Feature Request
Is your feature request related to a problem or unsupported use case? Please describe.
The current Django admin doesn't offer granularity in terms of roles an admin can have. One admin role does it all.
This lack of granularity and poses security risks, especially in environments where:
- Functional administrators (e.g., content managers) need access to specific models but not sensitive settings.
- Technical administrators (e.g., developers) require broader permissions but not full superuser rights.
- Audit logs or critical actions (e.g., user deletion) should be restricted to a subset of users.
Describe the solution you'd like
Introduce distinct permission levels in Django Admin, with the following capabilities:
-
Admin (e.g., for content managers):
- Access to specific models (e.g.,
docs) via Django's built-in ModelAdmin permissions.
- User management (add/edit/delete regular users) + account reconciliations
- Access management (add/edit/delete)
- Access log downloads
- No access to:
- System settings (sites, permissions, groups).
-
Super Admin (e.g., for Tech Lead):
Implementation Notes:
- Use Django's custom permissions and groups to enforce these roles.
- Extend the
AdminSite to dynamically hide menu items based on user roles.
- Add audit logging for critical actions (e.g., user deletion, permission changes).
- Integrate with Django's
user_has_perm to check permissions at the view level.
Considered Drawbacks:
- Complexity: Requires careful design to avoid permission conflicts.
- Maintenance: Custom permission logic may need updates when adding new models.
- Migration: Existing superusers must be manually assigned to the new roles.
Feature Request
Is your feature request related to a problem or unsupported use case? Please describe.
The current Django admin doesn't offer granularity in terms of roles an admin can have. One admin role does it all.
This lack of granularity and poses security risks, especially in environments where:
Describe the solution you'd like
Introduce distinct permission levels in Django Admin, with the following capabilities:
Admin (e.g., for content managers):
docs) via Django's built-inModelAdminpermissions.Super Admin (e.g., for Tech Lead):
Implementation Notes:
AdminSiteto dynamically hide menu items based on user roles.user_has_permto check permissions at the view level.Considered Drawbacks: