How do I assign specific users to a user-uploaded file so they can modify it/delete it (Django + Apache)
<p>Im using django 1.10 + Apache in Linux.
I've created a small webapp to upload documents (with dropzone.js) and want to implement the ability for a user to specify who can view/modify/delete a specific file but i can't figure out a way how. I attempted using a ManyToManyField but maybe im not understading the Field itself correctly.</p>

<p>The "Document" model is this:</p>

<h1>Model</h1>

<pre><code>class Document(models.Model):

    file = models.FileField(upload_to = 'files/')
                                #validators=[validate_file_type])
    uploaded_at = models.DateTimeField(auto_now_add = True)
    extension = models.CharField(max_length = 30, blank = True)
    thumbnail = models.ImageField(blank = True, null = True)
    is_public = models.BooleanField(default = False)
    accesible_by = models.ManyToManyField(User) #This is my attempt at doing this task.

    def clean(self):
        self.extension = self.file.name.split('/')[-1].split('.')[-1]
        if self.extension == 'xlsx' or self.extension == 'xls':
            self.thumbnail = 'xlsx.png'
        elif self.extension == 'pptx' or self.extension == 'ppt':
            self.thumbnail = 'pptx.png'
        elif self.extension == 'docx' or self.extension == 'doc':
            self.thumbnail = 'docx.png'


    def delete(self, *args, **kwargs):
        #delete file from /media/files
        self.file.delete(save = False)
        #call parent delete method.
        super().delete(*args, **kwargs)

    #Redirect to file list page.
    def get_absolute_url(self):
        return reverse('dashby-files:files')

    def __str__(self):
        return self.file.name.split('/')[-1]

    class Meta():
        ordering = ['-uploaded_at']
</code></pre>

<p>My  View to handle the creation of documents:</p>

<h1>View</h1>

<pre><code>class DocumentCreate(CreateView):
    model = Document
    fields = ['file', 'is_public']

    def form_valid(self, form):
        self.object = form.save(commit = False)
        ## I guess here i would Add the (self.request.user) to the accesible_by Field.
        self.object.save()
        data = {'status': 'success'}
        response = JSONResponse(data, mimetype =
        response_mimetype(self.request))
        return response
</code></pre>

<p>Thanks in advance to anyone for any ideas or suggestions...</p>

<p>You have a model and a view that hopefully works for adding new documents, you still have a number of steps to go.
You'll need a place to assign users that can view/modify/delete your files. If you need to store access levels (view/delete...), your accessible_by will not suffice and you'll do well with a <strong><em><a href="https://docs.djangoproject.com/en/1.10/ref/models/fields/#django.db.models.ManyToManyField.through" rel="nofollow">through</a></em></strong> table to add more information like access level.</p>

<p>You need to write views for various actions like view, delete... that users will request and here you ensure users have the right privileges. An implementation would be to get the request.user and the document id, look up if the user has the permission for what she's doing, return an http unauthorized exception or allow the action to proceed.</p>

<blockquote>
  <p>Edit: My question is about how can I assign user-permissions to each
  individual file</p>
</blockquote>

<p>If we're keeping this to access control from the django level, using the document model you already have, and you've taken some steps and for every document, you can assign users (accessible_by). Something like this can get you started:</p>

<pre><code>from django.core.exceptions import PermissionDenied
def view_document(request, doc_pk):
    doc = get_object_or_404(Document, pk=doc_pk)
    if not doc.accessible_by.filter(username=request.user.username):
        raise PermissionDenied
    #perform rest of action
</code></pre>

<p>Or do you mean to use the permissions framework itself?</p>

python django apache file-upload permissions