如何在Django Rest Framework中为特定规则创建权限? [英] How to create permission for specific rules in Django Rest Framework?

问题描述

我想安排权限，就像每个用户都可以编辑自己的个人资料一样.只是超级用户可以编辑所有配置文件.我需要添加 permissions.py 吗?谢谢.

I want to arrange permission like that each user can edit his own profile. Just super user can edit all profile. What I need to add permissions.py ? Thank you.

views.py

class UserViewSet(mixins.ListModelMixin,
              mixins.RetrieveModelMixin,
              mixins.UpdateModelMixin,
              mixins.DestroyModelMixin,
              generics.GenericAPIView):

queryset = User.objects.all()
serializer_class = UserSerializer
permission_classes = [IsAuthenticated]
authentication_classes = (JSONWebTokenAuthentication, )

permissions.py

class IsOwnerOrReadOnly(BasePermission):

message = '!!'
my_safe_method = ['GET', 'PUT']

def has_permission(self, request, view):
    if request.method in self.my_safe_method:
        return True
    return False

def has_object_permission(self, request, view, obj):
    # member .0 Membership.objects.get(user=request.user)
    # member.is_active
    if request.method in SAFE_METHODS:
        return True
    return obj.user == request.user

推荐答案

写您自己的权限

class IsObjectOwner(BasePermission):
        message = "You must be the owner of this object."
        my_safe_methods = ['GET', 'PUT', 'PATCH', 'DELETE']

    def has_permission(self, request, view):
        if request.method in self.my_safe_methods:
            return True
        return False

    def has_object_permission(self, request, view, obj):
        if request.user.is_superuser:
            return obj
        else:
            return obj == request.user

，然后在 view 中将其添加到 permission_classes

and then in the view add it in permission_classes

class UserDetailView(RetrieveUpdateDestroyAPIView):
    permission_classes = [IsObjectOwner, permissions.IsAuthenticated]

这篇关于如何在Django Rest Framework中为特定规则创建权限?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！