Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Assiging Permissions not Designed for the Class #797

Open
iamMHZ opened this issue Jul 3, 2023 · 0 comments
Open

Assiging Permissions not Designed for the Class #797

iamMHZ opened this issue Jul 3, 2023 · 0 comments

Comments

@iamMHZ
Copy link

iamMHZ commented Jul 3, 2023

There is a ValidationError in the BaseObjectPermission class that prevents assigning of permissions to an object that does not match the content type of the given permission.

def save(self, *args, **kwargs):
    content_type = get_content_type(self.content_object)
    if content_type != self.permission.content_type:
        raise ValidationError("Cannot persist permission not designed for "
                              "this class (permission's type is %r and object's type is %r)"
                              % (self.permission.content_type, content_type))

Also, there is an exception in the ObjectPermissionBackend class that checks the mentioned criteria.

if app_label != ctype.app_label:
    raise WrongAppError("Passed perm has app label of '%s' while "
                        "given obj has app label '%s' and given obj"
                        "content_type has app label '%s'" %
                        (app_label, obj._meta.app_label, ctype.app_label))
 

I know that it sounds awkward to assign the view_groups permission (which has the group content type ) to an instance of the School model to a user. But consider the following scenario:
I have an Education Academy that has some teachers and students and these teachers and students are members of some other Education Academies too. (M2M relation). I have other entities like Homework and Notification too.

So How can I say Teacher-A has permission to add Homework in School-A and Teacher-A can only Add Notifications in School-B? (we have the same thing for students too).
The Djagno/guardian of what I said is below:

from guardian.shortcuts import assign_perm

school_a = School.objects.create(name='School-A')
school_b = School.objects.create(name='School-B')
user_a = get_user_model().object.create(username='user_a')

school_a.teachers.add(user_a)
school_b.teachers.add(user_a)

assign_perm( 'add_homework',user_a, school_a)
assign_perm( 'add_notification', user_a, school_b)

# There we go,  user_a can call the API to add homework in School-A but can not add homework in School-B

What I am proposing is that the user is an entity that login to the system but that user can become a member of some other thing (like a teacher/student is a member of a school) and because of that membership has some permissions in that place(object).

Thank you in advance for any time and effort that you are putting into this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant