django - 使用 CreateAPIView 检查对象权限

Question

CommentCreate 是一个CreateAPIView，用于在另一个“报告”模型上发表评论。我需要阻止非报告作者或不属于允许发表评论的指定人员组的任何人使用此端点创建评论。

class CommentCreate(generics.CreateAPIView):
    serializer_class = CommentSerializer
    queryset = Comment.objects.none()

    def check_object_permissions(self, request, obj):
        if obj.report.creator != request.user:
            # also check if request.user is in the group of people that can comment
            raise exceptions.PermissionDenied(
                detail='You do not have permission')

我面临的问题是 check_object_permissions 被调用，但异常没有在任何地方被捕获，因此无论如何，评论都会正常发布。我在这里缺少什么？

Answer 1

创建 Comment 时，不会调用 check_object_permissions 方法。

以下是 CreateAPIView 的完整 create 代码:

class CreateModelMixin(object):
    """
    Create a model instance.
    """
    def create(self, request, *args, **kwargs):
        serializer = self.get_serializer(data=request.data)
        serializer.is_valid(raise_exception=True)
        self.perform_create(serializer)
        headers = self.get_success_headers(serializer.data)
        return Response(serializer.data, status=status.HTTP_201_CREATED, headers=headers)

    def perform_create(self, serializer):
        serializer.save()

    def get_success_headers(self, data):
        try:
            return {'Location': data[api_settings.URL_FIELD_NAME]}
        except (TypeError, KeyError):
            return {}

check_object_permissions 仅在 get_object 中调用，而 get_object 本身仅在您尝试通过 API 检索对象时调用。

为了在 CommentCreate 中进行权限检查，您应该重写其中的 perform_create 方法并进行检查:

class CommentCreate(generics.CreateAPIView):
    serializer_class = CommentSerializer
    queryset = Comment.objects.none()

    def perform_create(self, serializer):
        # untested if...
        if serializer.validated_data['report'].creator != self.request.user:
            raise exceptions.PermissionDenied(
                detail='You do not have permission')

        serializer.save()