a signal receiver which updates the lastlogin date for the user logging in the permissions system provides a way to assign permissions to specific users and groups of users the permission system is used by the django admin site but may also be useful in your own code the django admin site uses permissions as follows the add permission limits the user s ability to view the add form and add an object the change permission limits a user s ability to view the change list view the change form and change an object the delete permission limits the ability to delete an object the view permission limits the ability to view an object permissions are set globally per type of object not per specific object instance it is possible to say mary may change news stories but it s not currently possible to say mary may change news stories but only the ones she created herself or mary may only change news stories that have a certain status or publication date the permissions listed above are automatically created for each model the manager for the auth s group model groups are a generic way of categorizing users to apply permissions or some other label to those users a user can belong to any number of groups a user in a group automatically has all the permissions granted to that group for example if the group site editors has the permission canedithomepage any user in that group will have that permission beyond permissions groups are a convenient way to categorize users to apply some label or extended functionality to them for example you could create a group special users and you could write code that would do special things to those users such as giving them access to a membersonly portion of your site or sending them membersonly email messages create and save a user with the given username email and password lookup the real model class from the global app registry so this manager method can be used in migrations this is fine because managers are by definition working on the real model a few helper functions for common logic between user and anonymoususer a backend can raise permissiondenied to shortcircuit permission checking a backend can raise permissiondenied to shortcircuit permission checking add the fields and methods necessary to support the group and permission models using the modelbackend return a list of permission strings that this user has directly query all available auth backends if an object is passed in return only permissions matching this object return a list of permission strings that this user has through their groups query all available auth backends if an object is passed in return only permissions matching this object return true if the user has the specified permission query all available auth backends but return immediately if any backend returns true thus a user who has permission from a single auth backend is assumed to have permission in general if an object is provided check permissions for that object active superusers have all permissions otherwise we need to check the backends return true if the user has each of the specified permissions if object is passed check if the user has all required perms for it return true if the user has any permissions in the given app label use similar logic as hasperm above active superusers have all permissions an abstract base class implementing a fully featured user model with admincompliant permissions username and password are required other fields are optional return the firstname plus the lastname with a space in between return the short name for the user return self firstname def emailuserself subject message fromemailnone kwargs users within the django authentication system are represented by this model username and password are required other fields are optional a signal receiver which updates the last_login date for the user logging in the permissions system provides a way to assign permissions to specific users and groups of users the permission system is used by the django admin site but may also be useful in your own code the django admin site uses permissions as follows the add permission limits the user s ability to view the add form and add an object the change permission limits a user s ability to view the change list view the change form and change an object the delete permission limits the ability to delete an object the view permission limits the ability to view an object permissions are set globally per type of object not per specific object instance it is possible to say mary may change news stories but it s not currently possible to say mary may change news stories but only the ones she created herself or mary may only change news stories that have a certain status or publication date the permissions listed above are automatically created for each model the manager for the auth s group model groups are a generic way of categorizing users to apply permissions or some other label to those users a user can belong to any number of groups a user in a group automatically has all the permissions granted to that group for example if the group site editors has the permission can_edit_home_page any user in that group will have that permission beyond permissions groups are a convenient way to categorize users to apply some label or extended functionality to them for example you could create a group special users and you could write code that would do special things to those users such as giving them access to a members only portion of your site or sending them members only email messages create and save a user with the given username email and password lookup the real model class from the global app registry so this manager method can be used in migrations this is fine because managers are by definition working on the real model a few helper functions for common logic between user and anonymoususer a backend can raise permissiondenied to short circuit permission checking a backend can raise permissiondenied to short circuit permission checking add the fields and methods necessary to support the group and permission models using the modelbackend return a list of permission strings that this user has directly query all available auth backends if an object is passed in return only permissions matching this object return a list of permission strings that this user has through their groups query all available auth backends if an object is passed in return only permissions matching this object return true if the user has the specified permission query all available auth backends but return immediately if any backend returns true thus a user who has permission from a single auth backend is assumed to have permission in general if an object is provided check permissions for that object active superusers have all permissions otherwise we need to check the backends return true if the user has each of the specified permissions if object is passed check if the user has all required perms for it return true if the user has any permissions in the given app label use similar logic as has_perm above active superusers have all permissions an abstract base class implementing a fully featured user model with admin compliant permissions username and password are required other fields are optional return the first_name plus the last_name with a space in between return the short name for the user send an email to this user users within the django authentication system are represented by this model username and password are required other fields are optional instances always return the same hash value
from collections.abc import Iterable

from django.apps import apps
from django.contrib import auth
from django.contrib.auth.base_user import AbstractBaseUser, BaseUserManager
from django.contrib.auth.hashers import make_password
from django.contrib.contenttypes.models import ContentType
from django.core.exceptions import PermissionDenied
from django.core.mail import send_mail
from django.db import models
from django.db.models.manager import EmptyManager
from django.utils import timezone
from django.utils.translation import gettext_lazy as _

