Decorators¶
django-minosse provides two decorators for protecting function-based views.
Both raise django.core.exceptions.PermissionDenied (HTTP 403) when access is denied.
@role_required¶
Restricts a view to users that belong to a specific role.
from minosse.decorator import role_required
from .roles import EditorRole
@role_required(EditorRole)
def editor_dashboard(request):
...
Parameters¶
| Parameter | Type | Description |
|---|---|---|
role_class |
AbstractRole subclass |
The role that the user must have. |
Behaviour¶
Internally calls role_class.user_has_role(request.user). Unauthenticated users are
denied because user_has_role returns False for unauthenticated users.
Combining with @login_required
If you want to redirect unauthenticated users to the login page rather than
returning a 403, chain @login_required above @role_required:
@permission_required¶
Restricts a view to users that have a specific permission codename.
from minosse.decorator import permission_required
@permission_required("auth.can_publish")
def publish_article(request):
...
Parameters¶
| Parameter | Type | Description |
|---|---|---|
permission_codename |
str |
Full Django permission string in app_label.codename form (e.g. "auth.can_publish"). |
Behaviour¶
Internally calls request.user.has_perm(permission_codename).
Permission app label
django-minosse links all permissions to the auth.user content type, so the
app label is always auth. Use "auth.<codename>" when calling this decorator.