Bài 8.4: Permissions & Authorization - Phần 4 - Advanced Authorization Patterns

**Series Navigation:** - [Bài 8.1: Permission Basics](/django-advance/permissions-authorization-phan-1) - [Bài 8.2: Object-Level Permissions](/django-advance/permissions-authorization-phan-2) - [Bài 8.3: Custom Permissions](/django-advance/permissions-authorization-phan-3) - **Bài 8.4 (bài này): Advanced Authorization Patterns** 👈

Mục Tiêu Bài 8.4

Sau khi hoàn thành Bài 8.4 này, bạn sẽ:

✅ Implement Role-Based Access Control (RBAC)
✅ Implement Attribute-Based Access Control (ABAC)
✅ Build multi-tenancy permission systems
✅ Optimize permission checks with caching
✅ Test complex authorization scenarios
✅ Deploy production-ready permission systems

Role-Based Access Control (RBAC)

What is RBAC?

RBAC = Permissions assigned to roles, users assigned to roles.

User → Role → Permissions → Resources

Example:

User: john@example.com  → Role: Editor    → Permissions: create_article, edit_article, delete_own_article      → Can: Create/Edit articles, Delete own articles

Basic RBAC Implementation

Models:

# models.pyfrom django.db import modelsfrom django.contrib.auth.models import User class Role(models.Model):    name = models.CharField(max_length=50, unique=True)    description = models.TextField(blank=True)        class Meta:        ordering = ['name']        def __str__(self):        return self.name class Permission(models.Model):    name = models.CharField(max_length=100, unique=True)    codename = models.CharField(max_length=100, unique=True)    description = models.TextField(blank=True)        class Meta:        ordering = ['name']        def __str__(self):        return self.name class RolePermission(models.Model):    role = models.ForeignKey(Role, on_delete=models.CASCADE, related_name='permissions')    permission = models.ForeignKey(Permission, on_delete=models.CASCADE)        class Meta:        unique_together = ('role', 'permission') class UserRole(models.Model):    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='roles')    role = models.ForeignKey(Role, on_delete=models.CASCADE)        # Optional: Scope roles to specific resources    content_type = models.ForeignKey(        'contenttypes.ContentType',        on_delete=models.CASCADE,        null=True,        blank=True    )    object_id = models.PositiveIntegerField(null=True, blank=True)        class Meta:        unique_together = ('user', 'role', 'content_type', 'object_id')

Helper functions:

# utils/rbac.pyfrom myapp.models import Role, Permission, UserRole, RolePermission def assign_role(user, role_name, obj=None):    """Assign role to user"""    role = Role.objects.get(name=role_name)        if obj:        from django.contrib.contenttypes.models import ContentType        ct = ContentType.objects.get_for_model(obj)        UserRole.objects.get_or_create(            user=user,            role=role,            content_type=ct,            object_id=obj.id        )    else:        UserRole.objects.get_or_create(            user=user,            role=role        ) def remove_role(user, role_name, obj=None):    """Remove role from user"""    role = Role.objects.get(name=role_name)        if obj:        from django.contrib.contenttypes.models import ContentType        ct = ContentType.objects.get_for_model(obj)        UserRole.objects.filter(            user=user,            role=role,            content_type=ct,            object_id=obj.id        ).delete()    else:        UserRole.objects.filter(user=user, role=role).delete() def has_permission(user, permission_codename, obj=None):    """Check if user has permission"""    if obj:        from django.contrib.contenttypes.models import ContentType        ct = ContentType.objects.get_for_model(obj)                # Check scoped roles        user_roles = UserRole.objects.filter(            user=user,            content_type=ct,            object_id=obj.id        ).values_list('role', flat=True)    else:        # Check global roles        user_roles = UserRole.objects.filter(            user=user,            content_type__isnull=True        ).values_list('role', flat=True)        # Check if any role has the permission    return RolePermission.objects.filter(        role__in=user_roles,        permission__codename=permission_codename    ).exists() def get_user_permissions(user, obj=None):    """Get all permissions for user"""    if obj:        from django.contrib.contenttypes.models import ContentType        ct = ContentType.objects.get_for_model(obj)        user_roles = UserRole.objects.filter(            user=user,            content_type=ct,            object_id=obj.id        ).values_list('role', flat=True)    else:        user_roles = UserRole.objects.filter(            user=user,            content_type__isnull=True        ).values_list('role', flat=True)        return Permission.objects.filter(        rolepermission__role__in=user_roles    ).distinct()

