如何在Django中定义多访问级别的用户模型，并实现用户隶属于多组织且在各组织拥有不同角色

Hey there! Let's tackle these two super common (and critical) Django user management scenarios that pop up in real-world apps—they're totally solvable with Django's built-in tools plus some smart model design.

1. 定义具备多个访问级别的用户模型 #

Django's default User model is solid, but it doesn't come with built-in access levels out of the box. I usually lean into one of two approaches depending on how much customization I need:

方法一：扩展AbstractUser（推荐，快速上手） #

This is the easiest path because it preserves all default user fields (username, email, password, etc.) while letting you bolt on your own custom fields.

Here's a practical example:

# accounts/models.py
from django.contrib.auth.models import AbstractUser
from django.db import models

class CustomUser(AbstractUser):
    # 定义全局访问级别选项
    ACCESS_LEVEL_CHOICES = (
        ('viewer', 'Viewer'),
        ('editor', 'Editor'),
        ('admin', 'Admin'),
        ('superadmin', 'Super Admin'),
    )
    access_level = models.CharField(
        max_length=20,
        choices=ACCESS_LEVEL_CHOICES,
        default='viewer',
        help_text='Global access level for the user across the app'
    )

    def __str__(self):
        return f"{self.username} ({self.get_access_level_display()})"

Critical Step: Tell Django to use your custom user model in settings.py—do this before running migrations!

# settings.py
AUTH_USER_MODEL = 'accounts.CustomUser'

方法二：结合Django的Group与Permission系统（更灵活） #

If you need granular, per-feature permissions instead of just broad access levels, pair your custom user model with Django's built-in Group and Permission models:

• Create groups like "Viewers", "Content Editors", "Org Admins"
• Assign specific permissions to each group (e.g., "can view posts", "can publish posts")
• Add users to groups to grant those permissions automatically

You can even tie this to your access_level field—write a signal that adds users to the corresponding group whenever their access level is updated.

2. 实现用户多组织成员身份与分角色访问 #

For this, you'll need a many-to-many relationship with a through model—this lets you store extra data (like the user's role) for each user-organization membership.

Step 1: Define the Organization and Membership models #

# organizations/models.py
from django.db import models
from accounts.models import CustomUser

class Organization(models.Model):
    name = models.CharField(max_length=100)
    description = models.TextField(blank=True)
    # 可添加其他字段：创建时间、联系人、logo等

    def __str__(self):
        return self.name

class Membership(models.Model):
    ROLE_CHOICES = (
        ('owner', 'Owner'),
        ('admin', 'Organization Admin'),
        ('member', 'Regular Member'),
    )
    user = models.ForeignKey(CustomUser, on_delete=models.CASCADE, related_name='memberships')
    organization = models.ForeignKey(Organization, on_delete=models.CASCADE, related_name='members')
    role = models.CharField(max_length=20, choices=ROLE_CHOICES, default='member')
    joined_at = models.DateTimeField(auto_now_add=True)

    # 确保一个用户在同一个组织只能有唯一身份
    class Meta:
        unique_together = ('user', 'organization')

    def __str__(self):
        return f"{self.user.username} - {self.organization.name} ({self.get_role_display()})"

Step 2: Link User and Organization via the Membership model #

Update your CustomUser model to add the many-to-many relationship:

# accounts/models.py
class CustomUser(AbstractUser):
    # ... 保留之前的字段 ...
    organizations = models.ManyToManyField(
        Organization,
        through='organizations.Membership',
        related_name='users'
    )

Step 3: Use membership data in views/templates #

Now you can easily:

• Add a user to an organization with a specific role:

  org = Organization.objects.get(name="My Startup")
  user = CustomUser.objects.get(username="jane_smith")
  Membership.objects.create(user=user, organization=org, role='admin')
  

• Check a user's role in a specific organization:

  def get_user_role_in_org(user, org):
      try:
          return user.memberships.get(organization=org).role
      except Membership.DoesNotExist:
          return None
  

• Restrict access based on role (example in a view):

  from django.contrib.auth.decorators import login_required
  from django.http import HttpResponseForbidden
  
  @login_required
  def org_dashboard(request, org_id):
      org = Organization.objects.get(id=org_id)
      user_role = get_user_role_in_org(request.user, org)
      
      if user_role not in ['owner', 'admin']:
          return HttpResponseForbidden("You don't have permission to access this dashboard")
      
      # 继续处理 dashboard 逻辑
      return render(request, 'org_dashboard.html', {'org': org, 'role': user_role})
  

Pro Tip #

For cleaner access control in class-based views, use Django's UserPassesTestMixin to check the user's role in the target organization. You can also create custom decorators to reuse this logic across multiple views.

内容的提问来源于stack exchange，提问作者Collins Pro 15