Django Rest Framework对POST的对象级权限

Question

我想确保request.user只能发出一个POST请求来创建一个论坛主题,在这个主题中他们是作者.使用PUT和DELETE我能够通过使用has_object_permission但是通过POST 来实现它我无法做到这一点,我猜测因为尚未创建对象.

class TopicPermission(IsAuthenticatedOrReadOnly):
    """
    Any user should be able to read topics but only authenticated 
    users should be able to create new topics. An owner or moderator 
    should be able to update a discussion or delete.
    """
    def has_object_permission(self, request, view, obj):
        if request.method in SAFE_METHODS:
            return True

        # Instance must have an attribute named `author` or moderator
        return obj.author == request.user or request.user.forum_moderator

我如何request.user == obj.author在POST请求中进行验证？

Answer 1

我最终在视图集中而不是序列化程序中进行验证：

class TopicViewSet(viewsets.ModelViewSet):
    permission_classes = (TopicPermission, )
    queryset = Topic.objects.all()
    serializer_class = TopicSerializer

    def create(self, request, *args, **kwargs):
        """
        verify that the POST has the request user as the obj.author
        """
        if request.data["author"] == str(request.user.id):
            serializer = self.get_serializer(data=request.data)
            serializer.is_valid(raise_exception=True)
            self.perform_create(serializer)
            headers = self.get_success_headers(serializer.data)
            return Response(serializer.data, status=201, headers=headers)
        else:
            return Response(status=403)