Django Views

URL conf → Middleware → View decorators → View class → Method → Query

# urls.py - decorators applied at routing
from django.contrib.admin.views.decorators import staff_member_required

urlpatterns = [
    path('admin/', staff_member_required(admin_view)),
]

# settings.py MIDDLEWARE list
# Look for custom auth middleware that might set user context or enforce checks

@login_required
@permission_required('app.view_document')
@user_passes_test(lambda u: u.is_staff)

# Check the ENTIRE inheritance chain
class MyView(LoginRequiredMixin, PermissionRequiredMixin, DetailView):
    ...

# Also check for project-specific base classes
class MyView(BaseCompanyView, DetailView):
    # What does BaseCompanyView do?

# get_queryset() - often where scoping happens
# get_object() - may have custom logic
# dispatch() - sometimes has permission checks

# Permission classes - check what they actually do
permission_classes = [IsAuthenticated, IsOwner]

# get_queryset() - critical for scoping
def get_queryset(self):
    return Model.objects.filter(...)

# has_object_permission() - called by get_object()
def has_object_permission(self, request, view, obj):
    return obj.owner == request.user