):
        # Deny actions on objects if the user is not authenticated
        if not request.user.is_authenticated():
            return False

        if view.action == 'retrieve':
            return obj == request.user or request.user.is_admin
        elif view.action in ['update', 'partial_update']:
            return obj == request.user or request.user.is_admin
        elif view.action == 'destroy':
            return request.user.is_admin
        else:
            return False

views.py

from .models import User
from .permissions import UserPermission
from .serializers import UserSerializer
from rest_framework import viewsets


class UserViewSet(viewsets.ModelViewSet):
    queryset = User.objects.all()
    serializer_class = UserSerializer
    permission_classes = (UserPermission,)

For Django 2.0 replace is_authenticated() with is_authenticated. The method has been turned into an attribute.

Best Answer

Related Solutions

How to use Django permissions without defining a content type or model

Django REST Framework viewset per-action permissions

Related Topic