CODEWITHSUNDEEP
djangodjango-rest-framework
madhukar93
madhukar93

Reputation: 515

restrict fields according to user permissions in django

I'm building an API using Django rest framework. I have to restrict access to fields (both read or write access) according to the kind of user logged in. How do I go about it ? I'm considering writing separate serializers for different user roles
(I will get an access token with every request using which I can authenticate the user, the next step will get me the user's roles, according to which I want to restrict what fields the user can see/edit).

Upvotes: 2

Views: 1179

Answers (1)

Sebastian Wozny
Sebastian Wozny

Reputation: 17506

In case you want to give certain users model level permissions to conduct certain actions you can do this with custom permissions like so:

class T21Turma(models.Model):
    class Meta:
        permissions = (("can_view_boletim", "Can view boletim"),
                       ("can_view_mensalidades", "Can view mensalidades"),)

Then you can either make several serializers and swap them out in the views based on the permissions, or you can modify the fields of the serializer dynamically.

Upvotes: 2

Related Questions