🔑 Access control

Content Studio uses the permission system of the classic Django admin. Only active staff users can log in, editors need Django's model permissions to see and change content, and the permission hooks on a studio can restrict access further, down to single objects.

Model-level permissions

Each studio checks access through four permission methods. By default they check Django's model permissions:

Method	Default
has_view_permission(request, obj=None)	Django's view permission
has_add_permission(request, obj=None)	Django's add permission
has_change_permission(request, obj=None)	Django's change permission
has_delete_permission(request, obj=None)	Django's delete permission

An editor needs the matching permission on the model; superusers have them all. Grant permissions as you would anywhere in Django, through groups or user permissions.

Object-level permissions

The methods also receive the object, so a studio can decide per object. The admin respects the answer everywhere: an editor only sees and edits the objects you allow.

# blog/admin.py
from content_studio import register
from content_studio.admin import ModelStudio

from .models import Article


@register(Article)
class ArticleStudio(ModelStudio):
    def has_view_permission(self, request, obj=None):
        if obj is None:
            return super().has_view_permission(request)
        # Editors only see their own articles.
        return obj.author_id == request.user.id or request.user.is_superuser

Without an override, the object-level check falls back to the model-level check, as in the classic Django admin. The same methods also guard what surrounds an object: a related model's options only appear when the editor may view that model, and inline objects can only be added to parents the editor can see.

Login throttling

Login attempts are limited per IP address, to 10 per minute by default. Change or disable the limit with the LOGIN_THROTTLE_RATE setting:

# mysite/settings.py
CONTENT_STUDIO = {
    "LOGIN_THROTTLE_RATE": "5/min",  # None disables the limit
}

note

The limit is counted in the cache. With the default per-process cache, every worker counts separately; configure a shared cache such as Redis or Memcached when you run more than one worker.

Field-level permissions

Content Studio has no per-field permissions: an editor who may change an object sees all fields the studio shows. To hide a field from every editor, leave it out of the edit page with exclude or edit_main. To protect sensitive data from some editors only, keep it in a separate model with its own permissions.