如何从BasePermission中访问URL参数? [英] How can I access URL parameters from within a BasePermission?
问题描述
我正在尝试编写自定义的rest_framework权限,以防止用户查询与其所在公司不同的信息。不幸的是,我似乎无法从 has_permission()
或 has_object_permissions()
中访问任何URL参数。
I'm trying to write a custom rest_framework Permission to prevent users from querying information that's not of the same company as them. Unfortunately, I can't seem to access any of the URL's parameters from within has_permission()
or has_object_permissions()
.
这是路由器的开头:
# Create a basic router
router = routers.SimpleRouter()
# Establish some variables to assist with nested routes
root_elem = 'companies'
root_elem_id = '/(?P<company_id>[0-9]+)'
loca_elem = '/locations'
loca_elem_id = '/(?P<location_id>[0-9]+)'
# Companies will be the root from which all other relations branch
router.register(r'' + root_elem, views.CompanyViewSet)
router.register(r'' + root_elem + root_elem_id + loca_elem,
views.LocationViewSet)
这是我的自定义权限:
# Only permit actions originating from location managers or company admins
class IsLocationManagerOrHigher(BasePermission):
# Checked when displaying lists of records
def has_permission(self, request, *args, **kwargs):
is_correct_level = False
# Admins can see every location if their location_id
# matches a location that's a child of the company
# specified in the URL
if request.employee.is_admin:
is_correct_level = True
return request.user and is_correct_level
# Checked when viewing specific records
def has_object_permission(self, request, view, obj):
is_correct_level = False
# Admins can see location details if their location's company_id
# matches a Location's company_id
if request.employee.is_admin:
is_correct_level = True
# Managers can see location details if it's their location
elif obj.id == request.employee.location_id and request.employee.is_manager:
is_correct_level = True
return request.user and is_correct_level
现在检查 request.employee.is_admin
仅是我需要的一半-我还需要从URL访问 company_id
并确保它匹配管理员位置的 company_id
:
Right now checking request.employee.is_admin
is only half of what I need - I also need to access the company_id
from the URL and make sure it matches the admin's location's company_id
:
# Pseudocode
try:
user_location = Location.objects.get(id=request.employee.location_id)
return user_location.company_id == kwargs['company_id']
except ObjectDoesNotExist:
pass
我还没有弄清楚如何将这些参数传递给Permission,以便它可以执行额外的操作步。或者也许有更好的方法来完成我想做的事情?
I've yet to figure out how to pass these parameters into the Permission so that it can perform this extra step. Or perhaps there's a better way of accomplishing what I'm trying to do?
推荐答案
如果您不能直接将它们传递给(最好),它们在请求对象上可用:
If you can't pass them in directly (which would be preferable), they are available on the request object:
company_id = request.resolver_match.kwargs.get('company_id')
request.resolver_match.args
和 request.resolver_match.kwargs
包含在您的网址中捕获的位置/关键字参数。
request.resolver_match.args
and request.resolver_match.kwargs
contain the positional/keyword arguments captured in your url.
这篇关于如何从BasePermission中访问URL参数?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!