DRF Permission:

# permissions.pyfrom rest_framework import permissionsfrom myapp.utils.rbac import has_permission class RBACPermission(permissions.BasePermission):    """    Role-Based Access Control permission    """    # Map actions to permission codenames    permission_map = {        'list': 'view_{model}',        'retrieve': 'view_{model}',        'create': 'add_{model}',        'update': 'change_{model}',        'partial_update': 'change_{model}',        'destroy': 'delete_{model}',    }        def has_permission(self, request, view):        # Get permission codename        action = view.action        model_name = view.queryset.model._meta.model_name                perm_template = self.permission_map.get(action)        if not perm_template:            return False                perm_codename = perm_template.format(model=model_name)                # Check permission        return has_permission(request.user, perm_codename)        def has_object_permission(self, request, view, obj):        # Get permission codename        action = view.action        model_name = obj._meta.model_name                perm_template = self.permission_map.get(action)        if not perm_template:            return False                perm_codename = perm_template.format(model=model_name)                # Check object-level permission        return has_permission(request.user, perm_codename, obj)

Usage:

# views.pyclass ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [RBACPermission] # Assign rolesfrom myapp.utils.rbac import assign_role user = User.objects.get(username='john')assign_role(user, 'Editor')  # Global editor role # Or scoped to specific projectproject = Project.objects.get(id=1)assign_role(user, 'ProjectAdmin', project)

Hierarchical RBAC

Models with role hierarchy:

# models.pyclass Role(models.Model):    name = models.CharField(max_length=50, unique=True)    description = models.TextField(blank=True)    parent = models.ForeignKey(        'self',        on_delete=models.CASCADE,        null=True,        blank=True,        related_name='children'    )    level = models.IntegerField(default=0)        class Meta:        ordering = ['level', 'name']        def get_all_permissions(self):        """Get permissions including inherited from parent roles"""        perms = set(self.permissions.all())                # Add parent permissions        if self.parent:            perms.update(self.parent.get_all_permissions())                return perms

Example hierarchy:

SuperAdmin (level 0)  ├── Admin (level 1)  │   ├── Editor (level 2)  │   │   └── Viewer (level 3)  │   └── Moderator (level 2)  └── Support (level 1)

Permission inheritance:

# utils/rbac.pydef has_permission_hierarchical(user, permission_codename, obj=None):    """Check permission with role hierarchy"""    # Get user roles    user_roles = UserRole.objects.filter(user=user)        if obj:        from django.contrib.contenttypes.models import ContentType        ct = ContentType.objects.get_for_model(obj)        user_roles = user_roles.filter(content_type=ct, object_id=obj.id)    else:        user_roles = user_roles.filter(content_type__isnull=True)        # Check each role and its parents    for user_role in user_roles:        role = user_role.role                # Get all permissions (including inherited)        all_perms = role.get_all_permissions()                if any(p.codename == permission_codename for p in all_perms):            return True        return False

Attribute-Based Access Control (ABAC)

What is ABAC?

ABAC = Permissions based on attributes of user, resource, environment.

Allow if:  user.department == "Engineering" AND  resource.status == "draft" AND  environment.time >= 9:00 AND environment.time <= 17:00

ABAC Implementation

Policy Model:

