CODEWITHSUNDEEP
djangoapirestdjango-modelsdjango-rest-framework
diwakarb
diwakarb

Reputation: 561

How does viewset aligns with rest methods

I am relatively new to DRF, but found viewsets an amazing abstraction technique for writing RESTful API. I am having a hard time correlating Viewsets with REST methods though. Let's say I have a viewset for Userprofiles and somebody new creates a profile on client.

  1. Should this send a PUT or a POST ?
  2. Which url should this request go to, http://user or http://user/new_id ?
  3. If I want this profile only accessible to the user or admin(all CRUD operations), then where should I handle the code for making it inaccessible to others ?
  4. Should I create a new permission ? If yes, should I handle rest methods in has_permission/has_object_permission ?

I have gone through the tutorial, and know how permissions/mixins works, but I am not able to connect these dots here.

Upvotes: 0

Views: 127

Answers (1)

YPCrumble
YPCrumble

Reputation: 28692

1/ In general, POST is for creating new, PUT is for updating. See the docs on the SimpleRouter to show how the various types of Http methods align with various actions in your Django backend.

2/ You'll find that different situations call for different routing methods. If yours is standard, you may want to use a SimpleRouter like the example above. In that case, creating a new user would be a POST request to /user/ and updating a user would be a PUT request to /user/{{user_id}}/.

3/ To limit access to various API methods, you want to use Permissions. It's possible that you could use one of DRF's Custom Permissions. I've found that in general, if you want only the user to access his/her own profile, it's easier to either use conditional logic within a view (i.e., return a DRF PermissionDenied exception in the view logic if the request.user.pk is not the pk of that REST url. More often than not, I've used the UserPassesTestMixin from Django Braces, that works pretty well to filter user permissions.

4/ I guess the Django Braces mixin above answers this question. You should include a test_func method if you're using Django Braces that returns True if you want to grant the user access, and False otherwise.

Hope this helps! I agree that these are difficult parts of DRF and perhaps some of these could more effectively get incorporated into the source. Good luck!

Upvotes: 1

Related Questions