Django rest framework user model permissions - django

Question

I am building a web app using REST API and I have a 4 users that I want them to access only the content they have added to the backend. I have created 3 users say farmers(3 farmers) and added content using each one of them. However, I have been unable to implement permissions such that a farmer can view and delete only what they added.
Here's is my code in models.py
User = get_user_model()
# Create your models here.
class Tender(models.Model):
id = models.AutoField(primary_key=True)
name = models.CharField(max_length=255)
author = models.ForeignKey(User, on_delete=models.CASCADE)
description = models.TextField()
date_due = models.DateField(default=datetime.date.today)
location = models.CharField(max_length=255, null=False)
contact = models.PositiveIntegerField(null=False)
created_at = models.DateTimeField(auto_now_add=True)
updated_at = models.DateTimeField(auto_now=True)
def __str__(self):
return self.name
class Input(models.Model):
id = models.AutoField(primary_key=True)
name = models.CharField(max_length=255)
author = models.ForeignKey(User, on_delete=models.CASCADE)
description = models.TextField()
price = models.DecimalField(max_digits=10, decimal_places=2)
quantity = models.DecimalField(max_digits=10, decimal_places=2)
contact = models.PositiveIntegerField(null=False)
created_at = models.DateTimeField(auto_now_add=True)
updated_at = models.DateTimeField(auto_now=True)
def __str__(self):
return self.name
class Investor(models.Model):
id = models.AutoField(primary_key=True)
name = models.CharField(max_length=255, unique=True)
author = models.ForeignKey(User, on_delete=models.CASCADE)
description = models.TextField()
location = models.CharField(max_length=255, null=False)
contact = models.PositiveIntegerField(null=False)
created_at = models.DateTimeField(auto_now_add=True)
updated_at = models.DateTimeField(auto_now=True)
def __str__(self):
return self.name
Here's what I implemented in permissions.py
from rest_framework import permissions
class IsOwnerOrReadOnly(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.method in permissions.SAFE_METHODS:
return True
if request.user == obj.author:
return True
return False
class IsOwnerOnly(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.user == obj.user :
return True
return False
Here is my code in views.py:
from requests import request
from rest_framework.viewsets import ModelViewSet
from rest_framework import viewsets, status, permissions
from django.http import Http404, JsonResponse
from rest_framework.views import Response
from .models import Tender, Input , Investor
from .serializers import TenderViewSerializer, InputViewSerializer, InvestViewSerializer
from user.models import User
from user.permissions import IsOwnerOnly, IsOwnerOrReadOnly
# Create your views here.
class TenderViewSet(viewsets.ModelViewSet):
serializer_class = TenderViewSerializer
permission_classes = (permissions.IsAuthenticated,)
def get_queryset(self):
if self.request.user.is_tender_holder:
queryset = Tender.objects.all()
return queryset
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
def create(self, request, *args, **kwargs):
if self.request.user.is_tender_holder:
new_tender = Tender.objects.create(
name=request.data["name"],
description=request.data["description"],
date_due=request.data["date_due"],
location=request.data["location"],
contact=request.data['contact']
)
new_tender.save()
serializer = TenderViewSerializer(new_tender)
return Response(serializer.data)
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
def destroy(self, request, *args, **kwargs):
if self.request.user.is_tender_holder:
try:
instance =self.get_object()
self.perform_destroy(instance)
except Http404:
pass
return Response({"message": "Tender deleted successfully"})
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
# def update(self, request, *args, **kwargs):
class InvestorViewSet(ModelViewSet):
serializer_class = InvestViewSerializer
permission_classes = (permissions.IsAuthenticated,)
#queryset = Investor.objects.all()
def get_queryset(self):
if self.request.user.is_investor:
queryset = Investor.objects.all()
return queryset
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
def create(self, request, *args, **kwargs):
if self.request.user.is_investor:
new_investment = Investor.objects.create(
name=request.data["name"],
description=request.data["description"],
location=request.data["location"],
contact=request.data['contact']
)
new_investment.save()
serializer = InvestViewSerializer(new_investment)
return Response(serializer.data)
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
def destroy(self, request, *args, **kwargs):
if self.request.user.is_investor:
try:
instance =self.get_object()
self.perform_destroy(instance)
except Http404:
pass
return Response({"message": "Investment deleted successfully"})
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
class InputViewSet(ModelViewSet):
serializer_class = InputViewSerializer
permission_classes = (permissions.IsAuthenticated, IsOwnerOrReadOnly)
#queryset = Input.objects.all()
def get_queryset(self, **kwargs):
if self.request.user.is_input_holder or self.request.user.is_superuser:
user = self.request.user
return Input.objects.filter(id=user.id)
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
def create(self, request, *args, **kwargs):
if self.request.user.is_input_holder or self.request.user.is_superuser:
new_input = Input.objects.create(
name=request.data["name"],
description=request.data["description"],
price=request.data["price"],
quantity=request.data["quantity"],
contact=request.data['contact']
)
new_input.save()
serializer = InputViewSerializer(new_input)
return Response(serializer.data)
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)
def destroy(self, request, *args, **kwargs):
if self.request.user.is_input_holder or self.request.user.is_superuser:
try:
instance =self.get_object()
self.perform_destroy(instance)
except Http404:
pass
return Response({"message": "Input deleted successfully"})
else:
return Response({"NO_ACCESS": "Access Denied"}, status=401)

Answer 1

def has_object_permission(self, request, view, obj):
# Read permissions are allowed to any request,
# so we'll always allow GET, HEAD or OPTIONS requests.
if request.method in permissions.SAFE_METHODS:
return True
# Instance must have an attribute named `owner`.
return obj.owner == request.user
This code give view permission to all users
If you want to restrict all permission you should try something like this
def has_object_permission(self, request, view, obj):
# Instance must have an attribute named `owner`.
return obj.owner == request.user