小编use*_*657的帖子

我正在尝试为书籍构建REST API：

/api/book
/api/book/{book_id}

用户应该只能访问他的书。我现在这样做的方法是使用用户名（即Book.objects.all（）。filter（owner = request.user））过滤结果

views.py

class Book_List(APIView):

    permission_classes=(permissions.IsAuthenticated)

    def get(self, request, format=None):
        **books= Book.objects.all().filter(owner=request.user)**
        serializer = BookSerializer(books, many=True)
        return Response(serializer.data)

    def post(self, request, format=None):
        serializer = BookSerializer(data=request.data)
        if serializer.is_valid():
            serializer.save()
            return Response(serializer.data, status=status.HTTP_201_CREATED)
        return Response(serializer.errors,   status=status.HTTP_400_BAD_REQUEST)

    def perform_create(self, serializer):
        serializer.save(owner=self.request.user)    

#/book/{pk}
class Book_Detail(APIView):

    permission_classes = (permissions.IsAuthenticated)

    def get_object(self, pk, request):
        try:
            return Book.objects.get(pk=pk, owner=request.user)
        except Playlist.DoesNotExist:
            raise Http404

    def get(self, request, pk, format=None):
        book = self.get_object(pk, request)
        serializer = BookSerializer(playlist, context={'request': request})
        return Response(serializer.data)

    def put(self, request, …