Security model & auth & permissions

[lorddaedra]

Let's look at some simple case. Assume we have users and projects. Users can create new projects, view project list, view project details page, change project name, delete projects and have all related permissions if project.owner_id == request.user.pk. And we need create simple CRUD application (something like Django admin).

Let's assume, we already created all internal apis (python functions to create, view list or single item, update and delete projects). It's good idea to split backend with models and business logic from frontend (even if it's Django-based frontend with django-unicorn). I like guide https://phalt.github.io/django-api-domains/files/ , it's very pragmatic (it takes some good ideas of DDD which are not hard to implement and attach it to Django).

So we have /projects/ application with apis:

ProjectAPI.create_project(*, display_name, user_id)  # create project, display name is str, ex. 'Project 123' and user_id is id of project owner
ProjectAPI.get_project(*, pk, user_id)  # get project with pk=pk if owner_id == user_id
ProjectAPI.list_projects(*, user_id)  # get projects where owner_id == user_id
ProjectAPI.update_project(*, pk, display_name, user_id)  # update display_name if owner_id == user_id
ProjectAPI.get_project(*, pk, user_id)  # delete project if owner_id == user_id

And we have /frontend/ application with all public views, templates and django-unicorn components. Frontend application can use django cache and call apis. Frontend application can't directly add anything to database or access models etc.

We need several urls:

• /projects/ for ProjectListView, projects list view with 'Add project' button and related form,
• /projects/<project_id>/ for ProjectDetailView, project detail view with 'Edit' button and related form and 'Delete' button with related confirmation form.

In project_list.html we call projects unicorn parent component (with two child components - projectslist and projectscreate).
In project_detail.html we call project unicorn parent component (with three child components - projectdetail, projectupdate and projectdelete).

For example, we use action variable to detect current visible child component. So projects and project components based on their action variable value ('list' (default), 'create' and 'details' (default), 'update', 'delete') shows child components.

Scenario 1:
Given User1

When user go to '/projects/' page
Then user get empty projects list

When user click 'Add project' button
Then user get project creation form

When user set 'Display Name' field to 'Project 123' and click 'Create' button
Then user get project list which contain 'Project 123' project.

So this is single page scenario without page reloading. It mean we can't attach project_list (=ProjectAPI.list_projects(user_id=self.request.user_id)) to view context_data (we need updated version of projects list after project creation) or any DRF endpoints (we have no any RESTful apis). We should use component method to load these projects.

But to do that we need get user_id of current user in child component. How to do that, if self.request == None in component view?.. And we can't just call component method with user_id, because of it's not safe and user may change it to view projects of another user.

Is it safe to pass user_id during __init__ phase of parent component and store it inside _user variable? And in child component use self.parent._user or something like that to access it?.. Please, give some example how to get user_id inside child component.

[adamghill]

How to do that, if self.request == None in component view?
Does this mean that self.request is None in the child component? If so, I'd classify that as a bug and I should fix it.

s it safe to pass user_id during init phase of parent component and store it inside _user variable? And in child component use self.parent._user or something like that to access it?
For now, this seems reasonable to me. You could pass in request.user into the parent component from the template as a kwarg or just set an instance variable inside the view backend. Then, from your child component self.parent._user. Ideally, child components have self.request set so you wouldn't have to jump through these hoops, though.

[lorddaedra]

Does this mean that self.request is None in the child component? If so, I'd classify that as a bug and I should fix it.

Yes, looks like it's a bug, self.request == None in child component (I tested it in def mount()). But self.request in parent component exists. So I tried to refactor my code to get user_id via self.parent.request.user.pk but self.parent.request is also empty in child components...

For now, this seems reasonable to me. You could pass in request.user into the parent component from the template as a kwarg or just set an instance variable inside the view backend. Then, from your child component self.parent._user. Ideally, child components have self.request set so you wouldn't have to jump through these hoops, though.

Thank you!