I’m using Django for the purposes of this project and I have a Many-to-Many relation between Person and Event (many people can be at many [existing] Events) and I want to make sure that each Person can only view the Events they’re attending, not any other.

I’m trying to do this through the admin panel with the use of has_view_permission, but I haven’t a clue how to go on about this. I’m trying to use request.user for the purposes of this check.

I know that using a through table with models.ForeignKey also works, but since Django already has that implementation invisible to the end user, I wanted to try this idea with a models.ManyToManyField.

So far, I have this for my models.py:

class Person(models.Model):
    # fields in the model such as id, name, etc.

class Event(models.Model):
    # fields similar to Person - id, name, date, etc.
    attendees = models.ManyToManyField(Person)

and for the admin.py

from django.contrib import admin
from .models import Person, Event

class EventAdmin(admin.ModelAdmin):
    def has_view_permission(self, request, obj=None):
        if Event.objects.filter(attendees = request.user):
            return True
        else:
            return False

However, as one might imagine, this disallows anyone but the people in events to actually view the events, thus giving me a ValueError at the admin panel. Note that I have added some person and event before the function overload.

Upon opening the admin page, I get
Cannot query "admin": Must be "Person" instance., which isn’t desirable.

My question now is: How can I make it so that the Person (attendees) can only view the events they’re attending without preventing everyone else from viewing anything?

If this can be done in a more elegant manner without has_view_permission, then I’m also open to using that method too.