Django REST框架：限制对象的用户访问

Question

我正在尝试为书籍构建REST API：

/api/book
/api/book/{book_id}

用户应该只能访问他的书。我现在这样做的方法是使用用户名（即Book.objects.all（）。filter（owner = request.user））过滤结果

views.py

class Book_List(APIView):

    permission_classes=(permissions.IsAuthenticated)

    def get(self, request, format=None):
        **books= Book.objects.all().filter(owner=request.user)**
        serializer = BookSerializer(books, many=True)
        return Response(serializer.data)

    def post(self, request, format=None):
        serializer = BookSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors,   status=status.HTTP_400_BAD_REQUEST)

    def perform_create(self, serializer):
        serializer.save(owner=self.request.user)    

#/book/{pk}
class Book_Detail(APIView):

    permission_classes = (permissions.IsAuthenticated)

    def get_object(self, pk, request):
        try:
            return Book.objects.get(pk=pk, owner=request.user)
        except Playlist.DoesNotExist:
            raise Http404

    def get(self, request, pk, format=None):
        book = self.get_object(pk, request)
        serializer = BookSerializer(playlist, context={'request': request})
        return Response(serializer.data)

    def put(self, request, pk, format=None):
        book= self.get_object(pk)
        serializer = BookSerializer(playlist, data=request.data, context={'request': request})
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data)
        return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST)

    def delete(self, request, pk, format=None):
        book= self.get_object(pk)
        book.delete()
        return Response(status=status.HTTP_204_NO_CONTENT)

serializers.py

class BookSerializer(serializers.HyperlinkedModelSerializer):
    class Meta:
        model = Book
        fields = ('url', 'owner','title', 'created_date', 'shared_with', 'tracks')       

class UserSerializer(serializers.HyperlinkedModelSerializer):
    books = serializers.HyperlinkedRelatedField(many=True,view_name='playlist-detail', read_only=True)
    owner = serializers.ReadOnlyField(source='owner.username')

    class Meta:
        model = User
        fields = ('url', 'username', 'owner', 'books') 

但这是正确的方法吗？

Django Rest Framework是否为此提供任何内置解决方案？

解决方案在于权限吗？如果是，那么我们如何为用户创建的所有对象设置它（我了解要获取特定对象，我们可以进行权限检查obj.user==request.user）。我对吗？

Answer 1

您可以使用ModelViewset，其中包含典型CRUD的所有逻辑：

class BooksViewSet(ModelViewset):
    serializer_class = BookSerializer
    permission_classes=[permissions.IsAuthenticated, ]

    def get_queryset(self):
        return Books.objects.filter(owner=self.request.user)

    def perform_create(self, serializer):
        serializer.data.owner = self.request.user
        super(BooksViewSet, self).perform_create(serializer)