Bài 8.3: Permissions & Authorization - Phần 3 - Custom Permissions

**Series Navigation:** - [Bài 8.1: Permission Basics](/django-advance/permissions-authorization-phan-1) - [Bài 8.2: Object-Level Permissions](/django-advance/permissions-authorization-phan-2) - **Bài 8.3 (bài này): Custom Permissions** 👈 - [Bài 8.4: Advanced Authorization Patterns](/django-advance/permissions-authorization-phan-4)

Mục Tiêu Bài 8.3

Sau khi hoàn thành Bài 8.3 này, bạn sẽ:

✅ Build complex custom permission classes
✅ Implement conditional permission logic
✅ Create dynamic permissions
✅ Compose multiple permissions
✅ Use third-party permission packages
✅ Follow permission best practices

Building Custom Permission Classes

Basic Structure

# permissions.pyfrom rest_framework import permissions class MyCustomPermission(permissions.BasePermission):    """    Custom permission description    """        # Optional: Custom message when permission denied    message = 'Custom error message'        def has_permission(self, request, view):        """        View-level permission check        Called before view logic        """        return True  # or False        def has_object_permission(self, request, view, obj):        """        Object-level permission check        Called for detail operations (retrieve, update, destroy)        """        return True  # or False

Real-World Example: Blog Permissions

# permissions.pyfrom rest_framework import permissionsfrom django.utils import timezonefrom datetime import timedelta class BlogPermission(permissions.BasePermission):    """    Complex blog permission:    - Anyone can read published posts    - Authors can CRUD their own drafts    - Staff can CRUD all posts    - Authors can only edit posts within 24 hours of creation    """        def has_permission(self, request, view):        # List/Create actions        if view.action == 'list':            return True  # Anyone can list                if view.action == 'create':            return request.user.is_authenticated                # Other actions need authentication        return request.user.is_authenticated        def has_object_permission(self, request, view, obj):        # Read published posts        if request.method == 'GET' and obj.status == 'published':            return True                # Staff can do anything        if request.user.is_staff:            return True                # Must be author for remaining checks        if obj.author != request.user:            return False                # Author can read their own posts        if request.method == 'GET':            return True                # Author can only edit within 24 hours        if request.method in ['PUT', 'PATCH']:            time_limit = timezone.now() - timedelta(hours=24)            if obj.created_at < time_limit:                self.message = 'Can only edit posts within 24 hours of creation'                return False            return True                # Author can delete only drafts        if request.method == 'DELETE':            if obj.status != 'draft':                self.message = 'Can only delete draft posts'                return False            return True                return False

Usage:

class BlogPostViewSet(viewsets.ModelViewSet):    queryset = BlogPost.objects.all()    serializer_class = BlogPostSerializer    permission_classes = [BlogPermission]

Conditional Permissions

Action-Based Permissions

# permissions.pyclass ActionBasedPermission(permissions.BasePermission):    """    Different permissions for different actions    """        def has_permission(self, request, view):        # Public actions        if view.action in ['list', 'retrieve']:            return True                # Authenticated actions        if view.action in ['create', 'update', 'partial_update']:            return request.user.is_authenticated                # Admin actions        if view.action == 'destroy':            return request.user.is_staff                # Custom actions        if view.action == 'publish':            return request.user.is_staff                if view.action == 'like':            return request.user.is_authenticated                return False

Method-Based Permissions

# permissions.pyclass MethodBasedPermission(permissions.BasePermission):    """    Different permissions for different HTTP methods    """        def has_permission(self, request, view):        # Safe methods (GET, HEAD, OPTIONS)        if request.method in permissions.SAFE_METHODS:            return True                # POST - authenticated users        if request.method == 'POST':            return request.user.is_authenticated                # PUT, PATCH, DELETE - staff only        if request.method in ['PUT', 'PATCH', 'DELETE']:            return request.user.is_staff                return False

