Package: djangolovessandstorm
Django Loves Sandstorm (D♥S,DLS…anddjangolovessandstorm) provides
tools for adapting Django applications to work with Sandstorm.  For
authentication, D♥S usesHTTP headers provided by Sandstormto manageSandstormUserobjects as required byDjango Auth.Installation and ConfigurationD♥S requires installation in your Python environment and configuration in your
Django project.  This section documents the required configuration.AppsIf using the suggestedSandstormUseruser model, thedjangolovessandstormapp must be added to the DjangoINSTALLED_APPSlist:INSTALLED_APPS = [
    …
    "djangolovessandstorm.apps.DLSConfig",
    …
]Authentication BackendsD♥S provides theDLSAllowAllUsersBackendauthentication backend, which
populates theSandstormUsermodel from the HTTP headers
provided by the Sandstorm HTTP bridge.  Use it by adding it to theAUTHENTICATION_BACKENDSlist in the Django settings:AUTHENTICATION_BACKENDS = [
    "djangolovessandstorm.backends.DLSAllowAllUsersBackend",
]Authentication ModelD♥S suggests the use of theSandstormUsermodel.  Set theAUTH_USER_MODELin Django settings:AUTH_USER_MODEL = "djangolovessandstorm.SandstormUser"MiddlewareD♥S requires the use of middleware to read these HTTP headers and create the
appropriateSandstormUserobjects.  This middleware is found in thedjangolovessandstorm.middlewaremodule.It is added to the Django settingsMIDDLEWARElist.  In the list of
middleware,SessionMiddlewareshould appear beforeAuthenticationMiddleware.AuthenticationMiddlewareshould appear
beforeDLSMiddleware:MIDDLEWARE = [
    …
    "django.contrib.sessions.middleware.SessionMiddleware",
    "
    …
    "django.contrib.auth.middleware.AuthenticationMiddleware",
    …
    "djangolovessandstorm.middleware.DLSMiddleware",
    …
]PermissionsTo use the Django Auth superuser and staff roles, configure the
corresponding permissions in the Django settings.  D♥S will look for these
permissions in theX-Sandstorm-PermissionsHTTP header, which will
appear based upon the settings ofbridgeConfig.viewInfo.permissionsinsidesandstorm-pkgdef.capnp.  For example, the following two lines in
your Django settings, will result in Django expectingsuperuserandstaffto be set insandstorm-pkgdef.capnp:DLS_SUPERUSER_PERMISSION = "superuser"
DLS_STAFF_PERMISSION = "staff"To make this work,superuserandstaffshould be named as
permissions insandstorm-pkgdef.capnp:bridgeConfig = (
  viewInfo = (
    permissions = [
      (
        name = "superuser",
        title = (defaultText = "superuser"),
        description = (defaultText = "full control"),
      ),
      (
        name = "staff",
        title = (defaultText = "staff"),
        description = (defaultText = "administrator interface access"),
      ),
    ],
    roles = [
      (
        title = (defaultText = "Full access"),
        permissions = [
          true,  # superuser
          true,  # staff
        ],
        verbPhrase = (defaultText = "full access"),
        description = (defaultText = "may view and alter all data and settings"),
      ),
      (
        title = (defaultText = "Staff"),
        permissions = [
          false, # superuser
          true,  # staff
        ],
        verbPhrase = (defaultText = "staff may administer some applications"),
        description = (defaultText = "may view and alter all some data and settings through Django Admin"),
      ),
    ],
  ),
),How It WorksD♥S middleware processes requests, creating and updatingSandstormUserobjects as necessary.  To understand how the code works, look first at the
middleware.DLSMiddlewareinherits fromdjango.contrib.auth.middleware.RemoteUserMiddleware.  To understand the
code, begin by reading theprocess_requestmethod.DLSMiddleware.process_requestcallsRemoteUserMiddleware.process_request, which performs some sanity checks
before callingdjango.contrib.auth.authenticateanddjango.contrib.auth.login.  If the authentication backend does not find the
user in the database, a new user iscreate``d,``save``dand configured(``configure_user).DLSAllowAllUsersBackend.configure_userstores the
userʼs name and handle, and generates a session key.  (The session key is
necessary because a SandstormUser does not have a password hash, which would
otherwise function as the session key.)