الصلاحيات ونطاق الكائن

from django.conf import settings
settings.configure(
    SECRET_KEY="synthetic-course-key",
    USE_I18N=False, USE_TZ=True,
    INSTALLED_APPS=[],
    DATABASES={"default": {"ENGINE": "django.db.backends.sqlite3", "NAME": ":memory:"}},
    DEFAULT_AUTO_FIELD="django.db.models.AutoField",
    ALLOWED_HOSTS=["testserver"],
)
import django
django.setup()

from dataclasses import dataclass

@dataclass(frozen=True)
class Actor:
    id: int | None
    is_authenticated: bool

@dataclass(frozen=True)
class CourseRecord:
    owner_id: int

def can_edit(actor, course):
    return actor is not None and actor.is_authenticated and actor.id == course.owner_id

course = CourseRecord(owner_id=7)
print(can_edit(Actor(7, True), course))
print(can_edit(Actor(9, True), course))
print(can_edit(Actor(None, False), course))

True
False
False

توضح الدالة قاعدة ملكية صريحة ولا تسجلها Django تلقائيا.

from django.contrib.auth.decorators import login_required
from django.shortcuts import get_object_or_404, redirect, render
from django.views.decorators.http import require_POST
from .forms import CourseForm
from .models import Course

@login_required
@require_POST
def update_course(request, course_id):
    course = get_object_or_404(Course.objects.filter(owner=request.user), pk=course_id)
    form = CourseForm(request.POST, instance=course)
    if not form.is_valid():
        return render(request, "catalog/course_form.html", {"form": form}, status=400)
    course = form.save()
    return redirect("course-detail", course_id=course.pk)

In the declared isolated app: non-owner id is not found; valid owner input updates approved fields only.

تخفي السياسة سجلات غيره بالبحث المقيد ويستبعد النموذج المالك ويحفظ CSRF.