没有为详细信息和列表视图调用 Django Rest Framework 权限

Question

我创建了这个自定义权限类，当我从视图发出请求时，它似乎没有被调用。我将其设置为返回 false 并且请求仍然成功。尝试放置打印语句以查看是否有任何输出但没有。不知道我在做什么。

查看：

class EventEditView(RetrieveUpdateDestroyAPIView):
    authentication_classes = (SessionAuthentication, JSONWebTokenAuthentication,  )
    permission_classes = (EventVisibilityPerm, )
    serializer_class = EventEditSerializer

    def get(self, request, *args, **kwargs):
        event = get_object_or_404(Event, slug=kwargs['slug'])
        serializer = EventSerializer(event)
        return Response(serializer.data)

Permissions.py：

class EventVisibilityPerm(permissions.BasePermission):
    """
    Permission class determines whether a user has access to a specific Event
    """

def has_object_permission(self, request, view, obj):
    user = request.user
    if obj.user == user:
        return True

**序列化器：**

class EventSerializer(serializers.ModelSerializer):
    class Meta:
        model = Event
        exclude = ('user', 'id')

目前正在测试此详细视图的权限，但此权限也需要用于列表视图。

Answer 1

您必须在创建自定义权限类时实现has_permission(self, request, view)方法。

来自DRF Doc，

只有在视图级别的has_permission检查已经通过时，才会调用实例级别的has_object_permission方法。

示例：

from rest_framework import permissions


class EventVisibilityPerm(permissions.BasePermission):
    def has_permission(self, request, view):
        """
        allowing users with specific email ids
        """
        if request.user.email in EMAIL_WHITELIST:
            return True
        return False

    def has_object_permission(self, request, view, obj):
        """
        allowing users those who are the owner of the object (obj.user)
        """
        return request.user == obj.user

Answer 2

您可以覆盖权限类的两个函数，您继承自BasePermission。这些函数是has_permission 和has_object_permission。 has_permission 会自动检查。但has_object_permission 函数应在您的视图中手动调用，代码如下：

self.check_object_permissions(self.request, obj)