Query Parameter Permissions

# permissions.pyclass QueryParamPermission(permissions.BasePermission):    """    Permission based on query parameters    """        def has_permission(self, request, view):        # Check if filtering by sensitive fields        sensitive_params = ['ssn', 'credit_card', 'password']                for param in sensitive_params:            if param in request.query_params:                # Only staff can filter by sensitive fields                if not request.user.is_staff:                    self.message = f'Cannot filter by {param}'                    return False                return True

Header-Based Permissions

# permissions.pyclass APIKeyPermission(permissions.BasePermission):    """    Check API key in headers    """        def has_permission(self, request, view):        api_key = request.headers.get('X-API-Key')                if not api_key:            self.message = 'API key required'            return False                # Validate API key        from myapp.models import APIKey                try:            key = APIKey.objects.get(key=api_key, is_active=True)                        # Check rate limit            if key.requests_today >= key.rate_limit:                self.message = 'Rate limit exceeded'                return False                        # Increment counter            key.requests_today += 1            key.save()                        # Attach key to request            request.api_key = key                        return True        except APIKey.DoesNotExist:            self.message = 'Invalid API key'            return False

Dynamic Permissions

Database-Driven Permissions

# models.pyfrom django.db import modelsfrom django.contrib.auth.models import User class PermissionRule(models.Model):    name = models.CharField(max_length=100)    resource = models.CharField(max_length=50)  # e.g., 'article', 'comment'    action = models.CharField(max_length=50)    # e.g., 'create', 'update'    condition = models.JSONField()              # Conditions to check    is_active = models.BooleanField(default=True)        def evaluate(self, user, obj=None):        """Evaluate permission rule"""        # Example condition format:        # {        #     "user_field": "is_staff",        #     "object_field": "status",        #     "object_value": "published"        # }                if not self.is_active:            return False                # Check user condition        if 'user_field' in self.condition:            field = self.condition['user_field']            if not getattr(user, field, False):                return False                # Check object condition        if obj and 'object_field' in self.condition:            field = self.condition['object_field']            value = self.condition['object_value']            if getattr(obj, field, None) != value:                return False                return True # permissions.pyclass DynamicPermission(permissions.BasePermission):    """    Permission based on database rules    """        def has_permission(self, request, view):        from myapp.models import PermissionRule                # Get resource and action        resource = view.basename  # From router        action = view.action                # Find matching rules        rules = PermissionRule.objects.filter(            resource=resource,            action=action,            is_active=True        )                # Check if any rule passes        for rule in rules:            if rule.evaluate(request.user):                return True                return False        def has_object_permission(self, request, view, obj):        from myapp.models import PermissionRule                resource = view.basename        action = view.action                rules = PermissionRule.objects.filter(            resource=resource,            action=action,            is_active=True        )                for rule in rules:            if rule.evaluate(request.user, obj):                return True                return False

Feature Flag Permissions

# permissions.pyclass FeatureFlagPermission(permissions.BasePermission):    """    Permission based on feature flags    """    feature_flag = None  # Set in subclass or view        def has_permission(self, request, view):        # Get feature flag name        flag_name = getattr(view, 'feature_flag', self.feature_flag)                if not flag_name:            return True  # No flag specified                # Check if feature is enabled        from myapp.utils import is_feature_enabled                if not is_feature_enabled(flag_name):            self.message = 'This feature is not available'            return False                # Check if user has access to feature        if not is_feature_enabled(flag_name, request.user):            self.message = 'You do not have access to this feature'            return False                return True

Usage:

class BetaFeatureViewSet(viewsets.ModelViewSet):    queryset = BetaFeature.objects.all()    serializer_class = BetaFeatureSerializer    permission_classes = [IsAuthenticated, FeatureFlagPermission]    feature_flag = 'beta_features'

