Extending it¶
What a layer above bundles installs - starting bundles and a ceiling, as clearance.roles does - the backend that reads it, and what the library asks of a person.
No starting bundles, no ceiling: what a project without roles has.
The bundles user is given by what they are, not by being given them.
The condition that a permission is within user's ceiling -
permission names the column holding its id in the query it joins.
The condition on the user model that a person's ceiling permits any of
permissions - everybody's, asked at once, for "who holds this?".
Everybody given any of bundles by what they are - for the safety rules.
The bundles anybody is given by what they are - marked in the list of bundles.
What user is, in words - shown on their page in the admin site.
The fields of the user model that say what a person is. Writing one gives its bundles and lifts its ceiling, so the admin site keeps it for the superuser.
Put installed in force - called by the layer above when its app starts.
Bases: ModelBackend
Django's ModelBackend, less what was taken away from the person, with
the bundles they start with, and within their ceiling. Named in
AUTHENTICATION_BACKENDS in place of ModelBackend, never beside it.
with_perm(perm: Any, is_active: bool | None = True, include_superusers: bool = True, obj: Any = None) -> QuerySet[Any]
Everybody holding perm, as has_perm would answer for each: not
whoever it was taken from, whoever starts with it by their role too,
and nobody whose ceiling stops it.
Bases: Protocol
What the library asks of a person: Django's user, or anything answering
the same three questions - AnonymousUser among them.
The person a request carries - Django's or DRF's - as the library sees them.
Django types request.user as its own base classes, which promise less
than every real user has; this is the one place that says so.