Django Rest框架：如何使用APIView或GenericAPIView调用check_object_permissions（）

Question

我只想让对象创建者能够看到他们的对象

因此，我想验证用户是否等于对象的created_by字段

我仅使用APIView或GenericAPIView作为我的视图：

class CertificateDetailApi(APIView):

    permission_classes = [IsCreator]

    class OutputSerializer(serializers.ModelSerializer):
        class Meta:
            model = Certificate
            fields = ('__all__')

    def get(self, request, pk):
        certificate = get_object_or_404(Certificate, pk=pk)
        serializer = self.OutputSerializer(certificate)
        return Response(serializer.data)

以下是我的权限：

class IsCreator(BasePermission):
    def check_object_permissions(self, request, view, obj):
        return obj.created_by == request.user

我的问题是check_object_permissions()方法从未被调用

我所尝试的：

• 用GenericAPIView替换APIView
• 在return Response(serializer.data)之前调用视图中的check_object_permissions()
• 在视图中实现get_object()方法

这些解决方案都不起作用

我不明白该怎么称呼check_object_permissions()

欢迎任何帮助

Answer 1

您将错误的方法调用为documented

To implement a custom permission, override BasePermission and implement either, or both, of the following methods:

.has_permission(self, request, view)
.has_object_permission(self, request, view, obj)

那么你的情况呢

class IsCreator(BasePermission):
    def has_object_permission(self, request, view, obj):
        return obj.created_by == request.user

Answer 2

您必须将check\u object\u permission函数替换为has\u object\u permission