问题描述
尝试使用django-rest-framework最干净，最规范地管理django-guardian对象级权限。
Trying to manage django-guardian object-level permissions with django-rest-framework the most cleanly and canon possible.
我想分配读取权限（模块.view_object），然后发送给执行POST时发出请求的用户。
I want to assign a read permission (module.view_object) of an object to to the user making the request when performing a POST.
基于类的视图：
class ObjectList(ListCreateAPIView):
queryset = Object.objects.all()
serializer_class = ObjectSerializer
filter_backends = (DjangoObjectPermissionsFilter,)
# MyObjectPermissions inherit from DjangoObjectPermissions and just
# add the 'view_model' permission
permission_classes = (MyObjectPermissions,)
def perform_create(self, serializer):
serializer.save(owner=self.request.user)
如，为了将用户传递给序列化程序，我已经重载了 perform_create 。
As described in the django-rest-framework documentation, I've overloaded perform_create in order to pass the user to the serializer.
但是，如何在序列化程序中分配权限（使用guardian.shortcuts.assign_perm）。除了覆盖 save 方法以手动分配权限之外，没有其他方法吗？
But how do I assign the permission (using guardian.shortcuts.assign_perm) in the serializer. Is there no other way but to override the save method to assign the permission manually? Isn't there some kind of standard mechanism to manage a common behavior as this one?
推荐答案
您可以在其中分配权限吗？ ViewSet 的 perform_create（）方法。
You can assign the permission in the perform_create() method of the ViewSet.
这篇关于使用django-rest-framework设置对象级权限的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！