title: Safest and driest way to filter query_set depending on some user info
body: <p>I have a Post model with a boolean field, is_draft. If the user is logged and is member of the staff, then I want to displays all posts; otherwise, only the posts for which is_draft is false.</p>
  
  <p>My first thought was to use a custom model manager and use request.user as following:</p>
  
  <pre><code>class PostManager(models.Manager):
  def get_queryset(self):
      if request.user and request.user.is_staff:
          return super().get_queryset()
      else:
          return super().get_queryset().filter(is_draft=False)
  </code></pre>
  
  <p>but request is not available in the model.</p>
  
  <p>I saw some people use a <a href="https://stackoverflow.com/questions/41747344/django-custom-manager-filter-query-set-by-parameter">middleware to access the user</a> in the model. It seems to me the safest way to address my need (ie it's done once, in the custom manager; people modifying the views.py don't have to bother, no risk of forgetting it) but this solution seems controversial.</p>
  
  <p>I have of course the possibility to add some logic in the view, but I feel this is not DRY (as I query Post many times) nor safe (risk somebody forgets it at some point).</p>
  
  <p>According to you, what would be the cleanest and safest way to address this need?</p>
  
  <p>PS: I've found a <a href="https://stackoverflow.com/questions/58039448/limiting-access-to-objects-in-django">similar question</a> for which a solution was proposed for Class-based views, but my views are function-based.</p>
  
  <p>Thanks a lot!</p>