Django多模型层级实例级权限方案设计咨询

Hey there! Let's walk through how to tackle this instance-level permission setup for your Django project—based on your model hierarchy and requirements, here's a breakdown of best practices and actionable steps:

First off, let's address your core questions: automatic group creation is absolutely a good idea, cleanup can be streamlined with Django signals, and combining groups with direct instance permissions will give you the flexibility you need. Here's why and how:

1. Use Groups for Bulk Permission Management #

Groups are perfect for your hierarchical permission scopes (District/School/Student levels) because they let you bundle all relevant permissions for an instance into a single entity. Instead of manually assigning 3+ permissions (view/edit/delete) to every user who needs access to a District, you just add them to the District's group. This cuts down on repetitive admin work and keeps permissions organized.

For one-off cases (like granting access to a single specific Case), you can still use django-guardian's direct instance-level permissions—no need to create a group for every tiny scope.

2. Automate Group & Permission Creation with Django Signals #

You can hook into Django's post_save signal to auto-generate groups and assign instance-level permissions when a model is created. Here's a concrete example for your District model:

from django.db.models.signals import post_save, pre_delete
from django.dispatch import receiver
from django.contrib.auth.models import Group, Permission
from guardian.shortcuts import assign_perm
from .models import District, School, Student, Case

@receiver(post_save, sender=District)
def create_district_permission_group(sender, instance, created, **kwargs):
    if created:
        # Create a unique group for this district
        group_name = f"District: {instance.name} - Full Access"
        group, _ = Group.objects.get_or_create(name=group_name)
        
        # Add all model-level District permissions to the group
        district_perms = Permission.objects.filter(content_type__model='district')
        group.permissions.add(*district_perms)
        
        # Assign instance-level permissions for this specific District to the group
        for perm in district_perms:
            assign_perm(perm.codename, group, instance)

You can replicate this pattern for School, Student, and Case models. For hierarchical inheritance (e.g., a District group should have access to all its Schools), add a signal that adds School instance permissions to the parent District's group when a School is created:

@receiver(post_save, sender=School)
def link_school_to_district_group(sender, instance, created, **kwargs):
    if created:
        district_group = Group.objects.filter(name=f"District: {instance.district.name} - Full Access").first()
        if district_group:
            school_perms = Permission.objects.filter(content_type__model='school')
            district_group.permissions.add(*school_perms)
            for perm in school_perms:
                assign_perm(perm.codename, district_group, instance)

3. Simplify Cleanup with Pre-Delete Signals #

Worried about orphaned groups when you delete a District/School/Student? Use Django's pre_delete signal to automatically remove associated groups:

@receiver(pre_delete, sender=District)
def delete_district_permission_group(sender, instance, **kwargs):
    # Delete the group tied to this District
    Group.objects.filter(name=f"District: {instance.name} - Full Access").delete()
    
    # Optional: Delete all child School groups under this District
    for school in instance.schools.all():
        Group.objects.filter(name=f"School: {school.name} - Full Access").delete()

This logic is straightforward and ensures you don't leave unused cluttering up your auth system.

4. Handle Hierarchical Permission Checks #

For cases where you need to verify if a user has access to a lower-level instance (like a Case) via a higher-level permission (like its parent District), you can build a helper function to check permission inheritance:

from guardian.core import ObjectPermissionChecker

def has_instance_access(user, instance):
    checker = ObjectPermissionChecker(user)
    
    # Check direct instance permission first
    model_name = instance._meta.model_name
    if checker.has_perm(f'view_{model_name}', instance):
        return True
    
    # Check parent hierarchy permissions
    if isinstance(instance, Case):
        return has_instance_access(user, instance.student)
    elif isinstance(instance, Student):
        return has_instance_access(user, instance.school)
    elif isinstance(instance, School):
        return has_instance_access(user, instance.district)
    
    # Fallback to admin access
    return user.is_superuser

Use this function in your views or serializers to restrict access to only authorized users.

5. Integrate with the Django Admin #

Make it easy for admins to manage permissions by customizing your ModelAdmin classes. For example, add a bulk action to add users to a District's access group:

from django.contrib import admin
from guardian.admin import GuardedModelAdmin
from .models import District

class DistrictAdmin(GuardedModelAdmin):
    list_display = ('name',)
    actions = ['add_users_to_access_group']
    
    def add_users_to_access_group(self, request, queryset):
        for district in queryset:
            group, _ = Group.objects.get_or_create(name=f"District: {district.name} - Full Access")
            # Add a form here to let admins select which users to add, or use request data
            # Example: group.user_set.add(*User.objects.filter(id__in=request.POST.getlist('user_ids')))
        self.message_user(request, "Users added to district access groups successfully.")
    add_users_to_access_group.short_description = "Add selected users to district full-access groups"

admin.site.register(District, DistrictAdmin)

• Groups are worth it: They simplify bulk permission management for your hierarchical scopes.
• Signals make automation easy: Auto-creating/cleaning up groups removes manual admin work and prevents orphaned data.
• Combine groups and direct permissions: Use groups for large scopes (District/School) and direct permissions for one-off cases (specific Case access).
• Hierarchical checks add flexibility: The helper function ensures users inherit access through parent instances without redundant permission assignments.

内容的提问来源于stack exchange，提问作者Chandler