InquiryQuestion about permission validation logic relying on custom checks instead of Django's native system

Hi,

While using Codabench, I noticed some inconsistencies with permission control. Specifically, when I removed the "can add competition" permission from a user group via Django Admin, users in that group could still add competition.
Checking the code (~/competitions/views.py), I found that views like CompetitionCreateForm only require login status (LoginRequiredMixin) without integrating Django's native permission checks (e.g., PermissionRequiredMixin or has_perm()). Instead, permission control generally relies on hardcoded identity checks (e.g., is_superuser, created_by, collaborators), which bypasses Django's group permission system entirely.

I'd like to confirm:
Besides competition creation, which other features use similar custom identity checks instead of Django's native permissions?
Is this design intentional (e.g., for platform-specific needs)? Are there plans to integrate with Django's permission system for more flexible access control?
If full integration isn't feasible, is there documentation on which features use custom logic and their criteria?

Our use case requires role-based permission management (e.g., teachers creating competitions, students only submitting). Clarification would help avoid configuration conflicts.

Thanks for your help!

Start in ~/competitions/views.py and inspect the views mentioned in the issue for LoginRequiredMixin and custom identity checks. Compare the affected features with Django's native permission behavior, then document the findings or clarify the intended integration scope with maintainers. Done requires an agreed scope for permission handling or documentation of the existing criteria.