Hi there!
In my case I have different users which can be part of different companies. An user can belong to multiple companies and a company has multiple customers, products, services, …
Now I want the user to be able to have different permissions per company. So let’s say user X can manage the customers in company A but can only read the products and services. And user X can manage the users, products and services in company B.
I would like to work with roles: so manage everything would be the role “superadmin” and manage customers but read products and services would be the role “sales” for example.
So in short: I want to create roles where I can assing permssions to and then add these roles to users per company.
I am planning on using rsinger86/ drf-access-policy to manage access control but any suggestions are welcome.
Please suggest me a good way to accomplish this scenario. How am I able to add roles per company and am I still able to use the by-default-generated auth_permissions from Django?
Thank you in advance!
1 Like
I don’t think this is possible since Django’s permission model doesn’t support references to specific objects. However, you may be able to find another package that can help: Django Packages : Permissions
I’m sorry, I’m going to have to disagree with you here.
Actually, the permissions model supports per-row security quite well. The various combinations of has_perms, get_user_permissions, and the other available functions allow for the creation of just about any degree of complexity desired.
Override the User has_perm method and you can determine whether or not that user has access to the provided object.
What Django doesn’t have is a default implementation. (It would be extremely difficult to provide a general implementation that actually does something worthwhile.)
Side note: We’ve got a rather intricate row-level permissions system that grants access not just based on the row itself, but also the data within each row. (A user’s access to a row can change when the data changes.) It’s all built on top of the Django permissions model.
4 Likes
No need to apologize, I’m glad you chimed in. I stand corrected.
1 Like