Package: django-auth-utils
Django authentication and authorization utilities.ContentsInstallationConfigurationUsagePermission-checking viewsPermission-checking in templatesBaseAuthorizationBackendRelated workInstallationpipinstalldjango-auth-utilsSupported and tested on:Python: 2.7, 3.4, 3.5, 3.6, PyPy, PyPy3Django: 1.8, 1.10, 1.11ConfigurationIn order to use theauth_utilstemplate tag library, addauth_utilsto yourINSTALLED_APPS.Alternatively, since Django 1.9, you can addauth_utils.templatetags.auth_utilsto yourDjangoTemplatesOPTIONS.UsagePermission-checking viewsTheObjectPermissionRequiredMixinview combines Django’sPermissionRequiredMixinandSingleObjectMixinviews, and performs the permission check against the object that was looked up.Use it like the base classes:fromauth_utils.viewsimportObjectPermissionRequiredMixinclassArticleDetail(ObjectPermissionRequiredMixin,generic.DetailView):model=Articlepermission_required=['news.read_article']classArticleUpdate(ObjectPermissionRequiredMixin,generic.UpdateView):model=Articlepermission_required=['news.change_article']Permission-checking in templatesLoad the template tag library:{%loadauth_utils%}Thepermsfilter allows checking object-level permissions with a convenient syntax:{%ifperminuser|perms:object%}...{%endif%}Theobjectargument is optional. If omitted, the global permission is checked,
similar to Django’sperms object.Examples:{%if'news.read_article'inuser|perms:article%}{{article.text}}{%else%}You do not have permission to read this article.{%endif%}{%if'news.change_article'inuser|perms:article%}<ahref="...">Edit article</a>{%endif%}{%if'news.delete_article'inuser|perms:article%}<ahref="...">Delete article</a>{%endif%}The library providescan_changeandcan_deleteshorthands for checking Django’s defaultapp.change_modelandapp.delete_modelmodel permissions:{%ifuser|can_change:article%}<ahref="...">Edit</a>{%endif%}{%ifuser|can_delete:article%}<ahref="...">Delete</a>{%endif%}BaseAuthorizationBackendThis base class provides all the boilerplate code necessary for a Djangoauthentication backendto work, without performing any user authentication or permission authorization itself.This is intended to make it easy to writecustom authorizationpolicies that only implement the backend
methods they’re interested in:fromauth_utils.backendsimportBaseAuthorizationBackendclassArticleEditPolicy(BaseAuthorizationBackend):"""
    Allow authors to change and delete their own articles.
    """defget_user_permissions(self,user_obj,obj=None):is_author=isinstance(obj,Article)andarticle.author==user_objifuser_obj.is_activeandis_author:return{'news.change_article','news.delete_article'}else:returnset()classGuestAccessPolicy(BaseAuthorizationBackend):"""
    Allow anonymous users to read non-premium articles.
    """defget_user_permissions(self,user_obj,obj=None):guest_readable=isinstance(obj,Article)andnotarticle.is_premiumifnotuser_obj.is_authenticated()andguest_readable:return{'news.read_article'}else:returnset()Once defined, these policies can be enabled inAUTHENTICATION_BACKENDS:AUTHENTICATION_BACKENDS=['django.contrib.auth.backends.ModelBackend',# Custom authorization policies'news.auth.ArticleEditPolicy','news.auth.GuestAccessPolicy',]Related workInspiration:django-model-utilsdjango-guardianprovides object-based permission checking utilities:View: Analternative PermissionRequiredMixin, predating Django’s oneTemplate tag:get_obj_perms, using somewhat clunkier assignment syntax