Permissions

[l0rb]

Django has a nice built-in permission system: https://docs.djangoproject.com/en/3.0/topics/auth/default/#permissions-and-authorization

Permissions can be given to users via the builtin admin-site. It does not out-of-the box support instance level permissions which will be needed for issue #14 . It does however provide hooks for that.

Permissions can be set not only per type of object, but also per specific object instance. By using the has_view_permission(), has_add_permission(), has_change_permission() and has_delete_permission() methods provided by the ModelAdmin class, it is possible to customize permissions for different object instances of the same type.

It is probably best to have a many-to-many relationship between corpora and users where the pivot table holds information about what permissions the user has specifically for that corpus and than check the values of that pivot table in the methods mentioned above.