Bài 8.2: Permissions & Authorization - Phần 2 - Object-Level Permissions

**Series Navigation:** - [Bài 8.1: Permission Basics](/django-advance/permissions-authorization-phan-1) - **Bài 8.2 (bài này): Object-Level Permissions** 👈 - [Bài 8.3: Custom Permissions](/django-advance/permissions-authorization-phan-3) - [Bài 8.4: Advanced Authorization Patterns](/django-advance/permissions-authorization-phan-4)

Mục Tiêu Bài 8.2

Sau khi hoàn thành Bài 8.2 này, bạn sẽ:

✅ Hiểu object-level permissions
✅ Implement IsOwner pattern
✅ Use django-guardian for row-level permissions
✅ Handle complex object permissions
✅ Optimize permission queries
✅ Test object permissions

Object-Level Permissions Overview

What are Object-Level Permissions?

View-level permission: Can user access this endpoint?

# Can user access /api/articles/?has_permission(request, view)

Object-level permission: Can user access THIS specific object?

# Can user access article #5?has_object_permission(request, view, obj)

When Are They Called?

Object permissions checked for:

retrieve() - GET /articles/1/
update() - PUT /articles/1/
partial_update() - PATCH /articles/1/
destroy() - DELETE /articles/1/
Detail actions - GET /articles/1/stats/

NOT checked for:

list() - GET /articles/
create() - POST /articles/

Flow

Request: GET /articles/5/    ↓has_permission() → Check view-level    ↓get_object() → Fetch object    ↓has_object_permission() → Check object-level    ↓View logic    ↓Response

IsOwner Permission Pattern

Basic IsOwner

# permissions.pyfrom rest_framework import permissions class IsOwner(permissions.BasePermission):    """    Object-level permission to only allow owners of an object to access it.    """        def has_object_permission(self, request, view, obj):        # Check if obj has author attribute        return obj.author == request.user

Usage:

# views.pyclass ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticated, IsOwner]        # GET /articles/5/ → Only if request.user == article.author    # PUT /articles/5/ → Only if request.user == article.author

IsOwnerOrReadOnly

# permissions.pyclass IsOwnerOrReadOnly(permissions.BasePermission):    """    Read-only for everyone, write only for owner    """        def has_object_permission(self, request, view, obj):        # Read permissions (GET, HEAD, OPTIONS)        if request.method in permissions.SAFE_METHODS:            return True                # Write permissions only for owner        return obj.author == request.user

Usage:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsOwnerOrReadOnly]        # GET /articles/5/ → Anyone can read    # PUT /articles/5/ → Only owner can update

IsOwnerOrAdmin

# permissions.pyclass IsOwnerOrAdmin(permissions.BasePermission):    """    Owner or admin can access    """        def has_object_permission(self, request, view, obj):        # Owner check        if obj.author == request.user:            return True                # Admin check        if request.user.is_staff:            return True                return False

Shorthand:

class IsOwnerOrAdmin(permissions.BasePermission):    def has_object_permission(self, request, view, obj):        return obj.author == request.user or request.user.is_staff

Flexible Owner Field

# permissions.pyclass IsOwner(permissions.BasePermission):    """    Checks ownership using different field names    """    owner_field = 'author'  # Default        def has_object_permission(self, request, view, obj):        # Get owner field name        owner_field = getattr(view, 'owner_field', self.owner_field)                # Get owner from object        owner = getattr(obj, owner_field, None)                # Check ownership        return owner == request.user

Usage:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsOwner]    owner_field = 'author'  # Use 'author' field class CommentViewSet(viewsets.ModelViewSet):    queryset = Comment.objects.all()    serializer_class = CommentSerializer    permission_classes = [IsOwner]    owner_field = 'user'  # Use 'user' field

Complex Object Permissions

Multiple Ownership Checks

# permissions.pyclass IsArticleOwnerOrCommentOwner(permissions.BasePermission):    """    Check ownership of comment or parent article    """        def has_object_permission(self, request, view, obj):        # Comment owner        if obj.author == request.user:            return True                # Article owner (can moderate comments)        if hasattr(obj, 'article') and obj.article.author == request.user:            return True                return False

Status-Based Permissions

# permissions.pyclass CanEditPublishedArticle(permissions.BasePermission):    """    Only owner can edit draft, admin can edit published    """        def has_object_permission(self, request, view, obj):        # Draft: only owner        if obj.status == 'draft':            return obj.author == request.user                # Published: only admin        if obj.status == 'published':            return request.user.is_staff                # Archived: no one        return False

