Hi! is it possible to set permission classes for specific endpoints? I want to set the IsAuthenticatedOrReadOnly permission for two of my endpoints and not for the entire class, is that possible? or are there any other solutions to let any user get the data without being authenticated for my 2 endpoints without altering the permissions of the rest of the class?
#Set 'IsAuthenticatedOrReadOnly' permission only for one endpoint of my view
fickle cove
# I HAVE THIS CLASS
class CampaignViewSet(viewsets.ModelViewSet):
permission_classes = (IsAuthenticated,) # WITH THIS PERMISSION
serializer_class = CampaignSerializer
queryset = Campaign.objects.all()
@action(detail=False, methods=['GET'])
def available(self, request):
# SOMETHING HERE
@action(detail=False, methods=['GET'])
def my_campaigns(self, request):
# SOMETHING HERE
@action(detail=True, methods=['GET'])
def teams(self, request, pk):
# SOMETHING HERE
@action(detail=True, methods=['GET'])
def participant_details(self, request, pk):
# SOMETHING HERE
@action(detail=True, methods=['GET'])
def all_campaigns(self, request):
# NOW, IN THIS ENDPOINT I WANT A DIFFERENT PERMISSION I DON'T KNOW, SOMETHING LIKE THIS:
permission_classes = [IsAuthenticatedOrReadOnly]
timid lark
I think the action decorator takes permission_classes as a parameter. Probably worth checking the docs and/or the code.
fickle cove
ohh really? I'll check on that thank you!!
timid lark
Yeah, it's in one of the examples on https://www.django-rest-framework.org/api-guide/viewsets/#marking-extra-actions-for-routing it didn't have a linkable anchor for me to link you to directly.
fickle cove
Thanks!
sonic thistle
@fickle cove did you resolve this?
I am having issues related to you
This is accessing the CREATE action.. but still wont let access
fickle cove
yeah
but maybe your problem is different, because it says that you are not giving the credentials
well anyway, what I did was using the decorator for the permission as CodenameTim said
here's the example:
@action(detail=True, methods=['GET'], permission_classes=[IsAuthenticatedOrReadOnly])
def team_ranking(self, request, pk):
campaign = self.get_object()
teams = Team.objects.filter(campaign=campaign)
data = TeamRankingSerializer(teams, many=True).data
return Response(data=data, status=status.HTTP_200_OK)
so do you still have a class attribute for permission_classes?
fickle cove
yes
for the entire file it has the defaul permissions I set
but for that endpoint it usses the IsAuthenticatedOrReadOnly permission, that allows everyone to acces the endpoint if it is read only
sonic thistle
hmm. Have you ever heard of the get_permissions() function for a ViewSet?
usually I believe it is the thing designed to be overwritten and handle custom permissions for different actions
fickle cove
hmm no I haven't heard of it sorry :/
sonic thistle
I mean AllowAny shouldn't require credentials at all right
fickle cove
or maybe with the permission you are setting
sonic thistle
I'm not passing any credentials
sonic thistle
Currently nothing lol
fickle cove
hmm idk then
sonic thistle
I want to just do like HTTP -a username='xxxx' password='xxxx' POST req ... when it requires authentication
fickle cove
I was thinking that something was overriding the AllowAny permission