Time-Based Dynamic Permissions

# permissions.pyfrom django.utils import timezone class BusinessHoursPermission(permissions.BasePermission):    """    Only allow access during business hours    """        def has_permission(self, request, view):        now = timezone.localtime()                # Business hours: Monday-Friday, 9 AM - 5 PM        if now.weekday() >= 5:  # Weekend            self.message = 'Service unavailable on weekends'            return False                if now.hour < 9 or now.hour >= 17:            self.message = 'Service only available 9 AM - 5 PM'            return False                return True class MaintenanceWindowPermission(permissions.BasePermission):    """    Block access during maintenance windows    """        def has_permission(self, request, view):        from myapp.models import MaintenanceWindow                # Check if currently in maintenance        now = timezone.now()                if MaintenanceWindow.objects.filter(            start_time__lte=now,            end_time__gte=now,            is_active=True        ).exists():            # Staff can still access            if request.user.is_staff:                return True                        self.message = 'System under maintenance'            return False                return True

Permission Composition

AND Logic (All Must Pass)

# permissions.pyclass ComposedAND(permissions.BasePermission):    """    All sub-permissions must pass    """    sub_permissions = []  # List of permission classes        def has_permission(self, request, view):        for perm_class in self.sub_permissions:            perm = perm_class()            if not perm.has_permission(request, view):                self.message = getattr(perm, 'message', 'Permission denied')                return False        return True        def has_object_permission(self, request, view, obj):        for perm_class in self.sub_permissions:            perm = perm_class()            if not perm.has_object_permission(request, view, obj):                self.message = getattr(perm, 'message', 'Permission denied')                return False        return True

Usage:

class IsAuthenticatedAndOwner(ComposedAND):    sub_permissions = [IsAuthenticated, IsOwner] class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticatedAndOwner]

OR Logic (Any Can Pass)

# permissions.pyclass ComposedOR(permissions.BasePermission):    """    Any sub-permission can pass    """    sub_permissions = []        def has_permission(self, request, view):        messages = []                for perm_class in self.sub_permissions:            perm = perm_class()            if perm.has_permission(request, view):                return True            messages.append(getattr(perm, 'message', 'Permission denied'))                # All failed        self.message = ' OR '.join(messages)        return False        def has_object_permission(self, request, view, obj):        messages = []                for perm_class in self.sub_permissions:            perm = perm_class()            if perm.has_object_permission(request, view, obj):                return True            messages.append(getattr(perm, 'message', 'Permission denied'))                self.message = ' OR '.join(messages)        return False

Usage:

class IsOwnerOrAdmin(ComposedOR):    sub_permissions = [IsOwner, IsAdminUser] class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsOwnerOrAdmin]

Complex Composition

# permissions.pyclass ComplexPermission(permissions.BasePermission):    """    (IsAuthenticated AND IsOwner) OR IsAdmin    """        def has_permission(self, request, view):        # Check admin first (short-circuit)        if request.user.is_staff:            return True                # Then check authenticated + owner        if not request.user.is_authenticated:            return False                return True  # Will check object permission        def has_object_permission(self, request, view, obj):        # Admin can access        if request.user.is_staff:            return True                # Owner can access        if obj.author == request.user:            return True                return False

Permission Operator Overloading

# permissions.pyclass OperatorPermission(permissions.BasePermission):    """    Base class with operator support    """        def __and__(self, other):        """AND operator: perm1 & perm2"""        class AndPermission(permissions.BasePermission):            def has_permission(self, request, view):                return (self.__class__.__bases__[0]().has_permission(request, view) and                        other().has_permission(request, view))                        def has_object_permission(self, request, view, obj):                return (self.__class__.__bases__[0]().has_object_permission(request, view, obj) and                        other().has_object_permission(request, view, obj))                return AndPermission        def __or__(self, other):        """OR operator: perm1 | perm2"""        class OrPermission(permissions.BasePermission):            def has_permission(self, request, view):                return (self.__class__.__bases__[0]().has_permission(request, view) or                        other().has_permission(request, view))                        def has_object_permission(self, request, view, obj):                return (self.__class__.__bases__[0]().has_object_permission(request, view, obj) or                        other().has_object_permission(request, view, obj))                return OrPermission

Usage:

# Combine with operatorspermission_classes = [IsAuthenticated & IsOwner | IsAdminUser]

Third-Party Permission Packages

django-rules

Installation:

pip install rules

Configuration:

