How are you handling user permissions in more complex projects?

Yes.

We have a table that maps view_name to a list of target permissions (e.g. “add_timesheet”). We then have a table that maps the search criteria (“target permission” - e.g. “add_timesheet”) to a function name.

Our has_perms method then retrieves all the permissions needed for that view, and then does:

all((self.has_perm(perm, obj) for perm in perm_list))

The has_perm method then retrieves the method name from the function table and calls it:

getattr(PermissionChecks, permission_function)(perm, obj)

(Greatly simplified, but I’m sure you get the idea.)