# Mixins

Added in version 1.0.4.

## LoginRequiredMixin

class guardian.mixins.LoginRequiredMixin

  A login required mixin for use with class based views. This Class is a light wrapper around the login_required decorator and hence function parameters are just attributes defined on the class.

  Due to parent class order traversal this mixin must be added as the left most mixin of a view.

  The mixin has exactly the same flow as login_required decorator:

  > If the user isn’t logged in, redirect to `settings.LOGIN_URL`, passing the current absolute path in the query string. Example: `/accounts/login/?next=/polls/3/`.

  > If the user is logged in, execute the view normally. The view code is free to assume the user is logged in.

  Class Settings

  `LoginRequiredMixin.redirect_field_name`

  > Default: `'next'`

  `LoginRequiredMixin.login_url`

  > Default: `settings.LOGIN_URL`

## PermissionRequiredMixin

class guardian.mixins.PermissionRequiredMixin

  A view mixin that verifies if the current logged in user has the specified permission by wrapping the `request.user.has_perm(..)` method.

  If a get_object() method is defined either manually or by including another mixin (for example `SingleObjectMixin`) or `self.object` is defined then the permission will be tested against that specific instance, alternatively you can specify get_permission_object() method if `self.object` or get_object() does not return the object against you want to test permission

  The mixin does the following:

  > If the user isn’t logged in, redirect to settings.LOGIN_URL, passing the current absolute path in the query string. Example: /accounts/login/?next=/polls/3/.

  > If the raise_exception is set to True than rather than redirect to login page a PermissionDenied (403) is raised.

  > If the user is logged in, and passes the permission check than the view is executed normally.

  Example Usage:

      class SecureView(PermissionRequiredMixin, View):
          ...
          permission_required = 'auth.change_user'
          ...

  Class Settings

  `PermissionRequiredMixin.permission_required`

  > Default: `None`, must be set to either a string or list of strings in format: <app_label>.<permission_codename>.

  `PermissionRequiredMixin.login_url`

  > Default: `settings.LOGIN_URL`

  `PermissionRequiredMixin.redirect_field_name`

  > Default: `'next'`

  `PermissionRequiredMixin.return_403`

  > Default: `False`. Returns 403 error page instead of redirecting user.

  `PermissionRequiredMixin.return_404`

  > Default: `False`. Returns 404 error page instead of redirecting user.

  `PermissionRequiredMixin.raise_exception`

  > Default: `False`

  > permission_required - the permission to check of form “<app_label>.<permission codename>”

  >   i.e. ‘polls.can_vote’ for a permission on a model in the polls application.

  `PermissionRequiredMixin.accept_global_perms`

  > Default: `False`, If accept_global_perms would be set to True, then

  >   mixing would first check for global perms, if none found, then it will proceed to check object level permissions.

  `PermissionRequiredMixin.permission_object`

    Default: `(not set)`, object against which test the permission; if not set fallback to `self.get_permission_object()` which return `self.get_object()` or `self.object` by default.

  `PermissionRequiredMixin.any_perm`

  > Default: `False`. if True, any of permission in sequence is accepted.

  check_permissions(request)

    Checks if request.user has all permissions returned by get_required_permissions method.

    Parameters:

      request – Original request.

  get_required_permissions(request=None)

    Returns list of permissions in format <app_label>.<codename> that should be checked against request.user and object. By default, it returns list from `permission_required` attribute.

    Parameters:

      request – Original request.

  on_permission_check_fail(request, response, obj=None)

    Method called upon permission check fail. By default it does nothing and should be overridden, if needed.

    Parameters:

      - request – Original request

      - response – 403 response returned by check_permissions method.

      - obj – Object that was fetched from the view (using `get_object` method or `object` attribute, in that order).

## PermissionListMixin

class guardian.mixins.PermissionListMixin

  A view mixin that filter object in queryset for the current logged by required permission.

  Example Usage:

      class SecureView(PermissionListMixin, ListView):
          ...
          permission_required = 'articles.view_article'
          ...

  or:

      class SecureView(PermissionListMixin, ListView):
          ...
          permission_required = 'auth.change_user'
          get_objects_for_user_extra_kwargs = {'use_groups': False}
          ...

  Class Settings

  `PermissionListMixin.permission_required`

  > Default: `None`, must be set to either a string or list of strings in format: <app_label>.<permission_codename>.

  `PermissionListMixin.get_objects_for_user_extra_kwargs`

  > Default: `{}`, A extra params to pass for ``guardian.shortcuts.get_objects_for_user``

  get_get_objects_for_user_kwargs(queryset)

    Returns dict of kwargs that should be pass to ``get_objects_for_user``.

    Parameters:

      request – Queryset to filter

  get_required_permissions(request=None)

    Returns list of permissions in format <app_label>.<codename> that should be checked against request.user and object. By default, it returns list from `permission_required` attribute.

    Parameters:

      request – Original request.