Re: Row based permissions: In DB or App? ... farewell pain

Am Donnerstag, 17. August 2017 16:09:42 UTC+2 schrieb Vijay Khemlani: > > How can we propose faster alternatives if we don't know how fast must it > be? > > Of course it is up to you in the end, but if you are seriously considering > exotic options such as using stored procedures at least I

Re: Row based permissions: In DB or App? ... farewell pain

How can we propose faster alternatives if we don't know how fast must it be? Of course it is up to you in the end, but if you are seriously considering exotic options such as using stored procedures at least I would like to know what specific bottlenecks did you stumble upon as I also use

Re: Row based permissions: In DB or App? ... farewell pain

Am Mittwoch, 16. August 2017 13:39:53 UTC+2 schrieb Vijay Khemlani: > > So, please share the specific numbers you got from your profiling. > > Why should I share the numbers? How would this help? -- You received this message because you are subscribed to the Google Groups "Django users"

Re: Row based permissions: In DB or App? ... farewell pain

So, please share the specific numbers you got from your profiling. On Wed, Aug 16, 2017 at 6:10 AM, guettli wrote: > > > Am Donnerstag, 10. August 2017 14:30:31 UTC+2 schrieb Vijay Khemlani: >> >> It's still implemented like that in the background, but I'm not sure why >>

Re: Row based permissions: In DB or App? ... farewell pain

Am Donnerstag, 10. August 2017 14:30:31 UTC+2 schrieb Vijay Khemlani: > > It's still implemented like that in the background, but I'm not sure why > do you call it slow. > > Here are more docs about guardian being slow:

Re: Row based permissions: In DB or App? ... farewell pain

Am Freitag, 11. August 2017 10:05:00 UTC+2 schrieb James Schneider: > > >> My concern is that this python code can't return a queryset with all > items where a given permission+user tuple match. > > > def has_perm(obj, user): > if user.is_superuser: > return True > > This means I

Re: Row based permissions: In DB or App? ... farewell pain

Am Donnerstag, 10. August 2017 14:30:31 UTC+2 schrieb Vijay Khemlani: > > It's still implemented like that in the background, but I'm not sure why > do you call it slow. > > Did you run benchmarks? Profiling? > > Usually your own business logic will be the bottleneck of your > application, not

Re: Row based permissions: In DB or App? ... farewell pain

> My concern is that this python code can't return a queryset with all items where a given permission+user tuple match. def has_perm(obj, user): if user.is_superuser: return True This means I need a SQL WHERE condition For example MyModel.objects.filter(Q(...)|Q()) I never

Re: Row based permissions: In DB or App? ... farewell pain

It's still implemented like that in the background, but I'm not sure why do you call it slow. Did you run benchmarks? Profiling? Usually your own business logic will be the bottleneck of your application, not your permission checking. On Thu, Aug 10, 2017 at 5:15 AM, guettli

Re: Row based permissions: In DB or App? ... farewell pain

Am Mittwoch, 9. August 2017 18:03:44 UTC+2 schrieb Vijay Khemlani: > > > https://django-guardian.readthedocs.io/en/stable/userguide/check.html#get-objects-for-user > > projects = get_objects_for_user(request.user, 'projects.view_project') > > > Thank you for providing this link. I guess it is

Re: Row based permissions: In DB or App? ... farewell pain

https://django-guardian.readthedocs.io/en/stable/userguide/check.html#get-objects-for-user projects = get_objects_for_user(request.user, 'projects.view_project') On Wed, Aug 9, 2017 at 10:55 AM, guettli wrote: > > > Am Mittwoch, 9. August 2017 10:04:25 UTC+2

Re: Row based permissions: In DB or App? ... farewell pain

Am Mittwoch, 9. August 2017 10:46:10 UTC+2 schrieb James Schneider: > > Sorry for the duplicate, accidently hit send before I was done, finished > below. > > On Aug 3, 2017 1:08 AM, "guettli" wrote: > > First I asked a similar question on the postgresql-general list. The >

Re: Row based permissions: In DB or App? ... farewell pain

Am Mittwoch, 9. August 2017 10:04:25 UTC+2 schrieb James Schneider: > > > > On Aug 3, 2017 1:08 AM, "guettli" wrote: > > First I asked a similar question on the postgresql-general list. The > discussion[1] has settled there. > > Now I would love the hear what you think. > >

