Previously we tested our feed API in the browser everything seemed to work okay
except for we were able to attempt to create new feed objects when we weren't
authenticated in this video we're going to fix this issue by creating a custom
permission class and using an existing permission class that comes with the
Django rest framework so let's get started open up the atom editor and the
first change we're going to make is in our permissions dot py file we're going to
add a new permissions class that's very similar to the update own profile class
but it's for updating the users own status so this permission class is going to
ensure that if a user is updating a status that it is a status that is assigned
to their user account this way users can only update their own feed items in the
database
so let's create a new class called class update own status and we're
going to base our class from permissions dot base permission then in the doc
string we're going to write allow users to update their own status
alright so
just like with the update own profile we need to add a has object permission
function to our permission class so let's type def has underscore object
underscore permission
then the arguments that we need to add are self request view
and obj
then we'll add the doc string here check the user is trying to update
their own status
now because this permission class is only to ensure
that users can update their own status we're going to allow all these methods
that are in the safe methods through so that is if they're trying to retrieve or
create a new item we're going to return true
so if request dot method in permissions dot safe methods return
true
now we need to check that if the user is trying to update a status that
means they're not in the safe method so they're trying to perform a put or a
patch or a delete we want to make sure that the user owns that status or that
the user profile associated with the status is assigned to the user making
the request the way we do that is we type return obj dot user underscore
profile dot ID equal equals request dot user dot ID
so if the object that is being
modified has a user profile dot ID the same as the request dot user ID then
this will return true and it will allow the permission through otherwise it will
return false and it will block the request being made
okay so let's save the permissions dot py file now we need to configure our
view set to use this permission
so open up views dot py and we're going
to configure it to use our permission but we're also going to add a new
permission that comes with the Django rest framework so let's scroll right to
the top and let's type from rest underscore framework dot permissions
import is authenticated or read-only
as the name suggests this makes sure that a
view set is read-only if the user is not authenticated so let's go down to our
user profile feed view set and let's add a new class variable to our view set
called permission underscore classes equals and we're going to open up the
tuple here and I'm going to break it onto multiple lines because the input that we
need to add is quite long and I don't want to exceed the 79 character limit so
let's add our first permission which is the permission we created in
permissions dot py that is the update own status permission so let's type
permissions dot update own status comma and then below this we're going to also add
the is authenticated or read-only permission from the Django rest
framework so type is authenticated or read-only
so this will make sure that a
user must be authenticated to perform any request that is not a read request
so that will get rid of the issue of users trying to create a new feed item
when they're not authenticated
on top of that we'll also ensure that users can
only update statuses where the user profile is assigned to their user which
will stop users being able to update the statuses of other users in the system
okay so let's save that file and that's how we configure the permissions on our
user profile feed view set