Check a field in model in generics.RetrieveDestroyAPIView - django

Question

I am writing a rest API. this is my view:
class OrderDeleteAPIView(generics.RetrieveDestroyAPIView):
queryset = Order.objects.all()
serializer_class = OrderDeleteSerializer
# permission_classes = (OwnerCanManageOrReadOnly,)
lookup_field = 'id'
and this is its model:
class Order(models.Model):
product = models.ForeignKey(Product)
customer = models.ForeignKey(Customer, null=True)WAITING = 'WA'
PREPARATION = 'PR'
READY = 'RD'
DELIVERED = 'DV'
STATUS_CHOICES = (
(WAITING, 'waiting'),
(PREPARATION, 'preparation'),
(READY, 'ready'),
(DELIVERED, 'delivered'),
)
status = models.CharField(
max_length=2,
choices=STATUS_CHOICES,
default=WAITING,
)
and:
class Customer(models.Model):
name = models.CharField(max_length=40)
customer_email = models.EmailField()
def __str__(self):
return self.name
and this is its serializer:
class OrderDeleteSerializer(ModelSerializer):
class Meta:
model = Order
fields = '__all__'
What should I do if I want the object(order) can be deleted, only when the status field is 'waiting' ?

Answer 1

You can implement some checks, in the destroy and return an error message as response in case the constraints are not met:
class OrderDeleteAPIView(generics.RetrieveDestroyAPIView):
queryset = Order.objects.all()
serializer_class = OrderDeleteSerializer
# permission_classes = (OwnerCanManageOrReadOnly,)
lookup_field = 'id'
def destroy(self, request, *args, **kwargs):
instance = self.get_object()
if instance.status != Order.WAITING:
return JsonResponse(
status=412,
data={'status':'false',
'message': 'status should be WAITING'}
)
super(OrderDeleteAPIView, self).destroy(request, *args, **kwargs)
Of course you can return any sort of answer (not per se a JSON response, nor does the status has to be 412). Usually HTTP status code 412 means that 412 Precondion failed.

Answer 2

The question is not about permissions, but it is a close situation.
If you want to check permissions, there is a way to do this via overridden check_permissions:
from functools import lru_cache
from rest_framework.exceptions import PermissionDenied
class OrderDeleteAPIView(generics.RetrieveDestroyAPIView):
serializer_class = OrderDeleteSerializer
permission_classes = (OwnerCanManageOrReadOnly,)
lookup_field = 'id'
#lru_cache
def get_object(self, *args, **kwargs):
return Order.objects.get(self.kwargs['order_id'])
def check_permissions(self, request):
# this method will call OwnerCanManageOrReadOnly first
super().check_permissions(request)
# and then do other checks
instance = self.get_object()
if instance.owner != request.user:
raise PermissionDenied()
As you can notice, I use #lru_cache to cache get_object. The reason to use it is because after check_permissions there will be another method (in this case retrieve or destroy) which will call this method again. To reduce database requests count I use caching.