Required views and app name — Django roles 0.7 documentation

# Django roles 0.7 documentation

# Required views and app name

One last requirement is to give names in urls.py files to views and applications.

This is an implicit requirement if is expected to use all `django_roles` characteristics. This is necessary because the value used by `django_roles` to identify the views to be protected is it’s name. Equally is necessary to name the app with `app_name`. Examples of this can be found in Django project tutorial at Namespacing URL names.

As with Django this requirement could be optional; but if it is planned to create `django_roles.models.ViewAccess` object for a view, will be necessary to have a way to name the view so the object can be associated with it.

In the same way, if it is planned to classify applications in different types as is explained in Applications type it will be necessary to name the application in urls.py file.

Warning

`django_roles` use views names to associate `django_roles.models.ViewAccess` objects to the named view. And applications names to group all views belonging to that application so is possible to configure a type for the application and give it’s views a default security behavior.

# Namespaces and View Name

When creating a `roles.models.ViewAccess` object, the value of view attribute can be:

- view_name
- app_name:view_name
- namespace:view_name
- nest_namespace:namespace:view_name

As this are the only possible value for view attribute, a requirement of `django_roles` is to use view names and app_name in urls.py files. Read more about Naming URL in official Django project documentation Naming URL.

# Django roles response

When a user try to access a view and result a forbidden action, is possible to setup different responses to user.

## DJANGO_ROLES_REDIRECT

By default `django_roles` response with `django.http.HttpResponseForbidden` when the user has no access to the view. This behavior can be changed if add in settings files a new attribute DJANGO_ROLES_REDIRECT with a value equal to True:

    ...
    DJANGO_ROLES_REDIRECT = True
    ...

The answer given to a user without access is a `django.http.HttpResponseRedirect` to the address configured in settings.LOGIN_URL.

## DJANGO_ROLES_FORBIDDEN_MESSAGE

When `django_roles` answer with HttpResponseForbidden, the message used by default is: `<h1>403 Forbidden</h1>`; but this configuration can also be changed if add in settings files a new attribute DJANGO_ROLES_FORBIDDEN_MESSAGE with the wanted message to be returned instead of default one.