Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
---+-
 Reporter:  Ciantic|Owner:  nobody
 Type:  New feature|   Status:  closed
Component:  Generic views  |  Version:  master
 Severity:  Normal |   Resolution:  duplicate
 Keywords: | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+-
Changes (by MarkusH):

 * status:  new => closed
 * resolution:   => duplicate


Comment:

 There has been some discussion among core developers at DjangoCon Europe
 2015 where we basically agreed on the implementation as suggested in
 #24914. I'm therefore closing this ticket as duplicate.

--
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.2dcf76056620efc1dea36ad681aac3e9%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
---+
 Reporter:  Ciantic|Owner:  nobody
 Type:  New feature|   Status:  new
Component:  Generic views  |  Version:  master
 Severity:  Normal |   Resolution:
 Keywords: | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Changes (by mjtamlyn):

 * status:  closed => new
 * resolution:  wontfix =>


Comment:

 One of these should be kept open to track the issue.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.0a75f5e501872354e60e4eba449ebd86%40djangoproject.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
---+
 Reporter:  Ciantic|Owner:  nobody
 Type:  New feature|   Status:  new
Component:  Generic views  |  Version:  master
 Severity:  Normal |   Resolution:
 Keywords: | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+

Comment (by garrypolley):

 After spending some time on this, I don't think this is worth the effort
 at.  I think this ticket and the related one

 https://code.djangoproject.com/ticket/14512

 should both be closed, in favor of mixins.

 Thoughts?

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.2ca71ca49140d8885db5c005701c0c77%40djangoproject.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
---+
 Reporter:  Ciantic|Owner:  nobody
 Type:  New feature|   Status:  closed
Component:  Generic views  |  Version:  master
 Severity:  Normal |   Resolution:  wontfix
 Keywords: | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Changes (by garrypolley):

 * status:  new => closed
 * resolution:   => wontfix


Comment:

 Talked to Jacob, the solution here is to bring mixins into Django
 directly.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.e86d9a2d9f9f33ee4b712ba2a44caf0f%40djangoproject.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
---+
 Reporter:  Ciantic|Owner:  nobody
 Type:  New feature|   Status:  new
Component:  Generic views  |  Version:  master
 Severity:  Normal |   Resolution:
 Keywords: | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+

Comment (by garrypolley):

 I think this ticket and https://code.djangoproject.com/ticket/14512  are
 pretty much the same ticket.

 Another good spot that has been talked about is here:

 https://groups.google.com/forum/#!topic/django-developers/jrfbenCJYYU


 With all the current comments on the issue I think there are 2 ideas
 getting mixed with "mixins".

 1) A mixin is getting used to ''only apply decorators, I think
 that is the case for:

 {{{#!python
 @my_decorator
 class MyView(View):
 def get:
 # my code
 }}}

 2) A mixin is being used to define a clean API.  (e.g. form_valid,
 form_invalid, get_context_data)

 I think point 1 is the one that Django should support, and it should only
 get applied to dispatch.

 Looking into a comment by Alex Gaynor I believe this is possible.
 https://groups.google.com/d/msg/django-developers/jrfbenCJYYU/thffw4vO1D8J

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/065.1682cb27bbbf752c9897bbd925de%40djangoproject.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
---+
 Reporter:  Ciantic|Owner:  nobody
 Type:  New feature|   Status:  new
Component:  Generic views  |  Version:  master
 Severity:  Normal |   Resolution:
 Keywords: | Triage Stage:  Accepted
Has patch:  0  |  Needs documentation:  0
  Needs tests:  0  |  Patch needs improvement:  0
Easy pickings:  0  |UI/UX:  0
---+
Changes (by apollo13):

 * stage:  Design decision needed => Accepted


Comment:

 Accepting the ticket based on the fact that this stuff should be easier.
 Not sure that the suggested approach is the best way though.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
-+-
 Reporter:  Ciantic  |Owner:  nobody
 Type:  New feature  |   Status:  new
Component:  Generic views|  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Design
Has patch:  0|  decision needed
  Needs tests:  0|  Needs documentation:  0
Easy pickings:  0|  Patch needs improvement:  0
 |UI/UX:  0
-+-
Changes (by abki):

 * cc: amirouche.boubekki@… (added)


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
-+-
 Reporter:  Ciantic  |Owner:  nobody
 Type:  New feature  |   Status:  new
Component:  Generic views|  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Design
Has patch:  0|  decision needed
  Needs tests:  0|  Needs documentation:  0
Easy pickings:  0|  Patch needs improvement:  0
 |UI/UX:  0
-+-
Changes (by abki):

 * cc: amirouche.boubekki@… (removed)


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
-+-
 Reporter:  Ciantic  |Owner:  nobody
 Type:  New feature  |   Status:  new
Component:  Generic views|  Version:  master
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Design
Has patch:  0|  decision needed
  Needs tests:  0|  Needs documentation:  0
Easy pickings:  0|  Patch needs improvement:  0
 |UI/UX:  0
-+-
Changes (by abki):

 * cc: amirouche.boubekki@… (added)


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
-+-
 Reporter:  Ciantic  |Owner:  nobody
 Type:  New feature  |   Status:  new
Component:  Generic views|  Version:  SVN
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Design
Has patch:  0|  decision needed
  Needs tests:  0|  Needs documentation:  0
Easy pickings:  0|  Patch needs improvement:  0
 |UI/UX:  0
-+-
Changes (by selwin):

 * cc: selwin (added)


