Okay so now we have a fully functioning profile REST API however you may have
noticed there is one issue with this API and that is that any user can
anonymously make changes to any other user's profile so you can head over to
the profile with ID 2 and you can change the name change the password or
change any of the details with this API without being authenticated and you can
do the same to user profile 1 now this obviously would not work for a real API
we want to be able to restrict the users so they can only make changes to their
own profile in the system we do that using a Django permissions class so load
up the atom editor and we're going to create a new permissions class in our
profiles API app create a new file called permissions dot py and at the top of
the file we're going to import the permissions module from the rest
framework this is going to provide us with the base class that we can use to
create a custom permissions class so type from rest underscore framework
import permissions and then we're going to create a class called update own
profile and we're going to base it from permissions dot base permission as the name
suggests this is the base permission class that Django rest framework
provides for making your own custom permissions classes add the doc string
allow users to edit their own profile this is what this permission is going to
allow the users to do the way you define permission classes is you add a has
object permissions function to the class which gets called every time a request
is made to the API that we assign our permission to this function
will return a true or a false to determine whether the authenticated user
has the permission to do the change they're trying to do so let's create a
new function here called def has underscore object underscore permission
then we'll pass in the argument self request view and object or obj the
docstring that we're going to assign is check user is trying to edit their own
profile
So what happens here is every time a request is made the Django rest
framework will call this function has object permission and it will pass in
the request object the view and the actual object that we're checking the
permissions against so when we try and update a user profile this gets called
and all of these functions get passed in for the particular request and the
attempted object that we're trying to make the change on so we need to check
whether we should allow or deny this change and add the rules in here in the
has object permission logic what we're going to do is we're going to check the
method that is being made for the request and we're going to see
whether that is in the safe methods list so the method is the HTTP method that is
being used on the current request so that could be a HTTP GET put patch or
delete request
The safe methods are methods that don't require or don't make
any changes to the object so a safe method would be for example HTTP GET
because all you're doing is you're reading an object you're not actually
trying to make any changes to the object itself
So we want to allow users to view
other users profiles but only be able to make changes to their own profile we do
this by writing if request dot method in permissions dot safe methods return true
so if the method being used is a HTTP GET then it will be in the safe methods
therefore it will just return true and allow the request
Now we need to handle
what happens if the request is not in the safe methods for example if they're
trying to do a HTTP put to update an object
What we're going to do is we're
going to check whether the object they're updating matches their
authenticated user profile that is added to the authentication of the request so
when you authenticate a request in Django rest framework it will assign the
authenticated user profile to the request and we can use this to compare
it to the object that is being updated and make sure they have the same ID we
do this by typing return object dot ID and then two equals request dot user dot ID in Python
you can return a boolean of a comparison by writing the syntax like this so when
we return object dot ID equals request dot user dot ID if this evaluates to
true then it will return true and if it doesn't evaluate to true then it will
return false so when the user makes a request we're going to check if the
request is in the safe methods if it is in the safe methods we're just going to
allow the request to go through otherwise if it's not in the safe
methods so they're using an update or a delete or something like that
then we will return the result of if the object dot ID equals the request dot
user dot ID
this way it will return true if the user is trying to update their own
profile or otherwise it will return false okay so that's how we create a
custom permissions with the Django rest framework make sure you save the file
and then we're ready to move on to the next video