How to make provide views and specify which users can GET it - django

Question

I created the following model, with an author who is the user that created it and Title and description, with few other fields.
from django.db import models
from django.conf import settings
from django.utils import timezone
# Create your models here.
class Author(models.Model):
name = models.CharField(max_length=200)
added_by = models.ForeignKey(
settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
created_date = models.DateTimeField(default=timezone.now)
def __str__(self):
return self.name
class Book(models.Model):
title = models.CharField(max_length=200)
description = models.CharField(max_length=300)
author = models.ForeignKey(Author, on_delete=models.CASCADE)
added_by = models.ForeignKey(
settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
created_date = models.DateTimeField(default=timezone.now)
# 🔴 who_can_see
who_can_see = models.ManyToManyField(
settings.AUTH_USER_MODEL, related_name='tweet_user', blank=True)
def __str__(self):
return self.title
now I want to filter books based on who_can_see and auther
My question is: how to modify this books = Book.objects.filter(added_by=user) in order to get only the posts that have the authenticated username included in the who_can_see field.
in models.py i created this field to add the usernames that can see the view who_can_see = models.ManyToManyField( settings.AUTH_USER_MODEL, related_name='tweet_user', blank=True), but I don't know how to filter views based on them, also users can see all books even when they are not loggedin
#api_view(["POST"])
#csrf_exempt
#permission_classes([IsAuthenticated])
def add_book(request):
print({"request.data": request.data})
payload = request.data
user = request.user
try:
author = Author.objects.get(id=payload["author"])
book = Book.objects.create(
title=payload["title"],
description=payload["description"],
added_by=user,
author=author,
who_can_see=payload["who_can_see"] # 🔴
)
serializer = BookSerializer(book)
return JsonResponse({'books': serializer.data}, safe=False, status=status.HTTP_201_CREATED)
except ObjectDoesNotExist as e:
return JsonResponse({'error': str(e)}, safe=False, status=status.HTTP_404_NOT_FOUND)
except Exception:
return JsonResponse({'error': 'Something terrible went wrong'}, safe=False, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
#api_view(["GET"])
#csrf_exempt
#permission_classes([IsAuthenticated])
def get_books(request):
# here maybe I need other arguments than request to get the other filed, in order to create if statements.
user = request.user.id
# books = Book.objects.filter(added_by=user)
books = Book.objects.filter(who_can_see=user, added_by=user) # 🔴 after i created this user who are not logged in can see the all private books.
serializer = BookSerializer(books, many=True)
return JsonResponse({'books': serializer.data}, safe=False, status=status.HTTP_200_OK)

Answer 1

You have to write query in which you have to check for which book current user is in who_can_see field. You can write this like this.
from django.db.models import Q
current_user = request.user
books = Book.objects.filter(Q(Q(added_by=user) | Q(who_can_see=current_user)))
if you want to get books for which who_can_see is empty
books = Book.objects.filter(Q(Q(added_by=user) | Q(who_can_see=current_user) | Q(who_can_see=None)))