Considerations follow inline... On 11 December 2016 at 03:34, Avraham Serour <tovm...@gmail.com> wrote: > ... > > So should I check the parent object permissions? or just checking the > current object is enough?
It depends on the granularity level of your permissions. Could a child object have a different permission from its parent? If yes, you only need to check the object itself. If it doesn't override the parent permission, you should check the parent's permission, additionally. Or must it always obey the parent permissions? If that's the case, you only need to check the parent permission. > > I'm thinking of copying the parent permissions when an object is created, in > this way creating an object could be expensive and the permissions table may > get too big, but reading the permissions can be cheap. Or children objects can simply point to the parent to check its permission. You could have a column called `parent_id` in each object. If it is the higher level, it will point to nobody (or to itself. It will depend on your logic). So, each child will point to the parent. Permissions must be checked using `parent_id` for relationship. But, again, it will depend on the granularity of your permissions and how much you want to allow or forbid a child override a parent permission. -- Vinicius Assef -- You received this message because you are subscribed to the Google Groups "Django users" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-users+unsubscr...@googlegroups.com. To post to this group, send email to django-users@googlegroups.com. Visit this group at https://groups.google.com/group/django-users. To view this discussion on the web visit https://groups.google.com/d/msgid/django-users/CAFmXjSDOybmJ0EfBA1ECv9Mf6MFAtaEx6%2BrP8XB4x%3D%2BHsOK21Q%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