# settings.pyINSTALLED_APPS = [    'rules.apps.AutodiscoverRulesConfig',] AUTHENTICATION_BACKENDS = [    'rules.permissions.ObjectPermissionBackend',    'django.contrib.auth.backends.ModelBackend',]

Define rules:

# rules.pyimport rules @rules.predicatedef is_article_author(user, article):    return article.author == user @rules.predicatedef is_published(user, article):    return article.status == 'published' # Combine predicatesrules.add_perm('articles.view_article', is_published | is_article_author)rules.add_perm('articles.change_article', is_article_author)rules.add_perm('articles.delete_article', is_article_author)

DRF integration:

# permissions.pyfrom rest_framework import permissions class RulesPermission(permissions.BasePermission):    """    Use django-rules for permissions    """        def has_permission(self, request, view):        # Map actions to permissions        perm_map = {            'list': 'view',            'retrieve': 'view',            'create': 'add',            'update': 'change',            'partial_update': 'change',            'destroy': 'delete',        }                action = perm_map.get(view.action)        if not action:            return False                perm = f'{view.queryset.model._meta.app_label}.{action}_{view.queryset.model._meta.model_name}'                return request.user.has_perm(perm)        def has_object_permission(self, request, view, obj):        perm_map = {            'retrieve': 'view',            'update': 'change',            'partial_update': 'change',            'destroy': 'delete',        }                action = perm_map.get(view.action)        if not action:            return False                perm = f'{obj._meta.app_label}.{action}_{obj._meta.model_name}'                return request.user.has_perm(perm, obj)

dry-rest-permissions

Installation:

pip install dry-rest-permissions

Usage:

# models.pyfrom dry_rest_permissions.generics import authenticated_users class Article(models.Model):    title = models.CharField(max_length=200)    author = models.ForeignKey(User, on_delete=models.CASCADE)        @staticmethod    @authenticated_users    def has_read_permission(request):        return True        def has_object_read_permission(self, request):        return True        @staticmethod    @authenticated_users    def has_write_permission(request):        return True        def has_object_write_permission(self, request):        return self.author == request.user # views.pyfrom dry_rest_permissions.generics import DRYPermissions class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [DRYPermissions]

rest-condition

Installation:

pip install rest-condition

Usage:

# permissions.pyfrom rest_condition import Or, And, Not class ArticlePermission:    permission_classes = [        Or(IsAdminUser, And(IsAuthenticated, IsOwner))    ] # Or use decoratorsfrom rest_condition import permission_classes_or @permission_classes_or(IsAdminUser, IsOwner)class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer

Best Practices

1. Clear Permission Messages

class MyPermission(permissions.BasePermission):    def has_permission(self, request, view):        if not request.user.is_authenticated:            self.message = 'Authentication required'            return False                if not request.user.email_verified:            self.message = 'Email verification required'            return False                return True

2. Permission Naming Convention

# Good namingclass IsOwner(permissions.BasePermission): passclass CanEditArticle(permissions.BasePermission): passclass HasProjectAccess(permissions.BasePermission): pass # Bad namingclass ArticlePermission(permissions.BasePermission): pass  # Too vagueclass Permission1(permissions.BasePermission): pass  # Not descriptive

3. Separate Concerns

# Bad: Mixed concernsclass ComplexPermission(permissions.BasePermission):    def has_permission(self, request, view):        # Authentication check        if not request.user.is_authenticated:            return False                # Feature flag check        if not is_feature_enabled('feature_x'):            return False                # Rate limit check        if user_exceeded_rate_limit(request.user):            return False                return True # Good: Separate permissionsclass IsAuthenticated(permissions.BasePermission):    def has_permission(self, request, view):        return request.user.is_authenticated class HasFeatureAccess(permissions.BasePermission):    def has_permission(self, request, view):        return is_feature_enabled('feature_x') class RateLimitPermission(permissions.BasePermission):    def has_permission(self, request, view):        return not user_exceeded_rate_limit(request.user) # Use togetherpermission_classes = [IsAuthenticated, HasFeatureAccess, RateLimitPermission]

