Adventures in learning, from physics to baking…

Since the release of 1.2, Django has supported — to the extent of having an API for it — object level permissions. They leave it up to the developer to write their own implementation.

Object level permissions are something that have been long missing from Django. The ability to limit access to specific records, rather than entire tables, is a very common requirement of today’s web applications and the lack of such support in Django has been quite limiting in my experience. After doing some reading on the methods other developers are using to implement the new object permission API, I decided to write my own.

My implementation leverages any existing data you have and doesn’t require you to create new tables. It also doesn’t require you to create a set of permission records for every object in the database. It’s fairly simple and flexible, and works for both users and groups.

First, we need to extend the link tables that are part of Django’s auth package. We need to add an object_id field to both the auth_user_user_permissions and auth_group_permissions tables, like so:

ALTER TABLE `auth_user_user_permissions` ADD `object_id` integer NULL;
ALTER TABLE `auth_group_permissions` ADD `object_id` integer NULL;

Now, we need to create models to reference these tables, so we can filter on them. Put these in any models.py file you see appropriate for your application:

from django.contrib.auth.models import User, Group, Permission
class UserPermission(models.Model):
    user = models.ForeignKey(User)
    permission = models.ForeignKey(Permission)
    object_id = models.PositiveIntegerField(null=True)
    class Meta:
        db_table = 'auth_user_user_permissions'<
class GroupPermission(models.Model):
    group = models.ForeignKey(Group)
    permission = models.ForeignKey(Permission)
    object_id = models.PositiveIntegerField(null=True)<
    class Meta:
        db_table = 'auth_group_permissions'

There. Seem simple enough? Now all that's left is to write a custom authentication backend that handles object-level permissions using these modified tables. Create a new file in any of the apps in your project called 'objperm.py' (or whatever you choose to call it). In that file, import the UserPermission and GroupPermission models. The backend looks like so:

class ObjectPermBackend:
    support_object_permissions = True
    def authenticate(self, username=None, password=None):
        return None
    def has_perm(self, user_obj, perm, obj=None):
        (app_label, codename) = perm.split('.')
        u_kwargs = dict(user=user_obj, permission__content_type__app_label=app_label, permission__codename=codename)
        g_kwargs = dict(group__user=user_obj, permission__content_type__app_label=app_label, permission__codename=codename)
        if obj is not None:
            u_kwargs.update(dict(object_id=obj.id))
            g_kwargs.update(dict(object_id=obj.id))
        has_user_perms = UserPermission.objects.filter(**kwargs).count() > 0
        has_group_perms = GroupPermission.objects.filter(**kwargs).count() > 0
        return has_user_perms or has_group_perms

And there you have it! This authentication backend will support model-level permissions as well as object-level permissions, leveraging the existing permissions link tables that Django's auth package creates. Now all that's left is to add this new backend to your settings.py. If you don't have any custom authentication backends already, it's as simple as adding the following to your settings.py:

AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
    'path.to.your.backend.ObjectPermBackend'
)

To the left is a picture of my latest original creation, Irish Cream Bread. This was a completely experimental idea I had, and I wasn’t exactly sure how it would turn out. As you can see, the dough is very uneven and bumpy, which (I think) is caused by lack of water and too much alcohol.

Some more experienced bakers, at first glance and not considering the alcohol content, might say “hey, you’re not done kneading yet!” I kneaded this dough for nearly half an hour, adding a total of 3.5 cups of flour. The dough had, for the most part, lost its stickiness, which is usually a good indication of when its done. Why, then, did it turn out this way? I’m not entirely sure, but I’m guessing its caused by not enough water and too much alcohol.

Without getting too deep in to it, kneading dough creates gluten, which, like its name suggests, provides the ‘glue’ which holds your dough together and gives it it’s elasticity. I did a little bit of reading after having my dough turn out this way. Apparently, gluten forms best with water, and not so great with alcohol. Some forum conversations suggested replacing some of the water in a pie crust recipe with alcohol. The result being a softer dough you can work with, but less gluten due to the alcohol content, creating a flakier crust.

The last time I tried this recipe, I used a smaller amount of Irish Cream, thus it’s effect on the gluten formation was not as pronounced. At the same time, the resulting bread had no trace of the Irish Cream taste, which is what I was going for. So this time, I increased the amount of Irish Cream, and decreased the amount of milk.

Even though I suspected that the alcohol was indeed inhibiting the gluten formation, I went ahead and baked it anyway. The image on the right is the end result: a big, gaping hole in the middle, with doughy parts around it. For the most part, it turned out excellent! The crumb is fine and moist, and it tastes incredible. I’m guessing the giant hole is caused by lack of gluten: on the second rise, with the dough in the loaf pan, the gluten didn’t keep the dough together in the middle, creating a hole in the middle. As for the doughy part, I’m not sure what caused that. I baked this at 350F for about 30 minutes.

In any case, I ended up with a mostly awesome loaf of bread, and a lesson learned: water is an important part of gluten formation. If you’re going to add liquor to your bread recipes, be sure there’s enough water to complement it. My recipe had very little water to begin with — just enough to proof the yeast — so that was not a good place to begin.

So, what’s next? I’m considering experimenting with various liqueurs. Even with the 1/4 cup of Irish Cream in this version of the recipe, the taste is still eluding me. Perhaps the extra long rise is masking the flavour of the Irish Cream? I’m not sure. Other interesting ideas I’ve had are substituting the Irish Cream with a Hazelnut liqueur (such as Frangelico) or an almond liqueur (such as Amaretto). Of course, almond extract would probably add the same flavour.

Tomorrow, I’m baking fresh baguettes for dinner. I’ve made these once before, and that recipe is where I got the inspiration for the extra long rise time in my Irish Cream recipe. Stay tuned for more adventures in baking…

You can find the current version of my Irish Cream Bread recipe here.