Extending Django's User Model for a Multi-Role System

Based on your system design with client users, sales representatives, and staff users, here are recommendations for your questions:

1. Associating SalesUsers with Companies

The best approach would be to define the relationship in the SalesUser model using a ManyToMany field to Company:

PYTHONCopied
class SalesUser(models.Model):
    user = models.OneToOneField(User, on_delete=models.CASCADE)
    additional_salesuser_field = models.CharField(max_length=100)
    companies = models.ManyToManyField('Company', related_name='sales_representatives')

This approach has several advantages:

• It clearly indicates that sales representatives can be associated with multiple companies
• The related_name='sales_representatives' allows you to easily access all sales reps for a company with company.sales_representatives.all()
• It keeps the relationship logic in the most relevant model (SalesUser)

2. Relationship Keys in Other Models

It's generally better to have relationships point to the base User model rather than the extended profile models. This approach offers several benefits:

PYTHONCopied
class Order(models.Model):
    client = models.ForeignKey(User, on_delete=models.CASCADE, related_name='client_orders')
    handler = models.ForeignKey(User, on_delete=models.CASCADE, related_name='handled_orders')
    sales_rep = models.ForeignKey(User, on_delete=models.CASCADE, related_name='sales_orders')
    # other order fields

Benefits of this approach:

• Simpler database schema with fewer joins
• Authentication and permissions are handled at the User level
• You can still access profile data when needed (e.g., order.client.clientuser.additional_client_field)
• Easier to work with Django's built-in authentication views and decorators

3. Permission Management

Permission management should be handled at the base User model level using Django's built-in groups and permissions system. This is the standard approach and integrates well with Django's authentication framework:

PYTHONCopied
from django.contrib.auth.models import Group

# Create groups
client_group = Group.objects.create(name='Clients')
sales_group = Group.objects.create(name='Sales')
staff_group = Group.objects.create(name='Staff')

# Assign a user to a group
user = User.objects.get(username='example')
user.groups.add(client_group)

When creating a new user profile, you would:

1. Create the base User
2. Add them to the appropriate group
3. Create the corresponding profile model instance

This approach allows you to use Django's permission system with @permission_required decorators and the user.has_perm() method.

Remember that your profile models aren't auto-created when a user is created, so you might want to use Django signals to automatically create the appropriate profile when a user is added to a specific group:

PYTHONCopied
from django.db.models.signals import post_save
from django.dispatch import receiver

@receiver(post_save, sender=User)
def create_user_profile(sender, instance, created, **kwargs):
    if created:
        if instance.groups.filter(name='Clients').exists():
            ClientUser.objects.create(user=instance)
        elif instance.groups.filter(name='Sales').exists():
            SalesUser.objects.create(user=instance)
        elif instance.groups.filter(name='Staff').exists():
            StaffUser.objects.create(user=instance)

This approach gives you a clean, maintainable system that leverages Django's built-in authentication framework.