from django.db import models
class Article(models.Model): owner = models.ForeignKey('auth.User', related_name='articles') created = models.DateTimeField(auto_now_add=True) published = models.DateTimeField(auto_now_add=True) title = models.CharField(max_length=250) author = models.CharField(max_length=100) #content contains raw html that will be rendered at a special endpoint content = models.TextField()
class Meta: ordering = ('created',)
from rest_framework import serializersfrom shittr_api.models import Articlefrom django.contrib.auth.models import User
class ArticleSerializer(serializers.HyperlinkedModelSerializer): owner = serializers.Field(source='owner.username') render = serializers.HyperlinkedIdentityField(view_name='article-render', format='html')
class Meta: model = Article fields = ('url', 'render', 'title', 'author', 'content', 'owner')
class UserSerializer(serializers.HyperlinkedModelSerializer): articles = serializers.HyperlinkedRelatedField(many=True, view_name='article-detail', read_only=True)
class Meta: model = User fields = ('url', 'username', 'articles')from shittr_api.models import Articlefrom shittr_api.serializers import ArticleSerializerfrom shittr_api.serializers import UserSerializerfrom shittr_api.permissions import IsOwnerOrReadOnlyfrom rest_framework.decorators import api_viewfrom rest_framework.response import Responsefrom rest_framework.reverse import reversefrom rest_framework import genericsfrom rest_framework import permissionsfrom django.contrib.auth.models import Userfrom rest_framework import renderersfrom rest_framework.response import Response
@api_view(('GET',))def api_root(request, format=None): return Response({ 'users': reverse('user-list', request=request, format=format), 'articles': reverse('article-list', request=request, format=format) })
class UserList(generics.ListCreateAPIView): queryset = User.objects.all() serializer_class = UserSerializer
class UserDetail(generics.RetrieveAPIView): queryset = User.objects.all() serializer_class = UserSerializer
class ArticleList(generics.ListCreateAPIView): queryset = Article.objects.all() serializer_class = ArticleSerializer permission_classes = (permissions.IsAuthenticatedOrReadOnly,)
def perform_create(self, serializer): serializer.save(owner=self.request.user)
class ArticleDetail(generics.RetrieveUpdateDestroyAPIView): queryset = Article.objects.all() serializer_class = ArticleSerializer permission_classes = (permissions.IsAuthenticatedOrReadOnly, IsOwnerOrReadOnly)
class ArticleRender(generics.GenericAPIView): queryset = Article.objects.all() renderer_classes = (renderers.StaticHTMLRenderer,)
def get(self, request, *args, **kwargs): article = self.get_object() return Response(article.content)from django.conf.urls import patterns, urlfrom rest_framework.urlpatterns import format_suffix_patternsfrom shittr_api import viewsfrom django.conf.urls import include
urlpatterns = [ url(r'^$', views.api_root), url(r'^articles/$', views.ArticleList.as_view(),name='article-list'), url(r'^articles/(?P<pk>[0-9]+)$', views.ArticleDetail.as_view(),name='article-detail'), url(r'^articles/(?P<pk>[0-9]+)/render/$', views.ArticleRender.as_view(),name='article-render'), url(r'^users/$', views.UserList.as_view(),name='user-list'), url(r'^users/(?P<pk>[0-9]+)/$', views.UserDetail.as_view(),name='user-detail'),]
urlpatterns += [ url(r'^api-auth/', include('rest_framework.urls', namespace='rest_framework')),]from rest_framework import permissions
class IsOwnerOrReadOnly(permissions.BasePermission): """ Custom permission to allow only owners to edit objects """
def has_object_permission(self, request, view, obj): if request.method in permissions.SAFE_METHODS: return True
return obj.owner == request.userHi Matt,`serializers.Field` there should have been changed to `serializers.ReadOnlyField` for 3.0.I've gone and made that fix now.Thanks for raising the issue!