How to ensure account-based separation in Django

Question

I have a Django application that has a single account model. We convert this to a multi-account, so almost every model will have it ForeignKey(Account).

What is the easiest way to make sure that everyone Account(each account is in its own subdomain) can only access its own data? We have middleware that populates the subdomain and current account for each request.

We can do this the hard way by adding filter(...., account = request.account)to all our ideas. This is undesirable since

• filter(...., account = request.account)will be added to all requests, which will make this dry, repetitive and error prone.
• The greater risk is the lack of a missing filter, in any case it is a security risk.

Answer 1

I don’t think there is any clear winner, especially if you think that not all requests should be filtered by account. Also consider the old trick threadlocalsconsidered unreliable, which means that the only way to automatically insert filter parameters would be with middleware, I think ... but it also seems unreliable and complicated for me.

I also did not have a good way to make a query manager that can help here, but it is possible.

, , "multi-tenant" , . :

• , Middleware:

• sql, , , . " " , , , .

, , , .

Answer 2

, . , :

Django: //?

Answer 3

. , todo 1.2, 100% .

Answer 4

- , , ?

Answer 5

django.contrib.auth?

, a ForeignKey(User, unique=true) User

. ForeignKey(User)

, django Auth Docs

edit: , ...

,

my_model.objects.filter(user=request.user)

:

request.user.my_model_set.all()