django-authority 0.7 (experimental)

A Django app that provides generic per-object-permissions for Django's auth app.

Fixed an issue with the UserPermissionForm not being able to override the widget of the user field.

Added ability to override form class in add_permission view.

Added easy way to assign permissions via a permission instance, e.g.:

from django.contrib.auth.models import User
from mysite.articles.permissions import ArticlePermission

bob = User.objects.get(username='bob')
article_permission = ArticlePermission(bob)
article_permission.assign(content_object=article)

This version adds multiple fields to the Permission model and is therefore a backwards incompatible update.

This was required to add a feature that allows users to request, withdraw, deny and approve permissions. Request and approval date are now saved, as well as an approved property. An admin action has been added for bulk approval.

To migrate your existing data you can use the SQL files included in the source (migrations/), currently available for MySQL, Postgres and SQLite.

The templatetags have also been refactored to be easier to customize which required a change in the template tag signature:

Old:

{% permission_form flatpage %}
{% permission_form flatpage "flatpage_permission.top_secret" %}
{% permission_form OBJ PERMISSION_LABEL.CHECK_NAME %}

New:

{% permission_form for flatpage %}
{% permission_form for flatpage using "flatpage_permission.top_secret" %}
{% permission_form for OBJ using PERMISSION_LABEL.CHECK_NAME [with TEMPLATE] %}

New templatetags:

• permission_request_form
• get_permission_request
• get_permission_requests
• permission_request_approve_link
• permission_request_delete_link
• request_url_for_obj

The add_permission view is now accessible with GET requests and allows to request permissions, but also add them (only for users with the 'authority.add_permission' Django permission).