Adding custom permissions

[ridoo]

Is it somehow possible to add custom permissions to GeoNode?

Working on a UI feature which shall be available only for users having a particular permission, e.g. can_trigger_some_action. Django and geonode-mapstore-client provides some tooling as such:

myapp.models.py

class PermissionsModel(models.Model):
    """
    Auxiliary model to manage permissions without a database model.
    """
            
    class Meta:  # https://stackoverflow.com/a/37988537/2299448
        
        managed = False  # No database table creation or deletion  \
                         # operations will be performed for this model. 
                
        permissions = ( 
            ("can_trigger_some_action", "Can Trigger Some Action",),
        )

Here, the model just provides the permissions -- no table creation needed. Now, I can create a group, add that permission via admin, and assign the group to a user. In my Django app this works:

myapp.views.py

@login_required
@permission_required("myapp.can_trigger_some_action", raise_exception=True)
def do_action(request, path):
    # pass

However, I'd expected the API to return the new permission, so I can put the following snippet in my UI config:

localConfig.json

{
    "type": "plugin",
    "name": "MyPlugin",
    "disableIf": "{!context.userHasPermission(state('user'), 'can_trigger_some_action')}"
}

This does not work unfortunately, as it seems that only well known permissions are collected:

geonode/geonode/people/models.py

Lines 208 to 209 in 33be915

	# return constant names defined by GeoNode
	perms = [PERMISSIONS[db_perm] for db_perm in group_perms]

Sending a request to /api/v2/users/1001 would skip the perms field completely as (obviously) no mapping exists from geonode.security.permissions.PERMISSIONS. For this, I created this bug report: #12639

What I would like is to make custom permissions available via API.

@mattiagiupponi @giohappy Do I miss something here? Why is that mapping necessary?

[giohappy]

@ridoo I think this can be closed since your PR has been merged.