How to check current user's permissions from a Group in Django?

Question

I have a group EuropartsBuyer and model named Product.

The following code adds a permission to the Product model.

class Meta:
        permissions = (
            ("can_add_cost_price", "Can add cost price"),
        )

In one of my views I have the following code to add this permission to that group.

europarts_buyer, created = Group.objects.get_or_create(name='EuropartsBuyer')
add_cost_price = Permission.objects.get(codename='can_add_cost_price')
europarts_buyer.permissions.add(add_cost_price)

With the help of Django Admin I have added a user to the group EuropartsBuyer.

When I use the following code in another view

if request.user.has_perm('can_add_cost_price'):
    do something

the result is supposed to be True but it is showing False. Thus, the code under the if clause doesn't run.

I have imported the currently logged in user in Django shell and when I test the permission again it shows False.

What am I doing wrong here?

Solution

Try this:

if request.user.has_perm('app_name.can_add_cost_price'):

From the docs:

where each perm is in the format 'app_label.permission codename'

Comments

[SomeTypeFoo]

Did you check if the request.user is a AnonymousUser instance?

[MiniGunnR]

@ThulasiRam Yes. I have to log in to access that particular view.

[SomeTypeFoo]

That i get but If you use DRF and removed authentication classes although you are logged in..in the request the user will be Anonymous. So can you try printing request.user first before checking for permissions that way you can be sure. @MiniGunnR

[MiniGunnR]

I did. The user is logged in.

[MiniGunnR]

I forgot to use the app label. Now it's working. if request.user.has_perm('europarts.can_add_cost_price').

[Anthony Petrillo]

The convention is now <app>.<action>_<modelname>. See realpython.com/manage-users-in-django-admin

[NFSpeedy]

The zero limits you to check only one group. Also, the calculations in the view have been performed and you are checking too late if the server should perform something. Permissions are a way to even limit the server's overhead.