CODEWITHSUNDEEP
djangodjango-rest-frameworkpermissions
aejsi5
aejsi5

Reputation: 147

DRF Custom Permission is not firing

I wrote a custom permission class for a drf project to protect my view:

views.py

class Employee(APIView):
    permission_classes = [BelongsToClient]
    serializer_class = EmployeeSerializer

    def get(self, request, pk, format=None):
        employee = EmployeeModel.objects.get(pk=pk)
        serializer = EmployeeSerializer(employee, many=False)
        return Response(serializer.data)

    def delete(self, request, pk, format=None):
        employee = EmployeeModel.objects.get(pk=pk)
        employee.Employees_deleted = True
        employee.save()
        return Response(status=status.HTTP_200_OK)

My permission class:

permission.py

from rest_framework import permissions

class BelongsToClient(permissions.BasePermission):
    message= "You are only authorized to view objects of your client"

    """
    Object-level permission to only see objects of the authenticated users client
    """

    def has_object_permission(self, request, view, obj):
        if obj.Mandant == request.user.Mandant:
            return True
        else:
            return False

Unfortunatly this permission class isn't blocking my view even when it should. I dont know why. Did I miss something?

Upvotes: 0

Views: 224

Answers (2)

anjaneyulubatta505
anjaneyulubatta505

Reputation: 11705

has_object_permission only called when you use the DestroyAPIView or RetrieveAPIView or ViewSet.

Try to use a viewset just like below

from rest_framework import viewsets

class Employee(viewsets.ViewSet):
    permission_classes = [BelongsToClient]
    serializer_class = EmployeeSerializer

    def delete(self, request, pk, format=None):
        employee = EmployeeModel.objects.get(pk=pk)
        self.check_object_permissions(request, employee)
        employee.Employees_deleted = True
        employee.save()
        return Response(status=status.HTTP_200_OK)

Note: I didn't test it but it should work.

Upvotes: 1

Yunus Emre Cevik
Yunus Emre Cevik

Reputation: 167

You need to call check_object_permissions method before response for APIView

class Employee(APIView):
    permission_classes = [BelongsToClient]
    serializer_class = EmployeeSerializer

    def get(self, request, pk, format=None):
        employee = EmployeeModel.objects.get(pk=pk)
        serializer = EmployeeSerializer(employee, many=False)
        self.check_object_permissions(request, employee)
        return Response(serializer.data)

Upvotes: 2

Related Questions