Django 休息框架 : Disable field update after object is created

Question

我正在尝试通过 Django Rest Framework API 调用使我的用户模型成为 RESTful，以便我可以创建用户并更新他们的配置文件。

但是，当我对用户进行特定的验证过程时，我不希望用户在创建帐户后能够更新用户名。我尝试使用 read_only_fields，但这似乎在 POST 操作中禁用了该字段，因此我无法在创建用户对象时指定用户名。

我该如何着手实现它？现在存在的 API 的相关代码如下。

class UserSerializer(serializers.HyperlinkedModelSerializer):
    class Meta:
        model = User
        fields = ('url', 'username', 'password', 'email')
        write_only_fields = ('password',)

    def restore_object(self, attrs, instance=None):
        user = super(UserSerializer, self).restore_object(attrs, instance)
        user.set_password(attrs['password'])
        return user


class UserViewSet(viewsets.ModelViewSet):
    """
    API endpoint that allows users to be viewed or edited.
    """
    serializer_class = UserSerializer
    model = User

    def get_permissions(self):
        if self.request.method == 'DELETE':
            return [IsAdminUser()]
        elif self.request.method == 'POST':
            return [AllowAny()]
        else:
            return [IsStaffOrTargetUser()]

谢谢!

Answer 1

看来您需要为 POST 和 PUT 方法使用不同的序列化程序。在 PUT 方法的序列化程序中，您可以只排除用户名字段(或将用户名字段设置为只读)。

class UserViewSet(viewsets.ModelViewSet):
    """
    API endpoint that allows users to be viewed or edited.
    """
    serializer_class = UserSerializer
    model = User

    def get_serializer_class(self):
        serializer_class = self.serializer_class

        if self.request.method == 'PUT':
            serializer_class = SerializerWithoutUsernameField

        return serializer_class

    def get_permissions(self):
        if self.request.method == 'DELETE':
            return [IsAdminUser()]
        elif self.request.method == 'POST':
            return [AllowAny()]
        else:
            return [IsStaffOrTargetUser()]

检查这个问题 django-rest-framework: independent GET and PUT in same URL but different generics view