feat(geo): record created_by / profile and authorize the owner

[nossila]

Review findings 3 and 4 — the ones that needed a schema decision. Modelled on baseapp.files.

Problem

AbstractGeoJSONFeature had no owner column, so there was nothing to authorize against. GeoPermissionsBackend returned False for change/delete, which handed the whole decision to ModelBackend's model-level grant — one group membership let a user edit or delete every feature in the system, including features attached to other users' objects.

Changes

• created_by — FK to AUTH_USER_MODEL, null=True, blank=True, related_name="geo_features_created".
• profile — FK to the swappable Profile with on_delete=SET_NULL, added through the same apps.is_installed("baseapp_profiles") conditional mixin baseapp.files uses, so the block still works without that package.
• geoFeatureCreate records both. The profile comes from the request's current_profile, so the Current-Profile header is honoured the way it is everywhere else.
• GeoPermissionsBackend._is_owner_or_has_global for change/delete: the creator may act on their own feature; anyone else still needs the model permission, so moderators are unaffected. With no obj it still returns False, leaving ModelBackend to decide the global grant.
• geoFeatureUpdate / geoFeatureDelete resolve the feature before authorizing, so has_perm receives the object rather than None.
• Admin lists and autocompletes the new columns and select_relateds created_by.

One trap worth calling out

created_by is nullable, and AnonymousUser.pk is also None — so the obvious obj.created_by_id == user.pk makes every anonymous user the owner of every unowned feature. I hit exactly this: anonymous update/delete started succeeding and hasPerm returned canChange: true for anonymous. The backend now requires is_authenticated before the comparison, and test_anonymous_is_not_the_owner_of_an_unowned_feature pins it.

(baseapp.files sidesteps it by comparing instances — obj.created_by == user_obj, where None == AnonymousUser() is False. Comparing ids avoids an FK fetch, but is only safe behind the auth guard.)

created_by also needs blank=True, not just null=True, or full_clean() rejects every feature created without one — which the model and admin tests caught.

Testing

baseapp/geo/tests: 121 passed. makemigrations --check reports no changes. black, isort, flake8 clean.

New coverage: create records user + profile; owner updates/deletes their own feature with no model permission; non-owner is denied and the row is verifiably unchanged; a holder of the global permission still reaches other users' features; anonymous is not an owner.

Follow-up required in the template

baseapp-backend-template has its own concrete model (apps/social/geo) and needs its own AddField migration once the submodule pointer is bumped. Any other consuming project does too — called out in the commit message.

🤖 Generated with Claude Code

https://claude.ai/code/session_015fczpSCpN3kCRs3UBjbity

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1dbb9f0f-8da8-4a65-a96e-dae6f816cc80

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}