Time-Based Permissions

# permissions.pyfrom django.utils import timezonefrom datetime import timedelta class CanEditRecent(permissions.BasePermission):    """    Can only edit articles created in last 24 hours    """        def has_object_permission(self, request, view, obj):        # Check ownership        if obj.author != request.user:            return False                # Check time        time_limit = timezone.now() - timedelta(hours=24)        return obj.created_at >= time_limit

Role-Based Object Permissions

# permissions.pyclass HasProjectRole(permissions.BasePermission):    """    Check user role in project    """    required_roles = ['owner', 'admin', 'editor']        def has_object_permission(self, request, view, obj):        # Get user's role in this project        try:            membership = obj.members.get(user=request.user)            return membership.role in self.required_roles        except:            return False

Usage:

class ProjectViewSet(viewsets.ModelViewSet):    queryset = Project.objects.all()    serializer_class = ProjectSerializer        def get_permissions(self):        if self.action in ['update', 'partial_update']:            permission_classes = [HasProjectRole]            permission_classes[0].required_roles = ['owner', 'admin', 'editor']        elif self.action == 'destroy':            permission_classes = [HasProjectRole]            permission_classes[0].required_roles = ['owner']        else:            permission_classes = [IsAuthenticated]                return [p() for p in permission_classes]

django-guardian Integration

What is django-guardian?

django-guardian = Per-object permissions for Django.

Features:

Row-level permissions
Direct and group permissions
Works with Django admin
Custom permission models

Installation

pip install django-guardian

Configuration

# settings.pyINSTALLED_APPS = [    'guardian',] AUTHENTICATION_BACKENDS = [    'django.contrib.auth.backends.ModelBackend',    'guardian.backends.ObjectPermissionBackend',  # Add this] # Optional: Anonymous user permissionsANONYMOUS_USER_NAME = NoneGUARDIAN_RAISE_403 = True

Migrate:

python manage.py migrate

Assigning Object Permissions

Using assign_perm:

from guardian.shortcuts import assign_perm, remove_perm # Assign permission to userarticle = Article.objects.get(id=1)user = User.objects.get(username='john') assign_perm('articles.view_article', user, article)assign_perm('articles.change_article', user, article)assign_perm('articles.delete_article', user, article) # Assign permission to groupfrom django.contrib.auth.models import Groupeditors = Group.objects.get(name='editors')assign_perm('articles.change_article', editors, article) # Remove permissionremove_perm('articles.change_article', user, article)

On object creation:

# views.pyfrom guardian.shortcuts import assign_perm class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer        def perform_create(self, serializer):        article = serializer.save(author=self.request.user)                # Assign all permissions to creator        assign_perm('articles.view_article', self.request.user, article)        assign_perm('articles.change_article', self.request.user, article)        assign_perm('articles.delete_article', self.request.user, article)

Checking Object Permissions

Using has_perm:

from guardian.shortcuts import get_objects_for_user # Check if user has permission for specific objectuser.has_perm('articles.change_article', article)  # True/False # Get all objects user has permission forarticles = get_objects_for_user(    user,    'articles.view_article',    Article)

DRF Integration

Using DjangoObjectPermissions:

# views.pyfrom rest_framework.permissions import DjangoObjectPermissions class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [DjangoObjectPermissions]        # Now checks guardian object permissions:    # GET /articles/1/    → articles.view_article    # PUT /articles/1/    → articles.change_article    # DELETE /articles/1/ → articles.delete_article

Custom guardian permission:

# permissions.pyfrom rest_framework import permissionsfrom guardian.shortcuts import get_objects_for_user class GuardianPermission(permissions.BasePermission):    """    Custom guardian integration    """        def has_permission(self, request, view):        # View-level check        if not request.user.is_authenticated:            return False        return True        def has_object_permission(self, request, view, obj):        # Object-level check using guardian        perm_map = {            'GET': 'view',            'POST': 'add',            'PUT': 'change',            'PATCH': 'change',            'DELETE': 'delete',        }                action = perm_map.get(request.method)        if not action:            return False                perm = f'{obj._meta.app_label}.{action}_{obj._meta.model_name}'                return request.user.has_perm(perm, obj)

Filtering Queryset by Permissions

# views.pyfrom guardian.shortcuts import get_objects_for_user class ArticleViewSet(viewsets.ModelViewSet):    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticated, DjangoObjectPermissions]        def get_queryset(self):        """        Return only articles user has permission to view        """        user = self.request.user                # Get articles with view permission        return get_objects_for_user(            user,            'articles.view_article',            Article,            with_superuser=True        )

