我有一個(gè)模型Showcase，用戶可以用來(lái)展示項(xiàng)目，還有一個(gè)協(xié)作模型，用戶可以在其中將合作者添加到展示中。我正在嘗試實(shí)現(xiàn)一個(gè)案例，展示中的管理員和協(xié)作中的用戶可以刪除該協(xié)作。為了更好地解釋，在展示模型中，有一個(gè)管理展示的管理員列表。他們還可以將合作者（通過Collaborator模型）添加到展示中。有Collaborator一個(gè)用戶字段，即為展示做出貢獻(xiàn)的用戶。我希望在添加協(xié)作者后，該用戶可以刪除自己（如果他不想成為展示的一部分），或者管理員可以刪除該協(xié)作者（如果添加了錯(cuò)誤的用戶并想要?jiǎng)h除那個(gè)櫥窗里的他）models.pyclass Showcase(models.Model): title = models.CharField(max_length=50) description = models.TextField(null=True) skill_type = models.ForeignKey(Skill, on_delete=models.CASCADE) user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.DO_NOTHING, related_name="Showcases") content = models.TextField(null=True) created_on = models.DateTimeField(auto_now_add=True) updated_on = models.DateTimeField(auto_now=True) voters = models.ManyToManyField(settings.AUTH_USER_MODEL, related_name="upvotes") slug = models.SlugField(max_length=255, unique=True) administrator = models.ManyToManyField(settings.AUTH_USER_MODEL, related_name="administrators", blank=True)class Collaborator(models.Model): post = models.ForeignKey(Showcase, on_delete=models.CASCADE, related_name="collaborated_showcases") user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="collaborators") skill = models.ForeignKey(Skill, on_delete=models.CASCADE, null=True, related_name="creative_type") role = models.TextField(null=True) created_on = models.DateTimeField(auto_now_add=True) updated_on = models.DateTimeField(auto_now=True)permission.pyclass IsUser(permissions.BasePermission): def has_object_permission(self, request, view, obj): if request.method in permissions.SAFE_METHODS: return False return obj.user == request.user網(wǎng)path("collaborator/<int:pk>/delete/", qv.CollaboratorDeleteView.as_view(), name="collaborator-delete-view"),現(xiàn)在我已經(jīng)能夠?qū)崿F(xiàn)管理員可以刪除協(xié)作者，但是我如何為Collaborator模型中的用戶添加另一個(gè)權(quán)限，以便能夠通過相同的視圖將自己作為協(xié)作者刪除？
2 回答
狐的傳說
TA貢獻(xiàn)1804條經(jīng)驗(yàn) 獲得超3個(gè)贊
實(shí)際上，這兩種權(quán)限都可以合并為一個(gè)。例如像這樣更新權(quán)限：
class CanDeleteUser(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.method in permissions.SAFE_METHODS:
return False
return obj.user == request.user or ob.post.administrator.filter(pk=request.user.pk).exists()
在這里，我正在檢查request.useris或檢查附加變量obj.user的對(duì)象的管理員。showcaseobj
現(xiàn)在我只檢查collaborator.
class CollaboratorDeleteView(APIView):
'''
Allow Administrators to delete a collaborator to a showcase
or allow the collaborator user to be able to delete himself
'''
permission_classes = [CanDeleteUser]
def delete(self, request, pk):
collaborator = get_object_or_404(Collaborator, pk=pk)
try:
self.check_object_permissions(request, collaborator)
qq_笑_17
TA貢獻(xiàn)1818條經(jīng)驗(yàn) 獲得超7個(gè)贊
您可以permission_classses使用 & (and)、| 添加任意數(shù)量的權(quán)限來(lái)賦予屬性 (or) 和 ~ (not) 符號(hào) ( doc ):
class CollaboratorDeleteView(APIView):
'''
Allow Administrators to delete a collaborator to a showcase
or allow the collaborator user to be able to delete himself
'''
permission_classes = [IsAdmin|IsUser]
這兩個(gè)權(quán)限現(xiàn)在都可以使用OR邏輯。
添加回答
舉報(bào)
0/150
提交
取消