Django DRF:@permission\u类不工作

Question

我有一个具有自定义操作的视图，该视图应具有自定义权限“IsRightUser”。但是，它的has_object_permission从未被调用，即使我试图使用视图中的self.get_object()访问对象

class MyView(mixins.ListModelMixin, viewsets.GenericViewSet):
    serializer_class = MySerializer
    lookup_field = 'uuid'
    queryset = MyObject.objects.all()

    @action(methods=['get'], detail=True)
    @permission_classes([IsRightUser])
    def groups(self, request, uuid=None):
        # prints [<class 'rest_framework.permissions.IsAuthenticated'>]
        print(self.permission_classes)  
        my_object = self.get_object()
        groups = Group.objects.filter(my_object=my_object)
        serializer = MySerializer(groups, many=True)
        return Response(serializer.data)

在这里，您可以看到我的自定义权限，该权限从未调用过

class IsRightUser(BasePermission):
    def has_object_permission(self, request, view, obj):
        # never called
        return True

当我在视图中使用permission_classes = [IsRightUser]（即直接在lookup_字段下方）时，它可以工作（不幸的是，这对我来说不可行）

非常感谢您的帮助

Answer 1

您应该将权限类作为action参数直接传递：

@action(methods=['get'], detail=True, permission_classes=[IsRightUser])
def groups(self, request, uuid=None):
    # prints [<class 'rest_framework.permissions.IsAuthenticated'>]
    print(self.permission_classes)  
    my_object = self.get_object()
    groups = Group.objects.filter(my_object=my_object)
    serializer = MySerializer(groups, many=True)
    return Response(serializer.data)