# models.pyclass ABACPolicy(models.Model):    name = models.CharField(max_length=100)    description = models.TextField(blank=True)    resource_type = models.CharField(max_length=50)  # e.g., 'article', 'project'    action = models.CharField(max_length=50)  # e.g., 'view', 'edit', 'delete'    conditions = models.JSONField()  # Policy conditions    effect = models.CharField(        max_length=10,        choices=[('allow', 'Allow'), ('deny', 'Deny')],        default='allow'    )    priority = models.IntegerField(default=0)    is_active = models.BooleanField(default=True)        class Meta:        ordering = ['-priority', 'name']        def evaluate(self, user, resource, action, context=None):        """Evaluate policy against user, resource, action, and context"""        if not self.is_active:            return None                if self.action != action:            return None                if resource and self.resource_type != resource._meta.model_name:            return None                # Evaluate conditions        result = self._evaluate_conditions(user, resource, context or {})                if result:            return self.effect == 'allow'                return None        def _evaluate_conditions(self, user, resource, context):        """Evaluate all conditions"""        conditions = self.conditions                # User attributes        if 'user' in conditions:            if not self._check_attributes(user, conditions['user']):                return False                # Resource attributes        if 'resource' in conditions and resource:            if not self._check_attributes(resource, conditions['resource']):                return False                # Environment/Context        if 'environment' in conditions:            if not self._check_environment(conditions['environment'], context):                return False                return True        def _check_attributes(self, obj, attr_conditions):        """Check object attributes against conditions"""        for attr, condition in attr_conditions.items():            value = getattr(obj, attr, None)                        if isinstance(condition, dict):                op = condition.get('op')                expected = condition.get('value')                                if op == 'eq' and value != expected:                    return False                elif op == 'ne' and value == expected:                    return False                elif op == 'in' and value not in expected:                    return False                elif op == 'gt' and not (value > expected):                    return False                elif op == 'lt' and not (value < expected):                    return False            else:                if value != condition:                    return False                return True        def _check_environment(self, env_conditions, context):        """Check environment conditions"""        from django.utils import timezone                for key, condition in env_conditions.items():            if key == 'time_range':                now = timezone.localtime().time()                start = condition.get('start')                end = condition.get('end')                                if start and now < start:                    return False                if end and now > end:                    return False                        elif key == 'weekday':                now = timezone.localtime()                if now.weekday() not in condition:                    return False                        elif key == 'ip_range':                client_ip = context.get('ip')                # Check if IP in range (simplified)                if client_ip not in condition:                    return False                return True

Example policies:

# Create policiesABACPolicy.objects.create(    name='Engineering can edit drafts',    resource_type='article',    action='edit',    conditions={        'user': {            'department': 'Engineering'        },        'resource': {            'status': 'draft'        }    },    effect='allow') ABACPolicy.objects.create(    name='Business hours only',    resource_type='article',    action='create',    conditions={        'environment': {            'time_range': {                'start': '09:00:00',                'end': '17:00:00'            },            'weekday': [0, 1, 2, 3, 4]  # Monday-Friday        }    },    effect='allow') ABACPolicy.objects.create(    name='Deny archived articles',    resource_type='article',    action='edit',    conditions={        'resource': {            'status': 'archived'        }    },    effect='deny',    priority=100  # Higher priority)

ABAC Permission Class:

# permissions.pyfrom rest_framework import permissionsfrom myapp.models import ABACPolicy class ABACPermission(permissions.BasePermission):    """    Attribute-Based Access Control permission    """        def has_permission(self, request, view):        # For list/create actions        action = self._get_action(request.method, view.action)        resource_type = view.queryset.model._meta.model_name                return self._evaluate_policies(            request.user,            None,            action,            resource_type,            request        )        def has_object_permission(self, request, view, obj):        # For detail actions        action = self._get_action(request.method, view.action)                return self._evaluate_policies(            request.user,            obj,            action,            obj._meta.model_name,            request        )        def _get_action(self, method, view_action):        """Map HTTP method to action"""        action_map = {            'GET': 'view',            'POST': 'create',            'PUT': 'edit',            'PATCH': 'edit',            'DELETE': 'delete',        }        return action_map.get(method, view_action)        def _evaluate_policies(self, user, resource, action, resource_type, request):        """Evaluate all applicable policies"""        # Get context        context = {            'ip': self._get_client_ip(request),            'user_agent': request.META.get('HTTP_USER_AGENT'),        }                # Get all policies        policies = ABACPolicy.objects.filter(            is_active=True,            resource_type=resource_type        )                # Evaluate policies by priority        allow = False                for policy in policies:            result = policy.evaluate(user, resource, action, context)                        if result is not None:                if policy.effect == 'deny':                    return False  # Explicit deny                allow = True                return allow        def _get_client_ip(self, request):        """Get client IP address"""        x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')        if x_forwarded_for:            ip = x_forwarded_for.split(',')[0]        else:            ip = request.META.get('REMOTE_ADDR')        return ip

Multi-Tenancy Permissions

Tenant Isolation

Models:

