Is using view decorators to handle user permissions bad practice?

Question

I'm using Django view decorators to check permissions in quite a complex way, and am starting to realize that this might be bad practice.

Given a user's profile is in a certain state, say 'application pending' and so certain views should not be shown to this user but should be shown to users who have 'application complete'. I'm currently using decorators to redirect pending users to the homepage, with a popup telling them their application is still pending.

However, I read on google's python best practice, that decorators should be simple, and not rely on database connections, files, etc.

Does this mean that something such as checking the state of a borrowers application before showing a view is bad practice, and if it is, what is an alternative?

Answer 1

In Django use the user_passes_test or permission_required decorator is the right way to do it.

from django.contrib.auth.decorators import user_passes_test, permission_required

@user_passes_test(lambda user: user.is_superuser)
@permission_required('your_perm')
def my_view(request):
    # code