Optimizing Object Permissions

Problem: N+1 Queries

Bad:

class ArticleViewSet(viewsets.ModelViewSet):    queryset = Article.objects.all()    serializer_class = ArticleSerializer    permission_classes = [IsOwner]        # List articles    # Query 1: Get all articles    # Query 2-N: Check permission for each article

Solution 1: Filter Queryset

class ArticleViewSet(viewsets.ModelViewSet):    serializer_class = ArticleSerializer    permission_classes = [IsAuthenticated]        def get_queryset(self):        """Pre-filter by ownership"""        return Article.objects.filter(author=self.request.user)

class ArticleViewSet(viewsets.ModelViewSet):    serializer_class = ArticleSerializer    permission_classes = [IsOwner]        def get_queryset(self):        """Optimize with select_related"""        return Article.objects.select_related('author').all()

Solution 3: Cached Permissions

# permissions.pyclass CachedIsOwner(permissions.BasePermission):    """    Cache ownership check results    """        def has_object_permission(self, request, view, obj):        # Cache key        cache_key = f'owner_{request.user.id}_{obj.id}'                # Check cache        from django.core.cache import cache        result = cache.get(cache_key)                if result is None:            # Compute and cache            result = obj.author == request.user            cache.set(cache_key, result, 300)  # 5 minutes                return result

Advanced Object Permission Patterns

Hierarchical Permissions

# permissions.pyclass HasProjectAccess(permissions.BasePermission):    """    Check access through project hierarchy    """        def has_object_permission(self, request, view, obj):        # Direct ownership        if hasattr(obj, 'author') and obj.author == request.user:            return True                # Project member        if hasattr(obj, 'project'):            return obj.project.members.filter(user=request.user).exists()                # Organization member        if hasattr(obj, 'organization'):            return obj.organization.members.filter(user=request.user).exists()                return False

Delegated Permissions

# models.pyclass Article(models.Model):    title = models.CharField(max_length=200)    author = models.ForeignKey(User, on_delete=models.CASCADE, related_name='articles')    delegates = models.ManyToManyField(User, related_name='delegated_articles', blank=True) # permissions.pyclass IsOwnerOrDelegate(permissions.BasePermission):    def has_object_permission(self, request, view, obj):        # Owner check        if obj.author == request.user:            return True                # Delegate check        if request.user in obj.delegates.all():            return True                return False

Permission Chaining

# permissions.pyclass PermissionChain(permissions.BasePermission):    """    Check multiple conditions in order    """        def has_object_permission(self, request, view, obj):        # 1. Owner        if obj.author == request.user:            return True                # 2. Admin        if request.user.is_staff:            return True                # 3. Group member        if hasattr(obj, 'group'):            if obj.group.members.filter(user=request.user).exists():                return True                # 4. Public if published        if obj.status == 'published':            return True                return False

Testing Object Permissions

Basic Object Permission Tests

# tests.pyfrom rest_framework.test import APITestCasefrom django.contrib.auth.models import Userfrom myapp.models import Article class ObjectPermissionTest(APITestCase):    def setUp(self):        self.user1 = User.objects.create_user('user1', 'user1@test.com', 'pass')        self.user2 = User.objects.create_user('user2', 'user2@test.com', 'pass')                self.article1 = Article.objects.create(            title='Article 1',            content='Content 1',            author=self.user1        )        def test_owner_can_update(self):        """Owner can update their article"""        self.client.force_authenticate(user=self.user1)        response = self.client.patch(            f'/api/articles/{self.article1.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 200)        def test_non_owner_cannot_update(self):        """Non-owner cannot update article"""        self.client.force_authenticate(user=self.user2)        response = self.client.patch(            f'/api/articles/{self.article1.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 403)        def test_owner_can_delete(self):        """Owner can delete their article"""        self.client.force_authenticate(user=self.user1)        response = self.client.delete(f'/api/articles/{self.article1.id}/')        self.assertEqual(response.status_code, 204)        def test_non_owner_cannot_delete(self):        """Non-owner cannot delete article"""        self.client.force_authenticate(user=self.user2)        response = self.client.delete(f'/api/articles/{self.article1.id}/')        self.assertEqual(response.status_code, 403)

