时间戳

首页 > 解决方案 > 根据 Django 中选择的按钮更改权限

python - 根据 Django 中选择的按钮更改权限

问题描述

我正在研究 DRF 并使用视图集来创建 API。这里我遇到了一个问题：假设我在一个表单中有两个按钮，即员工和经理。如果用户单击 Employee，则它只能访问 GET 请求，如果他单击 Manager，则它具有 POST、PUT、PATCH 权限。

模型.py

class Employee(models.Model):
    emp_id = models.AutoField(primary_key=True)
    emp_name = models.CharField(max_length=30)
    email = models.EmailField(max_length=254, unique=True)
    position = models.CharField(max_length=30)
    team = models.CharField(max_length=30)
    phone = models.CharField(max_length=20, unique=True)

视图集.py

class EmpViewSet(viewsets.ModelViewSet):
    serializer_class = EmployeeSerializer
    queryset = Employee.objects.all()
    permission_classes = [OfficeEngineerPermission]

序列化程序.py

class EmployeeSerializer(serializers.ModelSerializer):
    class Meta:
        model = Employee
        fields = '__all__'

我试图编写自定义权限，但它不起作用。

custom_permiss.py

SAFE_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'HEADER', 'OPTIONS']
class OfficeEngineerPermission(BasePermission):
    def has_permission(self, request, view):
        if (request.method in SAFE_METHODS and request.user == 'OfficeEngineer'):
            return True
        return Response({'message':'This is not allowed'})

我读了所有的东西，但被卡住了。请建议！

标签： pythondjangodjango-rest-framework

解决方案

您可以覆盖视图集get_permissions()方法并为每个视图集操作定义权限

https://www.django-rest-framework.org/api-guide/viewsets/#viewset-actions

例如，我使用以下内容进行了快速测试：

class MyModelViewset(viewsets.ModelViewSet):
    serializer_class = MyModelSerializer
    model = MyModel

    def get_permissions(self):
        if self.action == "create":
            self.permission_classes = [IsNotSuperUser]
        elif self.action == "update":
            self.permission_classes = [IsTeacher]
        elif self.action == "partial_update":
            self.permission_classes = [IsNotSuperUser]
        elif self.action == "list":
            self.permission_classes = [IsSuperUser, IsAuthenticated]
        elif self.action == "retrieve":
            self.permission_classes = [IsSuperUser, IsAuthenticated]
        return super(self.__class__, self).get_permissions()

有了这个，您可以控制每个 HTTP 动词的权限。

推荐阅读