Managing Permissions and Customizing Authentication

John and Mary both have accounts on the blog, and both can log in. John should edit only his own articles, while Mary, an editor, should be able to fix anyone's article. Logging in cannot express that difference, because it only says who a user is. Django expresses it with permissions: named rights, such as "can change article", that you give to users or to groups of users. This lesson uses permissions on the blog's Article model, and then changes how users log in and adds a field to the user model.

The Four Default Permissions

Here is the blog's article model for this chapter