Django Rest Framework: best practices?

Question

I was interested to learn about best practices when it comes to the Django Rest Framework. I limited the access to change certain attributes in the account using different serializers for each user (state versus account owner and any other) and the HTTP method, but I feel that this is too inconsistent.

Is this the best way to accomplish my task of separating "permissions" to modify different fields of an object? Or is there a better and more pythonic way to accomplish what I am currently doing in this way?

Any criticism with the code below is accepted, as I feel like I cut some corners.

Thank you very much.

from rest_framework import serializers, viewsets from rest_framework.permissions import SAFE_METHODS from accounts.models import User from cpapi.permissions import * class UserSerializer(serializers.HyperlinkedModelSerializer): class Meta: model = User fields = ('id', 'url', 'username', 'password') write_only_fields = ('password',) def restore_object(self, attrs, instance=None): user = super(UserSerializer, self).restore_object(attrs, instance) if 'password' in attrs.keys(): user.set_password(attrs['password']) return user class UserDetailsSerializer(UserSerializer): class Meta(UserSerializer.Meta): fields = ('id', 'url', 'username', 'password', 'email') class UserListSerializer(UserSerializer): class Meta(UserSerializer.Meta): fields = ('id', 'url', 'username') class UserWithoutNameSerializer(UserSerializer): class Meta(UserSerializer.Meta): fields = ('id', 'url', 'password', 'email') class UserViewSet(viewsets.ModelViewSet): """ API endpoint that allows users to be viewed or edited. """ serializer_class = UserSerializer model = User def get_serializer_class(self): # Modify to allow different information for different access (userlist vs staff) serializer_class = self.serializer_class if 'List' in self.get_view_name(): serializer_class = UserListSerializer elif self.request.method in ['PUT', 'PATCH']: serializer_class = UserWithoutNameSerializer elif self.get_object() == self.request.user or self.request.user.is_staff: serializer_class = UserDetailsSerializer return serializer_class def get_permissions(self): if self.request.method in SAFE_METHODS or self.request.method == 'POST': return [AllowAny()] elif self.request.method == 'DELETE': return [IsAdminUser()] else: return [IsStaffOrTargetUser()] 

Answer 1

If I understand correctly what you want, these are permissions for each field, and not Django or Django-REST-Framework directly supports them. You can install the package, for example Django Fine-Grained Permissions , but you would be stuck with the same solution, because there was no way to associate these permissions with the View REST API.

I would recommend that you stick to your decision or put the logic of choosing a serializer in one serializer that has all the fields, and pass the role to the constructor, and let the serializer build the list of fields according to it, but for this you will need to write your own subclass Serializer.