Re: Row based permissions: In DB or App? ... farewell pain

Am Montag, 7. August 2017 14:48:54 UTC+2 schrieb Vijay Khemlani: > > I use django-guardian for object level permissions and it works > surprisingly well > Good to hear this. I will have a look at it. > > On Mon, Aug 7, 2017 at 4:59 AM, Antonis Christofides < > ant...@djangodeployment.com >

Re: Row based permissions: In DB or App? ... farewell pain

Am Montag, 7. August 2017 09:55:45 UTC+2 schrieb Mike Morris: > > I have no expertise in the field, but I've chosen not to let that stop me > from making a suggestion :-) > > How about splitting the difference: > >1. Assign & track permissions on the application side, then >2. Pass the

Re: Row based permissions: In DB or App? ... farewell pain

Am Montag, 7. August 2017 09:43:00 UTC+2 schrieb Andréas Kühne: > > Hi, > > I understand your concern, however I would like to learn more about how > you intend to solve the problem. The only way I could see a solution would > be to change the database user depending on which application user

Re: Row based permissions: In DB or App? ... farewell pain

Sorry for the duplicate, accidently hit send before I was done, finished below. On Aug 3, 2017 1:08 AM, "guettli" wrote: First I asked a similar question on the postgresql-general list. The discussion[1] has settled there. Now I would love the hear what you think. I am

Re: Row based permissions: In DB or App? ... farewell pain

> middle that runs very early middleware Antonis Christofides http://djangodeployment.com On 2017-08-09 11:15, Antonis Christofides wrote: > > Hi, > >> - You'll almost certainly take a performance hit when connecting to the >> database. If each connection to the DB is using a different user,

Re: Row based permissions: In DB or App? ... farewell pain

Hi, > - You'll almost certainly take a performance hit when connecting to the > database. If each connection to the DB is using a different user, then you > likely cannot take advantage of things like DB connection pooling. Every > request would require that a connection be built, utilized, and

Re: Row based permissions: In DB or App? ... farewell pain

On Aug 3, 2017 1:08 AM, "guettli" wrote: First I asked a similar question on the postgresql-general list. The discussion[1] has settled there. Now I would love the hear what you think. I am thinking about rewriting an existing application which uses PostgreSQL via Django.

Re: Row based permissions: In DB or App? ... farewell pain

I use django-guardian for object level permissions and it works surprisingly well On Mon, Aug 7, 2017 at 4:59 AM, Antonis Christofides < anto...@djangodeployment.com> wrote: > Hello, > > This is a tricky issue and we need to start from the basics. You already > know the basics, but they bear

Re: Row based permissions: In DB or App? ... farewell pain

Hello, This is a tricky issue and we need to start from the basics. You already know the basics, but they bear repeating. (Related questions are relatively common, which is why this is something like the third time I'm pasting this information here). > As you know, RDBMS's keep their own

Re: Row based permissions: In DB or App? ... farewell pain

On 7/08/2017 4:43 PM, guettli wrote: Hello this post is now four days old. I would like to hear from other people. Something like: "I have no clue what you are talking about" or "I understand your concerns, but I have no clue, too" or "Thank you about talking about this, this raised my

Re: Row based permissions: In DB or App? ... farewell pain

I have no expertise in the field, but I've chosen not to let that stop me from making a suggestion :-) How about splitting the difference: 1. Assign & track permissions on the application side, then 2. Pass the permission level/parameters into a Stored Procedure in the database If the

Re: Row based permissions: In DB or App? ... farewell pain

Hi, I understand your concern, however I would like to learn more about how you intend to solve the problem. The only way I could see a solution would be to change the database user depending on which application user is logged in. That would mean updating users and permissions in the database

Re: Row based permissions: In DB or App? ... farewell pain

Hello this post is now four days old. I would like to hear from other people. Something like: "I have no clue what you are talking about" or "I understand your concerns, but I have no clue, too" or "Thank you about talking about this, this raised my awareness" would make me happy. Thank

Row based permissions: In DB or App? ... farewell pain

First I asked a similar question on the postgresql-general list. The discussion[1] has settled there. Now I would love the hear what you think. I am thinking about rewriting an existing application which uses PostgreSQL via Django. Up to now the permission checks are done at the