In this lesson we're going to add some
permissions to our user profile feed
view set. These permissions are going to
solve two problems for us. First, they're
going to ensure that users can only
update their own profile statuses. And
second, it's going to fix the error we
received in the previous lesson when we
tried to create a new status update and we
weren't logged in. So let's get started.
Minimize Chrome and load up the atom
editor. We'll start by creating our
permissions class. So load up
permissions.py within our profiles API project.
We're going to create a new class called
PostOwnStatus. It's going to be similar
to our UpdateOwnProfile class but it's
going to be checking that the user's trying
to update that own status item instead
of their own user profile. So start
typing the class name class PostOwnStatus
We'll inherit from the base "permissions" class.
So: permissions.BasePermission
Give it the doc string "Allow users to update their own status"
Just like we did with the UpdateOwnProfile permissions class
We're going to add a has_object_permission function
which is going to run the logic
to check if the user has the correct
permissions to perform the action
they're trying to perform. So type
def has_object_permission
and give it self, request, view, obj
All right so we'll give this the doc string
"Checks the user is trying to
update their own status"
So we want users to be able to view
other people's api's...sorry, other
people's user statuses. But we don't want
them to be able to update or change the
user statuses. So we'll type:
if request.method in permissions.SAFE_METHODS
return True
This way they can view other people's statuses but
they just can't edit other people's
statuses. Finally we'll do:
return obj.user_profile.id == request.user.id
What this will do is it will check
if the user profile ID of the
status item they're trying to update
matches the request.user.id
which is the same as the user that is
logged in right now. If this equals true
then it will allow the action to
continue. If this returns false then it
will stop and it will prevent the user
from performing an action. Ok so make
sure you save that file, that's all we
need to do for our permissions file.
Now let's head over to views.py. Scroll to
the top of the page and we're going to
add one more import here. The import
we're going to add is a built in rest
framework permission this is called
IsAuthenticatedOrReadOnly. So type:
from rest_framework.permissions import IsAuthenticatedOrReadOnly
As the name suggests this
gives the user the permission to do
anything they want if they're
authenticated but it restricts them to
only read-only access if they're not
authenticated. So this will fix the error
that we had with creating a new status
item when we weren't logged in, because
after we apply this permission to our
view set you won't be able to create a
new object unless you're
into the system. So scroll down to the
bottom where we defined our user profile
feed view set. Add a new line below the
query set and write: permission_classes =
The first permission we'll add is the one that we
created. So this is: (permissions.PostOwnStatus, IsAuthenticatedOrReadOnly)
So this will apply both permission classes to our view set
So it will only allow them to update
and create and modify if they're logged in
or it will restrict them to read-only.
And then if they try and create a new
status or they try and update a status it
will run our post own status permissions
class and check that they're trying to
update that own status object. Okay so
save the file. That's how we add
permission classes to our user profile
feed viewset. Thank you for watching and
I'll see you in the next lesson.