Okay.
In the last video, we've created a new method for creating users.
And as you can see here at the moment, we have two users in our database.
So I would like to show you something.
If we go to the admin here and we have users here, that's two users that have been created.
One is the created with super user, another one we've created with a postman.
And so all the information as we pass it will be here and that's fine.
So we have username and we have also hashed password.
But the problem is if we go to the tokens, we have only one token for the Christian, which is the
first user.
So Django automatically is not creating a tokens for each user we've created.
So what we need to do is we need to fix it.
If we go to the Serializers here and this is the method we have used for creating our user and the user
is created correctly with this method, but we also need to create a token.
So what we can do is we can do token.
And in the same way as we've done it with the users above token.
Objects and then we can do create and then we do user equal to user because at this point we already
have a user.
It will be created, it will be returned to this variable and we have it available here.
So we can should be token, we need to import it.
So basically this object that is been created will be passed to the token and will create a token from
here.
So now we need to import the token from rest framework out token models, import token and we have the
token.
So basically at the at this point it will work.
What we can do here is we can we could pass it this token to a return if we need it, but I don't think
it's needed.
So what we can do is we can just create it and we don't care at this point for a token.
But you have an option that you will assign to a variable and you will pass it in return and it will
be available.
So let's test it now.
Let's go back to the postman and we have our post.
Uh, let's change it for a post method so it will use username and password.
And this time let's create a Christian tree.
So I will send it.
Uh, it's not working.
I think our server is not running, is it?
Uh, we have invalid syntax.
In our serialized line for.
So.
Let's run it again.
I think that was before we actually save it.
So we run it again and let's try.
To send it.
And you can see ID3, which is new user and then username Christian three.
Let's go to our admin and check if we have actually a token.
So I'll refresh this page and in fact we have a token for Christian three.
So at the moment we are creating users and this will create a token automatically for us.
So that token will be available when we will try to log in.
So let's do that login now.
So I will do out and that's our method for authentication.
Our user.
I will use the same username and password and we are expecting to see that new token and that will be
the post method.
So send.
And you can see here the token is so the token ends with C0 six.
And that's zero six for that Christian user.
And at this point, we have our application kind of ready for this, but we can also do some extra steps
to secure it.
So by secure it, we can implement different ways that it will be restricted to C for certain users,
a certain part of our application.
So what we can actually do, we can go to the views.
As we've done in the previous parts, we can also implement some permission classes.
So first let's go to the settings and anywhere here we can create a our settings for rest framework.
Default.
That's but supposed to be singular.
Like that.
We've done that before.
So basically what we are saying is default permission classes for the whole application will be isauthenticated.
So we'll restrict our application to for login users only.
So this is authenticated, it's now available for all of this.
So if I go here and let's say I will try to get the list of the movies and like that movies and then
I will send it here and.
Actually, we have some problems now.
Uh.
The object is not callable string.
Let's see.
What is that?
So permission for permission in self permission classes.
So I think we need to add it first inside our views and the movie we can call permission classes here
and then we can do is our tentacle ID and then we can do.
From rest framework.
Permissions.
We can do is authenticated like that.
So basically, we're telling that this needs to be authenticated.
Let's check if that was the error.
And in fact authentication credentials were not provided.
So if we use this token for the user three.
We can actually authorize ourself.
We can use it in the headers and this is how we're going to use it in the front end.
So I will put authorization here and then value will be token capital, token space and we can paste
our string here.
So we send it now and I can see a list of the movies are available.
So what we can do is we can take this.
And we can apply it for rating.
We have already token of the authorization, so the permission classes here is authenticated will be
for this.
But in fact, what we can do is, for example, it's really up to us how we would like to design this,
but for permission classes we can do allow any we need to also import this.
From the same permissions so allow any for movies and we can do is allow for rating.
So I will save it now and let's say movies and I will disable this authorization.
So the movies works without the authorization.
If I will go ratings.
I need to provide it.
And you can see I can do that.
So this all depends on us, how we would like to restrict certain parts of the application and we have
a full control over over this.
So let's say we will keep it like this.
If we want to have a ratings or create a ratings, then you will need to have this authentication authorization
and then we can have actually let's restrict all our movies as well because we'll kind of lock our application
under the login.
So we need to be logged in to see the the application so we will have it as Android negated.
Another thing I would like to show you is we have our rate movie method here, and that means that we
don't want to have the post method and for a put method.
So we have our rate method that will do either update or create a record.
But in fact, in the model view set, if we go here and then we can have update model mixing and that's
one method that is available, this one.
So it's kind of allowing user to do something that we should restrict it because we have our own.
So what we can do is if I will copy this update and go back to the views and on top of this rate movie,
what we can do is I will come here and create another method and that method will be used instead of
the Django built in one.
So what I can do is I can say.
Message you can't update.
Writing like that.
So this is what we have now, and then we can provide the message.
Also, I can restrict the create one.
So basically what we are saying, we overwrite the existing one in Django so they won't be used, our
will be used and in fact we disable them because we are not going to do anything here.
We'll just return the message You can't do this so you can't create ratings like that.
So let's come back to our postman.
And you see we have our ratings, so let's try to post our rating.
And then we go to the body.
Then we do start, let's say for for a movie, movie, let's say one, and the user will just create
a user and we will use user one.
So let's try to use the normal post for the rating.
And you can see here.
Must be a unique set.
So basically what is happening now is it's kind of restricted by the unique.
But if we will do something that is already not unique, we don't have any rating for the user to if
I'll send it now.
We are still using this.
And the reason for that is.
Because I kind of put it in a wrong place.
So if I will come back here and I will take it out, I should put it in the rating because that's what
we want to restrict.
We want to restrict putting our ratings from the ratings.
So update and create will be disabled.
So if I'll go back here, we will need to remove that ID five.
So I will remove rating five from here first and I will try to send it again.
So five has been removed and then let's do post again with the same data as we've done before.
So send it now.
And you can see here you can't rate a great rating like this at the same way will be with update.
So this is the way we can actually prevent using the default built in methods because if we use model
view set, it will be open to everything.
So it will be open to all the five methods and if we want to stop using them, we can override it with
our own custom code here and then we can just display some message here.
So this is the way you can actually control your application.
So we so far created a ready application.
We have our authorization so we can login the user, we can create user along with a token, we can
get that token and then we can authorize this.
And we have a full model for movies and we have our own method for creating ratings.
And at this point we are ready to move to another section, which is our front end.
And in the front end we will use all that data that's coming from our database and we will use it as
a Json to display that on screen.