python - 无法让 Django Rest Framework ViewSet 识别用户的权限

Question

我有一个型号Reservation具有两个自定义权限 reservation_can_view和reservation_can_edit :

class Reservation(models.Model):
    UNCONFIRMED = 'UNCONFIRMED'
    CONFIRMED = 'CONFIRMED'
    CANCELED = 'CANCELED'
    NO_SHOW = 'NO SHOW'
    GO_SHOW = 'GO SHOW'
    STATUS_CHOICES = (
        (UNCONFIRMED, _('Unconfirmed')),
        (CONFIRMED, _('Confirmed')),
        (CANCELED, _('Canceled')),
        (NO_SHOW, _('No show')),
        (GO_SHOW, _('Go show')),
    )

    booking = models.CharField(max_length=15, verbose_name=_('Booking'))
    agency = models.ForeignKey(Agency, on_delete=models.PROTECT, related_name='reservations', verbose_name=_('Agency'))
    comment = models.TextField(null=True, blank=True, verbose_name=_('Comment'))
    status = models.CharField(max_length=15, choices=STATUS_CHOICES, default=UNCONFIRMED, verbose_name=_('Status'))
    confirmation_date = models.DateTimeField(null=True, blank=True, verbose_name=_("Confirmation Date"))
    arrival_date = models.DateField(verbose_name=_('Arrival Date'))
    departure_date = models.DateField(verbose_name=_('Departure Date'))
    confirmation = models.CharField(max_length=15, null=True, blank=True, verbose_name=_('Confirmation Code'))
    is_invoiced = models.BooleanField(default=False, verbose_name=_('Is invoiced?'))
    euroamerica = models.BooleanField(default=False, verbose_name=_("Is Euroamerica sale"))
    user = models.ForeignKey(User, null=True, blank=True, on_delete=models.PROTECT, related_name='reservations')
    timestamp = models.DateTimeField(null=True, blank=True, auto_now_add=True)
    handle_fee = models.FloatField(null=True, blank=True, verbose_name=_("Handle Fee"))

    class Meta:
        verbose_name = _('Reservation')
        verbose_name_plural = _('Reservations')
        permissions = (
            ('reservation_can_edit', 'Can Edit Reservation'),
            ('reservation_can_view', 'Can View Reservation')
        )

以及验证此类权限的 ModelViewSet:

class ReservationCompositionPermission(permissions.BasePermission):
    def has_permission(self, request, view):
        user_permissions = Permission.objects.filter(user=request.user)
        print(str(user_permissions))

        if request.method == 'GET':
            return request.user.has_perm('reservation_can_view')
        elif request.method in ('POST', 'PUT', 'PATCH'):
            return request.user.has_perm('reservation_can_edit')

        return False

class ReservationCompositionViewSet(viewsets.ViewSet):
    permission_classes = (ReservationCompositionPermission,)

    def list(self, request, pk):
        reservation = models.Reservation.objects.filter(booking=pk).order_by('timestamp').last()
        if reservation == None:
            raise CustomValidation(_('There is not such Reservation: {}'.format(pk)), 'booking', status.HTTP_400_BAD_REQUEST)

        result_set = serializers.ReservationSerializer(reservation).data

        result_set['pax'] = self.get_reservation_people(reservation)
        result_set['itinerary'] = self.get_reservation_composition(reservation)

        return Response(result_set)

我可以在控制台中看到当前用户拥有这两种权限:

<QuerySet [<Permission: ReservationsManagerApp | Reservación | Can Edit Reservation>, <Permission: ReservationsManagerApp | Reservación | Can View Reservation>]>

但我仍然得到 False当自定义权限类评估request.user.has_perm('reservation_can_view')时，除非用户是 super 用户。

我想我错过了一些东西，但我找不到什么。

Answer 1

看看has_perm文档(链接适用于 Django 2.1)。看起来该方法需要的权限格式为 <app label>.<permission codename> .