How to write a Django template tag for access control?

Question

I am trying, in vain, to create a simple Django template tag to show or hide the delete link next to the submitted comment on my site.

In short, I want to pass the comment object to the template tag, determine if the authorized user is currently allowed to delete the comment, and then show or not show the link.

Use in my template would be like this:

{% load access_tags %}
{% if_authorized comment %}
   <a href="{% url delete_comment comment.id %}">Delete</a>
{% endif_authorized %}

Be sure that I will also check the relevant submission if the user has the right to delete the comment.

Does this tag type have a specific name? This will certainly help me in a google search if this happens. Thank you for your help!

UPDATE 1:

How my site works, two people can allow a comment to be deleted: 1) the creator of the comment and 2) the owner of the message in which the comment remained. Because of this, I need to determine for the comment if one of these conditions is present.

I don’t think that I can use something like the built-in Django authorization system, because this requires that the permissions are "set globally for each type of object, and not for a specific instance of the object."

In my case, the user "Bob" may have permission to delete the comment (if he wrote it or he is on the message he created), but he is also not allowed to delete it (if he looks at the comment to someone else).

UPDATE 2:

, , : " , token.split_contents(), ". , , , .

, , :

self.comment.resolve(context).user 

.

self.comment.user

Answer 1

, ...

:

   {% load access_tags %}
   {% if_authorized comment.user object.user user %}
      <a href="{% url delete_comment comment.id %}">Delete</a>
   {% endif_authorized %}

"access_tag.py" "templatetags" . "access_tag.py":

from django.template import Node, NodeList, TemplateSyntaxError
from django.template import Library, Variable, VariableDoesNotExist

register = Library()

def do_if_authorized(parser, token):
    """
    Outputs the contents of the block if the 'comment owner' or the 
    'page owner' is also the 'authenticated user'. As well, you can use
    an {% else %} tag to show text if the match fails.

    Takes three parameters:
      1) the comment owner
      2) the page owner
      3) the current authenticated user
    """
    bits = token.contents.split()
    if len(bits) != 4:
        raise TemplateSyntaxError("%s tag takes three arguments: \
                                   1) the comment owner \
                                   2) the page owner \
                                   3) the current authenticated user" % bits[0])
    nodelist_true = parser.parse(('else', 'endif_authorized'))
    token = parser.next_token()

    if token.contents == 'else':
        nodelist_false = parser.parse(('endif_authorized',))
        parser.delete_first_token()
    else:
        nodelist_false = NodeList()
    return IfAuthorizedNode(bits[1], bits[2], bits[3], nodelist_true, nodelist_false)

class IfAuthorizedNode(Node):
    def __init__(self, comment_owner, page_owner, authenticated_user, nodelist_true, nodelist_false):
        self.nodelist_true = nodelist_true
        self.nodelist_false = nodelist_false
        self.comment_owner = Variable(comment_owner)
        self.page_owner = Variable(page_owner)
        self.authenticated_user = Variable(authenticated_user)

    def render(self, context):
        try:
            comment_owner = self.comment_owner.resolve(context)
            page_owner = self.page_owner.resolve(context)
            authenticated_user = self.authenticated_user.resolve(context)
        except VariableDoesNotExist:
            return ''

        if comment_owner == authenticated_user or page_owner == authenticated_user:
            return self.nodelist_true.render(context)
        else:
            return self.nodelist_false.render(context)

register.tag('if_authorized', do_if_authorized)

. , {% if%} , , "access_tags". , :)

Answer 2

, , .

django-authority .

Django 1.2 .

Answer 3

... , , {% if %}

:

{% check_access comment %}
{% if has_access %}
    <a href="{% url delete_comment comment.id %}">Delete</a>
{% endif %}

, check_access "has_access" .