from .validators import UnicodeUsernameValidator


def update_last_login(sender, user, **kwargs):
    
    user.last_login = timezone.now()
    user.save(update_fields=["last_login"])


class PermissionManager(models.Manager):
    use_in_migrations = True

    def get_by_natural_key(self, codename, app_label, model):
        return self.get(
            codename=codename,
            content_type=ContentType.objects.db_manager(self.db).get_by_natural_key(
                app_label, model
            ),
        )


class Permission(models.Model):
    

    name = models.CharField(_("name"), max_length=255)
    content_type = models.ForeignKey(
        ContentType,
        models.CASCADE,
        verbose_name=_("content type"),
    )
    codename = models.CharField(_("codename"), max_length=100)

    objects = PermissionManager()

    class Meta:
        verbose_name = _("permission")
        verbose_name_plural = _("permissions")
        unique_together = [["content_type", "codename"]]
        ordering = ["content_type__app_label", "content_type__model", "codename"]

    def __str__(self):
        return "%s | %s" % (self.content_type, self.name)

    def natural_key(self):
        return (self.codename,) + self.content_type.natural_key()

    natural_key.dependencies = ["contenttypes.contenttype"]


class GroupManager(models.Manager):
    

    use_in_migrations = True

    def get_by_natural_key(self, name):
        return self.get(name=name)


class Group(models.Model):
    

    name = models.CharField(_("name"), max_length=150, unique=True)
    permissions = models.ManyToManyField(
        Permission,
        verbose_name=_("permissions"),
        blank=True,
    )

    objects = GroupManager()

    class Meta:
        verbose_name = _("group")
        verbose_name_plural = _("groups")

    def __str__(self):
        return self.name

    def natural_key(self):
        return (self.name,)


class UserManager(BaseUserManager):
    use_in_migrations = True

    def _create_user(self, username, email, password, **extra_fields):
        
        if not username:
            raise ValueError("The given username must be set")
        email = self.normalize_email(email)
        
        
        
        GlobalUserModel = apps.get_model(
            self.model._meta.app_label, self.model._meta.object_name
        )
        username = GlobalUserModel.normalize_username(username)
        user = self.model(username=username, email=email, **extra_fields)
        user.password = make_password(password)
        user.save(using=self._db)
        return user

    def create_user(self, username, email=None, password=None, **extra_fields):
        extra_fields.setdefault("is_staff", False)
        extra_fields.setdefault("is_superuser", False)
        return self._create_user(username, email, password, **extra_fields)

    def create_superuser(self, username, email=None, password=None, **extra_fields):
        extra_fields.setdefault("is_staff", True)
        extra_fields.setdefault("is_superuser", True)

        if extra_fields.get("is_staff") is not True:
            raise ValueError("Superuser must have is_staff=True.")
        if extra_fields.get("is_superuser") is not True:
            raise ValueError("Superuser must have is_superuser=True.")

        return self._create_user(username, email, password, **extra_fields)

    def with_perm(
        self, perm, is_active=True, include_superusers=True, backend=None, obj=None
    ):
        if backend is None:
            backends = auth._get_backends(return_tuples=True)
            if len(backends) == 1:
                backend, _ = backends[0]
            else:
                raise ValueError(
                    "You have multiple authentication backends configured and "
                    "therefore must provide the `backend` argument."
                )
        elif not isinstance(backend, str):
            raise TypeError(
                "backend must be a dotted import path string (got %r)." % backend
            )
        else:
            backend = auth.load_backend(backend)
        if hasattr(backend, "with_perm"):
            return backend.with_perm(
                perm,
                is_active=is_active,
                include_superusers=include_superusers,
                obj=obj,
            )
        return self.none()



def _user_get_permissions(user, obj, from_name):
    permissions = set()
    name = "get_%s_permissions" % from_name
    for backend in auth.get_backends():
        if hasattr(backend, name):
            permissions.update(getattr(backend, name)(user, obj))
    return permissions


def _user_has_perm(user, perm, obj):
    
    for backend in auth.get_backends():
        if not hasattr(backend, "has_perm"):
            continue
        try:
            if backend.has_perm(user, perm, obj):
                return True
        except PermissionDenied:
            return False
    return False


def _user_has_module_perms(user, app_label):
    
    for backend in auth.get_backends():
        if not hasattr(backend, "has_module_perms"):
            continue
        try:
            if backend.has_module_perms(user, app_label):
                return True
        except PermissionDenied:
            return False
    return False


class PermissionsMixin(models.Model):
    

    is_superuser = models.BooleanField(
        _("superuser status"),
        default=False,
        help_text=_(
            "Designates that this user has all permissions without "
            "explicitly assigning them."
        ),
    )
    groups = models.ManyToManyField(
        Group,
        verbose_name=_("groups"),
        blank=True,
        help_text=_(
            "The groups this user belongs to. A user will get all permissions "
            "granted to each of their groups."
        ),
        related_name="user_set",
        related_query_name="user",
    )
    user_permissions = models.ManyToManyField(
        Permission,
        verbose_name=_("user permissions"),
        blank=True,
        help_text=_("Specific permissions for this user."),
        related_name="user_set",
        related_query_name="user",
    )

