python - Django 规则对象权限

Question

我正在尝试使用 django rules在 django 和 django 管理界面中配置对象权限。

现在当我添加权限规则时，它们将始终只使用第一个参数调用，但对象始终为 None。

例如，如果我要创建这个谓词:

@rules.predicate
def is_book_author(user, book):
    return book.author == user

然后将其添加到django权限集中:

rules.add_perm('books.view_book', is_book_author)

现在，当我以用户身份登录到管理界面时，将使用用户和 None 调用 is_book_author。它将被多次调用(每个对象一次)，但对象始终为 None。

我在 django 2.1.1 和 python 3.7 中使用规则 2.0.0。

如果我做错了什么或如何配置 Django 以使用单个对象调用谓词，您有什么想法吗？

Answer 1

作为 django-rules documentation状态:

Django Admin does not support object-permissions, in the sense that it will never ask for permission to perform an action on an object, only whether a user is allowed to act on (any) instances of a model.

If you'd like to tell Django whether a user has permissions on a specific object, you'd have to override the following methods of a model's ModelAdmin:

has_view_permission(user, obj=None)
has_change_permission(user, obj=None)
has_delete_permission(user, obj=None)

rules comes with a custom ModelAdmin subclass, rules.contrib.admin.ObjectPermissionsModelAdmin, that overrides these methods to pass on the edited model instance to the authorization backends, thus enabling permissions per object in the Admin:

# books/admin.py
from django.contrib import admin
from rules.contrib.admin import ObjectPermissionsModelAdmin
from .models import Book

class BookAdmin(ObjectPermissionsModelAdmin):
    pass

admin.site.register(Book, BookAdmin)

Now this allows you to specify permissions like this:

rules.add_perm('books', rules.always_allow)
rules.add_perm('books.add_book', has_author_profile)
rules.add_perm('books.change_book', is_book_author_or_editor)
rules.add_perm('books.delete_book', is_book_author)

To preserve backwards compatibility, Django will ask for either view or change permission. For maximum flexibility, rules behaves subtly different: rules will ask for the change permission if and only if no rule exists for the view permission.