# models.pyfrom django.db import modelsfrom django.contrib.auth.models import User class Tenant(models.Model):    name = models.CharField(max_length=100)    slug = models.SlugField(unique=True)    is_active = models.BooleanField(default=True)        def __str__(self):        return self.name class TenantUser(models.Model):    tenant = models.ForeignKey(Tenant, on_delete=models.CASCADE, related_name='users')    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='tenants')    role = models.CharField(max_length=50)    is_active = models.BooleanField(default=True)        class Meta:        unique_together = ('tenant', 'user') class TenantAwareModel(models.Model):    """Base model for tenant-aware models"""    tenant = models.ForeignKey(Tenant, on_delete=models.CASCADE)        class Meta:        abstract = True class Article(TenantAwareModel):    title = models.CharField(max_length=200)    content = models.TextField()    author = models.ForeignKey(User, on_delete=models.CASCADE)    created_at = models.DateTimeField(auto_now_add=True)

Middleware to set tenant:

# middleware.pyfrom myapp.models import Tenant class TenantMiddleware:    """    Set tenant from subdomain or header    """        def __init__(self, get_response):        self.get_response = get_response        def __call__(self, request):        # Get tenant from subdomain        host = request.get_host()        subdomain = host.split('.')[0]                # Or from header        tenant_slug = request.headers.get('X-Tenant', subdomain)                try:            tenant = Tenant.objects.get(slug=tenant_slug, is_active=True)            request.tenant = tenant        except Tenant.DoesNotExist:            request.tenant = None                response = self.get_response(request)        return response

Tenant Permission:

# permissions.pyfrom rest_framework import permissions class IsTenantMember(permissions.BasePermission):    """    User must be member of tenant    """        def has_permission(self, request, view):        if not hasattr(request, 'tenant') or not request.tenant:            self.message = 'Tenant not found'            return False                if not request.user.is_authenticated:            return False                # Check tenant membership        return request.user.tenants.filter(            tenant=request.tenant,            is_active=True        ).exists() class HasTenantRole(permissions.BasePermission):    """    User must have specific role in tenant    """    required_roles = []        def has_permission(self, request, view):        if not hasattr(request, 'tenant') or not request.tenant:            return False                # Get user's role in tenant        try:            tenant_user = request.user.tenants.get(                tenant=request.tenant,                is_active=True            )                        return tenant_user.role in self.required_roles        except:            return False

Tenant-aware ViewSet:

# views.pyclass TenantViewSet(viewsets.ModelViewSet):    """    Base viewset for tenant-aware models    """        def get_queryset(self):        """Filter by tenant"""        if not hasattr(self.request, 'tenant') or not self.request.tenant:            return self.queryset.model.objects.none()                return super().get_queryset().filter(tenant=self.request.tenant)        def perform_create(self, serializer):        """Set tenant on create"""        serializer.save(tenant=self.request.tenant) class ArticleViewSet(TenantViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsTenantMember]

Permission Caching

Why Cache Permissions?

Problem:

Permission checks can be expensive (database queries)
Same checks repeated multiple times per request
Object-level checks on lists = N queries

Solution:

Cache permission results
Cache role/permission lookups
Batch permission checks

Request-Level Caching

# permissions.pyfrom rest_framework import permissions class CachedPermission(permissions.BasePermission):    """    Cache permission results for request duration    """        def has_permission(self, request, view):        # Create cache key        cache_key = f'perm_{view.__class__.__name__}_{view.action}'                # Check request cache        if not hasattr(request, '_permission_cache'):            request._permission_cache = {}                if cache_key in request._permission_cache:            return request._permission_cache[cache_key]                # Compute permission        result = self._check_permission(request, view)                # Cache result        request._permission_cache[cache_key] = result                return result        def has_object_permission(self, request, view, obj):        # Create cache key        cache_key = f'obj_perm_{view.__class__.__name__}_{view.action}_{obj.pk}'                # Check request cache        if not hasattr(request, '_permission_cache'):            request._permission_cache = {}                if cache_key in request._permission_cache:            return request._permission_cache[cache_key]                # Compute permission        result = self._check_object_permission(request, view, obj)                # Cache result        request._permission_cache[cache_key] = result                return result        def _check_permission(self, request, view):        """Override in subclass"""        return True        def _check_object_permission(self, request, view, obj):        """Override in subclass"""        return True

