Django Hierarchy Permissions

Question

I want to have hierarchical level permissions in my Django Applications.

For example:- Consider there are 4 levels -

Admin
Sub-admin(CountryLevel(CL) Admin)
sub-sub-admin(StateLevel(SL) Admin)
And then normal Users(U).

Admins will create CL, in return CL will create SL, and SL will finally onboard the users. The end goal is to onboard the users.

Admins have the access to apply CRUD operation on any user. CL should have access to those users(objects) which were onboarded(created) by the CL created SLs. In return, SL should have access to only those users(objects) onboarded(created) by him. Also, a user can get himself registered directly without any admins involved. In such case, the user shall have access to his own application.

How can I achieve such tree-level like permissions?

The solution that I can think of is (but not sure about it):-

I've updated auth_group table and added parent_id into it. Following is the schema.

id, group_name, parent_id

The significance of parent_id is to create a tree-like structure of the groups. The number of groups created is equal to the height of the tree. For eg consider following structure:-

id, group_name, parent_id

1 , admin, 0
2, CL, 1
3, SL, 2

Now when any user is created(onboarded), I'll assign an SL group_id, which will be added to auth_user_groups table.

Now, I want to ask the following questions

1) How do I manage hierarchy-level permission of the groups, ie SL should only be able to access users onboarded by him, CL should be able to access all the users onboarded by the SLs created by him and so on.

2) (Not sure I'm thinking correctly or not) Now, since I've assigned a group SL to all the users onboarded by the SL, will the user be able to access each other information, being part of the same group?

3) For the users who are onboarde directly(ie not via any SL), I shall not be mapping them to any group. Right?

Answer 1

Django already allows for a Group, User permissions which we can customize for our needs.

• Create the groups you need (form the admin panel for example, or by following this SO post.):

  1. 'country-admin-group`
  2. 'state-admin-group'
  3. 'user-group'

• Create custom permissions for your user groups and add them accordingly:

  from django.contrib.auth.models import Group
  from django.contrib.contenttypes.models import ContentType
  from your_app_name.models import CustomUserModel
  
  ct = ContentType.objects.get_for_model(CustomUserModel)
  permission_sl = Permission.objects.create(
      codename='can_add_sl_user',
      name='Can add SL user',
      content_type=ct
  )
  permission_user = Permission.objects.create(
      codename='can_add_simple_user',
      name='Can add simple user',
      content_type=ct
  )
  ...
  cl_group = Groups.get(name='country-admin-group')
  cl_group.permissions.add(permission_sl)
  cl_group,permissions.add(permission_user)
  
  sl_group = Groups.get(name='state-admin-group')
  sl_group,permissions.add(permission_user)
  ...
  

• Create views (and the corresponding urls) for each type of user.
  Personally I prefer to use class based views when applicable. We will control the access to each view with the method_decorator and permission_required decorators:

  from django.http import HttpResponse
  from django.views import View
  
  class CountryAdminView(View):
  
      @login_required
      def list(self, request):
          """
          Can access only users created by him
          """
          content = Users.objects.filter(parent_id=request.user.id)
          return HttpResponse(content)
  
      @method_decorator(@permission_required('your_app_name.can_add_sl_user'))
      def create(self, request):
         ...
         Logic for creating an SL admin user.
  
      ...
  

Keep in mind that the above is a simplified example to set you in the path to the solution.

---

As @BurhanKhalid points out, you can skip a part of the above by using django-guardian.

You can also use django-role-permissions to define per user roles and add permissions to those roles.