时间戳

首页 > 解决方案 > GET、PUT 和 DELETE 的 Django 权限

django - GET、PUT 和 DELETE 的 Django 权限

问题描述

我正在尝试使 PUT 和 DELETE 方法需要身份验证，但我希望 GET 方法是公开的。我知道我可以取出 GET 方法并将其放入自己的函数中，但我需要为它创建另一个 url。解决这个问题的最佳方法是什么？谢谢

@api_view(['GET', 'PUT', 'DELETE'])
@permission_classes([IsAuthenticated])
def getOrUpdateOrDeleteCar(request, pk):

    if request.method == 'GET':
        vehicle = Car.objects.get(id=pk)
        serializer = CarSerializer(vehicle, many=False)

        return Response(serializer.data)
    elif request.method == 'PUT':
        data = request.data
        car = Car.objects.get(id=pk)

        car.image=data['image']
        car.make=data['make']
        car.prototype=data['prototype']
        car.year=data['year']
        car.serviceInterval=data['serviceInterval']
        car.seats=data['seats']
        car.color=data['color']
        car.vin=data['vin']
        car.currentMileage=data['currentMileage']

        car.save()

        serializer = CarSerializer(car, many=False)
        return Response(serializer.data)
    elif request.method == 'DELETE':
        car = Car.objects.get(id=pk)
        car.delete()
        return Response('Car Deleted!')

标签： django

解决方案

编写自定义权限类：

from rest_framework.permissions import BasePermission

class CarPermission(BasePermission):
    
    def has_permission(self, request, view):
        if request.method == 'GET':
            return True
        return bool(request.user and request.user.is_authenticated)

并在您的 API 中使用它：

@api_view(['GET', 'PUT', 'DELETE'])
@permission_classes([CarPermission])
def getOrUpdateOrDeleteCar(request, pk):
...

推荐阅读