Redis Caching

# permissions.pyfrom django.core.cache import cachefrom rest_framework import permissions class RedisCachedPermission(permissions.BasePermission):    """    Cache permissions in Redis    """    cache_ttl = 300  # 5 minutes        def has_object_permission(self, request, view, obj):        # Create cache key        cache_key = self._get_cache_key(request.user, obj, view.action)                # Check cache        result = cache.get(cache_key)                if result is not None:            return result                # Compute permission        result = self._check_permission(request.user, obj, view.action)                # Cache result        cache.set(cache_key, result, self.cache_ttl)                return result        def _get_cache_key(self, user, obj, action):        """Generate cache key"""        return f'perm:{user.id}:{obj._meta.model_name}:{obj.pk}:{action}'        def _check_permission(self, user, obj, action):        """Override in subclass"""        return True

Cache invalidation:

# signals.pyfrom django.db.models.signals import post_save, post_deletefrom django.dispatch import receiverfrom django.core.cache import cachefrom myapp.models import Article @receiver([post_save, post_delete], sender=Article)def invalidate_article_permissions(sender, instance, **kwargs):    """Invalidate cached permissions when article changes"""    # Invalidate all cached permissions for this article    pattern = f'perm:*:article:{instance.pk}:*'        # Note: This requires Redis and django-redis    cache_keys = cache.keys(pattern)    if cache_keys:        cache.delete_many(cache_keys)

Batch Permission Checking

# utils/permissions.pydef check_permissions_batch(user, objects, permission):    """    Check permissions for multiple objects at once    """    from django.core.cache import cache        results = {}    to_check = []        # Check cache first    for obj in objects:        cache_key = f'perm:{user.id}:{obj._meta.model_name}:{obj.pk}:{permission}'        cached = cache.get(cache_key)                if cached is not None:            results[obj.pk] = cached        else:            to_check.append(obj)        # Batch check uncached    if to_check:        # Optimize with single query        # Example: Check ownership        owned_ids = set(            obj.pk for obj in to_check            if hasattr(obj, 'author') and obj.author_id == user.id        )                for obj in to_check:            result = obj.pk in owned_ids            results[obj.pk] = result                        # Cache result            cache_key = f'perm:{user.id}:{obj._meta.model_name}:{obj.pk}:{permission}'            cache.set(cache_key, result, 300)        return results # Usage in serializerclass ArticleListSerializer(serializers.ModelSerializer):    can_edit = serializers.SerializerMethodField()        def get_can_edit(self, obj):        # Get batch results from context        if 'permissions' in self.context:            return self.context['permissions'].get(obj.pk, False)        return False # In viewclass ArticleViewSet(viewsets.ModelViewSet):    def list(self, request, *args, **kwargs):        queryset = self.filter_queryset(self.get_queryset())                # Batch check permissions        permissions = check_permissions_batch(            request.user,            queryset,            'edit'        )                serializer = self.get_serializer(            queryset,            many=True,            context={'permissions': permissions}        )                return Response(serializer.data)

Testing Complex Permissions

Permission Test Helpers

# tests/helpers.pyfrom rest_framework.test import APITestCasefrom django.contrib.auth.models import User class PermissionTestMixin:    """    Mixin for testing permissions    """        def assert_can_access(self, user, method, url, data=None):        """Assert user can access endpoint"""        self.client.force_authenticate(user=user)                if method == 'GET':            response = self.client.get(url)        elif method == 'POST':            response = self.client.post(url, data)        elif method == 'PUT':            response = self.client.put(url, data)        elif method == 'PATCH':            response = self.client.patch(url, data)        elif method == 'DELETE':            response = self.client.delete(url)                self.assertIn(            response.status_code,            [200, 201, 204],            f'{user} should be able to {method} {url}'        )        def assert_cannot_access(self, user, method, url, data=None):        """Assert user cannot access endpoint"""        self.client.force_authenticate(user=user)                if method == 'GET':            response = self.client.get(url)        elif method == 'POST':            response = self.client.post(url, data)        elif method == 'PUT':            response = self.client.put(url, data)        elif method == 'PATCH':            response = self.client.patch(url, data)        elif method == 'DELETE':            response = self.client.delete(url)                self.assertEqual(            response.status_code,            403,            f'{user} should NOT be able to {method} {url}'        )        def create_user_with_role(self, username, role_name):        """Create user and assign role"""        user = User.objects.create_user(username, f'{username}@test.com', 'pass')        from myapp.utils.rbac import assign_role        assign_role(user, role_name)        return user

