django-rest-framework: GET 和 POST 到嵌套数据

Question

仿照this example，每个用户有多个专辑，每个专辑有很多曲目。

我如何允许我的用户仅将曲目 GET 和 POST 到他拥有的专辑中？ 我将使用哪个序列化程序以及如何设置我的视图？

这是我的模型：

from django.db import models
from django.contrib.auth.models import User

class Album(models.Model):
    album_name = models.CharField(max_length=100)
    user = models.ForeignKey(User)

class Track(models.Model):
    album = models.ForeignKey(Album, related_name='tracks')
    order = models.IntegerField()
    title = models.CharField(max_length=100)
    duration = models.IntegerField()

    class Meta:
        unique_together = ('album', 'order')
        order_by = 'order'

    def __unicode__(self):
        return '%d: %s' % (self.order, self.title)

注意：我并不是要您为我完成所有工作。在线链接到特定示例就足够了，谢谢。

Answer 1

您正在查看的是Object level permissions 您需要添加自定义权限才能仅允许对象的所有者对其进行编辑。

这里有一个例子 Object level permissions 。另一个例子：

# models.py
class Message(BaseDate):
    """
    Private Message Model
    Handles private messages between users
    """
    status = models.SmallIntegerField(_('status'), choices=choicify(MESSAGE_STATUS))
    from_user = models.ForeignKey(User, verbose_name=_('from'), related_name='messages_sent')
    to_user = models.ForeignKey(User, verbose_name=_('to'), related_name='messages_received')
    text = models.TextField(_('text'))
    viewed_on = models.DateTimeField(_('viewed on'), blank=True, null=True)


# serialisers.py
class MessageSerializer(serializers.ModelSerializer):
    from_user = serializers.Field(source='from_user.username')
    to_user = serializers.Field(source='to_user.username')

    class Meta:
        model = Message
        fields = ('id', 'status', 'from_user', 'to_user', 'text', 'viewed_on')


# views.py
from permissions import IsOwner

class MessageDetail(generics.RetrieveUpdateDestroyAPIView):
    model = Message
    serializer_class = MessageSerializer
    authentication_classes = (TokenAuthentication, SessionAuthentication)
    permission_classes = (permissions.IsAuthenticated, IsOwner)


# permissions.py
class IsOwner(permissions.BasePermission):
    """
    Custom permission to only allow owners of an object to edit or delete it.
    """

    def has_permission(self, request, view, obj=None):
       # Write permissions are only allowed to the owner of the snippet
       return obj is None or obj.from_user == request.user


# urls.py
urlpatterns = patterns('',
    url(r'^messages/(?P<pk>[0-9]+)/$', MessageDetail.as_view(), name='api_message_detail'),
)