在应用 perform_create() 方法之前检查权限

Question

我需要为请求用户的不同类型的操作检查不同类型的权限。例如get 权限只需要[IsAuthenticated] 但当用户请求perform_create 方法时。我想实现另一个权限是CanCreateProject permissions.py

class CanCreateProject(permissions.BasePermission):  
  def has_object_permission(self, request, view, obj):
    if request.user.is_superuser:
        return True
    else:
      return request.user.profile_limitation.can_create_project
    

views.py

class ProjectView(ModelViewSet):
  serializer_class = ProjectSerializer
  permission_classes = [IsAuthenticated]

  def get_queryset(self):
    queryset = Project.objects.all()
    organization = self.request.user.organization
    query_set = queryset.filter(organization=organization)    
    return query_set
  
  def perform_create(self, serializer):
    
    self.permission_classes = [CanCreateProject] ## here

    project = self.request.data["project_name"]
    path = self.request.data["project_name"]
    organization = self.request.data["organization"]
    serializer.save(project_name=project, project_path=path, organization=organization)

我怎样才能运行CanCreateProject 方法，只为请求perform_create 方法。

Answer 1

覆盖 get_permissions(...) 方法

class ProjectView(ModelViewSet):
    serializer_class = ProjectSerializer
    permission_classes = [IsAuthenticated]

    def get_queryset(self):
        queryset = Project.objects.all()
        organization = self.request.user.organization
        query_set = queryset.filter(organization=organization)
        return query_set

    def get_permissions(self):
        if self.action == 'create':
            composed_perm = IsAuthenticated & CanCreateProject
            return [composed_perm()]

        return super().get_permissions()

    # def perform_create(self, serializer):
    #     self.permission_classes = [CanCreateProject]  ## here
    # 
    #     project = self.request.data["project_name"]
    #     path = self.request.data["project_name"]
    #     organization = self.request.data["organization"]
    #     serializer.save(project_name=project, project_path=path,
    #                     organization=organization)

注意事项：

• 这里真的不需要perform_create(...)方法
• 可能的重复：DRF Viewset remove permission for detail route

更新-1

您应该实现 Permission 类的 has_permission(..) 方法，而不是 has_object_permission(...) 方法

from rest_framework import permissions


class CanCreateProject(permissions.BasePermission):
    def has_permission(self, request, view):
        if request.user.is_superuser:
            return True
        else:
            return request.user.profile_limitation.can_create_project