How to achieve the division of roles on the website



  • I have an Internet bank website, a role-- client, banker and administrator, how to implement a role system so that the client can't get to the service velves just a banker. LoginMixin checks only if the user's registered, I need to see the role. How can this be realized?



  • You can check whether the user has some rights to the tables according to his role, for example, you have a news table and such a record in the urls.

    ...
    path('news/<slug:slug>/<int:id1>', views.news, name='news'),
    ...
    

    Where slug is "add," "edit," "delete" or "view" and you need to check whether the user has the right (provided directly or through a group). In views, you can check this check has_perm('app_name.permission_object')

    • app_name - Annex name
    • permission - name of permit
    • object - object

    views.py

    def news(request, slug='', id1=-1):
        #  href /news/view - просмотр 
        if slug == 'view' and request.user.has_perm('main.view_news'):
            pass
        #  href /news/add - добавление
        if slug == 'add' and request.user.has_perm('main.add_news'):
            pass
        # href /news/edit - редактирование
        if slug == 'edit' and request.user.has_perm('main.change_news'):
            pass
        #  href /news/delete - удаление
        if slug == 'delete' and request.user.has_perm('main.delete_news'):
            pass
    

    Either if the permits are for the whole drink, you can use the decorator:

    from django.contrib.auth.decorators import permission_required
    ...
    @permission_required('main.view_news')
    def my_protected_view(request):
        pass
    

    This applies to default permits for each table. If necessary, you may also create your own permits. Reading documentation https://docs.djangoproject.com/en/3.2/topics/auth/default/



Suggested Topics

  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2