Like I said at the beginning of the course, auth is usually made up of

two parts, authentication which is identifying a user, and authorization.

Authentication has already been handled in this project with registration, login and

logout views.

You can always tell who a user is.

Authorization, though, isn't something I really talked about yet.

How do you tell in Django if a user is allowed to do the thing that

they want to do?

Well you've used one form of authorization already.

Views that just require an authenticated user have a very simple form of

authorization too so long as the user is authenticated they're also authorized.

Authorization can go much deeper than that.

Django's basic form of authorization is through permissions.

Every time you create a model Django creates three new permissions.

Before I can talk about permissions,

though, I need to talk about content types,

specifically the part of Django that's known as the content types framework.

When you make a new non-abstract model of Django, Django creates a content type in

each content type instance holds an applicable like Posts and

a model name like Post.

Why store information like this in the database?

It gives you a way to refer to a specific model without knowing exactly

where that model is to find.

Each Django permission is linked to a content type.

By default you get three permissions for each content type, add, change and delete.

Add lets you add new records to the database,

Change lets you change existing records, and Delete lets you delete records.

You can also add custom permissions to your models, too.

One thing I want to explicitly point out these permissions are about models,

not model instances.

Django doesn't have a built in concept of role level, or object level permissions.

So if a user has the change post permission they can change all posts,

not just the ones that they own.

And the users that are marked as being Super Users are automatically granted

all permissions.

This is one reason why you want to make sure you only create as many Super Users

as you absolutely need.

But permissions are not just a user thing.

Groups are generic way of lumping users together and

optionally giving them permissions.

Any user can belong to as many groups as they need to, and

all members of a group have all of the permissions of the group.

Now you could of course use groups without any special permissions.

Take a little break, get a drink, do some stretches, and

then come back to see how to create custom permissions and

use permissions to control what users are allowed to do.