fairdm.permissions

The object-level permission backend that makes a portal role’s rights real.

A role’s permissions are declared at the model level (fairdm/portal_roles.py), but ModelBackend.has_perm answers False for every object-level question (django/contrib/auth/backends.py): a Data Curator holding change_dataset cannot in fact change a dataset until something derives the object-level answer from it. This backend is that derivation, and it is deliberately narrow: only a permission held through membership of one of the four shipped portal roles confers the object-level answer. A permission granted straight to a person, or held through a group the portal made up itself, answers as before. Update, Delete and Descriptions stay refused to a person holding only a model-level grant on a private record, because a page that relies on inheriting a visibility rule is not guarded.

Module Contents

Classes

PortalRolePermissionBackend

Derives an object-level answer from a person’s membership in a shipped portal role.

API

class PortalRolePermissionBackend

Bases: django.contrib.auth.backends.BaseBackend

Derives an object-level answer from a person’s membership in a shipped portal role.

Registered in AUTHENTICATION_BACKENDS after the existing backends (fairdm/conf/settings/auth.py). Writes no per-record row.

Extends BaseBackend for its no-op authenticate/get_user, because django.contrib.auth.authenticate() introspects every configured backend’s authenticate signature, not only the one that handles a given credential.

has_perm(user_obj, perm, obj=None)

Answer object-level questions for permissions held through a shipped portal role.