User roles schema on Django

Question

A great greetings community

My question is related with the kind of manage users and the schema users in Django, In beginning I ask to you apologize just in case that my questions can will be too "newbies" or without sense, I am starting to related me with the Django Users schemas and their different possibilities of work in the projects.

I have the following situation.

I am building an application in which I will have three differents user types:

• Medical
• Patient
• Physiotherapist

I am using the default Django authentication scheme (django.contrib.auth).

Initially, I did think in this scheme of entities in which the User table is the auth_user table in where Django save the users created:

I have the is_patient, is_medical and is_physiotherapist fields like boolean attributes in the User table.

Like a particular detail I understand that in the Django default model User is not possible modify or add attributes or fields.

This is an important and powerful reason to I cannot add the is_patient, is_medical and is_physiotherapist boolean fields in User table.

A classic recommendation is extend the User model with a Userprofile table in which I add fields or attributes to User Model through of OneToOne relationship. A basic sample is such as follow:

Is of this way that I get that my users in Django can have the field photo and upload one in a given moment ...

Taking advantage of the previous, The following schema can be suited or can be an alternative for manage user roles (patient, medical and physiotherapist user types) ?

I will have relationships between:

• User medical and user patients

• user physiotherapist and user patients

and so between them and other tables ...

With this approach these relationships don't will be affected?

The different users will be saved between the Users and UserProfile table. Is this a good practice in the scalability sense? My tables could be crash or my database?

---

In addition, I also have seen other alternatives such as:

1. Role Table/Model

I will have a role table/model independent or separate and that this can be related with the Django User model (One User can will have many roles by example) This approach can be useful when I want store exclusive information about of a role in specia?

2. Django Permissions and Authorization

I ignore or unknown the granularity grade that let will me work. Of a single way I have been see that the permissions and authorizations system let will me work with create and edit and remove operations ....

Here, can I see the groups creation? For example a medical group and allocate them permissions and linked this permissions to the users that compose the group ? Is this another good alternative? This option seem more single although I don't know if an user could make some operations according to the group privileges that have ... I don't know if this thinking is correct/right

3. AUTH_USER_MODEL Creating a Custom User model

My requirements for patient, medical and physiotherapist users, require build a custom user model?

Answer 1

In this situation, especially if you want to store different infos for Patients, Medics and Physiotherapists you can create a Model for each and have a OneToOne field for each to the User model.

class Medic(models.Model):
    user = models.OneToOneField(User, primary_key=True)
    # other fields

class Physio(models.Model):
    user = models.OneToOneField(User, primary_key=True)
    # other fields

class Patient(models.Model):
    user = models.OneToOneField(User, primary_key=True)
    # other fields

This way you can give different permissions/roles implicitly in your application logic for each type of user (and still use the groups and permissions that Django offers if you need them for special cases, eg ChiefMedical...).

You will have to define some methods for your application logic like

def user_is_patient(user):
     ...

If you follow this path it is a good idea to have good tests to make sure that you don't get unexpected things like a user who is a Medic and a Physio...

Django lets you subclass the user model as well. Under the covers it would do the same thing as the code above, so it is probably better to do it explicitly as shown above (this way it is less probable that you access attributes that don't exist in that object!)

Taking advantage of the previous, The following schema can be suited or can be an alternative for manage user roles (patient, medical and physiotherapist user types) ?

The schema you show isn't great because it makes you store the information for all user types in the same table (and with the same fields). For example, Medics and Physios will have a blood type field type like Patients which will probably not be defined.

The different users will be saved between the Users and UserProfile table. Is this a good practice in the scalability sense? My tables could be crash or my database?

There should be no scalability problems with this solution (as long as you don't have millions new entries writes every day) and you can always optimise the database at a further point. However, you will have to make sure that your app doesn't accept 'forbidden' entries (e.g. users with no Medic, Physio or Patient profile)

Here, can I see the groups creation? For example a medical group and allocate them permissions and linked this permissions to the users that compose the group ? Is this another good alternative? This option seem more single although I don't know if an user could make some operations according to the group privileges that have ... I don't know if this thinking is correct/right

You can (should) use Django's permission system to give permissions to your users. You can use them to give different rights to users of the same type (for example Medics that have more permissions than others... or have groups for chief physios...)

Django lets you assign permissions to a group.

But I don't think groups can replace the custom models for each user, since you want to store information for them. Having custom models and groups would be redundant and make your app harder to maintain.

My requirements for patient, medical and physiotherapist users, require build a custom user model?

This option wouldn't be great (unless it is your only option) because your app won't be reusable and you might have problems with some packages as well.