Django: Complex Permission Model
<p>Suppose I have users, projects, memberships and in every membership a role is specified (for example: admin, read-only, user, etc.). The memberships define the relation between users and projects and the corresponding role.</p>

<p>Now I have a problem: how can I use the permission system of Django to assure that only admins can edit projects and the other roles are not allowed to edit projects?</p>

<p>The project list template should look like this:</p>

<pre><code>{% for project in object_list %}
    {# user.has_perm('edit_project', project) #}
{% endfor %}
</code></pre>

<p>What is the best way of doing this? How can I implement the permission based on the membership role?</p>

<p>You need to build your own permission system. </p>

<p>Django's built-in permission system is not suited for what you want to do.</p>

<p>Build models for the <code>Project</code>. Create a ManyToMany relationship between a <code>User</code> and a <code>Project</code> <code>through</code> a <code>Membership</code> model. This Membership model will have a <code>role</code> field.</p>

<p><a href="https://docs.djangoproject.com/en/1.10/topics/db/models/#extra-fields-on-many-to-many-relationships" rel="nofollow">https://docs.djangoproject.com/en/1.10/topics/db/models/#extra-fields-on-many-to-many-relationships</a> has an example that is almost ideally suited for your needs.</p>

<p>You can not do <code>user.has_perm('edit_project', project)</code> in a template. Django templates do not allow function calls directly with multiple params. I think in your case a custom template tag that takes a <code>User</code> instance, a <code>Project</code> instance, and a string describing the desired permission would be the way to go.</p>

python django permissions acl