    class Meta:
        abstract = True

    def get_user_permissions(self, obj=None):
        
        return _user_get_permissions(self, obj, "user")

    def get_group_permissions(self, obj=None):
        
        return _user_get_permissions(self, obj, "group")

    def get_all_permissions(self, obj=None):
        return _user_get_permissions(self, obj, "all")

    def has_perm(self, perm, obj=None):
        
        
        if self.is_active and self.is_superuser:
            return True

        
        return _user_has_perm(self, perm, obj)

    def has_perms(self, perm_list, obj=None):
        
        if not isinstance(perm_list, Iterable) or isinstance(perm_list, str):
            raise ValueError("perm_list must be an iterable of permissions.")
        return all(self.has_perm(perm, obj) for perm in perm_list)

    def has_module_perms(self, app_label):
        
        
        if self.is_active and self.is_superuser:
            return True

        return _user_has_module_perms(self, app_label)


class AbstractUser(AbstractBaseUser, PermissionsMixin):
    

    username_validator = UnicodeUsernameValidator()

    username = models.CharField(
        _("username"),
        max_length=150,
        unique=True,
        help_text=_(
            "Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only."
        ),
        validators=[username_validator],
        error_messages={
            "unique": _("A user with that username already exists."),
        },
    )
    first_name = models.CharField(_("first name"), max_length=150, blank=True)
    last_name = models.CharField(_("last name"), max_length=150, blank=True)
    email = models.EmailField(_("email address"), blank=True)
    is_staff = models.BooleanField(
        _("staff status"),
        default=False,
        help_text=_("Designates whether the user can log into this admin site."),
    )
    is_active = models.BooleanField(
        _("active"),
        default=True,
        help_text=_(
            "Designates whether this user should be treated as active. "
            "Unselect this instead of deleting accounts."
        ),
    )
    date_joined = models.DateTimeField(_("date joined"), default=timezone.now)

    objects = UserManager()

    EMAIL_FIELD = "email"
    USERNAME_FIELD = "username"
    REQUIRED_FIELDS = ["email"]

    class Meta:
        verbose_name = _("user")
        verbose_name_plural = _("users")
        abstract = True

    def clean(self):
        super().clean()
        self.email = self.__class__.objects.normalize_email(self.email)

    def get_full_name(self):
        
        full_name = "%s %s" % (self.first_name, self.last_name)
        return full_name.strip()

    def get_short_name(self):
        
        return self.first_name

    def email_user(self, subject, message, from_email=None, **kwargs):
        
        send_mail(subject, message, from_email, [self.email], **kwargs)


class User(AbstractUser):
    

    class Meta(AbstractUser.Meta):
        swappable = "AUTH_USER_MODEL"


class AnonymousUser:
    id = None
    pk = None
    username = ""
    is_staff = False
    is_active = False
    is_superuser = False
    _groups = EmptyManager(Group)
    _user_permissions = EmptyManager(Permission)

    def __str__(self):
        return "AnonymousUser"

    def __eq__(self, other):
        return isinstance(other, self.__class__)

    def __hash__(self):
        return 1  

    def __int__(self):
        raise TypeError(
            "Cannot cast AnonymousUser to int. Are you trying to use it in place of "
            "User?"
        )

    def save(self):
        raise NotImplementedError(
            "Django doesn't provide a DB representation for AnonymousUser."
        )

    def delete(self):
        raise NotImplementedError(
            "Django doesn't provide a DB representation for AnonymousUser."
        )

    def set_password(self, raw_password):
        raise NotImplementedError(
            "Django doesn't provide a DB representation for AnonymousUser."
        )

    def check_password(self, raw_password):
        raise NotImplementedError(
            "Django doesn't provide a DB representation for AnonymousUser."
        )

    @property
    def groups(self):
        return self._groups

    @property
    def user_permissions(self):
        return self._user_permissions

    def get_user_permissions(self, obj=None):
        return _user_get_permissions(self, obj, "user")

    def get_group_permissions(self, obj=None):
        return set()

    def get_all_permissions(self, obj=None):
        return _user_get_permissions(self, obj, "all")

    def has_perm(self, perm, obj=None):
        return _user_has_perm(self, perm, obj=obj)

    def has_perms(self, perm_list, obj=None):
        if not isinstance(perm_list, Iterable) or isinstance(perm_list, str):
            raise ValueError("perm_list must be an iterable of permissions.")
        return all(self.has_perm(perm, obj) for perm in perm_list)

    def has_module_perms(self, module):
        return _user_has_module_perms(self, module)

    @property
    def is_anonymous(self):
        return True

    @property
    def is_authenticated(self):
        return False

    def get_username(self):
        return self.username