Comprehensive Permission Tests

# tests/test_permissions.pyfrom tests.helpers import PermissionTestMixinfrom rest_framework.test import APITestCasefrom myapp.models import Article, Role, Permission, RolePermission class ArticlePermissionTest(PermissionTestMixin, APITestCase):    def setUp(self):        # Create roles        self.viewer_role = Role.objects.create(name='Viewer')        self.editor_role = Role.objects.create(name='Editor')        self.admin_role = Role.objects.create(name='Admin')                # Create permissions        view_perm = Permission.objects.create(            name='View Article',            codename='view_article'        )        add_perm = Permission.objects.create(            name='Add Article',            codename='add_article'        )        change_perm = Permission.objects.create(            name='Change Article',            codename='change_article'        )        delete_perm = Permission.objects.create(            name='Delete Article',            codename='delete_article'        )                # Assign permissions to roles        RolePermission.objects.create(role=self.viewer_role, permission=view_perm)                for perm in [view_perm, add_perm, change_perm]:            RolePermission.objects.create(role=self.editor_role, permission=perm)                for perm in [view_perm, add_perm, change_perm, delete_perm]:            RolePermission.objects.create(role=self.admin_role, permission=perm)                # Create users        self.viewer = self.create_user_with_role('viewer', 'Viewer')        self.editor = self.create_user_with_role('editor', 'Editor')        self.admin = self.create_user_with_role('admin', 'Admin')                # Create article        self.article = Article.objects.create(            title='Test Article',            content='Content',            author=self.editor        )        def test_viewer_can_list(self):        """Viewer can list articles"""        self.assert_can_access(self.viewer, 'GET', '/api/articles/')        def test_viewer_can_retrieve(self):        """Viewer can retrieve article"""        self.assert_can_access(self.viewer, 'GET', f'/api/articles/{self.article.id}/')        def test_viewer_cannot_create(self):        """Viewer cannot create article"""        self.assert_cannot_access(            self.viewer,            'POST',            '/api/articles/',            {'title': 'New', 'content': 'Content'}        )        def test_editor_can_create(self):        """Editor can create article"""        self.assert_can_access(            self.editor,            'POST',            '/api/articles/',            {'title': 'New', 'content': 'Content'}        )        def test_editor_can_update(self):        """Editor can update article"""        self.assert_can_access(            self.editor,            'PATCH',            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        def test_editor_cannot_delete(self):        """Editor cannot delete article"""        self.assert_cannot_access(            self.editor,            'DELETE',            f'/api/articles/{self.article.id}/'        )        def test_admin_can_delete(self):        """Admin can delete article"""        self.assert_can_access(            self.admin,            'DELETE',            f'/api/articles/{self.article.id}/'        )

Testing ABAC Policies

# tests/test_abac.pyfrom rest_framework.test import APITestCasefrom myapp.models import ABACPolicy, Articlefrom django.contrib.auth.models import User class ABACTest(APITestCase):    def setUp(self):        self.user = User.objects.create_user('user', 'user@test.com', 'pass')        self.user.department = 'Engineering'        self.user.save()                self.article = Article.objects.create(            title='Test',            content='Content',            author=self.user,            status='draft'        )        def test_allow_policy(self):        """Test allow policy"""        policy = ABACPolicy.objects.create(            name='Engineering can edit drafts',            resource_type='article',            action='edit',            conditions={                'user': {'department': 'Engineering'},                'resource': {'status': 'draft'}            },            effect='allow'        )                self.client.force_authenticate(user=self.user)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 200)        def test_deny_policy(self):        """Test deny policy"""        policy = ABACPolicy.objects.create(            name='Deny archived',            resource_type='article',            action='edit',            conditions={                'resource': {'status': 'archived'}            },            effect='deny',            priority=100        )                self.article.status = 'archived'        self.article.save()                self.client.force_authenticate(user=self.user)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 403)

