Set object-level permission with django-rest-framework

Question

Trying to manage django-guardian object-level permissions with django-rest-framework the most cleanly and canon possible.

I want to assign a read permission (module.view_object) of an object to to the user making the request when performing a POST.

My class-based view:

class ObjectList(ListCreateAPIView):
  queryset = Object.objects.all()
  serializer_class = ObjectSerializer
  filter_backends = (DjangoObjectPermissionsFilter,)
  # MyObjectPermissions inherit from DjangoObjectPermissions and just 
  # add the 'view_model' permission
  permission_classes = (MyObjectPermissions,)

  def perform_create(self, serializer):
    serializer.save(owner=self.request.user)

As described in the django-rest-framework documentation, I've overloaded perform_create in order to pass the user to the serializer.

But how do I assign the permission (using guardian.shortcuts.assign_perm) in the serializer. Is there no other way but to override the save method to assign the permission manually? Isn't there some kind of standard mechanism to manage a common behavior as this one?

You could assign the permission in the perform_create(). `serializer.save()` method returns the instance that was saved, you know — Mad Wombat, Dec 19 '16 at 20:15

score 3 · Accepted Answer · edited Jul 18 '19 at 14:51

3

You can assign the permission in the perform_create() method of the ViewSet.

edited Jul 18 '19 at 14:51

phoenix

7,988
6
39
45

answered Jan 19 '17 at 15:07

Mad Wombat

14,490
14
73
109

Set object-level permission with django-rest-framework

1 Answers1

Linked