Скачать или смотреть Implementing Field Level Validation in Django Rest Framework for Admin Users

Learn how to restrict field changes in Django Rest Framework to admin users only, while allowing authenticated users to create model instances.
---
This video is based on the question https://stackoverflow.com/q/62620844/ asked by the user 'Anoop K George' ( https://stackoverflow.com/u/10515390/ ) and on the answer https://stackoverflow.com/a/62621104/ provided by the user 'Anoop K George' ( https://stackoverflow.com/u/10515390/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Django RF, field level validation to check if requesting user is Admin

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Implementing Field Level Validation in Django Rest Framework for Admin Users

Introduction

In many web applications, it’s vital to ensure that only authorized users can modify certain fields, especially when it comes to sensitive data. For example, in a Django Rest Framework (DRF) application, you may want to allow authenticated users to create an instance of a model but restrict modifications to specific fields, such as an accepted field, to only admin users. In this post, we will explore how to implement field-level validation, ensuring that only Django Admin users can change the accepted status of a model instance, while still permitting authenticated users to create new instances with default field values.

Understanding the Problem

In your DRF project, you have a model defined as follows:

[[See Video to Reveal this Text or Code Snippet]]

With the above model, any authenticated user can create new instances of PO, but the requirement is to prevent unauthorized users from changing the accepted field after creation. Here’s how to achieve that.

Solution Overview

To limit access to the accepted field, we will:

Modify the serializer to handle two different cases — one for admin users and one for regular authenticated users.

Adjust the view to select the appropriate serializer class based on the user's permissions.

Step 1: Modify the View

First, we need to override the get_serializer_class method in the view where the model instances are created. This allows us to return a different serializer for admin users.

Below is the updated view code:

[[See Video to Reveal this Text or Code Snippet]]

Step 2: Create Admin and Regular Serializers

Now, let’s create two serializers — one for admin users that includes all fields, and another for regular users that excludes the accepted field along with others that should not be modified.

Here’s how you can define these serializers:

[[See Video to Reveal this Text or Code Snippet]]

Conclusion

With these modifications, authenticated users can create new instances of the PO model, but they will not have access to modify the accepted field. Only admin users can change the accepted status, ensuring the integrity and security of your data.

By implementing field-level validation through tailored serializers and view logic, you maintain both user functionality and data security in your Django Rest Framework application. This pattern not only enhances the flexibility of your API but also enforces strict access controls based on user roles.

For more updates or assistance with Django and DRF, feel free to explore further or reach out!