4. Cache Expensive Checks

from django.core.cache import cache class ExpensivePermission(permissions.BasePermission):    def has_object_permission(self, request, view, obj):        cache_key = f'perm_{request.user.id}_{obj.id}'                # Check cache        result = cache.get(cache_key)        if result is not None:            return result                # Expensive check        result = self._expensive_check(request.user, obj)                # Cache result        cache.set(cache_key, result, 300)  # 5 minutes                return result        def _expensive_check(self, user, obj):        # Complex database queries, API calls, etc.        pass

5. Document Permissions

class ArticlePermission(permissions.BasePermission):    """    Article permission rules:        - Anyone can view published articles    - Authenticated users can create articles    - Authors can update/delete their own articles    - Staff can update/delete any article    - Authors can only edit within 24 hours of creation        Examples:        GET /articles/     → Anyone        POST /articles/    → Authenticated        GET /articles/1/   → Anyone (if published)        PUT /articles/1/   → Author (within 24h) or Staff        DELETE /articles/1/ → Author or Staff    """        def has_permission(self, request, view):        # Implementation        pass

6. Test Permissions Thoroughly

# tests/test_permissions.pyfrom rest_framework.test import APITestCase class ArticlePermissionTest(APITestCase):    def setUp(self):        self.user = User.objects.create_user('user', 'user@test.com', 'pass')        self.admin = User.objects.create_user('admin', 'admin@test.com', 'pass', is_staff=True)        self.article = Article.objects.create(title='Test', author=self.user)        def test_anonymous_can_view_published(self):        """Anonymous users can view published articles"""        self.article.status = 'published'        self.article.save()                response = self.client.get(f'/api/articles/{self.article.id}/')        self.assertEqual(response.status_code, 200)        def test_anonymous_cannot_view_draft(self):        """Anonymous users cannot view draft articles"""        self.article.status = 'draft'        self.article.save()                response = self.client.get(f'/api/articles/{self.article.id}/')        self.assertEqual(response.status_code, 403)        def test_owner_can_update(self):        """Owner can update their article"""        self.client.force_authenticate(user=self.user)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 200)        def test_non_owner_cannot_update(self):        """Non-owner cannot update article"""        other_user = User.objects.create_user('other', 'other@test.com', 'pass')        self.client.force_authenticate(user=other_user)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 403)        def test_admin_can_update_any(self):        """Admin can update any article"""        self.client.force_authenticate(user=self.admin)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 200)

