Tastypie - Wrong Bundle Objects Created on PUT - django

Question

I have uncovered a few problems with the way Tastypie is creating bundle objects:
1) When I do a PUT to the detail endpoint of a Card resource (see below tests.py) without including the "id" field, instead of updating the resource from the URI, a new resource is created.
2) Another more significant issue is, if I include the "id" field, then the resource indicated in the "id" is updated and not the resource at the URI; this means I can update any resource by pointing to any other detail URI (I haven't built in auth yet, but this may be an authorization problem in the future).
The first test below fails (unless I remove default=uuid1_as_base64 in the model field definition and implement the logic in the model's save method) and the second test below passes even though it shouldn't pass.
What is happening here?
tests.py
def test_PUT_detail(self):
# Test 1: PUT to detail endpoint of card 1 without an ID field
put_data = {'text': 'wakka wakka'}
response = self.api_client.put(
uri='/api/v1/cards/rpHBJNOkEeKr2hTa6Uod1w/', # card 1 uri
data=put_data
)
self.assertEqual(self.card_1.read_file(), 'wakka wakka')
# Test 2: PUT to detail endpoint of card 1 with ID field of card 2
put_data = {'id': 'twt_UtOkEeKsuxTa6Uod1w', 'text': 'wakka wakka'}
response = self.api_client.put(
uri='/api/v1/cards/rpHBJNOkEeKr2hTa6Uod1w/', # still card 1 uri
data=put_data
)
self.assertEqual(self.card_2.read_file(), 'wakka wakka')
Bundle objects created during the above tests:
#Test 1
<Bundle for obj: 'rpHBJNOkEeKr2hTa6Uod1w' and with data: '{'text': u'wakka wakka', 'pk': u'rpHBJNOkEeKr2hTa6Uod1w'}'>
#Test 2 (notice how both the id field and pk field are included)
<Bundle for obj: 'twt_UtOkEeKsuxTa6Uod1w' and with data: '{'text': u'wakka wakka', 'id': u'twt_UtOkEeKsuxTa6Uod1w', 'pk': u'rpHBJNOkEeKr2hTa6Uod1w'}'>
api.py
class CardResource(ModelResource):
text = fields.CharField()
def __init__(self, *args, **kwargs):
super(CardResource, self).__init__(*args, **kwargs)
self.fields['id'].read_only = True
class Meta:
queryset = Card.objects.all()
fields = ['id', 'text']
resource_name = 'cards'
list_allowed_methods = ['get', 'post']
detail_allowed_methods = ['get', 'put', 'delete']
authorization = Authorization()
validation = CardValidation()
include_resource_uri = False
def dehydrate_text(self, bundle):
return bundle.obj.read_file()
def save(self, *args, **kwargs):
bundle = super(CardResource, self).save(*args, **kwargs)
bundle.obj.write_file(bundle.data['text'])
return bundle
models.py
class Card(TimeStampedModel):
id = models.CharField(max_length=22, db_index=True, primary_key=True,
default=uuid1_as_base64) # default is a callable
def file_path(self):
return '/'.join([settings.CARD_ROOT, self.id + '.txt'])
def read_file(self):
try:
with open(self.file_path(), 'rb') as f:
content = f.read()
return content
except IOError:
self.write_file(text='')
return self.read_file()
def write_file(self, text=''):
with open(self.file_path(), 'wb') as f:
f.write(text)
def __unicode__(self):
return u'%s' % self.id