外键项的 Django Rest Framework 权限

Question

我有两个模型有这样的关系：

class ManuscriptItem(models.Model):
    """Represents a single manuscript's content"""

    author = models.ForeignKey('accounts_api.UserProfile', on_delete=models.CASCADE)
    title = models.CharField(max_length=255)
    content = models.CharField(max_length=99999999)

    def __str__(self):
        """Django uses when it needs to convert the object to a string"""
        return str(self.id)


class ManuscriptLibrary(models.Model):
    """Represents a single manuscript's library"""

    manuscript = models.OneToOneField(ManuscriptItem, on_delete=models.CASCADE)
    bookmarks = models.CharField(max_length=99999999)
    history = models.CharField(max_length=99999999)

    def __str__(self):
        """Django uses when it needs to convert the object to a string"""
        return str(self.manuscript)

我只想让 ManuscriptItem Author 能够分配一个 该 ManuscriptItem 的 ManuscriptLibrary。

以下是我尝试过但没有成功的一些方法：

class PostOwnManuscriptLibrary(permissions.BasePermission):
    """Allow users to update their own manuscripts libraries."""

    def has_object_permission(self, request, view, obj):
        return obj.manuscript.author.id == request.user.id

结果：每个人都可以写入任何他们不是他们的 ManuscriptItem 作者。

class PostOwnManuscriptLibrary(permissions.BasePermission):
    def has_permission(self, request, view):
        manuscript = ManuscriptLibrary.objects.filter(manuscript__author=request.user.id).exists()
        return manuscript

结果：没有人拥有任何权限，甚至他们自己的作者也没有 手稿。

相关的API端点视图如下：

class ManuscriptViewSet(viewsets.ModelViewSet):
    """Handles creating, reading and updating items."""

    authentication_classes = (TokenAuthentication,)
    serializer_class = serializers.ManuscriptItemSerializer
    permission_classes = (permissions.PostOwnManuscript, IsAuthenticated,)

    def perform_create(self, serializer):
        """Sets the user profile to the logged in user."""
        serializer.save(author=self.request.user)

    def get_queryset(self):
        """
        This view should return a list of all the manuscripts
        for the currently authenticated user.
        """
        user = self.request.user
        return models.ManuscriptItem.objects.filter(author=user)


class ManuscriptLibraryViewSet(viewsets.ModelViewSet):
    """Handles creating, reading and updating manuscript library."""

    authentication_classes = (TokenAuthentication,)
    serializer_class = serializers.ManuscriptLibrarySerializer
    permission_classes = (permissions.PostOwnManuscriptLibrary,)

    def get_queryset(self):
        """
        This view should return a list of all the manuscripts settings
        where the manuscript author is the logged in user
        """
        user = self.request.user
        return models.ManuscriptLibrary.objects.filter(manuscript__author=user)

附加信息：

我已经覆盖了我的用户模型，因此在我的 settings.py 中包括：

# Takes the model and assigns it!
AUTH_USER_MODEL = 'profiles_api.UserProfile'

在我的用户个人资料 API 中

class UserProfile(AbstractBaseUser, PermissionsMixin):
    """Represents a "user profile" inside our system."""

    email = models.EmailField(max_length=255, unique=True)
    name = models.CharField(max_length=255)
    is_active = models.BooleanField(default=True)
    is_staff = models.BooleanField(default=False)

    objects = UserProfileManager()

    USERNAME_FIELD = 'email'
    REQUIRED_FIELDS = ['name']

    def get_full_name(self):
        """Used to get a users full name."""

        return self.name

    def get_short_name(self):
        """Used to get a users short name."""

        return self.name

    def __str__(self):
        """Django uses this when it needs to convert the object to a string"""

        return self.email

修复：

根据 BearBrown 的建议进行了调整，需要查询 正确的模型：

class PostOwnManuscriptLibrary(permissions.BasePermission):
    """Allow users to update their own manuscripts libraries."""

    def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.manuscript.author == request.user

    def has_permission(self, request, view):
        if request.method == 'POST':
            manuscript = request.data.get('manuscript')
            print(manuscript)
            instance = ManuscriptItem.objects.get(pk=manuscript)
            return instance.author == request.user
        return True

Answer 1

我想你可以试试这个：

class PostOwnManuscriptLibrary(permissions.BasePermission):
    """Allow users to update their own manuscripts libraries."""

    def has_object_permission(self, request, view, obj):
        if request.method in permissions.SAFE_METHODS:
            return True
        return obj.manuscript.author == request.user

    def has_permission(self, request, view):
        if request.method == 'POST':
            manuscript = request.data.get('manuscript')
            instance = ManuscriptLibrary.objects.get(pk=manuscript)
            return instance.author == request.user
         return True

当您完成“POST”后，从请求中获取 manuscript 数据并使用 request.author 使 ManuscriptLibrary.author 无效

查看

class ManuscriptLibraryViewSet(viewsets.ModelViewSet):
    """Handles creating, reading and updating manuscript library."""

    authentication_classes = (TokenAuthentication,)
    serializer_class = serializers.ManuscriptLibrarySerializer
    queryset = models.ManuscriptLibrary.objects.all()
    permission_classes = (permissions.PostOwnManuscriptLibrary,)