Is it good practice to access the request from a model manager?

Hello,

The problem

It has happened to me more than once to need to check the user's permissions before allowing access to an object. Rather than worry whether I've remembered to do that in all my views and in all pieces of code there might be access, I'd prefer to make this check at the model level, that is, for the model manager to return filtered results—only these objects that the user is allowed to access. But model managers don't have access to the request object (and, likewise, I don't want to create a manager that needs the request object to be passed to it, because likewise I won't be certain I remembered to pass the request object in all places in the code).

One solution

One solution that I've implemented in an app is to have middleware that stores the request in a thread local variable. The model manager gets the request from there and filters the results accordingly. If there is no request object stored in the thread local variable, the manager assumes this query does not come from the web and does not filter it.

Is this a good way to do it? Is there any alternative?

Regards,

A.

--   Antonis Christofides  http://djangodeployment.com