Extending Django's User Model for Multiple Roles

Based on your requirements, I recommend using a profile model approach (option 1) rather than removing email uniqueness constraints. This aligns better with Django's authentication system design and provides a cleaner architecture for your multi-role scenario.

Recommended Approach: Profile Model with Role-Based Access

Create a system where:

1. Each person has a single User account (with unique email)
2. Multiple profiles are linked to that User account
3. Each profile represents a role in a specific business

Implementation Steps

1. Keep your custom User model with unique email constraint

2. Create a Profile model that links to User:

PYTHONCopied
from django.contrib.auth.models import User
from django.db import models

class Business(models.Model):
    name = models.CharField(max_length=100)
    # other business fields

class Profile(models.Model):
    ROLE_CHOICES = [
        ('ADMIN', 'Admin'),
        ('OWNER', 'Business Owner'),
        ('EMPLOYEE', 'Employee'),
        ('CUSTOMER', 'Customer'),
    ]
    
    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name='profiles')
    business = models.ForeignKey(Business, on_delete=models.CASCADE)
    role = models.CharField(max_length=20, choices=ROLE_CHOICES)
    
    class Meta:
        # Ensure a user can have only one profile per role per business
        unique_together = ['user', 'business', 'role']

3. Implement a custom authentication backend to handle profile selection:

PYTHONCopied
from django.contrib.auth.backends import ModelBackend

class ProfileBackend(ModelBackend):
    def has_perm(self, user_obj, perm, obj=None):
        # Get the active profile from the session
        active_profile_id = getattr(user_obj, 'active_profile_id', None)
        
        if active_profile_id:
            try:
                profile = Profile.objects.get(id=active_profile_id, user=user_obj)
                # Implement permission logic based on profile.role
                if profile.role == 'ADMIN':
                    return True  # Admins have all permissions
                elif profile.role == 'OWNER':
                    # Business owner permission logic
                    pass
                # etc.
            except Profile.DoesNotExist:
                pass
                
        return super().has_perm(user_obj, perm, obj)

4. Create middleware to attach the active profile to each request:

PYTHONCopied
class ProfileMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        if request.user.is_authenticated:
            profile_id = request.session.get('active_profile_id')
            if profile_id:
                request.active_profile = Profile.objects.filter(
                    id=profile_id, 
                    user=request.user
                ).first()
            else:
                request.active_profile = None
        
        return self.get_response(request)

5. Implement a profile selection view after login:

PYTHONCopied
def profile_select(request):
    if not request.user.is_authenticated:
        return redirect('login')
        
    profiles = Profile.objects.filter(user=request.user)
    
    if request.method == 'POST':
        profile_id = request.POST.get('profile_id')
        if profile_id and profiles.filter(id=profile_id).exists():
            request.session['active_profile_id'] = profile_id
            # Redirect to appropriate dashboard based on role
            profile = profiles.get(id=profile_id)
            if profile.role == 'ADMIN':
                return redirect('admin_dashboard')
            elif profile.role == 'OWNER':
                return redirect('owner_dashboard')
            # etc.
    
    return render(request, 'profile_select.html', {'profiles': profiles})

Advantages of This Approach

1. Maintains email uniqueness (one account per person)
2. Allows a single user to have multiple roles across businesses
3. Preserves Django's authentication system integrity
4. Provides clear separation between authentication (who you are) and authorization (what you can do)
5. Easier to maintain and extend as your application grows

This approach requires more initial setup but provides a more robust and scalable solution for your multi-role requirements while maintaining Django's security model.