From f9b46145de7fef4343bc5a039bed295306163725 Mon Sep 17 00:00:00 2001 From: sev Date: Tue, 27 Dec 2022 07:10:30 -0600 Subject: [PATCH] website/docs: Clarify request.user and add link to Django docs (#4287) * Clarify request.user and add link to doc Signed-off-by: sev * rephrase a bit Signed-off-by: Jens Langhammer Signed-off-by: sev Signed-off-by: Jens Langhammer Co-authored-by: Jens Langhammer --- website/docs/policies/expression.mdx | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/website/docs/policies/expression.mdx b/website/docs/policies/expression.mdx index 54d6ba7f6..39376a91a 100644 --- a/website/docs/policies/expression.mdx +++ b/website/docs/policies/expression.mdx @@ -61,12 +61,12 @@ import Objects from "../expressions/_objects.md"; - `request.user`: The current user, against which the policy is applied. See [User](../user-group/user.md#object-attributes) :::warning - When a policy is executed in the context of a flow, this will be set to the previously authenticated user, i.e. when used with an authentication flow this will be set to _AnonymousUser_. + When a policy is executed in the context of a flow, this will be set to the user initiaing request, and will only be changed by a `user_login` stage. For that reason, using this value in authentication flow policies may not return the expected user. Use `context['pending_user']` instead; User Identification and other stages update this value during flow execution. - In flows, `context['pending_user']` should be used instead. + If the user is not authenticated, this will be set to a user called _AnonymousUser_, which is an instance of [authentik.core.models.User](https://docs.djangoproject.com/en/4.1/ref/contrib/auth/#django.contrib.auth.models.User) (authentik uses django-guardian for per-object permissions, [see](https://django-guardian.readthedocs.io/en/stable/)). ::: - - `request.http_request`: The Django HTTP Request. See ([Django documentation](https://docs.djangoproject.com/en/3.0/ref/request-response/#httprequest-objects)) + - `request.http_request`: The Django HTTP Request. See [Django documentation](https://docs.djangoproject.com/en/4.1/ref/request-response/#httprequest-objects). - `request.obj`: A Django Model instance. This is only set if the policy is ran against an object. - `request.context`: A dictionary with dynamic data. This depends on the origin of the execution.