Setting the value of a model field based on user authentication in Django

Question

I'm trying to selectively process a field in my Django/Python application based on whether a user is logged in or not. Basically, I have a model similar to the following:

class Resource(models.Model):
    uploaded = models.DateTimeField()
    name = models.CharField(max_length=200)
    description = models.CharField(max_length=500, blank=True)
    file = models.CharField(max_length=200)

What I want to do is for the file attribute to be set to one value if the user happens to be logged in (and has access to this resource based on a test against some permissions backend), and another value if the user is not logged in. So, when any client code tries to access Resource.file, it will get something like the following if the user is not logged in 'http://mysite.com/dummy_resource_for_people_without_access'. However, if the user is logged in and passes some tests for permissions, then the value of resource.file will actually be the true url of that resource (including any security keys etc. to access that resource).

From what I've read, it seems that you can only take account of the currently logged in user by passing that through the request context from a view function to the model. However, in the above use case I am trying to control the access more closely in the model without needing the client code to call a special function.

Answer 1

Just in case anyone's interested, I solved the above issue by actually creating a custom model field in django that could then have a method that takes a user to generate a URI. So, in the database, I store a key to the resource as above in the file column. However, now the file column is some custom field:

class CustomFileField(models.CharField):
    def to_python(self, value):
        ...
        return CustomFileResource(value)


class CustomFileResource:
    def __init__(self, *args, **kwargs):
        ....

    def uri(usr):
       #this method then gets the uri selectively based on the user . 

The pattern above is nice because I can wrap the db field and then create a specific method for getting the uri based on who is trying to access it.