Django中級 #4 ユーザー / 権限 — カスタム user model、permission、group

AUTH_USER_MODEL = "accounts.User"

from django.contrib.auth.models import AbstractUser

class User(AbstractUser):
    pass

from django.contrib.auth.models import AbstractUser
from django.db import models

class User(AbstractUser):
    bio = models.TextField(blank=True)
    avatar = models.ImageField(upload_to="avatars/", blank=True, null=True)
    birth_date = models.DateField(null=True, blank=True)

    def __str__(self):
        return self.username

from django.contrib.auth.models import AbstractBaseUser, BaseUserManager, PermissionsMixin
from django.db import models
from django.utils import timezone


class UserManager(BaseUserManager):
    use_in_migrations = True

    def _create_user(self, email, password, **extra):
        if not email:
            raise ValueError("メールは必須です。")
        email = self.normalize_email(email)
        user = self.model(email=email, **extra)
        user.set_password(password)
        user.save(using=self._db)
        return user

    def create_user(self, email, password=None, **extra):
        extra.setdefault("is_staff", False)
        extra.setdefault("is_superuser", False)
        return self._create_user(email, password, **extra)

    def create_superuser(self, email, password=None, **extra):
        extra.setdefault("is_staff", True)
        extra.setdefault("is_superuser", True)
        if extra.get("is_staff") is not True:
            raise ValueError("superuser は is_staff=True でなければなりません。")
        if extra.get("is_superuser") is not True:
            raise ValueError("superuser は is_superuser=True でなければなりません。")
        return self._create_user(email, password, **extra)


class User(AbstractBaseUser, PermissionsMixin):
    email = models.EmailField(unique=True)
    name = models.CharField(max_length=100, blank=True)

    is_active = models.BooleanField(default=True)
    is_staff = models.BooleanField(default=False)
    date_joined = models.DateTimeField(default=timezone.now)

    objects = UserManager()

    USERNAME_FIELD = "email"        # ログインに使うフィールド
    REQUIRED_FIELDS = []            # createsuperuser が訊ねる追加フィールド (email/password 以外)

    def __str__(self):
        return self.email

from django.contrib import admin
from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
from django.contrib.auth.forms import UserCreationForm, UserChangeForm
from .models import User


class UserAdmin(BaseUserAdmin):
    ordering = ("email",)
    list_display = ("email", "name", "is_staff", "is_active")
    search_fields = ("email", "name")

    fieldsets = (
        (None, {"fields": ("email", "password")}),
        ("個人情報", {"fields": ("name",)}),
        ("権限", {"fields": ("is_active", "is_staff", "is_superuser",
                          "groups", "user_permissions")}),
        ("記録", {"fields": ("last_login", "date_joined")}),
    )
    add_fieldsets = (
        (None, {"classes": ("wide",),
                "fields": ("email", "password1", "password2")}),
    )

admin.site.register(User, UserAdmin)

if request.user.has_perm("blog.change_post"):
    # 修正権限あり
    ...

if request.user.has_perms(["blog.change_post", "blog.delete_post"]):
    # 両方あり
    ...

from django.contrib.auth.decorators import permission_required

@permission_required("blog.change_post", raise_exception=True)
def post_edit(request, pk):
    ...

from django.contrib.auth.mixins import PermissionRequiredMixin

class PostUpdateView(PermissionRequiredMixin, UpdateView):
    permission_required = "blog.change_post"
    raise_exception = True

class Post(models.Model):
    ...
    class Meta:
        permissions = [
            ("publish_post", "Can publish post"),
            ("feature_post", "Can feature post on homepage"),
        ]

from django.contrib.auth.models import Group, Permission

editors, _ = Group.objects.get_or_create(name="エディター")
editors.permissions.add(
    Permission.objects.get(codename="add_post"),
    Permission.objects.get(codename="change_post"),
    Permission.objects.get(codename="publish_post"),
)

# ユーザーにグループを付与
user.groups.add(editors)

from django.db import migrations

def create_default_groups(apps, schema_editor):
    Group = apps.get_model("auth", "Group")
    Permission = apps.get_model("auth", "Permission")
    editors, _ = Group.objects.get_or_create(name="エディター")
    perms = Permission.objects.filter(
        codename__in=["add_post", "change_post", "publish_post"]
    )
    editors.permissions.set(perms)

class Migration(migrations.Migration):
    dependencies = [("blog", "0001_initial")]
    operations = [migrations.RunPython(create_default_groups, migrations.RunPython.noop)]

{% if user.is_authenticated %}
  {% if perms.blog.publish_post %}
    <a href="{% url 'post_publish' post.pk %}">公開</a>
  {% endif %}
{% endif %}

class PostUpdateView(LoginRequiredMixin, UserPassesTestMixin, UpdateView):
    model = Post
    form_class = PostForm

    def test_func(self):
        return self.get_object().author == self.request.user

user.set_password("新しいパスワード")  # ハッシュして保存
user.save()

user.check_password("入力値")          # 検証

from django.urls import path, include

urlpatterns = [
    path("accounts/", include("django.contrib.auth.urls")),
    # /accounts/login/, /accounts/logout/, /accounts/password_change/,
    # /accounts/password_reset/ など
]

if request.user.is_authenticated:
    ...

if request.user.is_staff:
    ...

if request.user.is_superuser:
    ...