I want to restrict a particular user from creating a saved class object if the current user id is different from the id in the live class object

Question

My models.py

from django.db import models
from django.contrib.auth.models import User
import datetime
from django.utils import timezone
    # Create your models here.
    
class LiveClass(models.Model):

    standard = models.IntegerField()
    no_of_students_registered = models.IntegerField(default=0)
    class Meta:
        verbose_name_plural = 'Class'
    
    def __str__(self):
        return str(self.standard) + ' class'
    
class User_details(models.Model):
    name = models.OneToOneField(User, on_delete = models.CASCADE, max_length=30)
    standard = models.IntegerField(default=0)
    email = models.EmailField()
    mobile_number = models.IntegerField()
    class Meta:
        verbose_name_plural = 'User_details'

     
    def __str__(self):
        return str(self.name)
    
class Mentor(models.Model):
    name = models.CharField(max_length=30)
    details = models.TextField()
    ratings = models.FloatField(default=2.5)
    class Meta:
        verbose_name_plural = 'Mentors'
    
    def __str__(self):
        return self.name
    
class LiveClass_details(models.Model):
    standard = models.ForeignKey(LiveClass, on_delete=models.CASCADE)
    chapter_name = models.CharField(max_length=30)
    chapter_details = models.TextField()
    mentor_name = models.ForeignKey(Mentor, max_length=30, on_delete=models.CASCADE)
    class_time = models.DateTimeField()
    end_time = models.DateTimeField(default=timezone.now())
    isDoubtClass = models.BooleanField(default=False)
    doubtsAddressed = models.IntegerField(default=0)
    class Meta:
        verbose_name_plural = 'LiveClass_details'
        
    def __str__(self):
        return self.chapter_name
    
    
    
class SavedClass(models.Model):
    class_details = models.ForeignKey(LiveClass_details, on_delete=models.CASCADE)
    user = models.ForeignKey(User, on_delete=models.CASCADE)
    is_registered = models.BooleanField(default=False)
    is_attended = models.BooleanField(default=False)
    
    class Meta: 
        verbose_name_plural = 'SavedClasses'
    
    def __str__(self):
        return 'SavedClass : ' + str(self.class_details)
    
        

my views.py

from django.shortcuts import render
from rest_framework import mixins
from rest_framework import generics
from django.contrib.auth.mixins import LoginRequiredMixin
from rest_framework import status
from django.contrib.auth.models import User
from rest_framework.response import Response
from django.contrib.auth import authenticate


from . import serializers
from . import models
# Create your views here.

class ListLiveClass(mixins.ListModelMixin, LoginRequiredMixin, generics.GenericAPIView):
    queryset = models.LiveClass_details.objects.all()
    serializer_class = serializers.LiveClass_details_serializer
    def get(self, request, *args, **kwargs):
        return self.list(request, *args, **kwargs)

class LiveClassView(mixins.ListModelMixin,
                    mixins.CreateModelMixin,
                    LoginRequiredMixin,
                    generics.GenericAPIView):
    queryset = models.LiveClass_details.objects.all()
    serializer_class = serializers.LiveClass_details_serializer
    
    def get(self, request, *args, **kwargs):
        return self.list(request, *args, **kwargs)

    def post(self, request, *args, **kwargs):
        if request.user.is_superuser:
            return self.create(request, *args, **kwargs)
        else:
            return Response(status=status.HTTP_403_FORBIDDEN)

class LiveClassViewId(mixins.RetrieveModelMixin,
                    mixins.UpdateModelMixin,
                    mixins.DestroyModelMixin,
                    LoginRequiredMixin,
                    generics.GenericAPIView):
    queryset = models.LiveClass_details.objects.all()
    serializer_class = serializers.LiveClass_details_serializer
    lookup_field = 'id'

    def get(self, request, id=None, format=None):
        if id:
           return self.retrieve(request)
        else:
            return Response(status=status.HTTP_400_BAD_REQUEST)

    def put(self, request, id, format=None):

        if request.user.is_superuser:
            return self.update(request, id)
        else:
            return Response(status=status.HTTP_403_FORBIDDEN)

    def delete(self, request, id, format=None):
        if request.user.is_superuser:
            return self.destroy(request, id)
        else:
            return Response(status=status.HTTP_403_FORBIDDEN)


class ListMentors(mixins.ListModelMixin, LoginRequiredMixin, generics.GenericAPIView):
    queryset = models.Mentor.objects.all()
    serializer_class = serializers.Mentor_serializer
    def get(self, request, *args, **kwargs):
        return self.list(request, *args, **kwargs)



class ListUserDetails(mixins.ListModelMixin, LoginRequiredMixin, generics.GenericAPIView):
    queryset = models.User_details.objects.all()
    serializer_class = serializers.User_details_serializer
    def get(self, request, *args, **kwargs):
        return self.list(request, *args, **kwargs)



#api endpoints to save  and register live classes 

class SavedClassView(LoginRequiredMixin, mixins.ListModelMixin, mixins.CreateModelMixin, mixins.DestroyModelMixin, generics.GenericAPIView):

    serializer_class = serializers.SavedClass_serializer
    
    def get_queryset(self):
        user = self.request.user
        return models.SavedClass.objects.filter(user=self.request.user.id)

    
    def get(self, request):
        return self.list(request)

    def post(self, request):
        cur_user = self.get_object()
              #return self.create(request) 
        return Response(status=status.HTTP_403_FORBIDDEN)
    

my serializers.py

from rest_framework import serializers
from . import models



class LiveClass_serializer(serializers.ModelSerializer):
    class Meta:
        model = models.LiveClass
        fields = '__all__'


class SavedClass_serializer(serializers.ModelSerializer):
    class Meta:
        model = models.SavedClass
        fields = '__all__'

class User_details_serializer(serializers.ModelSerializer):
    saved_class = SavedClass_serializer()
    class Meta:
        model = models.User_details
        fields = '__all__'


class LiveClass_details_serializer(serializers.ModelSerializer):
    class Meta:
        model = models.LiveClass_details
        fields = '__all__'

class Mentor_serializer(serializers.ModelSerializer):
    class Meta:
        model = models.Mentor
        fields = '__all__'

In savedClass view in GET request i am rendering all the savedClass Model wherever user in the model matches with the current user , now in POST request i want to create the savedclass row only for the current user and forbids the user from creating a view with different user id

I also needs help in my SavedClass model where whether a user is registered or not can only be decided by the admin

I tries different possible things but not able to do it, i am new to Django so needs help

Answer 1

You can get the logged in user from request.user so something like this should work

def post(self, request):
    cur_user = request.user
    if cur_user.id == request.data.user:
        return self.create(request) 
    return Response(status=status.HTTP_403_FORBIDDEN)

assuming that only logged in users can call this api