Testing Guardian Permissions

from guardian.shortcuts import assign_perm, remove_perm class GuardianPermissionTest(APITestCase):    def setUp(self):        self.user = User.objects.create_user('user', 'user@test.com', 'pass')        self.article = Article.objects.create(            title='Test Article',            content='Content',            author=self.user        )        def test_with_permission(self):        """User with permission can update"""        assign_perm('articles.change_article', self.user, self.article)                self.client.force_authenticate(user=self.user)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 200)        def test_without_permission(self):        """User without permission cannot update"""        remove_perm('articles.change_article', self.user, self.article)                self.client.force_authenticate(user=self.user)        response = self.client.patch(            f'/api/articles/{self.article.id}/',            {'title': 'Updated'}        )        self.assertEqual(response.status_code, 403)

Complete Example

# models.pyfrom django.db import modelsfrom django.contrib.auth.models import User class Project(models.Model):    name = models.CharField(max_length=200)    owner = models.ForeignKey(User, on_delete=models.CASCADE, related_name='owned_projects')    created_at = models.DateTimeField(auto_now_add=True) class ProjectMembership(models.Model):    ROLE_CHOICES = [        ('owner', 'Owner'),        ('admin', 'Admin'),        ('editor', 'Editor'),        ('viewer', 'Viewer'),    ]        project = models.ForeignKey(Project, on_delete=models.CASCADE, related_name='memberships')    user = models.ForeignKey(User, on_delete=models.CASCADE)    role = models.CharField(max_length=20, choices=ROLE_CHOICES)        class Meta:        unique_together = ('project', 'user') # permissions.pyfrom rest_framework import permissions class IsProjectMember(permissions.BasePermission):    """Check if user is project member"""        def has_object_permission(self, request, view, obj):        return obj.memberships.filter(user=request.user).exists() class IsProjectOwnerOrAdmin(permissions.BasePermission):    """Check if user is project owner or admin"""        def has_object_permission(self, request, view, obj):        # Owner check        if obj.owner == request.user:            return True                # Admin check        membership = obj.memberships.filter(user=request.user).first()        if membership and membership.role in ['owner', 'admin']:            return True                return False class HasProjectRole(permissions.BasePermission):    """Check if user has specific role"""    required_roles = []        def has_object_permission(self, request, view, obj):        membership = obj.memberships.filter(user=request.user).first()        if not membership:            return False                return membership.role in self.required_roles # views.pyclass ProjectViewSet(viewsets.ModelViewSet):    queryset = Project.objects.all()    serializer_class = ProjectSerializer        def get_queryset(self):        """Return only projects user has access to"""        user = self.request.user        return Project.objects.filter(            models.Q(owner=user) |             models.Q(memberships__user=user)        ).distinct()        def get_permissions(self):        if self.action == 'list':            permission_classes = [IsAuthenticated]        elif self.action == 'create':            permission_classes = [IsAuthenticated]        elif self.action == 'retrieve':            permission_classes = [IsProjectMember]        elif self.action in ['update', 'partial_update']:            permission_classes = [IsProjectOwnerOrAdmin]        elif self.action == 'destroy':            permission_classes = [IsProjectOwnerOrAdmin]        else:            permission_classes = [IsAuthenticated]                return [p() for p in permission_classes]        def perform_create(self, serializer):        project = serializer.save(owner=self.request.user)                # Create owner membership        ProjectMembership.objects.create(            project=project,            user=self.request.user,            role='owner'        )

Tóm Tắt Bài 8.2

Trong Bài 8.2 này, bạn đã học:

✅ Object-Level Permissions:

What and when they're checked
has_object_permission() method
Permission flow

✅ IsOwner Pattern:

Basic IsOwner
IsOwnerOrReadOnly
IsOwnerOrAdmin
Flexible owner field

✅ Complex Permissions:

Multiple ownership checks
Status-based permissions
Time-based permissions
Role-based permissions

✅ django-guardian:

Installation and setup
Assigning object permissions
Checking permissions
DRF integration
Filtering by permissions

✅ Optimization:

Avoid N+1 queries
Filter queryset
Select related
Cached permissions

✅ Advanced Patterns:

Hierarchical permissions
Delegated permissions
Permission chaining

✅ Testing:

Test owner permissions
Test guardian permissions
Complete examples

Next Steps

Trong Bài 8.3, bạn sẽ học:

Building complex custom permissions
Conditional permissions
Dynamic permission logic
Third-party permission packages
Best practices

Navigation:

← Bài 8.1: Permission Basics
Bài 8.2: Object-Level Permissions (current)
Bài 8.3: Custom Permissions →

#row-level-security

Permissions & Authorization - Phần 2 - Object-Level Permissions