Package: django-impersonate-permissions
Django Impersonate PermissionsAdd ability to control impersonate permissions.Impersonate is a powerful Django app that allow site admins to log in to a user's account, and take
actions on their behalf. This can be invalulable in providing technical support. However, with great
power comes great responsiblity, and operationally you shouldneverimpersonate a user without
their explicit consent.This app provides a mechanism for recording user consent, and enforcing it.How it worksThe core concept is the "permission window". This is a time period during which the user has granted
access to their account. How you determine when to ask for access is up to you - this library makes
no assumptions about that.The starting point is saving a newPermissionWindowobject:# views.pydefgrant_permission(request):"""Create a new PermissionWindow, allowing the user to be impersonated."""window=PermissionWindow.objects.create(user=request.user)returnHttpResponse("OK")Once you have an active PermissionWindow, the user will appear in theusers_impersonablequeryset.
Whilst you are impersonating a user, the middleware will check that the permissions window is still
valid. If it expires (or is disabled), the middleware will redirect the request to theimpersonate-stopURL, effectively logging the impersonator out of the impersonation session.UseThe app itself contains a model,PermissionWindow, that is use to record a user's permission, and
a middleware class,EnforcePermissionWindowMiddlewarethat is used to enforce it.You will need to add the middleware to yourMIDDLEWAREDjango settings. It also contains a
functionusers_impersonablethat you should set to the as the impersonateCUSTOM_USER_QUERYSETfunction:# settings.pyINSTALLED_APPS=("django.contrib.admin","django.contrib.auth","django.contrib.contenttypes","django.contrib.sessions","django.contrib.messages","django.contrib.staticfiles","django.contrib.humanize","impersonate","impersonate_permissions",...)MIDDLEWARE=("django.contrib.sessions.middleware.SessionMiddleware","django.middleware.common.CommonMiddleware","django.middleware.csrf.CsrfViewMiddleware","django.contrib.auth.middleware.AuthenticationMiddleware","django.contrib.messages.middleware.MessageMiddleware","impersonate.middleware.ImpersonateMiddleware","impersonate_permissions.middleware.EnforcePermissionWindowMiddleware","impersonate_permissions.middleware.ImpersonationAlertMiddleware",...)TEMPLATES=[{"BACKEND":"django.template.backends.django.DjangoTemplates","DIRS":[path.join(PROJECT_DIR,"templates")],"APP_DIRS":True,"OPTIONS":{"context_processors":["django.contrib.messages.context_processors.messages","django.contrib.auth.context_processors.auth","impersonate_permissions.context_processors.impersonation",]},}]IMPERSONATE={"CUSTOM_USER_QUERYSET":"impersonate_permissions.models.users_impersonable","DEFAULT_PERMISSION_EXPIRY":60,"PERMISSION_EXPIRY_WARNING_INTERVAL":10,}There is a second piece of middleware,ImpersonationAlertMiddleware, that is optional - if
installed it will add a flash message (using thedjango.contrib.messagesapp) for users who are
being impersonated.TemplatesThere are three templates included with the app,impersonating.tpl,expired.tpl, andimpersonated.tpl, that are used to render the flash messages shown to users who are impersonating,
or being impersonated. You can overwrite these templates to change the message if you wish.Context ProcessorThere is a context processor,impersonation, which can be used to add three properties to template
render contexts. This is just a shortcut to existing request properties:{"is_impersonate":True,"impersonator":request.real_user,"impersonating":request.user,}SettingsThe following settings can be set in the Django settings module, as part of theIMPERSONATEdictionary.DEFAULT_PERMISSION_EXPIRYAn integer value that defines the default length of a permission 'window', in minutes, thereby
setting its expiry.Default value is 60 - which equates to a one hour window.PERMISSION_EXPIRY_WARNING_INTERVALAn integer value which is used to turn the impersation message level fromINFOtoWARNING. Value
is in minutes.Default value is 10, which means that the message will change 10 minutes before the session expires.LicenseMIT.ContributingIf you want to contribute, add features, fix bugs - thank you.The project uses Poetry to handle dependencies, and it comes will a working Django project that you
can use for testing.TestsTo begin, it's best to install the virtualenv and check that the tests run:$poetryinstall
$poetryrunpytestOnce you have a working test run, you can set up the project locally (it uses SQLite), create a
superuser account, and spin up the site:$poetryshell(venv)$pythonmanage.pymigrate(venv)$pythonmanage.pycreatesuperuser(venv)$pythonmanage.pyrunserverCode styleThe project contains apre-commitconfig, and you should set this up before committing any code:$pre-commitinstallCode must be formatted usingisortandblack.All new code should use type hints.CIThe project contains a.travis.ymlconfig, and the tests will run on any new PR. This config runs
the tests and a suite of linting / formatting tools:isort,black,pylint,flake8(withbanditandpydocstyle) andmypy.