Complete Real-World Example

# models.pyfrom django.db import modelsfrom django.contrib.auth.models import Userfrom django.utils import timezone class Article(models.Model):    STATUS_CHOICES = [        ('draft', 'Draft'),        ('review', 'Under Review'),        ('published', 'Published'),        ('archived', 'Archived'),    ]        title = models.CharField(max_length=200)    content = models.TextField()    author = models.ForeignKey(User, on_delete=models.CASCADE, related_name='articles')    status = models.CharField(max_length=20, choices=STATUS_CHOICES, default='draft')    created_at = models.DateTimeField(auto_now_add=True)    updated_at = models.DateTimeField(auto_now=True)    published_at = models.DateTimeField(null=True, blank=True)        # Collaborators    editors = models.ManyToManyField(User, related_name='editable_articles', blank=True)    reviewers = models.ManyToManyField(User, related_name='reviewable_articles', blank=True) # permissions.pyfrom rest_framework import permissionsfrom django.utils import timezonefrom datetime import timedelta class ArticlePermission(permissions.BasePermission):    """    Complex article permission system    """        def has_permission(self, request, view):        # List - anyone        if view.action == 'list':            return True                # Create - authenticated        if view.action == 'create':            return request.user.is_authenticated                # Other actions - authenticated        return request.user.is_authenticated        def has_object_permission(self, request, view, obj):        # View        if request.method == 'GET':            return self._can_view(request.user, obj)                # Update        if request.method in ['PUT', 'PATCH']:            return self._can_edit(request.user, obj)                # Delete        if request.method == 'DELETE':            return self._can_delete(request.user, obj)                return False        def _can_view(self, user, article):        """Can user view this article?"""        # Published - anyone        if article.status == 'published':            return True                # Staff - all        if user.is_staff:            return True                # Author - own articles        if article.author == user:            return True                # Editor - assigned articles        if user in article.editors.all():            return True                # Reviewer - articles under review        if article.status == 'review' and user in article.reviewers.all():            return True                return False        def _can_edit(self, user, article):        """Can user edit this article?"""        # Staff - all        if user.is_staff:            return True                # Archived - no one        if article.status == 'archived':            return False                # Author - own articles        if article.author == user:            # Check time limit for published articles            if article.status == 'published':                time_limit = timezone.now() - timedelta(hours=24)                if article.published_at and article.published_at < time_limit:                    self.message = 'Cannot edit published articles after 24 hours'                    return False            return True                # Editor - assigned articles in draft/review        if user in article.editors.all():            if article.status in ['draft', 'review']:                return True                return False        def _can_delete(self, user, article):        """Can user delete this article?"""        # Staff - all        if user.is_staff:            return True                # Author - only drafts        if article.author == user:            if article.status != 'draft':                self.message = 'Can only delete draft articles'                return False            return True                return False # Custom actions permissionclass CanPublishArticle(permissions.BasePermission):    """    Can user publish this article?    """        def has_object_permission(self, request, view, obj):        # Staff can publish        if request.user.is_staff:            return True                # Author can publish own articles from review        if obj.author == request.user and obj.status == 'review':            return True                return False # views.pyfrom rest_framework import viewsetsfrom rest_framework.decorators import actionfrom rest_framework.response import Responsefrom django.utils import timezone class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [ArticlePermission]        def get_queryset(self):        """Filter articles based on user permissions"""        user = self.request.user                if user.is_staff:            # Staff sees all            return Article.objects.all()                if user.is_authenticated:            # Authenticated sees: published + own + assigned            from django.db.models import Q            return Article.objects.filter(                Q(status='published') |                Q(author=user) |                Q(editors=user) |                Q(reviewers=user, status='review')            ).distinct()                # Anonymous sees only published        return Article.objects.filter(status='published')        @action(detail=True, methods=['post'], permission_classes=[CanPublishArticle])    def publish(self, request, pk=None):        """Publish article"""        article = self.get_object()        article.status = 'published'        article.published_at = timezone.now()        article.save()                serializer = self.get_serializer(article)        return Response(serializer.data)        @action(detail=True, methods=['post'])    def submit_review(self, request, pk=None):        """Submit article for review"""        article = self.get_object()                # Only author can submit        if article.author != request.user:            return Response({'error': 'Only author can submit for review'}, status=403)                # Must be draft        if article.status != 'draft':            return Response({'error': 'Can only submit draft articles'}, status=400)                article.status = 'review'        article.save()                serializer = self.get_serializer(article)        return Response(serializer.data)

Tóm Tắt Bài 8.3

Trong Bài 8.3 này, bạn đã học:

✅ Custom Permission Classes:

Basic structure
Real-world examples
Custom error messages

✅ Conditional Permissions:

Action-based
Method-based
Query parameter based
Header-based

✅ Dynamic Permissions:

Database-driven
Feature flags
Time-based
Maintenance windows

✅ Permission Composition:

AND logic
OR logic
Complex combinations
Operator overloading

✅ Third-Party Packages:

django-rules
dry-rest-permissions
rest-condition

✅ Best Practices:

Clear messages
Naming conventions
Separation of concerns
Caching
Documentation
Testing

Next Steps

Trong Bài 8.4, bạn sẽ học:

Advanced authorization patterns
Role-based access control (RBAC)
Attribute-based access control (ABAC)
Permission caching strategies
Testing complex permission scenarios

Navigation:

← Bài 8.2: Object-Level Permissions
Bài 8.3: Custom Permissions (current)
Bài 8.4: Advanced Authorization Patterns →

#permission-logic

Permissions & Authorization - Phần 3 - Custom Permissions