https://www.django-rest-framework.org/api-guide/permissions/#custom-permissions
from django.shortcuts import render from rest_framework import mixins,viewsets from .serializers import UserFavSerializer from .models import UserFav from rest_framework.permissions import IsAuthenticated # Create your views here. from rest_framework import permissions class IsOwnerOrReadOnly(permissions.BasePermission): """ Object-level permission to only allow owners of an object to edit it. Assumes the model instance has an `owner` attribute. """ def has_object_permission(self, request, view, obj): # Read permissions are allowed to any request, # so we‘ll always allow GET, HEAD or OPTIONS requests. if request.method in permissions.SAFE_METHODS: return True # Instance must have an attribute named `owner`. return obj.user == request.user class UserFavSetview(mixins.CreateModelMixin,mixins.ListModelMixin, mixins.DestroyModelMixin,viewsets.GenericViewSet): permission_classes = (IsAuthenticated,IsOwnerOrReadOnly) #需登陆和需要是拥有者 serializer_class = UserFavSerializer # queryset = UserFav.objects.all() def get_queryset(self): return UserFav.objects.filter(user=self.request.user)
PS:可以在view中配置authtication_classes,来指明特定的接口需要授权
原文地址:https://www.cnblogs.com/chenyishi/p/10661903.html
时间: 2024-10-08 11:45:45