python - 如何使模型对象在用户首次提交后不可编辑

Question

我已经设置好了个人资料模型。我还能够将数据呈现到模板，但是，当前登录用户可以编辑该数据。

然而，我的计划是给予用户一次性填写数据的权限，一旦提交，这些数据就不能由他们编辑，除非具有 is_staff 或 super 管理员权限的用户，即使他们打算在他们的个人资料 View 中查看他们的数据。

这可能吗？如果是，我可以遵循什么策略和/或例子，因为我不知道如何去做。

views.py

@transaction.atomic
def edit_profile(request):
    if request.method == 'POST':
        user_form = UserForm(request.POST, instance=request.user)
        employee_form = EmployeeProfileUpdateForm(request.POST, instance=request.user.profile)
        if user_form.is_valid() and employee_form.is_valid():
            user_form.save()
            employee_form.save()
            messages.success(request, 'Account successfully updated!')
            return render(request, 'accounts/update-profile.html')
        else:
            messages.warning(request, 'Please correct the error(s) below')
    else:
        user_form = UserForm(instance=request.user)
        employee_form = EmployeeProfileUpdateForm(instance=request.user.profile)
    return render(request, 'accounts/update-profile.html', {
        'user_form': user_form,
        'employee_form': employee_form,
    })

Answer 1

如果您使用 generic class based views provided by Django这相当简单。 mixin UserPassesTestMixin将方法 test_func 添加到 View 中，如果用户有权限，您可以使用该方法返回 True 或 False

from django.views.generic import CreateView, UpdateView, DetailView
from django.contrib.auth.mixins import UserPassesTestMixin


class ProfileCreateView(CreateView):
    # Used for creation - has no special permissions
    model = Profile


class ProfileDetailView(DetailView):
    # Used for viewing - has no special permissions
    model = Profile


class ProfileUpdateView(UserPassesTestMixin, UpdateView):
    # Used for updating - requires a user be superuser or staff
    model = Profile

    def test_func(self):
        return self.request.user.is_superuser or self.request.user.is_staff