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
-+-
 Reporter:  Ciantic  |Owner:  nobody
 Type:  New feature  |   Status:  new
Component:  Generic views|  Version:  SVN
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Design
Has patch:  0|  decision needed
  Needs tests:  0|  Needs documentation:  0
Easy pickings:  0|  Patch needs improvement:  0
 |UI/UX:  0
-+-

Comment (by selwin):

 This is (roughly) how I implemented permission checks in one of my
 projects:

 {{{
 def dispatch(self, request, *args, **kwargs):
 if hasattr(self, 'check_permissions'):
 self.check_permissions(request, *args, **kwargs)
 elif self.require_permissions:
 if not request.user.has_perms(self.require_permissions):
 raise PermissionDenied
 return super(TableView, self).dispatch(request, *args, **kwargs)
 }}}

 You can use the API in two different ways:
 {{{
 class MyView(View):
 require_permissions = ['app.view_model', 'app2.view_model2']
 }}}

 or:

 {{{
 class MyView(View):

def check_permissions(self, request, *args, **kwargs):
# Custom code
 }}}

 If this approach is acceptable, I'm more than happy to try writing a
 proper patch and tests for inclusion into django. Comments welcome :)

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
--+--
   Reporter:  Ciantic |Owner:  nobody
 Status:  new |Milestone:
  Component:  Generic views   |  Version:  SVN
 Resolution:  | Keywords:
   Triage Stage:  Design decision needed  |Has patch:  0
Needs documentation:  0   |  Needs tests:  0
Patch needs improvement:  0   |
--+--
Changes (by tomchristie):

 * cc: tomchristie (added)


-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
--+-
   Reporter:  Ciantic | Owner:  nobody
 Status:  new | Milestone:
  Component:  Generic views   |   Version:  SVN   
 Resolution:  |  Keywords:
   Triage Stage:  Design decision needed  | Has patch:  0 
Needs documentation:  0   |   Needs tests:  0 
Patch needs improvement:  0   |  
--+-
Changes (by russellm):

  * stage:  Unreviewed => Design decision needed


Comment:

 I'm not convinced that this is exactly the right approach, but after using
 CBVs in action for a bit, I will grant the premise that it's unnecessarily
 difficult to add a login_required decorator to a CBV on the class itself.

 #14512 was an original swing at this with a specific solution aimed at
 making decorators work for class based views -- it turns out to be
 inherently complex to do so. The discussions related to that thread
 provide more detail ([http://groups.google.com/group/django-
 developers/browse_thread/thread/f4bad32127776177 thread 1]
 [http://groups.google.com/group/django-
 developers/browse_thread/thread/f36447f96277fe8c thread 2]).

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
-+--
   Reporter:  Ciantic| Owner:  nobody
 Status:  new| Milestone:
  Component:  Generic views  |   Version:  SVN   
 Resolution: |  Keywords:
   Triage Stage:  Unreviewed | Has patch:  0 
Needs documentation:  0  |   Needs tests:  0 
Patch needs improvement:  0  |  
-+--

Comment (by Ciantic):

 Opened up also a thread to [http://groups.google.com/group/django-
 developers/browse_thread/thread/805209d630ed303d django-devs for this] if
 anyone is interested.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

Re: [Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
-+--
   Reporter:  Ciantic| Owner:  nobody
 Status:  new| Milestone:
  Component:  Generic views  |   Version:  SVN   
 Resolution: |  Keywords:
   Triage Stage:  Unreviewed | Has patch:  0 
Needs documentation:  0  |   Needs tests:  0 
Patch needs improvement:  0  |  
-+--
Changes (by Ciantic):

  * needs_better_patch:  => 0
  * needs_tests:  => 0
  * needs_docs:  => 0


Comment:

 This could be implemented as Mixin too, could be more pythonic, kind of
 like:

 {{{
 class ProtectedView(TemplateView, ForbiddenMixin):
 template_name = 'secret.html'
 forbidden_checks = (login_required, has_perms('auth.change_user'),
 }}}

 I have not tested this, but it this ForbiddenMixin should be part of
 Django it is so general and useful.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.

[Django] #15215: API for simpler (permission or any) checks for generic view classes

[Django]

#15215: API for simpler (permission or any) checks for generic view classes
---+
 Reporter:  Ciantic|  Owner:  nobody
   Status:  new|  Milestone:
Component:  Generic views  |Version:  SVN   
 Keywords: |   Triage Stage:  Unreviewed
Has patch:  0  |  
---+
 The generic class based views are difficult and cumbersome to decorate,
 why even trying to reuse the decorator functions? Why not implement simple
 functions that would do the checking.

 I propose following API for checking the class based views (in this case
 just permissions):

 {{{
 from django.contrib.auth.viewchecks import login_required, has_perms

 class ProtectedView(TemplateView):
 template_name = 'secret.html'
 dispatch_checks = (login_required, has_perms('auth.change_user'),)
 }}}
 (Notice that I used hypothetical `django.contrib.auth.viewchecks`)

 `dispatch_checks` is list of ''functions'' `(request, *args, **kwargs)` ->
 `bool` if allowed to dispatch. Thus the `has_perms('auth.change_user')`
 should return ''function''.

 Above would also allow overriding the `dispatch_checks` tuple in
 subclassed views which I think is very important.

 I'm working on a simple patch for `django.contrib.auth` and to `View`
 class to allow this, these checker functions should be reusable in
 decorators.

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To post to this group, send email to django-updates@googlegroups.com.
To unsubscribe from this group, send email to 
django-updates+unsubscr...@googlegroups.com.
For more options, visit this group at 
http://groups.google.com/group/django-updates?hl=en.