限制用户访问APIView

Question

我想要获取用户的详细信息：

class UserDetailAPIView(RetrieveAPIView):
    """
    User detail information
    """
    queryset = User.objects.filter(is_valid=True).exclude(status=4)
    serializer_class = UserDetailSerializer
    lookup_field = "username"

我想限制其他用户访问此APIView，我只希望管理员用户和用户自己访问。

如何限制这一点？

Answer 1

您应该像这样定义自己的权限class.something：

from rest_framework import permissions


class OwnerProfilePermission(permissions.BasePermission):
    """object lvl permissions for owner """
    def has_object_permission(self, request, view, obj):
        return obj.user == request.user

在您的视图中包含permission_classes .see DRF文档。http://www.tomchristie.com/rest-framework-2-docs/api-guide/permissions

并且你选择的类基视图很重要。http://www.tomchristie.com/rest-framework-2-docs/api-guide/generic-views