Production Best Practices

1. Fail Secure

# Always default to denyclass SecurePermission(permissions.BasePermission):    def has_permission(self, request, view):        try:            return self._check_permission(request, view)        except Exception as e:            # Log error            logger.error(f'Permission check error: {e}')            # Fail secure - deny access            return False

2. Audit Logging

# middleware.pyimport logging logger = logging.getLogger('security') class PermissionAuditMiddleware:    def __init__(self, get_response):        self.get_response = get_response        def __call__(self, request):        response = self.get_response(request)                # Log permission denials        if response.status_code == 403:            logger.warning(                f'Permission denied: {request.user} '                f'tried to {request.method} {request.path}'            )                return response

3. Rate Limiting

# permissions.pyfrom django.core.cache import cachefrom rest_framework import permissions class RateLimitPermission(permissions.BasePermission):    """    Rate limit permission checks    """    rate = 100  # requests    period = 3600  # per hour        def has_permission(self, request, view):        if not request.user.is_authenticated:            return False                # Get rate limit key        key = f'rate_limit:{request.user.id}:{view.__class__.__name__}'                # Get current count        count = cache.get(key, 0)                if count >= self.rate:            self.message = 'Rate limit exceeded'            return False                # Increment counter        if count == 0:            cache.set(key, 1, self.period)        else:            cache.incr(key)                return True

4. Monitoring

# utils/monitoring.pyfrom django.core.cache import cacheimport time class PermissionMonitor:    """Monitor permission check performance"""        @staticmethod    def track_check(permission_class, duration):        """Track permission check"""        key = f'perm_stats:{permission_class.__name__}'                stats = cache.get(key, {'count': 0, 'total_time': 0})        stats['count'] += 1        stats['total_time'] += duration                cache.set(key, stats, 3600)        @staticmethod    def get_stats(permission_class):        """Get stats for permission"""        key = f'perm_stats:{permission_class.__name__}'        stats = cache.get(key, {'count': 0, 'total_time': 0})                if stats['count'] > 0:            stats['avg_time'] = stats['total_time'] / stats['count']        else:            stats['avg_time'] = 0                return stats # Decoratordef monitor_permission(func):    """Decorator to monitor permission checks"""    def wrapper(*args, **kwargs):        start = time.time()        result = func(*args, **kwargs)        duration = time.time() - start                # Track        permission_class = args[0].__class__        PermissionMonitor.track_check(permission_class, duration)                return result    return wrapper # Usageclass MonitoredPermission(permissions.BasePermission):    @monitor_permission    def has_permission(self, request, view):        # ... permission logic ...        pass

Tóm Tắt Bài 8.4

Trong Bài 8.4 này, bạn đã học:

✅ Role-Based Access Control (RBAC):

Basic RBAC implementation
Hierarchical roles
Permission inheritance
DRF integration

✅ Attribute-Based Access Control (ABAC):

Policy-based permissions
Condition evaluation
User/resource/environment attributes
Dynamic authorization

✅ Multi-Tenancy:

Tenant isolation
Tenant-aware models
Tenant permissions
Middleware integration

✅ Permission Caching:

Request-level caching
Redis caching
Batch permission checks
Cache invalidation

✅ Testing:

Permission test helpers
Comprehensive test suites
ABAC policy testing
Test best practices

✅ Production Best Practices:

Fail secure
Audit logging
Rate limiting
Performance monitoring

Tổng Kết Series Bài 8

🎉 Chúc mừng! Bạn đã hoàn thành series về Permissions & Authorization!

Tổng quan những gì đã học:

Bài 8.1: Permission basics, built-in classes, view/method-level permissions
Bài 8.2: Object-level permissions, IsOwner pattern, django-guardian
Bài 8.3: Custom permissions, conditional logic, composition, third-party packages
Bài 8.4: RBAC, ABAC, multi-tenancy, caching, testing, production patterns

Next Steps:

Trong Bài 9, bạn sẽ học về:

Filtering & Pagination
DjangoFilterBackend
SearchFilter & OrderingFilter
Custom filters
Pagination styles

Navigation:

← Bài 8.3: Custom Permissions
Bài 8.4: Advanced Authorization Patterns (current)
Bài 9: Filtering & Pagination →

#rbac

Permissions & Authorization - Phần 4 - Advanced Authorization Patterns